Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240215-en -
submitted
10-05-2024 22:03
Static task
static1
Behavioral task
behavioral1
Sample
MSI.msi
Resource
win7-20240215-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
MSI.msi
Resource
win10v2004-20240426-en
windows10-2004-x64
15 signatures
150 seconds
General
-
Target
MSI.msi
-
Size
1.5MB
-
MD5
b4a482a7e96cfdef632a7af286120156
-
SHA1
73e3639a9388af84b9c0f172b3aeaf3823014596
-
SHA256
ead5ebf464c313176174ff0fdc3360a3477f6361d0947221d31287eeb04691b3
-
SHA512
15661f1dc751a48f5d213ec99c046e0b9fa1a2201d238d26bee0f15341e9d84611c30f152c463368c6d59f3e7cccb5ae991b1f3127ad65eb3a2ea7823d3b598b
-
SSDEEP
49152:oIR3YuW8zBQSc0ZnSKYZKumZr7ANCuyspI:FY90ZniK/A8uR
Malware Config
Signatures
-
Brute Ratel C4
A customized command and control framework for red teaming and adversary simulation.
-
Bruteratel family
-
Detect BruteRatel badger 2 IoCs
resource yara_rule behavioral1/memory/1544-43-0x000000026E7A0000-0x000000026E7EA000-memory.dmp family_bruteratel behavioral1/memory/1544-46-0x000000026E7A0000-0x000000026E7EA000-memory.dmp family_bruteratel -
Blocklisted process makes network request 64 IoCs
flow pid Process 4 1544 rundll32.exe 7 1544 rundll32.exe 9 1544 rundll32.exe 10 1544 rundll32.exe 11 1544 rundll32.exe 12 1544 rundll32.exe 14 1544 rundll32.exe 15 1544 rundll32.exe 16 1544 rundll32.exe 17 1544 rundll32.exe 18 1544 rundll32.exe 19 1544 rundll32.exe 20 1544 rundll32.exe 21 1544 rundll32.exe 23 1544 rundll32.exe 24 1544 rundll32.exe 25 1544 rundll32.exe 26 1544 rundll32.exe 27 1544 rundll32.exe 28 1544 rundll32.exe 29 1544 rundll32.exe 30 1544 rundll32.exe 31 1544 rundll32.exe 32 1544 rundll32.exe 34 1544 rundll32.exe 35 1544 rundll32.exe 36 1544 rundll32.exe 37 1544 rundll32.exe 38 1544 rundll32.exe 42 1544 rundll32.exe 43 1544 rundll32.exe 44 1544 rundll32.exe 45 1544 rundll32.exe 46 1544 rundll32.exe 47 1544 rundll32.exe 48 1544 rundll32.exe 49 1544 rundll32.exe 50 1544 rundll32.exe 51 1544 rundll32.exe 52 1544 rundll32.exe 53 1544 rundll32.exe 54 1544 rundll32.exe 55 1544 rundll32.exe 56 1544 rundll32.exe 57 1544 rundll32.exe 58 1544 rundll32.exe 59 1544 rundll32.exe 60 1544 rundll32.exe 61 1544 rundll32.exe 62 1544 rundll32.exe 63 1544 rundll32.exe 64 1544 rundll32.exe 65 1544 rundll32.exe 66 1544 rundll32.exe 67 1544 rundll32.exe 68 1544 rundll32.exe 69 1544 rundll32.exe 70 1544 rundll32.exe 71 1544 rundll32.exe 72 1544 rundll32.exe 73 1544 rundll32.exe 74 1544 rundll32.exe 75 1544 rundll32.exe 76 1544 rundll32.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe -
Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File created C:\Windows\Installer\f7629bf.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI29EE.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2AC9.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\f7629bf.msi msiexec.exe File created C:\Windows\Installer\f7629c0.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI2AEA.tmp msiexec.exe -
Executes dropped EXE 1 IoCs
pid Process 1696 MSI2AEA.tmp -
Loads dropped DLL 10 IoCs
pid Process 2552 MsiExec.exe 2552 MsiExec.exe 2552 MsiExec.exe 2552 MsiExec.exe 2552 MsiExec.exe 2296 MsiExec.exe 1544 rundll32.exe 1544 rundll32.exe 1544 rundll32.exe 1544 rundll32.exe -
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 1660 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSI2AEA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe -
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 rundll32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 49 IoCs
