Analysis
-
max time kernel
87s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240214-en -
resource tags
arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system -
submitted
07-03-2024 23:13
Static task
static1
Behavioral task
behavioral1
Sample
3a950d7e6736f17c3df90844c76d934dc66c17ec76841a4ad58de07af7955f0f.msi
Resource
win11-20240214-en
windows11-21h2-x64
11 signatures
150 seconds
General
-
Target
3a950d7e6736f17c3df90844c76d934dc66c17ec76841a4ad58de07af7955f0f.msi
-
Size
1.5MB
-
MD5
c4e8f3e02fd50a4051f11048f1355726
-
SHA1
c82bf39c9f4797f346447aecc1070fb8c892010f
-
SHA256
3a950d7e6736f17c3df90844c76d934dc66c17ec76841a4ad58de07af7955f0f
-
SHA512
e44d8330c4ffdae01614ed5d11c2f112cff9b39bae793242f983d039e1404d371a2697a77fa65b740e43548ab1b203607a6d82b05ff3df741be02bd99a136592
-
SSDEEP
24576:QjGxLNvYLSMvZCFlp8zBQSc0ZoCvqKwx0ECIgYmfLVYeBZr7A0r7Jh3OnJ3qXIoj:QjivYpW8zBQSc0ZnSKeZKumZr7A+D3O2
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe -
Drops file in Windows directory 14 IoCs
description ioc Process File created C:\Windows\SystemTemp\~DFCB3B3CB83FC53EA7.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI7746.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI761A.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DF5774DCD73B532402.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI76E7.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF39B21D9E7E19175C.TMP msiexec.exe File created C:\Windows\Installer\e5775dc.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\SourceHash{A38F5F69-A209-49ED-8CCE-91613AA34EAF} msiexec.exe File created C:\Windows\SystemTemp\~DF0C6DE3141DA80E65.TMP msiexec.exe File opened for modification C:\Windows\Installer\e5775dc.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI76A8.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe -
Executes dropped EXE 1 IoCs
pid Process 2584 MSI7746.tmp -
Loads dropped DLL 10 IoCs
pid Process 4436 MsiExec.exe 4436 MsiExec.exe 4436 MsiExec.exe 4436 MsiExec.exe 4436 MsiExec.exe 4436 MsiExec.exe 3276 MsiExec.exe 3276 MsiExec.exe 756 rundll32.exe 1044 rundll32.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000a24af70bd82af6610000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000a24af70b0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900a24af70b000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1da24af70b000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000a24af70b00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 576 msiexec.exe 576 msiexec.exe 2584 MSI7746.tmp 2584 MSI7746.tmp 756 rundll32.exe 756 rundll32.exe 756 rundll32.exe 756 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4340 msiexec.exe Token: SeIncreaseQuotaPrivilege 4340 msiexec.exe Token: SeSecurityPrivilege 576 msiexec.exe Token: SeCreateTokenPrivilege 4340 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4340 msiexec.exe Token: SeLockMemoryPrivilege 4340 msiexec.exe Token: SeIncreaseQuotaPrivilege 4340 msiexec.exe Token: SeMachineAccountPrivilege 4340 msiexec.exe Token: SeTcbPrivilege 4340 msiexec.exe Token: SeSecurityPrivilege 4340 msiexec.exe Token: SeTakeOwnershipPrivilege 4340 msiexec.exe Token: SeLoadDriverPrivilege 4340 msiexec.exe Token: SeSystemProfilePrivilege 4340 