Analysis
-
max time kernel
195s -
max time network
205s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
13-03-2024 13:24
Static task
static1
Behavioral task
behavioral1
Sample
cisa.msi
Resource
win7-20231129-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
cisa.msi
Resource
win10v2004-20240226-en
windows10-2004-x64
15 signatures
150 seconds
General
-
Target
cisa.msi
-
Size
1.5MB
-
MD5
c4e8f3e02fd50a4051f11048f1355726
-
SHA1
c82bf39c9f4797f346447aecc1070fb8c892010f
-
SHA256
3a950d7e6736f17c3df90844c76d934dc66c17ec76841a4ad58de07af7955f0f
-
SHA512
e44d8330c4ffdae01614ed5d11c2f112cff9b39bae793242f983d039e1404d371a2697a77fa65b740e43548ab1b203607a6d82b05ff3df741be02bd99a136592
-
SSDEEP
24576:QjGxLNvYLSMvZCFlp8zBQSc0ZoCvqKwx0ECIgYmfLVYeBZr7A0r7Jh3OnJ3qXIoj:QjivYpW8zBQSc0ZnSKeZKumZr7A+D3O2
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\taskschd.msc mmc.exe -
Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSIEEB5.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIEFC0.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{A38F5F69-A209-49ED-8CCE-91613AA34EAF} msiexec.exe File opened for modification C:\Windows\Installer\MSIF1C4.tmp msiexec.exe File created C:\Windows\Installer\e57edea.msi msiexec.exe File opened for modification C:\Windows\Installer\e57edea.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIF2CF.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe -
Executes dropped EXE 1 IoCs
pid Process 6084 MSIF2CF.tmp -
Loads dropped DLL 10 IoCs
pid Process 3040 MsiExec.exe 3040 MsiExec.exe 3040 MsiExec.exe 3040 MsiExec.exe 3040 MsiExec.exe 3040 MsiExec.exe 5860 MsiExec.exe 5860 MsiExec.exe 5140 rundll32.exe 2664 rundll32.exe -
Checks SCSI registry key(s) 3 TTPs 8 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000f85275ef8222787e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000f85275ef0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900f85275ef000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1df85275ef000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000f85275ef00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe -
Suspicious behavior: EnumeratesProcesses 29 IoCs
pid Process 1952 msiexec.exe 1952 msiexec.exe 6084 MSIF2CF.tmp 6084 MSIF2CF.tmp 5140 rundll32.exe 5140 rundll32.exe 5140 rundll32.exe 5140 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4472 mmc.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2088 msiexec.exe Token: SeIncreaseQuotaPrivilege 2088 msiexec.exe Token: SeSecurityPrivilege 1952 msiexec.exe Token: SeCreateTokenPrivilege 2088 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2088 msiexec.exe Token: SeLockMemoryPrivilege 2088 msiexec.exe Token: SeIncreaseQuotaPrivilege 2088 msiexec.exe Token: SeMachineAccountPrivilege 2088 msiexec.exe Token: SeTcbPrivilege 2088 msiexec.exe Token: SeSecurityPrivilege 2088 msiexec.exe Token: SeTakeOwnershipPrivilege 2088 msiexec.exe Token: SeLoadDriverPrivilege 2088 msiexec.exe Token: SeSystemProfilePrivilege 2088 msiexec.exe Token: SeSystemtimePrivilege 2088 msiexec.exe Token: SeProfSingleProcessPrivilege 2088 msiexec.exe Token: SeIncBasePriorityPrivilege 2088 msiexec.exe Token: SeCreatePagefilePrivilege 2088 msiexec.exe Token: SeCreatePermanentPrivilege 2088 msiexec.exe Token: SeBackupPrivilege 2088 msiexec.exe Token: SeRestorePrivilege 2088 msiexec.exe Token: SeShutdownPrivilege 2088 msiexec.exe Token: SeDebugPrivilege 2088 msiexec.exe Token: SeAuditPrivilege 2088 msiexec.exe Token: SeSystemEnvironmentPrivilege 2088 msiexec.exe Token: SeChangeNotifyPrivilege 2088 msiexec.exe Token: SeRemoteShutdownPrivilege 2088 msiexec.exe Token: SeUndockPrivilege 2088 msiexec.exe Token: SeSyncAgentPrivilege 2088 msiexec.exe Token: SeEnableDelegationPrivilege 2088 msiexec.exe Token: SeManageVolumePrivilege 2088 msiexec.exe Token: SeImpersonatePrivilege 2088 msiexec.exe Token: SeCreateGlobalPrivilege 2088 msiexec.exe Token: SeCreateTokenPrivilege 2088 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2088 msiexec.exe Token: SeLockMemoryPrivilege 2088 msiexec.exe Token: SeIncreaseQuotaPrivilege 2088 msiexec.exe Token: SeMachineAccountPrivilege 2088 msiexec.exe Token: SeTcbPrivilege 2088 msiexec.exe Token: SeSecurityPrivilege 2088 msiexec.exe Token: SeTakeOwnershipPrivilege 2088 msiexec.exe Token: SeLoadDriverPrivilege 2088 msiexec.exe Token: SeSystemProfilePrivilege 2088 msiexec.exe Token: SeSystemtimePrivilege 2088 msiexec.exe Token: SeProfSingleProcessPrivilege 2088 msiexec.exe Token: SeIncBasePriorityPrivilege 2088 msiexec.exe Token: SeCreatePagefilePrivilege 2088 msiexec.exe Token: SeCreatePermanentPrivilege 2088 msiexec.exe Token: SeBackupPrivilege 2088 msiexec.exe Token: SeRestorePrivilege 2088 msiexec.exe Token: SeShutdownPrivilege 2088 msiexec.exe Token: SeDebugPrivilege 2088 msiexec.exe Token: SeAuditPrivilege 2088 msiexec.exe Token: SeSystemEnvironmentPrivilege 2088 msiexec.exe Token: SeChangeNotifyPrivilege 2088 msiexec.exe Token: SeRemoteShutdownPrivilege 2088 msiexec.exe Token: SeUndockPrivilege 2088 msiexec.exe Token: SeSyncAgentPrivilege 2088 msiexec.exe Token: SeEnableDelegationPrivilege 2088 msiexec.exe Token: SeManageVolumePrivilege 2088 msiexec.exe Token: SeImpersonatePrivilege 2088 msiexec.exe Token: SeCreateGlobalPrivilege 2088 msiexec.exe Token: SeCreateTokenPrivilege 2088 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2088 msiexec.exe Token: SeLockMemoryPrivilege 2088 msiexec.exe -
