Resubmissions
28/04/2024, 17:00
240428-vjbvpacf3v628/04/2024, 16:58
240428-vhb43ace81628/04/2024, 16:57
240428-vgg9pace7v628/04/2024, 16:55
240428-ve3gvace4v628/04/2024, 16:52
240428-vdlspscd916Analysis
- max time kernel
133s - max time network
298s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system - submitted
28/04/2024, 16:57
Static task
static1
Behavioral task
behavioral1
Sample
8.3.0_AdbeRdr830_en_US.msi
Resource
win7-20240221-en
windows7-x64
7 signatures
300 seconds
Behavioral task
behavioral2
Sample
8.3.0_AdbeRdr830_en_US.msi
Resource
win10-20240404-en
windows10-1703-x64
6 signatures
300 seconds
General
- Target 8.3.0_AdbeRdr830_en_US.msi
- Size 33.8MB
- Sample240428-vgg9pace7v
- SHA256 c790688ef44768de819049d4cad1da5a56adb14c739e6077f8c7ecd927094578
- MD5 76e0f38f830ab74d76390c7d88a69c81
- SHA1 2e5aa34947ec971fdfd9d65eae03ec106a995189
- SHA512 498c010b5d58251d45494ed9bd57ce8e2e7f6e511a1a5df54e92aa9d9c82d63bf9611075d030826fcf7566401d9b289e86b90322a078f254598c9d17c0d7ddd6
- SSDEEP 786432:k059avjairvEBUhjqTU/dLGoADoBMfVyVzreX:HGjairMBUpkUlnADUeVMz
- MD5 SHA1 SHA512 SSDEEP
Score
6/10
Malware Config
Signatures
- Blocklisted process makes network request 3 IoCs
flow pid Process 2 3296 msiexec.exe 4 3296 msiexec.exe 6 3296 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe - Loads dropped DLL 3 IoCs
pid Process 3696 MsiExec.exe 3696 MsiExec.exe 3696 MsiExec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3296 msiexec.exe Token: SeIncreaseQuotaPrivilege 3296 msiexec.exe Token: SeSecurityPrivilege 3112 msiexec.exe Token: SeCreateTokenPrivilege 3296 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3296 msiexec.exe Token: SeLockMemoryPrivilege 3296 msiexec.exe Token: SeIncreaseQuotaPrivilege 3296 msiexec.exe Token: SeMachineAccountPrivilege 3296 msiexec.exe Token: SeTcbPrivilege 3296 msiexec.exe Token: SeSecurityPrivilege 3296 msiexec.exe Token: SeTakeOwnershipPrivilege 3296 msiexec.exe Token: SeLoadDriverPrivilege 3296 msiexec.exe Token: SeSystemProfilePrivilege 3296 msiexec.exe Token: SeSystemtimePrivilege 3296 msiexec.exe Token: SeProfSingleProcessPrivilege 3296 msiexec.exe Token: SeIncBasePriorityPrivilege 3296 msiexec.exe Token: SeCreatePagefilePrivilege 3296 msiexec.exe Token: SeCreatePermanentPrivilege 3296 msiexec.exe Token: SeBackupPrivilege 3296 msiexec.exe Token: SeRestorePrivilege 3296 msiexec.exe Token: SeShutdownPrivilege 3296 msiexec.exe Token: SeDebugPrivilege 3296 msiexec.exe Token: SeAuditPrivilege 3296 msiexec.exe Token: SeSystemEnvironmentPrivilege 3296 msiexec.exe Token: SeChangeNotifyPrivilege 3296 msiexec.exe Token: SeRemoteShutdownPrivilege 3296 msiexec.exe Token: SeUndockPrivilege 3296 msiexec.exe Token: SeSyncAgentPrivilege 3296 msiexec.exe Token: SeEnableDelegationPrivilege 3296 msiexec.exe Token: SeManageVolumePrivilege 3296 msiexec.exe Token: SeImpersonatePrivilege 3296 msiexec.exe Token: SeCreateGlobalPrivilege 3296 msiexec.exe Token: SeCreateTokenPrivilege 3296 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3296 msiexec.exe Token: SeLockMemoryPrivilege 3296 msiexec.exe Token: SeIncreaseQuotaPrivilege 3296 msiexec.exe Token: SeMachineAccountPrivilege 3296 msiexec.exe