0fc59838280a5d1ee9fa531ed578473b4039d7a8aef9fa047c08a32bc18c7b04

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
14-05-2024 14:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0fc59838280a5d1ee9fa531ed578473b4039d7a8aef9fa047c08a32bc18c7b04.msi
Size

35.0MB
MD5

2bc508fd91bf49c2f29575bb0d017289
SHA1

801c42782cf13dfdac63a4e6ed09f3f4c190b3db
SHA256

0fc59838280a5d1ee9fa531ed578473b4039d7a8aef9fa047c08a32bc18c7b04
SHA512

ea57d0e78d1afb4776fffd777c8cb1131308c5d279613fe188e6e8f0ad1f617987b697cac0e23be291b35df9939ff0eb43db34dc56f0022a2a05f5ba9bda6d59
SSDEEP

786432:blU27h2QVu9cCct5rB9rIX9gW6cnzELhEe2x53gpknKM:blvA+ptO2Cnne2xUe

Score

6^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 4 IoCs

flow	pid	Process
3	1748	msiexec.exe
5	1748	msiexec.exe
7	1748	msiexec.exe
8	108	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\Installer\f76174d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f76174b.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\f761748.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1B6E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1C6A.tmp	msiexec.exe
File created	C:\Windows\Installer\f76174b.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2061.tmp	msiexec.exe
File created	C:\Windows\Installer\f761748.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1A54.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1BDC.tmp	msiexec.exe

Loads dropped DLL 4 IoCs

pid	Process
1692	MsiExec.exe
1692	MsiExec.exe
1692	MsiExec.exe
1692	MsiExec.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2192	powershell.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2192	powershell.exe
108	msiexec.exe
108	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1748	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1748	msiexec.exe
Token: SeRestorePrivilege	108	msiexec.exe
Token: SeTakeOwnershipPrivilege	108	msiexec.exe
Token: SeSecurityPrivilege	108	msiexec.exe
Token: SeCreateTokenPrivilege	1748	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1748	msiexec.exe
Token: SeLockMemoryPrivilege	1748	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1748	msiexec.exe
Token: SeMachineAccountPrivilege	1748	msiexec.exe
Token: SeTcbPrivilege	1748	msiexec.exe
Token: SeSecurityPrivilege	1748	msiexec.exe
Token: SeTakeOwnershipPrivilege	1748	msiexec.exe
Token: SeLoadDriverPrivilege	1748	msiexec.exe
Token: SeSystemProfilePrivilege	1748	msiexec.exe
Token: SeSystemtimePrivilege	1748	msiexec.exe
Token: SeProfSingleProcessPrivilege	1748	msiexec.exe
Token: SeIncBasePriorityPrivilege	1748	msiexec.exe
Token: SeCreatePagefilePrivilege	1748	msiexec.exe
Token: SeCreatePermanentPrivilege	1748	msiexec.exe
Token: SeBackupPrivilege	1748	msiexec.exe
Token: SeRestorePrivilege	1748	msiexec.exe
Token: SeShutdownPrivilege	1748	msiexec.exe
Token: SeDebugPrivilege	1748	msiexec.exe
Token: SeAuditPrivilege	1748	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1748	msiexec.exe
Token: SeChangeNotifyPrivilege	1748	msiexec.exe
Token: SeRemoteShutdownPrivilege	1748	msiexec.exe
Token: SeUndockPrivilege	1748	msiexec.exe
Token: SeSyncAgentPrivilege	1748	msiexec.exe
Token: SeEnableDelegationPrivilege	1748	msiexec.exe
Token: SeManageVolumePrivilege	1748	msiexec.exe
Token: SeImpersonatePrivilege	1748	msiexec.exe
Token: SeCreateGlobalPrivilege	1748	msiexec.exe
Token: SeRestorePrivilege	108	msiexec.exe
Token: SeTakeOwnershipPrivilege	108	msiexec.exe
Token: SeRestorePrivilege	108	msiexec.exe
Token: SeTakeOwnershipPrivilege	108	msiexec.exe
Token: SeRestorePrivilege	108	msiexec.exe
Token: SeTakeOwnershipPrivilege	108	msiexec.exe
Token: SeRestorePrivilege	108	msiexec.exe
Token: SeTakeOwnershipPrivilege	108	msiexec.exe
Token: SeRestorePrivilege	108	msiexec.exe
Token: SeTakeOwnershipPrivilege	108	msiexec.exe
Token: SeDebugPrivilege	2192	powershell.exe
Token: SeRestorePrivilege	108	msiexec.exe
Token: SeTakeOwnershipPrivilege	108	msiexec.exe
Token: SeRestorePrivilege	108	msiexec.exe
Token: SeTakeOwnershipPrivilege	108	msiexec.exe
Token: SeRestorePrivilege	108	msiexec.exe
Token: SeTakeOwnershipPrivilege	108	msiexec.exe
Token: SeRestorePrivilege	108	msiexec.exe
Token: SeTakeOwnershipPrivilege	108	msiexec.exe
Token: SeRestorePrivilege	108	msiexec.exe
Token: SeTakeOwnershipPrivilege	108	msiexec.exe
Token: SeRestorePrivilege	108	msiexec.exe
Token: SeTakeOwnershipPrivilege	108	msiexec.exe
Token: SeRestorePrivilege	108	msiexec.exe
Token: SeTakeOwnershipPrivilege	108	msiexec.exe
Token: SeRestorePrivilege	108	msiexec.exe
Token: SeTakeOwnershipPrivilege	108	msiexec.exe
Token: SeRestorePrivilege	108	msiexec.exe
Token: SeTakeOwnershipPrivilege	108	msiexec.exe
Token: SeRestorePrivilege	108	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1748	msiexec.exe
1748	msiexec.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 108 wrote to memory of 1692	108	msiexec.exe	29
PID 108 wrote to memory of 1692	108	msiexec.exe	29
PID 108 wrote to memory of 1692	108	msiexec.exe	29
PID 108 wrote to memory of 1692	108	msiexec.exe	29
PID 108 wrote to memory of 1692	108	msiexec.exe	29
PID 108 wrote to memory of 1692	108	msiexec.exe	29
PID 108 wrote to memory of 1692	108	msiexec.exe	29
PID 1692 wrote to memory of 2192	1692	MsiExec.exe	30
PID 1692 wrote to memory of 2192	1692	MsiExec.exe	30
PID 1692 wrote to memory of 2192	1692	MsiExec.exe	30
PID 1692 wrote to memory of 2192	1692	MsiExec.exe	30

