Analysis
- max time kernel
137s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system - submitted
26/04/2024, 11:41
Static task
static1
Behavioral task
behavioral1
Sample
147f810affa8a7f95cc8a15cc5918933d3cf430232e132b340180d3878951974.msi
Resource
win7-20240221-en
windows7-x64
14 signatures
150 seconds
General
- Target 147f810affa8a7f95cc8a15cc5918933d3cf430232e132b340180d3878951974.msi
- Size 1.5MB
- Sample240426-ntqchafe7t
- SHA256 147f810affa8a7f95cc8a15cc5918933d3cf430232e132b340180d3878951974
- MD5 6d3f68d31efc5fc456850af228427c25
- SHA1 487fcaaab61ce4e76d6a1e2568cf3602a5f6632b
- SHA512 e1c26181065ad69078e281154f741d318ceec9d412c030a89397e6d27ff89c224ed7f106b68892f41309264830e48255ff114369985206efe9c5311f8725df3d
- SSDEEP 24576:kt9cpVDhOXLcVXyEq9GRhv9cWP8rtPN01Mq7+xtA+w9TxDfoUBoiGt+eWilfdqF6:jpRhOXLcJyEq9GRhvVqtV01Mq7kctDAo
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
asyncrat
Version
-
AWS | 3Losh
Botnet
-
mafiaexe
C2
-
127.0.0.1:6606
-
127.0.0.1:7707
-
127.0.0.1:8808
-
twinks234.duckdns.org:6606
-
twinks234.duckdns.org:7707
-
twinks234.duckdns.org:8808
Mutex
-
mafiaEXE
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
- Async RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x000a000000023b9a-66.dat family_asyncrat - Modifies file permissions 1 TTPs 1 IoCs
pid Process 1220 ICACLS.EXE - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe - Drops file in Windows directory 9 IoCs
description ioc Process File opened for modification C:\Windows\LOGS\DPX\setuperr.log EXPAND.EXE File created C:\Windows\Installer\e576949.msi msiexec.exe File opened for modification C:\Windows\Installer\e576949.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\SourceHash{BE13E8ED-EE1E-41EA-93EE-21B2B781511E} msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI6A14.tmp msiexec.exe File opened for modification C:\Windows\LOGS\DPX\setupact.log EXPAND.EXE - Executes dropped EXE 1 IoCs
pid Process 4920 mafiachroom.exe - Loads dropped DLL 1 IoCs
pid Process 3952 MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e45bd8429619152b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e45bd8420000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900e45bd842000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de45bd842000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000e45bd84200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 4896 msiexec.exe 4896 msiexec.exe 4920 mafiachroom.exe - Suspicious use of AdjustPrivilegeToken 50 IoCs
description pid Process Token: SeShutdownPrivilege 4636 msiexec.exe Token: SeIncreaseQuotaPrivilege 4636 msiexec.exe Token: SeSecurityPrivilege 4896 msiexec.exe Token: SeCreateTokenPrivilege 4636 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4636 msiexec.exe Token: SeLockMemoryPrivilege 4636 msiexec.exe Token: SeIncreaseQuotaPrivilege 4636 msiexec.exe Token: SeMachineAccountPrivilege 4636 msiexec.exe Token: SeTcbPrivilege 4636 msiexec.exe Token: SeSecurityPrivilege 4636 msiexec.exe Token: SeTakeOwnershipPrivilege 4636 msiexec.exe Token: SeLoadDriverPrivilege 4636 msiexec.exe Token: SeSystemProfilePrivilege 4636 msiexec.exe Token: SeSystemtimePrivilege 4636 msiexec.exe