Token: SeTcbPrivilege 3296 msiexec.exe Token: SeSecurityPrivilege 3296 msiexec.exe Token: SeTakeOwnershipPrivilege 3296 msiexec.exe Token: SeLoadDriverPrivilege 3296 msiexec.exe Token: SeSystemProfilePrivilege 3296 msiexec.exe Token: SeSystemtimePrivilege 3296 msiexec.exe Token: SeProfSingleProcessPrivilege 3296 msiexec.exe Token: SeIncBasePriorityPrivilege 3296 msiexec.exe Token: SeCreatePagefilePrivilege 3296 msiexec.exe Token: SeCreatePermanentPrivilege 3296 msiexec.exe Token: SeBackupPrivilege 3296 msiexec.exe Token: SeRestorePrivilege 3296 msiexec.exe Token: SeShutdownPrivilege 3296 msiexec.exe Token: SeDebugPrivilege 3296 msiexec.exe Token: SeAuditPrivilege 3296 msiexec.exe Token: SeSystemEnvironmentPrivilege 3296 msiexec.exe Token: SeChangeNotifyPrivilege 3296 msiexec.exe Token: SeRemoteShutdownPrivilege 3296 msiexec.exe Token: SeUndockPrivilege 3296 msiexec.exe Token: SeSyncAgentPrivilege 3296 msiexec.exe Token: SeEnableDelegationPrivilege 3296 msiexec.exe Token: SeManageVolumePrivilege 3296 msiexec.exe Token: SeImpersonatePrivilege 3296 msiexec.exe Token: SeCreateGlobalPrivilege 3296 msiexec.exe Token: SeCreateTokenPrivilege 3296 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3296 msiexec.exe Token: SeLockMemoryPrivilege 3296 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3296 msiexec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3112 wrote to memory of 3696 3112 msiexec.exe 77 PID 3112 wrote to memory of 3696 3112 msiexec.exe 77 PID 3112 wrote to memory of 3696 3112 msiexec.exe 77
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\8.3.0_AdbeRdr830_en_US.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3296
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F3117AE752CAD3AE6BB173236FC11AEC C2⤵
- Loads dropped DLL
PID:3696
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MSI69B6.tmp
- Size 48KB
- SHA256 bec93eab72916acf1a650be51d661ebb0b83f7edf61b495d58c5f2bf231edb9d
- MD5 8055a7a8444f6088957c01e54b2d94c1
- SHA1 7fc5f33c4f6f89e6088c4305db94aff55e30e290
- SHA512 912fca6bd24bcb6a5bb26f10e420cb8b88a62461149801cf8698d8b470e45942804aa6aff4994b00b5bd6272c67cc2c30558b92fb36e221b5f175de899bfcaa8
- SSDEEP 768:EL4sJXAY9TKSrl7DtrF0rahOCGJSmSvAIFSojc:E8Y9TfrxVP8JzKko
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI6A44.tmp
- Size 60KB
- SHA256 df50c0242690c81b6b1ccc43d7a95a1f2a2c0b964652530e8e7582b0d15a21b3
- MD5 0d1bd6352e9dff52829acb137d4a2676
- SHA1 3488ec4059b67b4282ff38ac69609f605be8402a
- SHA512 fea48100b2da0f757f13be1c4058cb5607932bcbc1e4c7a21ae646df97cae0272c665b4e7a44ca5b0da616d6eedcfa256529b344febf9913b5af6cf5b6b95a0a
- SSDEEP 768:sIw6W8SmI+bZR6jTzvldzjQ88i89T8bkic2kzoUNWL7/8v:svPjTzvjk8+B/JjoYWL7/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI6A55.tmp
- Size 93KB
- SHA256 10179b633b475f23604bab98e7c14a55a833ae92f0f9c6bc66c3c8d910300795
- MD5 0ee7c20f810e34cc679a7fa285bafb49
- SHA1 2bdbb66bf65beff0159895cc205f62ac45d552ff
- SHA512 7a7f4ab7119a3ceb24d769de8271c27a8d5263e29dc1ab8024d1db77f16338ae9eca096b9aa94ae7b0c701ef7165b5ae40627b857ab44395839b971f68de368a
- SSDEEP 1536:OhfJ7D9zga5T22BXjbot0cjr0aaH7BSswZlHw9qt9P63aEaQCi:kzga5T22BXncca/Hwwt563aFO
- MD5 SHA1 SHA512 SSDEEP