Overview

overview

6

Static

static

1

msodbcsql_...26.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    158s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-04-2024 14:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    msodbcsql_3be4cf889ad6c6334b15ac136d57321cbca28026.exe

  • Size

    4.1MB

  • MD5

    ac85224e7442d03afab8e7e468d12b12

  • SHA1

    3be4cf889ad6c6334b15ac136d57321cbca28026

  • SHA256

    139bf4bc1e0b8b3832e82f23cef43ab0b66530caa0963e45950175df459b1458

  • SHA512

    607405c83eeac87239e9906092732a808deb16d4620ac46708f0b0efe15e097a66869e97ac6d78bcbe0f48a9ec30cfaf4a44c74ab8c35e95dd75e09ba39140d7

  • SSDEEP

    98304:tJxJzqAgBeiY7reD2RZDwEZbRmckDZVRss+C26lbZ8nHezBbH8YD:tJxwAn3e6RZhbUcif26sn+9bRD

Score
6/10
persistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Blocklisted process makes network request 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 29 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 27 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\msodbcsql_3be4cf889ad6c6334b15ac136d57321cbca28026.exe
    "C:\Users\Admin\AppData\Local\Temp\msodbcsql_3be4cf889ad6c6334b15ac136d57321cbca28026.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1952
    • C:\Windows\SYSTEM32\msiexec.exe
      msiexec /quiet /passive /qn /i msodbcsql.msi IACCEPTMSODBCSQLLICENSETERMS=YES
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3904
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3436
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding 602E65D1F101419876954C7DB9BBA116
      2⤵
      • Loads dropped DLL
      PID:1156
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1348 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:3012
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:644
      • C:\Windows\system32\mmc.exe
        "C:\Windows\system32\mmc.exe" "C:\Windows\System32\services.msc"
        2⤵
        • Drops file in System32 directory
        • Suspicious use of SetWindowsHookEx
        PID:3020

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Initial Access

    Execution

    Persistence

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Privilege Escalation

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Discovery

    Query Registry

    2
    T1012

    Peripheral Device Discovery

    2
    T1120

    System Information Discovery

    2
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Resource Development

    Reconnaissance

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Config.Msi\e581163.rbs
      Filesize

      27KB

      MD5

      40ecb55a41f43f2e8d2b81f8ef37ad3c

      SHA1

      2798fbc52bea3f5c8cc9cb562b593106e1650248

      SHA256

      3b8f9053956059f8d20a170380651b106f79c400656615c971305d965bc80613

      SHA512

      48581624bc162bd7ba4834fb335f264d298c34beb28272b27b0e630bcc0134dab79b46174e9543c2541d558dd12606c040356eb5faf2bfbcfe7c1f93d8997fcd

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\msodbcsql.msi
      Filesize

      4.5MB

      MD5

      5dab1714ad4c7336de247e8a342a85f8

      SHA1

      3ae75e74fda38674144ac30a40d7f734dc849d7f

      SHA256

      1b6e2fe09fb48bd0f4c78e092e441993718eb5515abf94552384e09a06afee58

      SHA512

      b838ef39fa88f944d0f19f081dd528546d017bad3ba2b8da9e843a6aaed0e880a2a1b0841f3a2de7b4fc3ce9737ed294f4ae293d45081e8083734d34742cfa56

      Download Submit
    • C:\Windows\Installer\MSI21DB.tmp
      Filesize

      29KB

      MD5

      885c18679e8801363b0de671dc4fd88c

      SHA1

      fa5d67d04d65502edc62b2967f4df28f78b7b879

      SHA256

      8efa4c0c279df5db94a10e05390b539424293ab8dcb402c613ed74749737afb7

      SHA512

      4cf10b350b841e24678f2b88aa7f11dc65ea5a4a1dad032540f1d11fe792d5517c8ba332017d716ad6f197814f7bf29e4852b235b9ca0e19d2d569d9431d1563

      Download Submit
    • memory/644-62-0x0000021B8AFA0000-0x0000021B8AFA1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/644-55-0x0000021B8AFA0000-0x0000021B8AFA1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/644-57-0x0000021B8AFA0000-0x0000021B8AFA1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/644-56-0x0000021B8AFA0000-0x0000021B8AFA1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/644-61-0x0000021B8AFA0000-0x0000021B8AFA1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/644-63-0x0000021B8AFA0000-0x0000021B8AFA1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/644-64-0x0000021B8AFA0000-0x0000021B8AFA1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/644-65-0x0000021B8AFA0000-0x0000021B8AFA1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/644-66-0x0000021B8AFA0000-0x0000021B8AFA1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/644-67-0x0000021B8AFA0000-0x0000021B8AFA1000-memory.dmp
      Filesize

      4KB

      Download