Overview
overview
7Static
static
3TwingateWi...er.exe
windows7-x64
6TwingateWi...er.exe
windows10-2004-x64
6$PLUGINSDI...ck.exe
windows7-x64
1$PLUGINSDI...ck.exe
windows10-2004-x64
1$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...er.msi
windows7-x64
6$PLUGINSDI...er.msi
windows10-2004-x64
6$PLUGINSDI...64.exe
windows7-x64
4$PLUGINSDI...64.exe
windows10-2004-x64
4$PLUGINSDI...eb.exe
windows7-x64
7$PLUGINSDI...eb.exe
windows10-2004-x64
7$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3Analysis
-
max time kernel
117s -
max time network
163s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-03-2024 15:12
Static task
static1
Behavioral task
behavioral1
Sample
TwingateWindowsInstaller.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
TwingateWindowsInstaller.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/NetCoreCheck.exe
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/NetCoreCheck.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/TwingateWindowsInstaller.msi
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/TwingateWindowsInstaller.msi
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/dotnet-WindowsDesktop-x64.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/dotnet-WindowsDesktop-x64.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
$PLUGINSDIR/ndp48-web.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral12
Sample
$PLUGINSDIR/ndp48-web.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral14
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
General
-
Target
$PLUGINSDIR/TwingateWindowsInstaller.msi
-
Size
27.0MB
-
MD5
3974c25fcade33b85f27d2770ed5ff87
-
SHA1
13a04128d62654e53e6d2b29c6ff3205c717f189
-
SHA256
5c0292d6ae44e7fe2949a12170d820f7ee8fb091f508717a7c9bbddf876e97ab
-
SHA512
018a49d3183a43a54f185b0de55aefe8cccacf17fd5d7ddc65e937945c25cc9741e8c62177c2187002b58c8875d945093e1cd2859667efa50af46dbdb94065ca
-
SSDEEP
786432:KPZj+TaQhNxLjbKSEEXK+KbOejfWquBxqHf4lWsayGs:KV++QhLj2SRXKZiejHuBxqQlWvs
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 3 1248 msiexec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe -
Loads dropped DLL 1 IoCs
pid Process 2416 MsiExec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1248 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1248 msiexec.exe Token: SeIncreaseQuotaPrivilege 1248 msiexec.exe Token: SeRestorePrivilege 1028 msiexec.exe Token: SeTakeOwnershipPrivilege 1028 msiexec.exe Token: SeSecurityPrivilege 1028 msiexec.exe Token: SeCreateTokenPrivilege 1248 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1248 msiexec.exe Token: SeLockMemoryPrivilege 1248 msiexec.exe Token: SeIncreaseQuotaPrivilege 1248 msiexec.exe Token: SeMachineAccountPrivilege 1248 msiexec.exe Token: SeTcbPrivilege 1248 msiexec.exe Token: SeSecurityPrivilege 1248 msiexec.exe Token: SeTakeOwnershipPrivilege 1248 msiexec.exe Token: SeLoadDriverPrivilege 1248 msiexec.exe Token: SeSystemProfilePrivilege 1248 msiexec.exe Token: SeSystemtimePrivilege 1248 msiexec.exe Token: SeProfSingleProcessPrivilege 1248 msiexec.exe Token: SeIncBasePriorityPrivilege 1248 msiexec.exe Token: SeCreatePagefilePrivilege 1248 msiexec.exe Token: SeCreatePermanentPrivilege 1248 msiexec.exe Token: SeBackupPrivilege 1248 msiexec.exe Token: SeRestorePrivilege 1248 msiexec.exe Token: SeShutdownPrivilege 1248 msiexec.exe Token: SeDebugPrivilege 1248 msiexec.exe Token: SeAuditPrivilege 1248 msiexec.exe Token: SeSystemEnvironmentPrivilege 1248 msiexec.exe Token: SeChangeNotifyPrivilege 1248 msiexec.exe Token: SeRemoteShutdownPrivilege 1248 msiexec.exe Token: SeUndockPrivilege 1248 msiexec.exe Token: SeSyncAgentPrivilege 1248 msiexec.exe Token: SeEnableDelegationPrivilege 1248 msiexec.exe Token: SeManageVolumePrivilege 1248 msiexec.exe Token: SeImpersonatePrivilege 1248 msiexec.exe Token: SeCreateGlobalPrivilege 1248 msiexec.exe Token: SeCreateTokenPrivilege 1248 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1248 msiexec.exe Token: SeLockMemoryPrivilege 1248 msiexec.exe Token: SeIncreaseQuotaPrivilege 1248 msiexec.exe Token: SeMachineAccountPrivilege 1248 msiexec.exe Token: SeTcbPrivilege 1248 msiexec.exe Token: SeSecurityPrivilege 1248 msiexec.exe Token: SeTakeOwnershipPrivilege 1248 msiexec.exe Token: SeLoadDriverPrivilege 1248 msiexec.exe Token: SeSystemProfilePrivilege 1248 msiexec.exe Token: SeSystemtimePrivilege 1248 msiexec.exe Token: SeProfSingleProcessPrivilege 1248 msiexec.exe Token: SeIncBasePriorityPrivilege 1248 msiexec.exe Token: SeCreatePagefilePrivilege 1248 msiexec.exe Token: SeCreatePermanentPrivilege 1248 msiexec.exe Token: SeBackupPrivilege 1248 msiexec.exe Token: SeRestorePrivilege 1248 msiexec.exe Token: SeShutdownPrivilege 1248 msiexec.exe Token: SeDebugPrivilege 1248 msiexec.exe Token: SeAuditPrivilege 1248 msiexec.exe Token: SeSystemEnvironmentPrivilege 1248 msiexec.exe Token: SeChangeNotifyPrivilege 1248 msiexec.exe Token: SeRemoteShutdownPrivilege 1248 msiexec.exe Token: SeUndockPrivilege 1248 msiexec.exe Token: SeSyncAgentPrivilege 1248 msiexec.exe Token: SeEnableDelegationPrivilege 1248 msiexec.exe Token: SeManageVolumePrivilege 1248 msiexec.exe Token: SeImpersonatePrivilege 1248 msiexec.exe Token: SeCreateGlobalPrivilege 1248 msiexec.exe Token: SeCreateTokenPrivilege 1248 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1248 msiexec.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1028 wrote to memory of 2416 1028 msiexec.exe 29 PID 1028 wrote to memory of 2416 1028 msiexec.exe 29 PID 1028 wrote to memory of 2416 1028 msiexec.exe 29 PID 1028 wrote to memory of 2416 1028 msiexec.exe 29 PID 1028 wrote to memory of 2416 1028 msiexec.exe 29
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\TwingateWindowsInstaller.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1248
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Windows\system32\MsiExec.exeC:\Windows\system32\MsiExec.exe -Embedding 1C1BE9BA475352AA9F5FFCF1A86E053C C2⤵
- Loads dropped DLL
PID:2416
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
143KB
MD59bfd64145dd0d1ddb2ca2ad9fdafb284
SHA152a6bb2fd4bc52d6362392125427ada2df84bfd5
SHA25640556d398d350df55db2015fe539dd976ceb735fc9d19cd460565c678114ec69
SHA512f858a7b61b5c98ccf134d4a33b93027928afd322828b222f4d48c1948b9f5a7ab1b8532db56490dc54e9c97d64bdb679b3a1dc1304ce7ebcce608647ac901b88
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06