Token: SeProfSingleProcessPrivilege 4636 msiexec.exe Token: SeIncBasePriorityPrivilege 4636 msiexec.exe Token: SeCreatePagefilePrivilege 4636 msiexec.exe Token: SeCreatePermanentPrivilege 4636 msiexec.exe Token: SeBackupPrivilege 4636 msiexec.exe Token: SeRestorePrivilege 4636 msiexec.exe Token: SeShutdownPrivilege 4636 msiexec.exe Token: SeDebugPrivilege 4636 msiexec.exe Token: SeAuditPrivilege 4636 msiexec.exe Token: SeSystemEnvironmentPrivilege 4636 msiexec.exe Token: SeChangeNotifyPrivilege 4636 msiexec.exe Token: SeRemoteShutdownPrivilege 4636 msiexec.exe Token: SeUndockPrivilege 4636 msiexec.exe Token: SeSyncAgentPrivilege 4636 msiexec.exe Token: SeEnableDelegationPrivilege 4636 msiexec.exe Token: SeManageVolumePrivilege 4636 msiexec.exe Token: SeImpersonatePrivilege 4636 msiexec.exe Token: SeCreateGlobalPrivilege 4636 msiexec.exe Token: SeBackupPrivilege 908 vssvc.exe Token: SeRestorePrivilege 908 vssvc.exe Token: SeAuditPrivilege 908 vssvc.exe Token: SeBackupPrivilege 4896 msiexec.exe Token: SeRestorePrivilege 4896 msiexec.exe Token: SeRestorePrivilege 4896 msiexec.exe Token: SeTakeOwnershipPrivilege 4896 msiexec.exe Token: SeRestorePrivilege 4896 msiexec.exe Token: SeTakeOwnershipPrivilege 4896 msiexec.exe Token: SeDebugPrivilege 4920 mafiachroom.exe Token: SeBackupPrivilege 4832 srtasks.exe Token: SeRestorePrivilege 4832 srtasks.exe Token: SeSecurityPrivilege 4832 srtasks.exe Token: SeTakeOwnershipPrivilege 4832 srtasks.exe Token: SeBackupPrivilege 4832 srtasks.exe Token: SeRestorePrivilege 4832 srtasks.exe Token: SeSecurityPrivilege 4832 srtasks.exe Token: SeTakeOwnershipPrivilege 4832 srtasks.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4636 msiexec.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4920 mafiachroom.exe - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 4896 wrote to memory of 4832 4896 msiexec.exe 90 PID 4896 wrote to memory of 4832 4896 msiexec.exe 90 PID 4896 wrote to memory of 3952 4896 msiexec.exe 92 PID 4896 wrote to memory of 3952 4896 msiexec.exe 92 PID 4896 wrote to memory of 3952 4896 msiexec.exe 92 PID 3952 wrote to memory of 1220 3952 MsiExec.exe 93 PID 3952 wrote to memory of 1220 3952 MsiExec.exe 93 PID 3952 wrote to memory of 1220 3952 MsiExec.exe 93 PID 3952 wrote to memory of 4736 3952 MsiExec.exe 95 PID 3952 wrote to memory of 4736 3952 MsiExec.exe 95 PID 3952 wrote to memory of 4736 3952 MsiExec.exe 95 PID 3952 wrote to memory of 4920 3952 MsiExec.exe 97 PID 3952 wrote to memory of 4920 3952 MsiExec.exe 97 PID 3952 wrote to memory of 4920 3952 MsiExec.exe 97 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\147f810affa8a7f95cc8a15cc5918933d3cf430232e132b340180d3878951974.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4636
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:4832
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 18B3A57CC5D6C57EA6B5207E8437BCDF2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-931e10c7-f4b8-4ccb-a4a8-02fb195e20ab\." /SETINTEGRITYLEVEL (CI)(OI)HIGH3⤵
- Modifies file permissions
PID:1220
-
-
C:\Windows\SysWOW64\EXPAND.EXE"C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files3⤵
- Drops file in Windows directory
