Analysis
-
max time kernel
599s -
max time network
600s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
11-03-2024 15:45
Static task
static1
Behavioral task
behavioral1
Sample
cisa.msi
Resource
win7-20240221-en
windows7-x64
10 signatures
600 seconds
Behavioral task
behavioral2
Sample
cisa.msi
Resource
win10-20240221-en
windows10-1703-x64
11 signatures
600 seconds
Behavioral task
behavioral3
Sample
cisa.msi
Resource
win10v2004-20240226-en
windows10-2004-x64
12 signatures
600 seconds
Behavioral task
behavioral4
Sample
cisa.msi
Resource
win11-20240221-en
windows11-21h2-x64
12 signatures
600 seconds
General
-
Target
cisa.msi
-
Size
1.5MB
-
MD5
c4e8f3e02fd50a4051f11048f1355726
-
SHA1
c82bf39c9f4797f346447aecc1070fb8c892010f
-
SHA256
3a950d7e6736f17c3df90844c76d934dc66c17ec76841a4ad58de07af7955f0f
-
SHA512
e44d8330c4ffdae01614ed5d11c2f112cff9b39bae793242f983d039e1404d371a2697a77fa65b740e43548ab1b203607a6d82b05ff3df741be02bd99a136592
-
SSDEEP
24576:QjGxLNvYLSMvZCFlp8zBQSc0ZoCvqKwx0ECIgYmfLVYeBZr7A0r7Jh3OnJ3qXIoj:QjivYpW8zBQSc0ZnSKeZKumZr7A+D3O2
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 64 IoCs
flow pid Process 3 2376 rundll32.exe 4 2376 rundll32.exe 5 2376 rundll32.exe 7 2376 rundll32.exe 8 2376 rundll32.exe 9 2376 rundll32.exe 10 2376 rundll32.exe 11 2376 rundll32.exe 12 2376 rundll32.exe 13 2376 rundll32.exe 14 2376 rundll32.exe 15 2376 rundll32.exe 16 2376 rundll32.exe 17 2376 rundll32.exe 18 2376 rundll32.exe 19 2376 rundll32.exe 20 2376 rundll32.exe 21 2376 rundll32.exe 22 2376 rundll32.exe 23 2376 rundll32.exe 24 2376 rundll32.exe 25 2376 rundll32.exe 26 2376 rundll32.exe 27 2376 rundll32.exe 28 2376 rundll32.exe 29 2376 rundll32.exe 30 2376 rundll32.exe 31 2376 rundll32.exe 32 2376 rundll32.exe 33 2376 rundll32.exe 34 2376 rundll32.exe 35 2376 rundll32.exe 36 2376 rundll32.exe 37 2376 rundll32.exe 38 2376 rundll32.exe 39 2376 rundll32.exe 40 2376 rundll32.exe 41 2376 rundll32.exe 42 2376 rundll32.exe 43 2376 rundll32.exe 44 2376 rundll32.exe 45 2376 rundll32.exe 46 2376 rundll32.exe 47 2376 rundll32.exe 48 2376 rundll32.exe 49 2376 rundll32.exe 50 2376 rundll32.exe 51 2376 rundll32.exe 52 2376 rundll32.exe 53 2376 rundll32.exe 54 2376 rundll32.exe 55 2376 rundll32.exe 56 2376 rundll32.exe 57 2376 rundll32.exe 58 2376 rundll32.exe 59 2376 rundll32.exe 60 2376 rundll32.exe 61 2376 rundll32.exe 62 2376 rundll32.exe 63 2376 rundll32.exe 64 2376 rundll32.exe 65 2376 rundll32.exe 66 2376 rundll32.exe 67 2376 rundll32.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe -
Drops file in Windows directory 14 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e576793.msi msiexec.exe File created C:\Windows\SystemTemp\~DFB7200AB0D2810CA4.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI6840.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF5987F0E67082BC30.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF5C0D93E7B18A2BBB.TMP msiexec.exe File created C:\Windows\Installer\e576793.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{A38F5F69-A209-49ED-8CCE-91613AA34EAF} msiexec.exe File created C:\Windows\SystemTemp\~DF2423401469B98FBA.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI688F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI68CF.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI67D2.tmp msiexec.exe -
Executes dropped EXE 1 IoCs
pid Process 3304 MSI68CF.tmp -
Loads dropped DLL 10 IoCs