msiexec.exe Token: SeSystemtimePrivilege 4340 msiexec.exe Token: SeProfSingleProcessPrivilege 4340 msiexec.exe Token: SeIncBasePriorityPrivilege 4340 msiexec.exe Token: SeCreatePagefilePrivilege 4340 msiexec.exe Token: SeCreatePermanentPrivilege 4340 msiexec.exe Token: SeBackupPrivilege 4340 msiexec.exe Token: SeRestorePrivilege 4340 msiexec.exe Token: SeShutdownPrivilege 4340 msiexec.exe Token: SeDebugPrivilege 4340 msiexec.exe Token: SeAuditPrivilege 4340 msiexec.exe Token: SeSystemEnvironmentPrivilege 4340 msiexec.exe Token: SeChangeNotifyPrivilege 4340 msiexec.exe Token: SeRemoteShutdownPrivilege 4340 msiexec.exe Token: SeUndockPrivilege 4340 msiexec.exe Token: SeSyncAgentPrivilege 4340 msiexec.exe Token: SeEnableDelegationPrivilege 4340 msiexec.exe Token: SeManageVolumePrivilege 4340 msiexec.exe Token: SeImpersonatePrivilege 4340 msiexec.exe Token: SeCreateGlobalPrivilege 4340 msiexec.exe Token: SeCreateTokenPrivilege 4340 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4340 msiexec.exe Token: SeLockMemoryPrivilege 4340 msiexec.exe Token: SeIncreaseQuotaPrivilege 4340 msiexec.exe Token: SeMachineAccountPrivilege 4340 msiexec.exe Token: SeTcbPrivilege 4340 msiexec.exe Token: SeSecurityPrivilege 4340 msiexec.exe Token: SeTakeOwnershipPrivilege 4340 msiexec.exe Token: SeLoadDriverPrivilege 4340 msiexec.exe Token: SeSystemProfilePrivilege 4340 msiexec.exe Token: SeSystemtimePrivilege 4340 msiexec.exe Token: SeProfSingleProcessPrivilege 4340 msiexec.exe Token: SeIncBasePriorityPrivilege 4340 msiexec.exe Token: SeCreatePagefilePrivilege 4340 msiexec.exe Token: SeCreatePermanentPrivilege 4340 msiexec.exe Token: SeBackupPrivilege 4340 msiexec.exe Token: SeRestorePrivilege 4340 msiexec.exe Token: SeShutdownPrivilege 4340 msiexec.exe Token: SeDebugPrivilege 4340 msiexec.exe Token: SeAuditPrivilege 4340 msiexec.exe Token: SeSystemEnvironmentPrivilege 4340 msiexec.exe Token: SeChangeNotifyPrivilege 4340 msiexec.exe Token: SeRemoteShutdownPrivilege 4340 msiexec.exe Token: SeUndockPrivilege 4340 msiexec.exe Token: SeSyncAgentPrivilege 4340 msiexec.exe Token: SeEnableDelegationPrivilege 4340 msiexec.exe Token: SeManageVolumePrivilege 4340 msiexec.exe Token: SeImpersonatePrivilege 4340 msiexec.exe Token: SeCreateGlobalPrivilege 4340 msiexec.exe Token: SeCreateTokenPrivilege 4340 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4340 msiexec.exe Token: SeLockMemoryPrivilege 4340 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4340 msiexec.exe 4340 msiexec.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 576 wrote to memory of 4436 576 msiexec.exe 82 PID 576 wrote to memory of 4436 576 msiexec.exe 82 PID 576 wrote to memory of 4436 576 msiexec.exe 82 PID 576 wrote to memory of 3344 576 msiexec.exe 87 PID 576 wrote to memory of 3344 576 msiexec.exe 87 PID 576 wrote to memory of 3276 576 msiexec.exe 89 PID 576 wrote to memory of 3276 576 msiexec.exe 89 PID 576 wrote to memory of 3276 576 msiexec.exe 89 PID 576 wrote to memory of 2584 576 msiexec.exe 90 PID 576 wrote to memory of 2584 576 msiexec.exe 90 PID 576 wrote to memory of 2584 576 msiexec.exe 90 PID 756 wrote to memory of 1044 756 rundll32.exe 92 PID 756 wrote to memory of 1044 756 rundll32.exe 92 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\3a950d7e6736f17c3df90844c76d934dc66c17ec76841a4ad58de07af7955f0f.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4340
