Analysis
- max time kernel
452s - max time network
1178s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/05/2024, 15:47
Static task
static1
Behavioral task
behavioral1
Sample
avp.msi
Resource
win10-20240404-en
windows10-1703-x64
14 signatures
1200 seconds
Behavioral task
behavioral2
Sample
avp.msi
Resource
win10v2004-20240426-en
windows10-2004-x64
13 signatures
1200 seconds
General
- Target avp.msi
- Size 1.4MB
- Sample240503-s8jwgsdc95
- SHA256 dcae57ec4b69236146f744c143c42cc8bdac9da6e991904e6dbf67ec1179286a
- MD5 4d81be09c23e02fab7364e508c21c111
- SHA1 52cae521d7a808c8206f4b5afd6b037bc573b50e
- SHA512 4f5b4fdeb9a056025455ede8ee6e1757da8db64f9692df2a46558a3c04aaec551734b4d75803bbd579e1163b9aba5005f71c5efb22ee3d336779804a11b2b5a5
- SSDEEP 24576:BqKxnNTYUx0ECIgYmfLVYeBZr7A9zdfoAX+8UhxcS:Bq6TYCZKumZr7ARdAAO8oxz
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detects SSLoad Unpacked payload 1 IoCs
resource yara_rule behavioral2/memory/3048-46-0x0000000003190000-0x0000000003203000-memory.dmp family_ssload - Blocklisted process makes network request 2 IoCs
flow pid Process 37 3048 MsiExec.exe 39 3048 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 36 api.ipify.org 37 api.ipify.org - Drops file in Windows directory 9 IoCs
description ioc Process File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\e576707.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI67C3.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{52EF198D-0C6C-406A-803F-F86D93DD7930} msiexec.exe File opened for modification C:\Windows\Installer\MSI6880.tmp msiexec.exe File opened for modification C:\Windows\Installer\e576707.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI6755.tmp msiexec.exe - Loads dropped DLL 9 IoCs
pid Process 1180 MsiExec.exe 1180 MsiExec.exe 1180 MsiExec.exe 1180 MsiExec.exe 1180 MsiExec.exe 1180 MsiExec.exe 3048 MsiExec.exe 3048 MsiExec.exe 3048 MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000d9d47eb9a1a06eb40000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000d9d47eb90000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900d9d47eb9000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dd9d47eb9000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000d9d47eb900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2472 msiexec.exe 2472 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4364 msiexec.exe Token: SeIncreaseQuotaPrivilege 4364 msiexec.exe Token: SeSecurityPrivilege 2472 msiexec.exe Token: SeCreateTokenPrivilege 4364 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4364 msiexec.exe Token: SeLockMemoryPrivilege 4364 msiexec.exe Token: SeIncreaseQuotaPrivilege 4364 msiexec.exe Token: SeMachineAccountPrivilege 4364 msiexec.exe Token: SeTcbPrivilege 4364 msiexec.exe Token: SeSecurityPrivilege 4364 msiexec.exe Token: SeTakeOwnershipPrivilege 4364 msiexec.exe Token: SeLoadDriverPrivilege 4364 msiexec.exe Token: SeSystemProfilePrivilege 4364 msiexec.exe Token: SeSystemtimePrivilege 4364 msiexec.exe Token: SeProfSingleProcessPrivilege 4364 msiexec.exe Token: SeIncBasePriorityPrivilege 4364 msiexec.exe Token: SeCreatePagefilePrivilege 4364 msiexec.exe Token: SeCreatePermanentPrivilege 4364 msiexec.exe Token: SeBackupPrivilege 4364 msiexec.exe Token: SeRestorePrivilege 4364 msiexec.exe Token: SeShutdownPrivilege 4364 msiexec.exe Token: SeDebugPrivilege 4364 msiexec.exe Token: SeAuditPrivilege 4364 msiexec.exe Token: SeSystemEnvironmentPrivilege 4364 msiexec.exe Token: SeChangeNotifyPrivilege 4364 msiexec.exe Token: SeRemoteShutdownPrivilege 4364 msiexec.exe Token: SeUndockPrivilege 4364 msiexec.exe Token: SeSyncAgentPrivilege 4364 msiexec.exe Token: SeEnableDelegationPrivilege 4364 msiexec.exe Token: SeManageVolumePrivilege 4364 msiexec.exe Token: SeImpersonatePrivilege 4364 msiexec.exe Token: SeCreateGlobalPrivilege 4364 msiexec.exe Token: SeCreateTokenPrivilege 4364 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4364 msiexec.exe Token: SeLockMemoryPrivilege 4364 msiexec.exe Token: SeIncreaseQuotaPrivilege 4364 msiexec.exe Token: SeMachineAccountPrivilege 4364 msiexec.exe Token: SeTcbPrivilege 4364 msiexec.exe Token: SeSecurityPrivilege 4364 msiexec.exe Token: SeTakeOwnershipPrivilege 4364 msiexec.exe Token: SeLoadDriverPrivilege 4364 msiexec.exe Token: SeSystemProfilePrivilege 4364 msiexec.exe Token: