Analysis
-
max time kernel
92s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2024, 07:40
Behavioral task
behavioral1
Sample
下载说明.url
Resource
win7-20240419-en
windows7-x64
Behavioral task
behavioral2
Sample
下载说明.url
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
反聚生/AARP.msi
Resource
win7-20240419-en
windows7-x64
Behavioral task
behavioral4
Sample
反聚生/AARP.msi
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
反聚生/ActArp_MemKey.exe
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral6
Sample
反聚生/ActArp_MemKey.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
反聚生/下载说明.url
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral8
Sample
反聚生/下载说明.url
Resource
win10v2004-20240508-en
windows10-2004-x64
General
-
Target
反聚生/AARP.msi
-
Size
878KB
-
MD5
db7fe957514871f5be4ad7aaa07efee8
-
SHA1
f49dd1e627dd914d14a85dacc88e306b377b4b3f
-
SHA256
0421ed4c54a48f579756d9bacef80f47f4d444b1786c304d2db4db72c12d1c2c
-
SHA512
80e686ffbec7eb4be3cfb8996974a12416de82403508328a274742470bacd05ae9b12ac2a99d3dc69cacf32315f3967102865515dbf2210729c7fd9b410ec908
-
SSDEEP
24576:54e7AuYnISIHeYgrcM2SsZsBMwhB05w7G:54e7AuYISOeY3ws7whBOw
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe -
Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeShutdownPrivilege 452 msiexec.exe Token: SeIncreaseQuotaPrivilege 452 msiexec.exe Token: SeSecurityPrivilege 736 msiexec.exe Token: SeCreateTokenPrivilege 452 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 452 msiexec.exe Token: SeLockMemoryPrivilege 452 msiexec.exe Token: SeIncreaseQuotaPrivilege 452 msiexec.exe Token: SeMachineAccountPrivilege 452 msiexec.exe Token: SeTcbPrivilege 452 msiexec.exe Token: SeSecurityPrivilege 452 msiexec.exe Token: SeTakeOwnershipPrivilege 452 msiexec.exe Token: SeLoadDriverPrivilege 452 msiexec.exe Token: SeSystemProfilePrivilege 452 msiexec.exe Token: SeSystemtimePrivilege 452 msiexec.exe Token: SeProfSingleProcessPrivilege 452 msiexec.exe Token: SeIncBasePriorityPrivilege 452 msiexec.exe Token: SeCreatePagefilePrivilege 452 msiexec.exe Token: SeCreatePermanentPrivilege 452 msiexec.exe Token: SeBackupPrivilege 452 msiexec.exe Token: SeRestorePrivilege 452 msiexec.exe Token: SeShutdownPrivilege 452 msiexec.exe Token: SeDebugPrivilege 452 msiexec.exe Token: SeAuditPrivilege 452 msiexec.exe Token: SeSystemEnvironmentPrivilege 452 msiexec.exe Token: SeChangeNotifyPrivilege 452 msiexec.exe Token: SeRemoteShutdownPrivilege 452 msiexec.exe Token: SeUndockPrivilege 452 msiexec.exe Token: SeSyncAgentPrivilege 452 msiexec.exe Token: SeEnableDelegationPrivilege 452 msiexec.exe Token: SeManageVolumePrivilege 452 msiexec.exe Token: SeImpersonatePrivilege 452 msiexec.exe Token: SeCreateGlobalPrivilege 452 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 452 msiexec.exe
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\反聚生\AARP.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:452
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:736