Analysis
-
max time kernel
148s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
17-04-2024 14:48
Static task
static1
Behavioral task
behavioral1
Sample
avp.msi
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
avp.msi
Resource
win10v2004-20240412-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
avp.msi
-
Size
1.4MB
-
MD5
4d81be09c23e02fab7364e508c21c111
-
SHA1
52cae521d7a808c8206f4b5afd6b037bc573b50e
-
SHA256
dcae57ec4b69236146f744c143c42cc8bdac9da6e991904e6dbf67ec1179286a
-
SHA512
4f5b4fdeb9a056025455ede8ee6e1757da8db64f9692df2a46558a3c04aaec551734b4d75803bbd579e1163b9aba5005f71c5efb22ee3d336779804a11b2b5a5
-
SSDEEP
24576:BqKxnNTYUx0ECIgYmfLVYeBZr7A9zdfoAX+8UhxcS:Bq6TYCZKumZr7ARdAAO8oxz
Score
6/10
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 50 4876 MsiExec.exe 52 4876 MsiExec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\J: msiexec.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 49 api.ipify.org 50 api.ipify.org -
Drops file in Windows directory 9 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSIF59C.tmp msiexec.exe File created C:\Windows\Installer\e57f414.msi msiexec.exe File opened for modification C:\Windows\Installer\e57f414.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{52EF198D-0C6C-406A-803F-F86D93DD7930} msiexec.exe File opened for modification C:\Windows\Installer\MSIF687.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIF4B0.tmp msiexec.exe -
Loads dropped DLL 9 IoCs
pid Process 572 MsiExec.exe 572 MsiExec.exe 572 MsiExec.exe 572 MsiExec.exe 572 MsiExec.exe 572 MsiExec.exe 4876 MsiExec.exe 4876 MsiExec.exe 4876 MsiExec.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e5c2a4af95b248be0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e5c2a4af0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900e5c2a4af000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de5c2a4af000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000e5c2a4af00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4280 msiexec.exe 4280 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4556 msiexec.exe Token: SeIncreaseQuotaPrivilege 4556 msiexec.exe Token: SeSecurityPrivilege 4280 msiexec.exe Token: SeCreateTokenPrivilege 4556 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4556 msiexec.exe Token: SeLockMemoryPrivilege 4556 msiexec.exe Token: SeIncreaseQuotaPrivilege 4556 msiexec.exe Token: SeMachineAccountPrivilege 4556 msiexec.exe Token: SeTcbPrivilege 4556 msiexec.exe Token: SeSecurityPrivilege 4556 msiexec.exe Token: SeTakeOwnershipPrivilege 4556 msiexec.exe Token: SeLoadDriverPrivilege 4556 msiexec.exe Token: SeSystemProfilePrivilege 4556 msiexec.exe Token: SeSystemtimePrivilege 4556 msiexec.exe Token: SeProfSingleProcessPrivilege 4556 msiexec.exe Token: SeIncBasePriorityPrivilege 4556 msiexec.exe Token: SeCreatePagefilePrivilege 4556 msiexec.exe Token: SeCreatePermanentPrivilege 4556 msiexec.exe Token: SeBackupPrivilege 4556 msiexec.exe Token: SeRestorePrivilege 4556 msiexec.exe Token: SeShutdownPrivilege 4556 msiexec.exe Token: SeDebugPrivilege 4556 msiexec.exe Token: SeAuditPrivilege 4556 msiexec.exe Token: SeSystemEnvironmentPrivilege 4556 msiexec.exe Token: SeChangeNotifyPrivilege 4556 msiexec.exe Token: SeRemoteShutdownPrivilege 4556 msiexec.exe Token: SeUndockPrivilege 4556 msiexec.exe Token: SeSyncAgentPrivilege 4556 msiexec.exe Token: SeEnableDelegationPrivilege 4556 msiexec.exe Token: SeManageVolumePrivilege 4556 msiexec.exe Token: SeImpersonatePrivilege 4556 msiexec.exe Token: SeCreateGlobalPrivilege 4556 msiexec.exe Token: SeCreateTokenPrivilege 4556 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4556 msiexec.exe Token: SeLockMemoryPrivilege 4556 msiexec.exe