Analysis

  • max time kernel
    120s
  • max time network
    139s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    23-04-2024 23:00

General

  • Target

    OFFICE2016/dcf.es-es/dcfmui.msi

  • Size

    2.3MB

  • MD5

    a0543b894c018380cc5e868f3f168069

  • SHA1

    583ec7da66ba57ba1fb4415380259614117e74ae

  • SHA256

    42de4102487e0ca49c4968f1109ba98abb970600eda32ac0eb11e489bd9fb8d0

  • SHA512

    c51e9ff337a37a593dbc91a34de66d16a045862f0d735c8dea65fb8885ce9f21bb55940643315a357a56de5db4a2de41571d44fef073b7cd93bd715ea32bc932

  • SSDEEP

    49152:IhIu+svi4ut1yFXyzEKqle+93GwtF2VbIPk9u:IhIuFvPut1WKM3Gw7Yb

Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 7 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies data under HKEY_USERS 43 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 55 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\OFFICE2016\dcf.es-es\dcfmui.msi
    1⤵
    • Enumerates connected drives
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1040
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2472
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 89A88581F8157DDB324E96B20373A027
      2⤵
      • Loads dropped DLL
      PID:2112
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2524
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003FC" "0000000000000588"
    1⤵
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    PID:1692

Network

MITRE ATT&CK Matrix ATT&CK v13

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    3342887d7ebc310b185d1290eba7d366

    SHA1

    5ec1880a20428bf653465e7d62ed9b2b3dec90de

    SHA256

    b6409eab33d2f87a7c15d7ea609ab1cf55316cef2880addef245ccc6a4bdc3c7

    SHA512

    9e8ffdf81c020d01e2c098dde08754cb55aeab8d13397486abe43a39ac0dfd42015fe9f358614dd1f5c2d533d24b42d71eca3d39c14c9968b7f05b361e0e38c2

  • C:\Users\Admin\AppData\Local\Temp\Cab84C9.tmp
    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Windows\Installer\MSI8519.tmp
    Filesize

    95KB

    MD5

    acfd123d0e36411b9c1f556853dd9ea5

    SHA1

    812025408e21687dcd6e8eeb1667025a7b7abcbf

    SHA256

    d89dd83af50bfc6e325e2b4e7eecd982ec3ddee9ccb9cfef86d8a5593907c317

    SHA512

    e01da6d2867ca5a029d60bac781cef6639485255ce515bc8e094a43fa107b0d8c120b7bb3de75457407479de71585dfd9475b1b1f39d2d82d303586ccdb9024d