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\0fc59838280a5d1ee9fa531ed578473b4039d7a8aef9fa047c08a32bc18c7b04.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1748

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:108
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 99D0A7B615241CF1F0D051C731718E98
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss1CF6.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msi1CF3.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scr1CF4.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scr1CF5.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f76174c.rbs

Filesize
18KB

MD5
f6bf62a344b334465129741f6e59b50e

SHA1
1b8f58a4b7a6ed6f55012bad07b6db84fe922143

SHA256
4d7ed1e3f17e29f1e7ef9d78ce5654f283a9b3b028bfdeb675ee6d606e51f8a0

SHA512
55ab2eafe7913036f418df6d8cb108c436e345db9307b6757cc883b3931a17f6fbb30680bf460c4a15b93276ea01a762bde9c0cb4b0449e871e99d40b20637b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C5C8CC0A7FE31816B4641D0465402560

Filesize
1KB

MD5
e94fb54871208c00df70f708ac47085b

SHA1
4efc31460c619ecae59c1bce2c008036d94c84b8

SHA256
7b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df86

SHA512
2e15b76e16264abb9f5ef417752a1cbb75f29c11f96ac7d73793172bd0864db65f2d2b7be0f16bbbe686068f0c368815525f1e39db5a0d6ca3ab18be6923b898

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f2416c2276a52f10fd9079b67805fa7

SHA1
eb451795dedfdead65ea1bc3d570e9804d4f3c2a

SHA256
f999c5ccc61feb071f369ce05e35885667cfeb60f63e1373609ff803ca94720d

SHA512
d8ddba74bdf494dfaab5226161ab529ab9aa69b065d78b453c9e1fd62ca139638dbefd8be0de2c5fe186660f5701e13afdf1c8021c3d145b9404d88d8604ab25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C5C8CC0A7FE31816B4641D0465402560

Filesize
264B

MD5
027559133498919570119a0148d6eecd

SHA1
a331c3f153258f9332605cab37b0603edf44b873

SHA256
2f729891f410032b312d5fd652ee59226c421b1212f64f4eadac57ec52bb3ab2

SHA512
326ed8c3d90fb1d2b838511863c25b9d68421e154401a1635dad27904a974546d023c3bdd490340d70eb2314f0c959e536af4dc8b1d926c5a8ce3e37c1f007d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab15A5.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar15B7.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Local\Temp\msi1CF3.txt

