Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
27/04/2024, 01:35
Static task
static1
Behavioral task
behavioral1
Sample
b5eff0ea9b3f64f0753e9a0c94d25783dfe0fd4581d8152445ee1aa5e409d046.msi
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral2
Sample
b5eff0ea9b3f64f0753e9a0c94d25783dfe0fd4581d8152445ee1aa5e409d046.msi
Resource
win10v2004-20240419-en
windows10-2004-x64
General
-
Target
b5eff0ea9b3f64f0753e9a0c94d25783dfe0fd4581d8152445ee1aa5e409d046.msi
-
Size
4.4MB
-
MD5
62db092b81779e1111fc850ed153c67f
-
SHA1
8f54951de3a53b33432d415d97ad96c979b2f1eb
-
SHA256
b5eff0ea9b3f64f0753e9a0c94d25783dfe0fd4581d8152445ee1aa5e409d046
-
SHA512
baf9fedab20e25e0f059dcd55453395c532b172e99e1ab065f56e0fac19b0acc7ec826f3c176585a535041c1bc6985b5ede7fc746daff976ff47c2e6592842e9
-
SSDEEP
98304:SjaRY3ue9SPixM8tFVmAcpmWqEzKy9+WV:WQt3ixM8fVmAcpmJHe+WV
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe -
Drops file in Windows directory 9 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSIA7C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB38.tmp msiexec.exe File created C:\Windows\Installer\f760a21.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSID0E.tmp msiexec.exe File opened for modification C:\Windows\Installer\f760a1e.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIB97.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\f760a21.ipi msiexec.exe File created C:\Windows\Installer\f760a1e.msi msiexec.exe -
Executes dropped EXE 1 IoCs
pid Process 2568 FomsTudioª.exe -
Loads dropped DLL 5 IoCs
pid Process 2664 MsiExec.exe 2664 MsiExec.exe 2664 MsiExec.exe 2376 msiexec.exe 2568 FomsTudioª.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2376 msiexec.exe 2376 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 50 IoCs
description pid Process Token: SeShutdownPrivilege 2200 msiexec.exe Token: SeIncreaseQuotaPrivilege 2200 msiexec.exe Token: SeRestorePrivilege 2376 msiexec.exe Token: SeTakeOwnershipPrivilege 2376 msiexec.exe Token: SeSecurityPrivilege 2376 msiexec.exe Token: SeCreateTokenPrivilege 2200 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2200 msiexec.exe Token: SeLockMemoryPrivilege 2200 msiexec.exe Token: SeIncreaseQuotaPrivilege 2200 msiexec.exe Token: SeMachineAccountPrivilege 2200 msiexec.exe Token: SeTcbPrivilege 2200 msiexec.exe Token: SeSecurityPrivilege 2200 msiexec.exe Token: SeTakeOwnershipPrivilege 2200 msiexec.exe Token: SeLoadDriverPrivilege 2200 msiexec.exe Token: SeSystemProfilePrivilege 2200 msiexec.exe Token: SeSystemtimePrivilege 2200 msiexec.exe Token: SeProfSingleProcessPrivilege 2200 msiexec.exe Token: SeIncBasePriorityPrivilege 2200 msiexec.exe Token: SeCreatePagefilePrivilege 2200 msiexec.exe Token: SeCreatePermanentPrivilege 2200 msiexec.exe Token: SeBackupPrivilege 2200 msiexec.exe Token: SeRestorePrivilege 2200 msiexec.exe Token: SeShutdownPrivilege 2200 msiexec.exe Token: SeDebugPrivilege 2200 msiexec.exe Token: SeAuditPrivilege 2200 msiexec.exe Token: SeSystemEnvironmentPrivilege 2200 msiexec.exe Token: SeChangeNotifyPrivilege 2200 msiexec.exe Token: SeRemoteShutdownPrivilege 2200 msiexec.exe Token: SeUndockPrivilege 2200 msiexec.exe Token: SeSyncAgentPrivilege 2200 msiexec.exe Token: SeEnableDelegationPrivilege 2200 msiexec.exe Token: