Overview
overview
7Static
static
3TwingateWi...er.exe
windows7-x64
6TwingateWi...er.exe
windows10-2004-x64
6$PLUGINSDI...ck.exe
windows7-x64
1$PLUGINSDI...ck.exe
windows10-2004-x64
1$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...er.msi
windows7-x64
6$PLUGINSDI...er.msi
windows10-2004-x64
6$PLUGINSDI...64.exe
windows7-x64
4$PLUGINSDI...64.exe
windows10-2004-x64
4$PLUGINSDI...eb.exe
windows7-x64
7$PLUGINSDI...eb.exe
windows10-2004-x64
7$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3Analysis
-
max time kernel
142s -
max time network
279s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
19/03/2024, 15:12
Static task
static1
Behavioral task
behavioral1
Sample
TwingateWindowsInstaller.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
TwingateWindowsInstaller.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/NetCoreCheck.exe
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/NetCoreCheck.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/TwingateWindowsInstaller.msi
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/TwingateWindowsInstaller.msi
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/dotnet-WindowsDesktop-x64.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/dotnet-WindowsDesktop-x64.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
$PLUGINSDIR/ndp48-web.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral12
Sample
$PLUGINSDIR/ndp48-web.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral14
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
General
-
Target
$PLUGINSDIR/TwingateWindowsInstaller.msi
-
Size
27.0MB
-
MD5
3974c25fcade33b85f27d2770ed5ff87
-
SHA1
13a04128d62654e53e6d2b29c6ff3205c717f189
-
SHA256
5c0292d6ae44e7fe2949a12170d820f7ee8fb091f508717a7c9bbddf876e97ab
-
SHA512
018a49d3183a43a54f185b0de55aefe8cccacf17fd5d7ddc65e937945c25cc9741e8c62177c2187002b58c8875d945093e1cd2859667efa50af46dbdb94065ca
-
SSDEEP
786432:KPZj+TaQhNxLjbKSEEXK+KbOejfWquBxqHf4lWsayGs:KV++QhLj2SRXKZiejHuBxqQlWvs
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 5 2196 msiexec.exe 10 2196 msiexec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe -
Loads dropped DLL 1 IoCs
pid Process 4760 MsiExec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2196 msiexec.exe Token: SeIncreaseQuotaPrivilege 2196 msiexec.exe Token: SeSecurityPrivilege 4136 msiexec.exe Token: SeCreateTokenPrivilege 2196 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2196 msiexec.exe Token: SeLockMemoryPrivilege 2196 msiexec.exe Token: SeIncreaseQuotaPrivilege 2196 msiexec.exe Token: SeMachineAccountPrivilege 2196 msiexec.exe Token: SeTcbPrivilege 2196 msiexec.exe Token: SeSecurityPrivilege 2196 msiexec.exe Token: SeTakeOwnershipPrivilege 2196 msiexec.exe Token: SeLoadDriverPrivilege 2196 msiexec.exe Token: SeSystemProfilePrivilege 2196 msiexec.exe Token: SeSystemtimePrivilege 2196 msiexec.exe Token: SeProfSingleProcessPrivilege 2196 msiexec.exe Token: SeIncBasePriorityPrivilege 2196 msiexec.exe Token: SeCreatePagefilePrivilege 2196 msiexec.exe Token: SeCreatePermanentPrivilege 2196 msiexec.exe Token: SeBackupPrivilege 2196 msiexec.exe Token: SeRestorePrivilege 2196 msiexec.exe Token: SeShutdownPrivilege 2196 msiexec.exe Token: SeDebugPrivilege 2196 msiexec.exe Token: SeAuditPrivilege 2196 msiexec.exe Token: SeSystemEnvironmentPrivilege 2196 msiexec.exe Token: SeChangeNotifyPrivilege 2196 msiexec.exe Token: SeRemoteShutdownPrivilege 2196 msiexec.exe Token: SeUndockPrivilege 2196 msiexec.exe Token: SeSyncAgentPrivilege 2196 msiexec.exe Token: SeEnableDelegationPrivilege 2196 msiexec.exe Token: SeManageVolumePrivilege 2196 msiexec.exe Token: SeImpersonatePrivilege 2196 msiexec.exe Token: SeCreateGlobalPrivilege 2196 msiexec.exe Token: SeCreateTokenPrivilege 2196 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2196 msiexec.exe Token: SeLockMemoryPrivilege 2196 msiexec.exe Token: SeIncreaseQuotaPrivilege 2196 msiexec.exe Token: SeMachineAccountPrivilege 2196 msiexec.exe Token: SeTcbPrivilege 2196 msiexec.exe Token: SeSecurityPrivilege 2196 msiexec.exe Token: SeTakeOwnershipPrivilege 2196 msiexec.exe Token: SeLoadDriverPrivilege 2196 msiexec.exe Token: SeSystemProfilePrivilege 2196 msiexec.exe Token: SeSystemtimePrivilege 2196 msiexec.exe Token: SeProfSingleProcessPrivilege 2196 msiexec.exe Token: SeIncBasePriorityPrivilege 2196 msiexec.exe Token: SeCreatePagefilePrivilege 2196 msiexec.exe Token: SeCreatePermanentPrivilege 2196 msiexec.exe Token: SeBackupPrivilege 2196 msiexec.exe Token: SeRestorePrivilege 2196 msiexec.exe Token: SeShutdownPrivilege 2196 msiexec.exe Token: SeDebugPrivilege 2196 msiexec.exe Token: SeAuditPrivilege 2196 msiexec.exe Token: SeSystemEnvironmentPrivilege 2196 msiexec.exe Token: SeChangeNotifyPrivilege 2196 msiexec.exe Token: SeRemoteShutdownPrivilege 2196 msiexec.exe Token: SeUndockPrivilege 2196 msiexec.exe Token: SeSyncAgentPrivilege 2196 msiexec.exe Token: SeEnableDelegationPrivilege 2196 msiexec.exe Token: SeManageVolumePrivilege 2196 msiexec.exe Token: SeImpersonatePrivilege 2196 msiexec.exe Token: SeCreateGlobalPrivilege 2196 msiexec.exe Token: SeCreateTokenPrivilege 2196 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2196 msiexec.exe Token: SeLockMemoryPrivilege 2196 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2196 msiexec.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4136 wrote to memory of 4760 4136 msiexec.exe 92 PID 4136 wrote to memory of 4760 4136 msiexec.exe 92
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\TwingateWindowsInstaller.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2196
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding AF72BACD5108E4D1C03A446C52955941 C2⤵
- Loads dropped DLL
PID:4760
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
143KB
MD59bfd64145dd0d1ddb2ca2ad9fdafb284
SHA152a6bb2fd4bc52d6362392125427ada2df84bfd5
SHA25640556d398d350df55db2015fe539dd976ceb735fc9d19cd460565c678114ec69
SHA512f858a7b61b5c98ccf134d4a33b93027928afd322828b222f4d48c1948b9f5a7ab1b8532db56490dc54e9c97d64bdb679b3a1dc1304ce7ebcce608647ac901b88