Filesize
54B

MD5
db420131f396adc6189eb74ccab4ef61

SHA1
f7a0653289e00ae8a37836e4bb0c484a5434f4db

SHA256
20712a091c0903c153ec0394f349e4e687fc16980c77434fab8af6c768b4de22

SHA512
8f29ec5eae268faa330bc71859bada8e36b6f53e27d819dff04451de2cb644307c80f64f71b5768906a6c5eb28e5e77f4a1b23dde01bbfa0e6b9575c4fd92f73

Download Submit
C:\Users\Admin\AppData\Local\Temp\pss1CF6.ps1

Filesize
6KB

MD5
30c30ef2cb47e35101d13402b5661179

SHA1
25696b2aab86a9233f19017539e2dd83b2f75d4e

SHA256
53094df6fa4e57a3265ff04bc1e970c10bcdb3d4094ad6dd610c05b7a8b79e0f

SHA512
882be2768138bb75ff7dde7d5ca4c2e024699398baacd0ce1d4619902402e054297e4f464d8cb3c22b2f35d3dabc408122c207facad64ec8014f2c54834cf458

Download Submit
C:\Users\Admin\AppData\Local\Temp\scr1CF4.ps1

Filesize
558B

MD5
32aaf95e81f7c25950c11c53615c753a

SHA1
603ae202e859261d2ea09ac44f84d98a44007316

SHA256
e523cdefc4d381fd0bb040f80f8ebcba9a022c7b731d1e3fba27ef0ad8643a58

SHA512
4076c6b5a77ebc5c5e02c28269cf4751644a508c9661806e7560664e9c9379c808ca8c0860e6efd4ea3c837edbcbc4b20060413012e5f446f17a44efcef517db

Download Submit
C:\Users\Admin\AppData\Roaming\Vuis Queue\AppQue\libgcrypt-20.dll

Filesize
975KB

MD5
24dac6152c216a1b7b1afef7c36e2b65

SHA1
a832467931f07b3f41772d89feb194a90be4119b

SHA256
784af4a0d287a6611d5ee4fda32e31d7b3d5afcd14bca75d2564bb9f0045b449

SHA512
b4da7fe3e32fe1dc89197ec4f0a84c1cb38ff4d872f842f4692d1520e2b39efd2d7e3b928a8e225d2504aadf72a923ed7ee7e3552988c6365b9b30358912d6ce

Download Submit
C:\Windows\Installer\MSI1C6A.tmp

Filesize
758KB

MD5
fb4665320c9da54598321c59cc5ed623

SHA1
89e87b3cc569edd26b5805244cfacb2f9c892bc7

SHA256
9fb3156c665211a0081b189142c1d1ab18cda601ee54d5f5d8883ecfa4177a59

SHA512
b205552a3cfbaa2202e6ef7e39e229af167b2342a7dc4a2f4cadfe4d05000966cf19e9e208e44d6bb0fd6a56f4283caeed9c13f523e5b301b87f79febb1840cf

Download Submit
C:\Windows\Installer\f761748.msi

Filesize
35.0MB

MD5
2bc508fd91bf49c2f29575bb0d017289

SHA1
801c42782cf13dfdac63a4e6ed09f3f4c190b3db

SHA256
0fc59838280a5d1ee9fa531ed578473b4039d7a8aef9fa047c08a32bc18c7b04

SHA512
ea57d0e78d1afb4776fffd777c8cb1131308c5d279613fe188e6e8f0ad1f617987b697cac0e23be291b35df9939ff0eb43db34dc56f0022a2a05f5ba9bda6d59

Download Submit
\Windows\Installer\MSI1A54.tmp

Filesize
738KB

MD5
b158d8d605571ea47a238df5ab43dfaa

SHA1
bb91ae1f2f7142b9099e3cc285f4f5b84de568e4

SHA256
ca763693cc25d316f14a9ebad80ebf00590329550c45adb7e5205486533c2504

SHA512
56aef59c198acf2fcd0d95ea6e32ce1c706e5098a0800feff13ddb427bfb4d538de1c415a5cb5496b09a5825155e3abb1c13c8c37dc31549604bd4d63cb70591

Download Submit