Analysis
-
max time kernel
154s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
02-04-2024 13:54
Static task
static1
Behavioral task
behavioral1
Sample
2374fd5d049c1b8f1b7fd3115f035e9f154b1f04e1cc276507930811fe349399.msi
Resource
win7-20240319-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2374fd5d049c1b8f1b7fd3115f035e9f154b1f04e1cc276507930811fe349399.msi
Resource
win10v2004-20240226-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
2374fd5d049c1b8f1b7fd3115f035e9f154b1f04e1cc276507930811fe349399.msi
-
Size
2.0MB
-
MD5
b13b0cf148e3a25cbad37604956df69d
-
SHA1
b7136c309dd803a1303c6d93c1aafebb00e1b6bd
-
SHA256
2374fd5d049c1b8f1b7fd3115f035e9f154b1f04e1cc276507930811fe349399
-
SHA512
af79999ff2b12d6fd32fd0fdaf0a69b23f5ad196035d9a521ff959960c29a9ee7a2dd781f8e5cd1b82677554afd370d97bb17d4434e177cc4ef215df08fefd49
-
SSDEEP
24576:fBlIwwkElBoKQs8pRUm6rPtWYW/x91J8/k:fBmQEjoY8Xbm
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation rundll32.exe -
Drops file in Windows directory 13 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e5a3346.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI347F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI347F.tmp-\test.old.cs.dll rundll32.exe File created C:\Windows\Installer\e5a3346.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI46CF.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI347F.tmp-\WixSharp.dll rundll32.exe File created C:\Windows\Installer\SourceHash{02C6E29E-995C-4F09-890C-8FBD7C9B4E2B} msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\e5a3348.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI347F.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSI347F.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\ msiexec.exe -
Loads dropped DLL 3 IoCs
pid Process 892 MsiExec.exe 1304 rundll32.exe 3656 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000064efbbd21686319b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000064efbbd20000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090064efbbd2000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d64efbbd2000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000064efbbd200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 684 msiexec.exe 684 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3280 msiexec.exe Token: SeIncreaseQuotaPrivilege 3280 msiexec.exe Token: SeSecurityPrivilege 684 msiexec.exe Token: SeCreateTokenPrivilege 3280 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3280 msiexec.exe Token: SeLockMemoryPrivilege 3280 msiexec.exe Token: SeIncreaseQuotaPrivilege 3280 msiexec.exe Token: SeMachineAccountPrivilege 3280 msiexec.exe Token: SeTcbPrivilege 3280 msiexec.exe Token: SeSecurityPrivilege 3280 msiexec.exe Token: SeTakeOwnershipPrivilege 3280 msiexec.exe Token: SeLoadDriverPrivilege 3280 msiexec.exe Token: SeSystemProfilePrivilege 3280 msiexec.exe Token: SeSystemtimePrivilege 3280 msiexec.exe Token: SeProfSingleProcessPrivilege 3280 msiexec.exe Token: SeIncBasePriorityPrivilege 3280 msiexec.exe Token: SeCreatePagefilePrivilege 3280 msiexec.exe Token: SeCreatePermanentPrivilege 3280 msiexec.exe Token: SeBackupPrivilege 3280 msiexec.exe Token: SeRestorePrivilege 3280 msiexec.exe Token: SeShutdownPrivilege 3280 msiexec.exe Token: SeDebugPrivilege 3280 msiexec.exe Token: SeAuditPrivilege 3280 msiexec.exe Token: SeSystemEnvironmentPrivilege 3280 msiexec.exe Token: SeChangeNotifyPrivilege 3280 msiexec.exe Token: SeRemoteShutdownPrivilege 3280 msiexec.exe Token: SeUndockPrivilege 3280 msiexec.exe Token: SeSyncAgentPrivilege 3280 msiexec.exe Token: SeEnableDelegationPrivilege 3280 msiexec.exe Token: SeManageVolumePrivilege 3280 msiexec.exe Token: SeImpersonatePrivilege 3280 msiexec.exe Token: SeCreateGlobalPrivilege 3280 