PID:4736
-
-
C:\Users\Admin\AppData\Local\Temp\MW-931e10c7-f4b8-4ccb-a4a8-02fb195e20ab\files\mafiachroom.exe"C:\Users\Admin\AppData\Local\Temp\MW-931e10c7-f4b8-4ccb-a4a8-02fb195e20ab\files\mafiachroom.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4920
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:908
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MW-931e10c7-f4b8-4ccb-a4a8-02fb195e20ab\files.cab
- Size 1.2MB
- SHA256 943ef4c71d53ef383ee9591d460799c7e503e493c26abdd6ded50eb82f2dd47f
- MD5 d4e7f05d7f6a7dc75f468dbcaa9f437f
- SHA1 f377284434b0200c6ebeba730dfcddaff7f2de13
- SHA512 9f8d960ee4367f388a0717b9a3991682a900f13db547dd51242a6c1686a2d9badbb94446db36700116c0c7753daacc7fb43ec35c09e94bc462e74c36e2b86bf5
- SSDEEP 24576:TLcVXyEq9GRhv9cWP8rtPN01Mq7+xtA+w9TxDfoUBoiGt+eWilfdqFWVgK:TLcJyEq9GRhvVqtV01Mq7kctDAUdGHWZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MW-931e10c7-f4b8-4ccb-a4a8-02fb195e20ab\files\mafiachroom.exe
- Size 1.2MB
- SHA256 1cf774a50175eb7321b1366c585ccfc68bdf0916d8e78edf1fe24e079209eb9e
- MD5 6e7ebd37b6095cb1a2f3ffa9d5598c81
- SHA1 d4d0cfa65f6dd224af16ff81a29abdf6ab0eab69
- SHA512 f23d689393db2f8292018d8b303992b19dd8b9cfd4f226a84ddd70d30ec2d89083e9b1418d5f82e04a1a81d9014387e0450747b99a02fc32e094c987cc2c782b
- SSDEEP 24576:1lcVkyEq9DRho1jFP8ltPP01Ws7+wFPEl9ix4fpUzoQDt+egElxdqFWVvQ:1lcCyEq9DRho/ctH01Ws74rA4RUBDHgq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MW-931e10c7-f4b8-4ccb-a4a8-02fb195e20ab\msiwrapper.ini
- Size 1KB
- SHA256 5c524a4d8d60bd09d70a471bf79dbe5daf2b1040e951fce2a0cf36ef7e742f7b
- MD5 dffa0a3e7ecff3826ae09ca25512214b
- SHA1 e55c11013561d4a258b41f9212dae119a1c41c10
- SHA512 4668ddf0be83d90e844f838248e16a855045a6f0f6b5ff64cc1a6f20a14c65f049608a68f9e43485b50dfb7b2e51fa4275144cc845d8aaa81492361e2d076107
- MD5 SHA1 SHA512
- Path C:\Windows\Installer\MSI6A14.tmp
- Size 208KB
- SHA256 fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1
- MD5 0c8921bbcc37c6efd34faf44cf3b0cb5
- SHA1 dcfa71246157edcd09eecaf9d4c5e360b24b3e49
- SHA512 ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108
- SSDEEP 3072:xspAtOdmXwCGjtYNKbYO2gjpcm8rRuqpjCL42loHUvU0yGxr5GqM2a8:jtOdiRQYpgjpjew5DHyGxcqo8
- MD5 SHA1 SHA512 SSDEEP
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 3530a60d46aa08ca536e77ad14a3009adf8f8b7cbd79a06e76335d8f4bd2e7d2
- MD5 cd9ecbd469455cf821c3aecb12891669
- SHA1 935e0e592d450fc3b4da9c7667a611d4f39ea52b
- SHA512 179ad2c62a5a1f823dab9cd011a8c0e4e38860da74ea4d2547957f41c54a4903ca3dbb239eac3edf37dd5a8042ac975e1eebdddd42c26b2bc7d1b4c664817cf9
- SSDEEP 24576:NZxm+1dodoO/vvTL6WZecmqtoA6hBVzS1/mt72I1xUaYu+QJIP1KRvSxbR:Gb
- MD5 SHA1 SHA512 SSDEEP
- Path \??\Volume{42d85be4-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{9925b7a6-0ed1-4e06-8ab9-720ee441940a}_OnDiskSnapshotProp
- Size 6KB
- SHA256 4f32a812d21afa7ee96845ba11a8f95ed358e260e24d924c56442139cbb31e86
- MD5 199c7129a55b64ba5e1c8de5afcb69fc
- SHA1 8bde313bfb5e6ab4f152c6df44244815f5f3a322
- SHA512 8e8c99fbe0b36d010ff3e7427648c21a9fc5d51cc2d26bbc03a0f02f78edd452ab34317700827a11a67e31e5776734d5806618a2dc17d99ce8b6383f43e584ba
- SSDEEP 96:FJ/cZKC4wDD84LTHzbOHXOHBlBRQs8Sc9XE56tOSVQpu:H/cxb++lVm
- MD5 SHA1 SHA512 SSDEEP