pid Process 4836 MsiExec.exe 4836 MsiExec.exe 4836 MsiExec.exe 4836 MsiExec.exe 4836 MsiExec.exe 4836 MsiExec.exe 3888 MsiExec.exe 3888 MsiExec.exe 1144 rundll32.exe 2376 rundll32.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000239892d157dd5a9c0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000239892d10000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900239892d1000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d239892d1000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000239892d100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 2968 msiexec.exe 2968 msiexec.exe 3304 MSI68CF.tmp 3304 MSI68CF.tmp 1144 rundll32.exe 1144 rundll32.exe 1144 rundll32.exe 1144 rundll32.exe 2376 rundll32.exe 2376 rundll32.exe 2376 rundll32.exe 2376 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4872 msiexec.exe Token: SeIncreaseQuotaPrivilege 4872 msiexec.exe Token: SeSecurityPrivilege 2968 msiexec.exe Token: SeCreateTokenPrivilege 4872 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4872 msiexec.exe Token: SeLockMemoryPrivilege 4872 msiexec.exe Token: SeIncreaseQuotaPrivilege 4872 msiexec.exe Token: SeMachineAccountPrivilege 4872 msiexec.exe Token: SeTcbPrivilege 4872 msiexec.exe Token: SeSecurityPrivilege 4872 msiexec.exe Token: SeTakeOwnershipPrivilege 4872 msiexec.exe Token: SeLoadDriverPrivilege 4872 msiexec.exe Token: SeSystemProfilePrivilege 4872 msiexec.exe Token: SeSystemtimePrivilege 4872 msiexec.exe Token: SeProfSingleProcessPrivilege 4872 msiexec.exe Token: SeIncBasePriorityPrivilege 4872 msiexec.exe Token: SeCreatePagefilePrivilege 4872 msiexec.exe Token: SeCreatePermanentPrivilege 4872 msiexec.exe Token: SeBackupPrivilege 4872 msiexec.exe Token: SeRestorePrivilege 4872 msiexec.exe Token: SeShutdownPrivilege 4872 msiexec.exe Token: SeDebugPrivilege 4872 msiexec.exe Token: SeAuditPrivilege 4872 msiexec.exe Token: SeSystemEnvironmentPrivilege 4872 msiexec.exe Token: SeChangeNotifyPrivilege 4872 msiexec.exe Token: SeRemoteShutdownPrivilege 4872 msiexec.exe Token: SeUndockPrivilege 4872 msiexec.exe Token: SeSyncAgentPrivilege 4872 msiexec.exe Token: SeEnableDelegationPrivilege 4872 msiexec.exe Token: SeManageVolumePrivilege 4872 msiexec.exe Token: SeImpersonatePrivilege 4872 msiexec.exe Token: SeCreateGlobalPrivilege 4872 msiexec.exe Token: SeCreateTokenPrivilege 4872 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4872 msiexec.exe Token: SeLockMemoryPrivilege 4872 msiexec.exe Token: SeIncreaseQuotaPrivilege 4872 msiexec.exe Token: SeMachineAccountPrivilege 4872 msiexec.exe Token: SeTcbPrivilege 4872 msiexec.exe Token: SeSecurityPrivilege 4872 msiexec.exe Token: SeTakeOwnershipPrivilege 4872 msiexec.exe Token: SeLoadDriverPrivilege 4872 msiexec.exe Token: SeSystemProfilePrivilege 4872 msiexec.exe Token: SeSystemtimePrivilege 4872 msiexec.exe Token: SeProfSingleProcessPrivilege 4872 msiexec.exe Token: SeIncBasePriorityPrivilege 4872 msiexec.exe Token: SeCreatePagefilePrivilege 4872 msiexec.exe Token: SeCreatePermanentPrivilege 4872 msiexec.exe Token: SeBackupPrivilege 4872 msiexec.exe Token: SeRestorePrivilege 4872 msiexec.exe Token: SeShutdownPrivilege 4872 msiexec.exe Token: SeDebugPrivilege 4872 msiexec.exe Token: SeAuditPrivilege 4872 msiexec.exe Token: SeSystemEnvironmentPrivilege 4872 msiexec.exe Token: SeChangeNotifyPrivilege 4872 msiexec.exe Token: SeRemoteShutdownPrivilege 4872 msiexec.exe Token: SeUndockPrivilege 4872 msiexec.exe Token: SeSyncAgentPrivilege 4872 msiexec.exe Token: SeEnableDelegationPrivilege 4872 msiexec.exe Token: SeManageVolumePrivilege 4872 msiexec.exe Token: SeImpersonatePrivilege 4872 msiexec.exe Token: SeCreateGlobalPrivilege 4872 msiexec.exe Token: SeCreateTokenPrivilege 4872 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4872 msiexec.exe Token: SeLockMemoryPrivilege 4872 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4872 msiexec.exe 4872 msiexec.