Analysis
- max time kernel
1524s - max time network
1497s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
04/04/2024, 17:30
Static task
static1
Behavioral task
behavioral1
Sample
Cosmos_InstallerLast.msi
Resource
win10-20240404-en
windows10-1703-x64
17 signatures
1800 seconds
Behavioral task
behavioral2
Sample
Cosmos_InstallerLast.msi
Resource
win10v2004-20240226-en
windows10-2004-x64
5 signatures
1800 seconds
General
- Target Cosmos_InstallerLast.msi
- Size 41.3MB
- Sample240404-v24y7aeb95
- SHA256 0899b99992e6f8143ad1c51ed422ca64ae309e5663fc3e3d38504c2e45576a93
- MD5 3557dec4b3425f3a4337842267e97413
- SHA1 2570810596dbf2f4930164ab7ebf1309c5f57230
- SHA512 e2c8e4b97f8a8b98725e2d09dd1ac81948a822c4c8aba4b974e79b22bd6b4662cf87f374131f089f44fed7e2ca541205397b879c496d466f7879caf5466d8fac
- SSDEEP 786432:XHM8SkQIgNNR+uDfVoJhFl/zPCdi3uS+5ep2NaKDXyMQKHktsI8z8/fiC/JcJVsU:XHM8SkeNvbDfVoJzl/zP13TS78KDXyMl
- MD5 SHA1 SHA512 SSDEEP
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe - Loads dropped DLL 10 IoCs
pid Process 4892 MsiExec.exe 4892 MsiExec.exe 4892 MsiExec.exe 4892 MsiExec.exe 4892 MsiExec.exe 4892 MsiExec.exe 4892 MsiExec.exe 4892 MsiExec.exe 4892 MsiExec.exe 4892 MsiExec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4636 msiexec.exe Token: SeIncreaseQuotaPrivilege 4636 msiexec.exe Token: SeSecurityPrivilege 4064 msiexec.exe Token: SeCreateTokenPrivilege 4636 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4636 msiexec.exe Token: SeLockMemoryPrivilege 4636 msiexec.exe Token: SeIncreaseQuotaPrivilege 4636 msiexec.exe Token: SeMachineAccountPrivilege 4636 msiexec.exe Token: SeTcbPrivilege 4636 msiexec.exe Token: SeSecurityPrivilege 4636 msiexec.exe Token: SeTakeOwnershipPrivilege 4636 msiexec.exe Token: SeLoadDriverPrivilege 4636 msiexec.exe Token: SeSystemProfilePrivilege 4636 msiexec.exe Token: SeSystemtimePrivilege 4636 msiexec.exe Token: SeProfSingleProcessPrivilege 4636 msiexec.exe Token: SeIncBasePriorityPrivilege 4636 msiexec.exe Token: SeCreatePagefilePrivilege 4636 msiexec.exe Token: SeCreatePermanentPrivilege 4636 msiexec.exe Token: SeBackupPrivilege 4636 msiexec.exe Token: SeRestorePrivilege 4636 msiexec.exe Token: SeShutdownPrivilege 4636 msiexec.exe Token: SeDebugPrivilege 4636 msiexec.exe Token: SeAuditPrivilege 4636 msiexec.exe Token: SeSystemEnvironmentPrivilege 4636 msiexec.exe Token: SeChangeNotifyPrivilege 4636 msiexec.exe Token: SeRemoteShutdownPrivilege 4636 msiexec.exe Token: SeUndockPrivilege 4636 msiexec.exe Token: SeSyncAgentPrivilege 4636 msiexec.exe Token: SeEnableDelegationPrivilege 4636 msiexec.exe Token: SeManageVolumePrivilege 4636 msiexec.exe Token: SeImpersonatePrivilege 4636 msiexec.exe Token: SeCreateGlobalPrivilege 4636 msiexec.exe Token: SeCreateTokenPrivilege 4636 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4636 msiexec.exe Token: SeLockMemoryPrivilege 4636 msiexec.exe Token: SeIncreaseQuotaPrivilege 4636 msiexec.exe Token: SeMachineAccountPrivilege 4636 msiexec.exe Token: SeTcbPrivilege 4636 msiexec.exe Token: SeSecurityPrivilege 4636 msiexec.exe Token: SeTakeOwnershipPrivilege 4636 msiexec.exe