msiexec.exe Token: SeBackupPrivilege 5080 vssvc.exe Token: SeRestorePrivilege 5080 vssvc.exe Token: SeAuditPrivilege 5080 vssvc.exe Token: SeBackupPrivilege 684 msiexec.exe Token: SeRestorePrivilege 684 msiexec.exe Token: SeRestorePrivilege 684 msiexec.exe Token: SeTakeOwnershipPrivilege 684 msiexec.exe Token: SeRestorePrivilege 684 msiexec.exe Token: SeTakeOwnershipPrivilege 684 msiexec.exe Token: SeRestorePrivilege 684 msiexec.exe Token: SeTakeOwnershipPrivilege 684 msiexec.exe Token: SeRestorePrivilege 684 msiexec.exe Token: SeTakeOwnershipPrivilege 684 msiexec.exe Token: SeRestorePrivilege 684 msiexec.exe Token: SeTakeOwnershipPrivilege 684 msiexec.exe Token: SeRestorePrivilege 684 msiexec.exe Token: SeTakeOwnershipPrivilege 684 msiexec.exe Token: SeRestorePrivilege 684 msiexec.exe Token: SeTakeOwnershipPrivilege 684 msiexec.exe Token: SeRestorePrivilege 684 msiexec.exe Token: SeTakeOwnershipPrivilege 684 msiexec.exe Token: SeRestorePrivilege 684 msiexec.exe Token: SeTakeOwnershipPrivilege 684 msiexec.exe Token: SeRestorePrivilege 684 msiexec.exe Token: SeTakeOwnershipPrivilege 684 msiexec.exe Token: SeRestorePrivilege 684 msiexec.exe Token: SeTakeOwnershipPrivilege 684 msiexec.exe Token: SeRestorePrivilege 684 msiexec.exe Token: SeTakeOwnershipPrivilege 684 msiexec.exe Token: SeRestorePrivilege 684 msiexec.exe Token: SeTakeOwnershipPrivilege 684 msiexec.exe Token: SeRestorePrivilege 684 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3280 msiexec.exe 3280 msiexec.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 684 wrote to memory of 3612 684 msiexec.exe 111 PID 684 wrote to memory of 3612 684 msiexec.exe 111 PID 684 wrote to memory of 892 684 msiexec.exe 113 PID 684 wrote to memory of 892 684 msiexec.exe 113 PID 892 wrote to memory of 1304 892 MsiExec.exe 114 PID 892 wrote to memory of 1304 892 MsiExec.exe 114 PID 1304 wrote to memory of 3656 1304 rundll32.exe 115 PID 1304 wrote to memory of 3656 1304 rundll32.exe 115 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\2374fd5d049c1b8f1b7fd3115f035e9f154b1f04e1cc276507930811fe349399.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3280
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:3612
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 0D2CA9A5BCABB71CFA79F04587379EF92⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSI347F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240793031 2 test.old.cs!Test.CustomActions.MyAction3⤵
- Checks computer location settings
- Drops file in Windows directory
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\tmp3E14.dll",scab4⤵
- Loads dropped DLL
PID:3656
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5080
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3756 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:81⤵PID:3464
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD5224860528d5673cefcf3b70dc46b7205
SHA17b95edf06725447b45e041cc89f026d8371d1cd5
SHA256fe388f3dc394a6ca873d7485928d67ee555e2a2c610720b48e3029ae1f0a169e
SHA5122ae80458732b74702f0560769d883657f6dbef7dcd844dc8374d047be0897b0af6bd74734325940398b5d89caa9328a76cd1c592a2f6f15e873702be855cd9c8
-
Filesize
1.6MB
MD5986c2e054d91a9466fbfadf0a5e22168
SHA1583dd35705afedf2d068f3477b481fc9654ec6b7
SHA256d51d38f49f7b810bccd6a41159e8e5142aceff1d6be775a34c2c7c54eda192d9
SHA5129106ae09b2732a2a9c8164fef5d5fc4f2c673a6fb6615a6269a286a24c0d4e3118575f05b78fdfd999540efaa2e09df5ec384b705716f059aa02d21b924286a0
-
Filesize
408KB
MD50421886125b50123188287996979264e
SHA1a7a3015012a668d35d9375a91ebc06ead1903477
SHA25663de2da6690ec48231b10585e8eeb1d320925568d55ed8de22e6cfdbb197ca2a
SHA5124cb61236b634ee1ddd44e192fbba24a47b1f6f8abefa758e7e804e5d1e3fba79396e2d65a5f8cd5dd1dc56c60415ed4d8d586a752491c056b3d6004724764eb5