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F7C93422D5CD79DF470178D1364078B5 C2⤵
- Loads dropped DLL
PID:4436
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:3344
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding AB2D7427E6913A5F9CAE27EA5F992A4E2⤵
- Loads dropped DLL
PID:3276
-
-
C:\Windows\Installer\MSI7746.tmp"C:\Windows\Installer\MSI7746.tmp" C:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\stat\falcon.dll, vgml2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2584
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:1528
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\stat\falcon.dll, vgml1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\System32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Roaming\Custom_update\Update_52c9018f.dll", vgml2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1044
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD563b3bc18651612772d0278e9bd80a9dd
SHA184c1a97d9cd3aa042c29bf40942b3a467b1169d8
SHA25689b324962e5e956834e9091937846ef0db40cd18c8de6ab1865576e127e26a34
SHA512b80b6295be80180f9d00caabdda130ea6c2ea852127e92a0be7c8fa286cb48bc298e1712200c3f396e061b04c1bf4f459b6f081d55db1cbc6010c94ee2836ee0
-
Filesize
395KB
MD5b424673b5a98f557fd8c06a33a94e609
SHA1a47dbae5b1d3101b36b0485f6a046cf90d87db5a
SHA25625abe219f57af5514a7d698454af6a19aa0088513a389da68d53bb718a371ee7
SHA5123dca5e5b389bd163859e4cede08165dc988025249a6c16317eaf45e8529a0f1665b44277f2560091ac5e4fe1630ee7726a4279ccb5b30c1e87318eef18b122ac
-
Filesize
436KB
MD5475d20c0ea477a35660e3f67ecf0a1df
SHA167340739f51e1134ae8f0ffc5ae9dd710e8e3a08
SHA256426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
SHA51299525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
-
Filesize
694KB
MD5da8ae8e1de522b20a462239c6893613e
SHA17f65ef885815d81d220f9f42877ff0d696b0134c
SHA256aee22a35cbdac3f16c3ed742c0b1bfe9739a13469cf43b36fb2c63565111028c
SHA512d2dca9ba9272a0bdfa88f7520545e21a1f4d18dcacec36b072369cee8e28ba635a0214b47caef74b6f7fcd06e120d898da997e71c8955c72510972c66d2a855d
-
Filesize
389KB
MD5b9545ed17695a32face8c3408a6a3553
SHA1f6c31c9cd832ae2aebcd88e7b2fa6803ae93fc83
SHA2561e0e63b446eecf6c9781c7d1cae1f46a3bb31654a70612f71f31538fb4f4729a
SHA512f6d6dc40dcba5ff091452d7cc257427dcb7ce2a21816b4fec2ee249e63246b64667f5c4095220623533243103876433ef8c12c9b612c0e95fdfffe41d1504e04
-
Filesize
10.2MB
MD515a07d9e7d2e0a3f2b33d041122a2911
SHA1ff8e86fedec15fb6b696306d15a1919322a3f3a9
SHA256c3213d2f37819228556d5dc5a077307f3d9514b44c598507df33dbeacb95b8f1
SHA512116e2b261b0727740ce713cf8a2815bc7ad814c7b17bb077dc06ab4b4b1dbd87a3ec6dd8bce9deb2fe49e30e371f8026f209730556dbb7440d0e871c84dae424
-
\??\Volume{0bf74aa2-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{a98d6012-70ad-4102-bf32-4bebb4c988cf}_OnDiskSnapshotProp
Filesize6KB
MD5cfc8efe30c5c81579c401fd64ad735e9
SHA19851151f639bd7f5b585e42ae943d39a21c5851c
SHA25643485b75d9ad26c48c9744b41501b05019ab10a5eb2e687db1e2a3e743b884eb
SHA51206f401eb27022bb4c31256bd412d1d7bb3e8e138f2c4031da2bff7a7cf4cd52e1fa2233b6177e489f6ab0786ddd80389f453d233622f430d98194eb2e0de94ef