SeManageVolumePrivilege 2200 msiexec.exe Token: SeImpersonatePrivilege 2200 msiexec.exe Token: SeCreateGlobalPrivilege 2200 msiexec.exe Token: SeRestorePrivilege 2376 msiexec.exe Token: SeTakeOwnershipPrivilege 2376 msiexec.exe Token: SeRestorePrivilege 2376 msiexec.exe Token: SeTakeOwnershipPrivilege 2376 msiexec.exe Token: SeRestorePrivilege 2376 msiexec.exe Token: SeTakeOwnershipPrivilege 2376 msiexec.exe Token: SeRestorePrivilege 2376 msiexec.exe Token: SeTakeOwnershipPrivilege 2376 msiexec.exe Token: SeRestorePrivilege 2376 msiexec.exe Token: SeTakeOwnershipPrivilege 2376 msiexec.exe Token: SeRestorePrivilege 2376 msiexec.exe Token: SeTakeOwnershipPrivilege 2376 msiexec.exe Token: SeRestorePrivilege 2376 msiexec.exe Token: SeTakeOwnershipPrivilege 2376 msiexec.exe Token: SeRestorePrivilege 2376 msiexec.exe Token: SeTakeOwnershipPrivilege 2376 msiexec.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 2200 msiexec.exe 2200 msiexec.exe 2568 FomsTudioª.exe 2568 FomsTudioª.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2376 wrote to memory of 2664 2376 msiexec.exe 29 PID 2376 wrote to memory of 2664 2376 msiexec.exe 29 PID 2376 wrote to memory of 2664 2376 msiexec.exe 29 PID 2376 wrote to memory of 2664 2376 msiexec.exe 29 PID 2376 wrote to memory of 2664 2376 msiexec.exe 29 PID 2376 wrote to memory of 2664 2376 msiexec.exe 29 PID 2376 wrote to memory of 2664 2376 msiexec.exe 29 PID 2376 wrote to memory of 2568 2376 msiexec.exe 30 PID 2376 wrote to memory of 2568 2376 msiexec.exe 30 PID 2376 wrote to memory of 2568 2376 msiexec.exe 30
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\b5eff0ea9b3f64f0753e9a0c94d25783dfe0fd4581d8152445ee1aa5e409d046.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2200
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 56D0DFA76F178EF1BB0533DB0EC103D02⤵
- Loads dropped DLL
PID:2664
-
-
C:\Users\Admin\AppData\Roaming\FomsTudioª.exe"C:\Users\Admin\AppData\Roaming\FomsTudioª.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:2568
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5fe809675e3c79a94c93d890cba5e77f7
SHA1df8c94157092bdb60e36d7d74483ef8a33cf32bc
SHA256b80fee9ccef8d3e2c513a93e7f3dc8ce33666e73b8382b88f0f2e5b9dc6f8026
SHA512c37b3e14019306880c4cacbf3c4d7c77f88dac2687924d79deb85e8ed002437c07238b51b4e813e2e0143cf902ec1e0355cdbf80978ce93db2ae0ffc170ab749
-
Filesize
4.8MB
MD59d51f30870fd792b2072cb09952d0ea9
SHA103fd5f5cdba17de2ba0f4df503fbb112c2c390c5
SHA2562bcb35fdea08c99b2eef2733e474d151685724981408521ea15a74e34faf8241
SHA512445dbd210b0537ff35132822328a1a8e126841ea72368edacc850e72ffe59bb9f414ed11de48f19eb0dbbf24e90e084ba2e42ce59b63b9d587b7b9be4ae890cd
-
Filesize
721KB
MD55a1f2196056c0a06b79a77ae981c7761
SHA1a880ae54395658f129e24732800e207ecd0b5603
SHA25652f41817669af7ac55b1516894ee705245c3148f2997fa0e6617e9cc6353e41e
SHA5129afc180ebc10c0ee0d7306f4b7085608a4e69321044d474691587bf7e63f945888781a9fc5e69568d351ac690b0335214bd04bdf5c75fd8a3bd1ec4be5d3475a
-
Filesize
3.9MB
MD58a242aeba83c7da62dff095417cccd31
SHA12f93e5c9e75e4de7d9a82826ace4dfaa763e6db7
SHA25651915ee49701927a930a033ac2b84c3303b8cf7ac88869b0d2ba6aabc5fa66f8
SHA512b91742f74367f7bcbb4f3956fdbbb27edf1589c7badb9a835391c6c003f7ddd52c73632c92d272aca0a056b54801a9f9e0b5faead7242170c5c7d2c261fe614b