Token: SeLoadDriverPrivilege 4636 msiexec.exe Token: SeSystemProfilePrivilege 4636 msiexec.exe Token: SeSystemtimePrivilege 4636 msiexec.exe Token: SeProfSingleProcessPrivilege 4636 msiexec.exe Token: SeIncBasePriorityPrivilege 4636 msiexec.exe Token: SeCreatePagefilePrivilege 4636 msiexec.exe Token: SeCreatePermanentPrivilege 4636 msiexec.exe Token: SeBackupPrivilege 4636 msiexec.exe Token: SeRestorePrivilege 4636 msiexec.exe Token: SeShutdownPrivilege 4636 msiexec.exe Token: SeDebugPrivilege 4636 msiexec.exe Token: SeAuditPrivilege 4636 msiexec.exe Token: SeSystemEnvironmentPrivilege 4636 msiexec.exe Token: SeChangeNotifyPrivilege 4636 msiexec.exe Token: SeRemoteShutdownPrivilege 4636 msiexec.exe Token: SeUndockPrivilege 4636 msiexec.exe Token: SeSyncAgentPrivilege 4636 msiexec.exe Token: SeEnableDelegationPrivilege 4636 msiexec.exe Token: SeManageVolumePrivilege 4636 msiexec.exe Token: SeImpersonatePrivilege 4636 msiexec.exe Token: SeCreateGlobalPrivilege 4636 msiexec.exe Token: SeCreateTokenPrivilege 4636 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4636 msiexec.exe Token: SeLockMemoryPrivilege 4636 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4636 msiexec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4064 wrote to memory of 4892 4064 msiexec.exe 89 PID 4064 wrote to memory of 4892 4064 msiexec.exe 89 PID 4064 wrote to memory of 4892 4064 msiexec.exe 89
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Cosmos_InstallerLast.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4636
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 7DFD14F5B575233EEC2E9CB1DE1FF17A C2⤵
- Loads dropped DLL
PID:4892
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MSI6D41.tmp
- Size 588KB
- SHA256 39fd8d36f8e5d915ad571ea429db3c3de6e9c160dbea7c3e137c9ba4b7fd301d
- MD5 b7a6a99cbe6e762c0a61a8621ad41706
- SHA1 92f45dd3ed3aaeaac8b488a84e160292ff86281e
- SHA512 a17e4512d906599b7f004ebb2f19ee2566ee93c2c18114ac05b0a0115a8c481592788f6b97da008795d5c31fb8d819ac82a5097b1792248319139c3face45642
- SSDEEP 6144:QaFYTdIO9QmvIeVKVhaxkSBULBA4tKSM3BZC4o4AOl+mN9ysU5pvs8g73E:pYL9HXVW0xOA+KlZC4vc55s8g73E
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI71BB.tmp
- Size 1.1MB
- SHA256 b980c67b11cc39f006535303151273749e4ca69dd370cf45b6110a0b5af77b68
- MD5 8e3862ecc7a591df93cb916906eae863
- SHA1 1c9f1f80be421f8c87662b5ab11749dd7604fcf2
- SHA512 5d58c26f1f4ed448578e118c526a67159284e68b58062a0ff74492a38785fc94608ca09aadb5473f66dd0161fccdbad3ea4a2ed5c65396bef5e3d6572ac607ce
- SSDEEP 24576:cBbmgYewSBprKpygTqkg0z/f2sbQEiwiUt5KTD54qQc3w0RZqTkqMUM0zVQZA:cBflKp/Dz/f2sbQEidUt5K35Bz3w0RZg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI7258.tmp
- Size 736KB
- SHA256 3071af6be43a2611db45205f0d3f1f25aba05acf5f70992fce2fffd63ee9c85d
- MD5 8dd026145833182777a182a646df81f3
- SHA1 4f5cb840193eea97df088c83a794fb6e8f67ab07
- SHA512 f6c860bf563a24c046a7d76a6bc1e2f6bbfc80a87ac4513de331049f35198dcbbdbb5be7f5d49100e1d1c8ab680ecf3eaaa4fdb8f744c9fd5479a1ba64079391
- SSDEEP 12288:sXWV44ngBNmhAzLUhfVdrjpuG1PE0I7+avw4UbY6t5rXf63Rfklet:KWV4zHzLUdVB1n1PE0Yw4Ubz5rXf63hL
- MD5 SHA1 SHA512 SSDEEP