pid Process 1980 msiexec.exe 1980 msiexec.exe 1696 MSI2AEA.tmp 1544 rundll32.exe 1544 rundll32.exe 1544 rundll32.exe 1544 rundll32.exe 1544 rundll32.exe 1544 rundll32.exe 1544 rundll32.exe 1544 rundll32.exe 1544 rundll32.exe 1544 rundll32.exe 1544 rundll32.exe 1544 rundll32.exe 1544 rundll32.exe 1544 rundll32.exe 1544 rundll32.exe 1544 rundll32.exe 1544 rundll32.exe 1544 rundll32.exe 1544 rundll32.exe 1544 rundll32.exe 1544 rundll32.exe 1544 rundll32.exe 1544 rundll32.exe 1544 rundll32.exe 1544 rundll32.exe 1544 rundll32.exe 1544 rundll32.exe 1544 rundll32.exe 1544 rundll32.exe 1544 rundll32.exe 1544 rundll32.exe 1544 rundll32.exe 1544 rundll32.exe 1544 rundll32.exe 1544 rundll32.exe 1544 rundll32.exe 1544 rundll32.exe 1544 rundll32.exe 1544 rundll32.exe 1544 rundll32.exe 1544 rundll32.exe 1544 rundll32.exe 1544 rundll32.exe 1544 rundll32.exe 1544 rundll32.exe 1544 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1660 msiexec.exe Token: SeIncreaseQuotaPrivilege 1660 msiexec.exe Token: SeRestorePrivilege 1980 msiexec.exe Token: SeTakeOwnershipPrivilege 1980 msiexec.exe Token: SeSecurityPrivilege 1980 msiexec.exe Token: SeCreateTokenPrivilege 1660 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1660 msiexec.exe Token: SeLockMemoryPrivilege 1660 msiexec.exe Token: SeIncreaseQuotaPrivilege 1660 msiexec.exe Token: SeMachineAccountPrivilege 1660 msiexec.exe Token: SeTcbPrivilege 1660 msiexec.exe Token: SeSecurityPrivilege 1660 msiexec.exe Token: SeTakeOwnershipPrivilege 1660 msiexec.exe Token: SeLoadDriverPrivilege 1660 msiexec.exe Token: SeSystemProfilePrivilege 1660 msiexec.exe Token: SeSystemtimePrivilege 1660 msiexec.exe Token: SeProfSingleProcessPrivilege 1660 msiexec.exe Token: SeIncBasePriorityPrivilege 1660 msiexec.exe Token: SeCreatePagefilePrivilege 1660 msiexec.exe Token: SeCreatePermanentPrivilege 1660 msiexec.exe Token: SeBackupPrivilege 1660 msiexec.exe Token: SeRestorePrivilege 1660 msiexec.exe Token: SeShutdownPrivilege 1660 msiexec.exe Token: SeDebugPrivilege 1660 msiexec.exe Token: SeAuditPrivilege 1660 msiexec.exe Token: SeSystemEnvironmentPrivilege 1660 msiexec.exe Token: SeChangeNotifyPrivilege 1660 msiexec.exe Token: SeRemoteShutdownPrivilege 1660 msiexec.exe Token: SeUndockPrivilege 1660 msiexec.exe Token: SeSyncAgentPrivilege 1660 msiexec.exe Token: SeEnableDelegationPrivilege 1660 msiexec.exe Token: SeManageVolumePrivilege 1660 msiexec.exe Token: SeImpersonatePrivilege 1660 msiexec.exe Token: SeCreateGlobalPrivilege 1660 msiexec.exe Token: SeCreateTokenPrivilege 1660 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1660 msiexec.exe Token: SeLockMemoryPrivilege 1660 msiexec.exe Token: SeIncreaseQuotaPrivilege 1660 msiexec.exe Token: SeMachineAccountPrivilege 1660 msiexec.exe Token: SeTcbPrivilege 1660 msiexec.exe Token: SeSecurityPrivilege 1660 msiexec.exe Token: SeTakeOwnershipPrivilege 1660 msiexec.exe Token: SeLoadDriverPrivilege 1660 msiexec.exe Token: SeSystemProfilePrivilege 1660 msiexec.exe Token: SeSystemtimePrivilege 1660 msiexec.exe Token: SeProfSingleProcessPrivilege 1660 msiexec.exe Token: SeIncBasePriorityPrivilege 1660 msiexec.exe Token: SeCreatePagefilePrivilege 1660 msiexec.exe Token: SeCreatePermanentPrivilege 1660 msiexec.exe Token: SeBackupPrivilege 1660 msiexec.exe Token: SeRestorePrivilege 1660 msiexec.exe Token: SeShutdownPrivilege 1660 msiexec.exe Token: SeDebugPrivilege 1660 msiexec.exe Token: SeAuditPrivilege 1660 msiexec.exe Token: SeSystemEnvironmentPrivilege 1660 msiexec.exe Token: SeChangeNotifyPrivilege 1660 msiexec.exe Token: SeRemoteShutdownPrivilege 1660 msiexec.exe Token: SeUndockPrivilege 1660 msiexec.exe Token: SeSyncAgentPrivilege 1660 msiexec.exe Token: SeEnableDelegationPrivilege 1660 msiexec.exe Token: SeManageVolumePrivilege 1660 msiexec.exe Token: SeImpersonatePrivilege 1660 msiexec.exe Token: SeCreateGlobalPrivilege 1660 msiexec.exe Token: SeCreateTokenPrivilege 1660 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1660 msiexec.