Token: SeIncreaseQuotaPrivilege 4556 msiexec.exe Token: SeMachineAccountPrivilege 4556 msiexec.exe Token: SeTcbPrivilege 4556 msiexec.exe Token: SeSecurityPrivilege 4556 msiexec.exe Token: SeTakeOwnershipPrivilege 4556 msiexec.exe Token: SeLoadDriverPrivilege 4556 msiexec.exe Token: SeSystemProfilePrivilege 4556 msiexec.exe Token: SeSystemtimePrivilege 4556 msiexec.exe Token: SeProfSingleProcessPrivilege 4556 msiexec.exe Token: SeIncBasePriorityPrivilege 4556 msiexec.exe Token: SeCreatePagefilePrivilege 4556 msiexec.exe Token: SeCreatePermanentPrivilege 4556 msiexec.exe Token: SeBackupPrivilege 4556 msiexec.exe Token: SeRestorePrivilege 4556 msiexec.exe Token: SeShutdownPrivilege 4556 msiexec.exe Token: SeDebugPrivilege 4556 msiexec.exe Token: SeAuditPrivilege 4556 msiexec.exe Token: SeSystemEnvironmentPrivilege 4556 msiexec.exe Token: SeChangeNotifyPrivilege 4556 msiexec.exe Token: SeRemoteShutdownPrivilege 4556 msiexec.exe Token: SeUndockPrivilege 4556 msiexec.exe Token: SeSyncAgentPrivilege 4556 msiexec.exe Token: SeEnableDelegationPrivilege 4556 msiexec.exe Token: SeManageVolumePrivilege 4556 msiexec.exe Token: SeImpersonatePrivilege 4556 msiexec.exe Token: SeCreateGlobalPrivilege 4556 msiexec.exe Token: SeCreateTokenPrivilege 4556 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4556 msiexec.exe Token: SeLockMemoryPrivilege 4556 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4556 msiexec.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4280 wrote to memory of 572 4280 msiexec.exe 85 PID 4280 wrote to memory of 572 4280 msiexec.exe 85 PID 4280 wrote to memory of 572 4280 msiexec.exe 85 PID 4280 wrote to memory of 720 4280 msiexec.exe 96 PID 4280 wrote to memory of 720 4280 msiexec.exe 96 PID 4280 wrote to memory of 4876 4280 msiexec.exe 98 PID 4280 wrote to memory of 4876 4280 msiexec.exe 98 PID 4280 wrote to memory of 4876 4280 msiexec.exe 98 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\avp.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4556
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 28CED8F0F3310FFA5943D81F600611FC C2⤵
- Loads dropped DLL
PID:572
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:720
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D20C277F4280DF6D38808C7E0A1A252B2⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:4876
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:4460
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
436KB
MD5475d20c0ea477a35660e3f67ecf0a1df
SHA167340739f51e1134ae8f0ffc5ae9dd710e8e3a08
SHA256426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
SHA51299525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
-
Filesize
956KB
MD5b28a478eb5b99efcdc7caf428bffb89a
SHA1d394c7b8fe15753bfbff79fb4f648f6f8bae70f9
SHA2563bca1dcaef4430272b9029c9a4bc8be0d45ecff66e8de8679ed30d8afab00f6f
SHA512decb2581f64949bfaaaf0368917f0705d7a4b7392ec272eda025cf06a4384ec4cdd5202081c2e085f00645029dd96bfef262e8628bed1861185adf6281c1cc88
-
Filesize
23.7MB
MD5d43d5be45efd10a0115763ff4f36163c
SHA154f801428965634eb3d4bcb91a077906f2217260
SHA2568120fe9e4437c5cc14ecb7f5c962fb32c9e7f5e25c9fa4bffeb0ca00a9f3da32
SHA512d45506d68a958afdd9926a69ca57ec73374259925f35159b986c3b96419ed459f587dc60c76ab8b5382b194496f3990c4c63f563a8cc7ffac0ec73d63474881f
-
\??\Volume{afa4c2e5-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{52081ded-d4e7-4b1d-b185-016bb1d2e97f}_OnDiskSnapshotProp
Filesize6KB
MD5194b4d86b2772a1de267c7b6338b29fc
SHA14120af0df7e90fd97252115e0dd0fb3755759dfa
SHA2560e67706a2f86eed61131e28449b1aaa390f127528f5f5ae307b3e6fcd7f26ad1
SHA512ee697c7873d603c1e0ffa09973151887d5ee274b26a65096985b3ce6e8fa61659f8f1d7d61fb30158cc50d50a5ad6f1be207831d97068284e270bd5448c6a7cf