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 2968 wrote to memory of 4836 2968 msiexec.exe 83 PID 2968 wrote to memory of 4836 2968 msiexec.exe 83 PID 2968 wrote to memory of 4836 2968 msiexec.exe 83 PID 2968 wrote to memory of 1288 2968 msiexec.exe 88 PID 2968 wrote to memory of 1288 2968 msiexec.exe 88 PID 2968 wrote to memory of 3888 2968 msiexec.exe 90 PID 2968 wrote to memory of 3888 2968 msiexec.exe 90 PID 2968 wrote to memory of 3888 2968 msiexec.exe 90 PID 2968 wrote to memory of 3304 2968 msiexec.exe 91 PID 2968 wrote to memory of 3304 2968 msiexec.exe 91 PID 2968 wrote to memory of 3304 2968 msiexec.exe 91 PID 1144 wrote to memory of 2376 1144 rundll32.exe 93 PID 1144 wrote to memory of 2376 1144 rundll32.exe 93 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\cisa.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4872
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C0456131DCF89602E4A889583677E017 C2⤵
- Loads dropped DLL
PID:4836
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:1288
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 8BCF59D22DA1930CD11A9D6DB3CF1F532⤵
- Loads dropped DLL
PID:3888
-
-
C:\Windows\Installer\MSI68CF.tmp"C:\Windows\Installer\MSI68CF.tmp" C:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\stat\falcon.dll, vgml2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3304
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:2104
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\stat\falcon.dll, vgml1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\System32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Roaming\Custom_update\Update_31d12547.dll", vgml2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2376
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD572552113738b3c97579fc8210240dad8
SHA173837bfa4a96a87697e15c77f92e17450fc68ffc
SHA256513306b153fc0b4f97c09d39762b7062840c601d39d42f21dc1067bd985fca90
SHA51233d22f73bbe64850d819ad03b86a8a035e3c24d5e72dedc04621e1ebea9ff69de437207c8cfe0c40bfa8bb28fce8629e4ae5b7e2fb6f983cb40aa4729508fd77
-
Filesize
436KB
MD5475d20c0ea477a35660e3f67ecf0a1df
SHA167340739f51e1134ae8f0ffc5ae9dd710e8e3a08
SHA256426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
SHA51299525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
-
Filesize
694KB
MD5da8ae8e1de522b20a462239c6893613e
SHA17f65ef885815d81d220f9f42877ff0d696b0134c
SHA256aee22a35cbdac3f16c3ed742c0b1bfe9739a13469cf43b36fb2c63565111028c
SHA512d2dca9ba9272a0bdfa88f7520545e21a1f4d18dcacec36b072369cee8e28ba635a0214b47caef74b6f7fcd06e120d898da997e71c8955c72510972c66d2a855d
-
Filesize
389KB
MD5b9545ed17695a32face8c3408a6a3553
SHA1f6c31c9cd832ae2aebcd88e7b2fa6803ae93fc83
SHA2561e0e63b446eecf6c9781c7d1cae1f46a3bb31654a70612f71f31538fb4f4729a
SHA512f6d6dc40dcba5ff091452d7cc257427dcb7ce2a21816b4fec2ee249e63246b64667f5c4095220623533243103876433ef8c12c9b612c0e95fdfffe41d1504e04
-
Filesize
12.8MB
MD50f712ff0a09a53a8adf9de306f662821
SHA12ff04736f5eba8545030b414b23f42997f48f53a
SHA25652bf0d26407fa3b3bd18d06b4ca7f30785589d498c809f7ca07d15d0b3115feb
SHA5128200285bf930e635a3a9b0eb5436bae59c136eab695e46e9b45949ce457d6d504352cdf2528321747d453bc99b7a3669a167d41bd3965b785f70799d2634406f
-
\??\Volume{d1929823-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{1cd83ace-eeef-4a0f-8578-31d1f2e23617}_OnDiskSnapshotProp
Filesize6KB
MD5ed88930a59814e8ba96655ae3bb58067
SHA187b3764c30b91d6e14948f98b758c56a6edaf6a6
SHA2567385f326cfd42afb3f4944345d6593cc24693d870055ff80a9286d457cd74303
SHA512ec07eef13175da3c6f265aabacd31bbde170b4bc60ccd977c05eb15f9dcdd72d65c899b51516b99cc41d2aefce01dc2954190cbf82f5a527196292f52eeba19e