SeSystemtimePrivilege 4364 msiexec.exe Token: SeProfSingleProcessPrivilege 4364 msiexec.exe Token: SeIncBasePriorityPrivilege 4364 msiexec.exe Token: SeCreatePagefilePrivilege 4364 msiexec.exe Token: SeCreatePermanentPrivilege 4364 msiexec.exe Token: SeBackupPrivilege 4364 msiexec.exe Token: SeRestorePrivilege 4364 msiexec.exe Token: SeShutdownPrivilege 4364 msiexec.exe Token: SeDebugPrivilege 4364 msiexec.exe Token: SeAuditPrivilege 4364 msiexec.exe Token: SeSystemEnvironmentPrivilege 4364 msiexec.exe Token: SeChangeNotifyPrivilege 4364 msiexec.exe Token: SeRemoteShutdownPrivilege 4364 msiexec.exe Token: SeUndockPrivilege 4364 msiexec.exe Token: SeSyncAgentPrivilege 4364 msiexec.exe Token: SeEnableDelegationPrivilege 4364 msiexec.exe Token: SeManageVolumePrivilege 4364 msiexec.exe Token: SeImpersonatePrivilege 4364 msiexec.exe Token: SeCreateGlobalPrivilege 4364 msiexec.exe Token: SeCreateTokenPrivilege 4364 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4364 msiexec.exe Token: SeLockMemoryPrivilege 4364 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4364 msiexec.exe 4364 msiexec.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2472 wrote to memory of 1180 2472 msiexec.exe 84 PID 2472 wrote to memory of 1180 2472 msiexec.exe 84 PID 2472 wrote to memory of 1180 2472 msiexec.exe 84 PID 2472 wrote to memory of 4180 2472 msiexec.exe 96 PID 2472 wrote to memory of 4180 2472 msiexec.exe 96 PID 2472 wrote to memory of 3048 2472 msiexec.exe 98 PID 2472 wrote to memory of 3048 2472 msiexec.exe 98 PID 2472 wrote to memory of 3048 2472 msiexec.exe 98 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\avp.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4364
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B0FEF125D375A3D696A0A05789A3B589 C2⤵
- Loads dropped DLL
PID:1180
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4180
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 87F9C1008400BA9455956C20DDD128A22⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:3048
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:1468
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e576708.rbs
- Size 1KB
- SHA256 a5962f190f18ab6c61d70a0d08f86f9b6261d8b498befb7edc14239a109635f2
- MD5 7f7a30ff0e3aceb286e68b17bc937e7a
- SHA1 e7cad2feaf9c68d75049be39182bf7a3d1bbc8ac
- SHA512 cfc06ef1ed8e0d082e9a36a9ed6c9e9248263767510c0cd54e43d975b8ebf7fa2a07ed937defdbc99678054ae9b04a5b02820f39623347c19a4d7f1ebfeedda6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\MSI3B73.tmp
- Size 436KB
- SHA256 426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
- MD5 475d20c0ea477a35660e3f67ecf0a1df
- SHA1 67340739f51e1134ae8f0ffc5ae9dd710e8e3a08
- SHA512 99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
- SSDEEP 6144:5x0A4eCDsgvSd7ftYx5fnLHT7ybjfgaUFfQiAOuv2IaZeB+:5x0ECIgYOx5fnL/tYi8OBZr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\sharepoint\forcedelctl.dll
- Size 956KB
- SHA256 3bca1dcaef4430272b9029c9a4bc8be0d45ecff66e8de8679ed30d8afab00f6f
- MD5 b28a478eb5b99efcdc7caf428bffb89a
- SHA1 d394c7b8fe15753bfbff79fb4f648f6f8bae70f9
- SHA512 decb2581f64949bfaaaf0368917f0705d7a4b7392ec272eda025cf06a4384ec4cdd5202081c2e085f00645029dd96bfef262e8628bed1861185adf6281c1cc88
- SSDEEP 24576:rs6ZRS5J3ifJvlxfcdaeti7w+0bf0XznPMvPD:Yni8dK9CEMXD
- MD5 SHA1 SHA512 SSDEEP
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 23.7MB
- SHA256 07a04caf1c8593e17c287efa93d7e0328b3dd6ffbcdfb30e7fc0ed3902b57f64
- MD5 20e81fd7fe6425ca19775aa5def3c30b
- SHA1 304fbb1fb86b6c257d6dbfab5e20dee3ff6e0e3d
- SHA512 6b3f143d28cd6cf2aefab8f0bd8454b9bafbf05d2f4082cdbe7a4a6cd624b860a61754bf7677c57471b3c5b07b190936af054f760b7ac8f2dbf073fe971cc5cc
- SSDEEP 24576:8Sqm41xfdoO/vvTLkNtuanWduOCZvgK6JTNN52A2aW6x8eRWoBli7aNoa:i
- MD5 SHA1 SHA512 SSDEEP
- Path \??\Volume{b97ed4d9-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{719eb1cd-eb7f-4838-87fa-764ff4a505f7}_OnDiskSnapshotProp
- Size 6KB
- SHA256 56d829686dfed10fa4caac364818a45915344dbd1abfac1371514f9f6a78e5a3
- MD5 93553d8d1d84235959f1535723759fb7
- SHA1 3b70e4a63a1a04b07990365584aae7eb82e6175b
- SHA512 5c7305b4fd9158892f61fe37b3b7791c438dd7c5cbaaeb0d7fde5c6f04f4fa9ce35b4533f9881b6e9d179e95008e741b5f575ac05c5a9eec8315a177a24eb9a1
- SSDEEP 96:Fj0XI9c4xDD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:B0gb++1Vm
- MD5 SHA1 SHA512 SSDEEP