Suspicious use of FindShellTrayWindow 45 IoCs
pid Process 2088 msiexec.exe 2088 msiexec.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe -
Suspicious use of SendNotifyMessage 43 IoCs
pid Process 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4472 mmc.exe 4472 mmc.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1952 wrote to memory of 3040 1952 msiexec.exe 89 PID 1952 wrote to memory of 3040 1952 msiexec.exe 89 PID 1952 wrote to memory of 3040 1952 msiexec.exe 89 PID 1952 wrote to memory of 5732 1952 msiexec.exe 116 PID 1952 wrote to memory of 5732 1952 msiexec.exe 116 PID 1952 wrote to memory of 5860 1952 msiexec.exe 119 PID 1952 wrote to memory of 5860 1952 msiexec.exe 119 PID 1952 wrote to memory of 5860 1952 msiexec.exe 119 PID 1952 wrote to memory of 6084 1952 msiexec.exe 121 PID 1952 wrote to memory of 6084 1952 msiexec.exe 121 PID 1952 wrote to memory of 6084 1952 msiexec.exe 121 PID 5140 wrote to memory of 2664 5140 rundll32.exe 123 PID 5140 wrote to memory of 2664 5140 rundll32.exe 123 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\cisa.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2088
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 037626B93DD59102E52522D460053001 C2⤵
- Loads dropped DLL
PID:3040
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:5732
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 816745CE3DCF68EC9EA52D69E42A5E132⤵
- Loads dropped DLL
PID:5860
-
-
C:\Windows\Installer\MSIF2CF.tmp"C:\Windows\Installer\MSIF2CF.tmp" C:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\stat\falcon.dll, vgml2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:6084
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:856
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /s1⤵
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4472
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\stat\falcon.dll, vgml1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5140 -
C:\Windows\System32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Roaming\Custom_update\Update_481b8caf.dll", vgml2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2664
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1124
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5000
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"1⤵PID:1784
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5fae8f4542d401e2ac84e4fc68e43ee13
SHA126ca1f82789a8bb7bb11c6d24e427f886ed2b49d
SHA256942ca969e863302e1a1d968132a05776c4ea753863bcec4f538fd21ce3bfb45a
SHA512975345c69a6534daf387a093923c4906dedf583648f05a3a34796f76248b156b6dcde073c3688ed42819a07f8e6bbc0868e29d2f2b65948ffe3622545a14b517
-
Filesize
436KB
MD5475d20c0ea477a35660e3f67ecf0a1df
SHA167340739f51e1134ae8f0ffc5ae9dd710e8e3a08
SHA256426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
SHA51299525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
-
Filesize
694KB
MD5da8ae8e1de522b20a462239c6893613e
SHA17f65ef885815d81d220f9f42877ff0d696b0134c
SHA256aee22a35cbdac3f16c3ed742c0b1bfe9739a13469cf43b36fb2c63565111028c
SHA512d2dca9ba9272a0bdfa88f7520545e21a1f4d18dcacec36b072369cee8e28ba635a0214b47caef74b6f7fcd06e120d898da997e71c8955c72510972c66d2a855d
-
Filesize
389KB
MD5b9545ed17695a32face8c3408a6a3553
SHA1f6c31c9cd832ae2aebcd88e7b2fa6803ae93fc83
SHA2561e0e63b446eecf6c9781c7d1cae1f46a3bb31654a70612f71f31538fb4f4729a
SHA512f6d6dc40dcba5ff091452d7cc257427dcb7ce2a21816b4fec2ee249e63246b64667f5c4095220623533243103876433ef8c12c9b612c0e95fdfffe41d1504e04
-
Filesize
15.0MB
MD58358f51c56f5c9f5894eb1e3f535323c
SHA1c6d16786a85a5a42fff39bd23b7c9218e58cb47d
SHA25697aa417ed3bc5f62b2fef06b8148a6efa345e7975e9c890f309dc277a7a49284
SHA512d03d30435fe0cbbb316293cfb89e0ec6f494c75586a26a2bdd3312009512917cecef1a4fb35b21c259098aa76b7aa4f4241270767323db19eb2ebc0f46b0f55d
-
\??\Volume{ef7552f8-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{799e50b2-704b-4630-b581-34df4968f2fd}_OnDiskSnapshotProp
Filesize6KB
MD56b8d98ba5b1bce270535cbd9acb0477e
SHA1d6942118293acf62d3379e923d09f2c4025ba53e
SHA256be5a8862628563d3991b50c0d3f4f9723556da7f19c03f516d3930953c6fccca
SHA512275ca364701f707af43d0ea3cd617bd44caed8c768dcbd35c1569b403feacb553e02ed28d6d2da0a0b71a09098136b18e15fa900390261e4f1aeb354f4c979fc