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1980 wrote to memory of 2552 1980 msiexec.exe 29 PID 1980 wrote to memory of 2552 1980 msiexec.exe 29 PID 1980 wrote to memory of 2552 1980 msiexec.exe 29 PID 1980 wrote to memory of 2552 1980 msiexec.exe 29 PID 1980 wrote to memory of 2552 1980 msiexec.exe 29 PID 1980 wrote to memory of 2552 1980 msiexec.exe 29 PID 1980 wrote to memory of 2552 1980 msiexec.exe 29 PID 1980 wrote to memory of 2296 1980 msiexec.exe 33 PID 1980 wrote to memory of 2296 1980 msiexec.exe 33 PID 1980 wrote to memory of 2296 1980 msiexec.exe 33 PID 1980 wrote to memory of 2296 1980 msiexec.exe 33 PID 1980 wrote to memory of 2296 1980 msiexec.exe 33 PID 1980 wrote to memory of 2296 1980 msiexec.exe 33 PID 1980 wrote to memory of 2296 1980 msiexec.exe 33 PID 1980 wrote to memory of 1696 1980 msiexec.exe 34 PID 1980 wrote to memory of 1696 1980 msiexec.exe 34 PID 1980 wrote to memory of 1696 1980 msiexec.exe 34 PID 1980 wrote to memory of 1696 1980 msiexec.exe 34 PID 1980 wrote to memory of 1696 1980 msiexec.exe 34 PID 1980 wrote to memory of 1696 1980 msiexec.exe 34 PID 1980 wrote to memory of 1696 1980 msiexec.exe 34 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\MSI.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1660
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 2E0EFCDF8181C08AD089D9B1A8862742 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2552
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A3A0DFBA813CB70327DCD08AC12051402⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2296
-
-
C:\Windows\Installer\MSI2AEA.tmp"C:\Windows\Installer\MSI2AEA.tmp" C:/Windows/System32/rundll32.exe C:\Users\Admin\AppData\Roaming\upfilles.dll, stow2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1696
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:2432
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "000000000000059C" "000000000000055C"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2692
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\upfilles.dll, stow1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:1544
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1System Binary Proxy Execution
1Msiexec
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
436KB
MD5475d20c0ea477a35660e3f67ecf0a1df
SHA167340739f51e1134ae8f0ffc5ae9dd710e8e3a08
SHA256426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
SHA51299525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
-
Filesize
508KB
MD5ccb6d3cb020f56758622911ddd2f1fcb
SHA14a013f752c2bf84ca37e418175e0d9b6f61f636d
SHA256f4cb6b684ea097f867d406a978b3422bbf2ecfea39236bf3ab99340996b825de
SHA5126ed929967005eaa6407e273b53a1fedcb2b084d775bed17272fd05b1ce143dbf921ac201246dfbfdbe663c7351e44c12f162e6f03343548b69b5d4598bb3492e
-
Filesize
389KB
MD5b9545ed17695a32face8c3408a6a3553
SHA1f6c31c9cd832ae2aebcd88e7b2fa6803ae93fc83
SHA2561e0e63b446eecf6c9781c7d1cae1f46a3bb31654a70612f71f31538fb4f4729a
SHA512f6d6dc40dcba5ff091452d7cc257427dcb7ce2a21816b4fec2ee249e63246b64667f5c4095220623533243103876433ef8c12c9b612c0e95fdfffe41d1504e04