Analysis
-
max time kernel
141s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
15/05/2024, 15:55
General
-
Target
bbb45077f52c14bda8e240fc2e94e36efc1d45c24a40f51a4ed7f506126d4c36.msi
-
Size
35.0MB
-
MD5
94089be88986618b7be913ee8b0d8a67
-
SHA1
377ecca72bbdf278cb2a15531188e14eb59145e4
-
SHA256
bbb45077f52c14bda8e240fc2e94e36efc1d45c24a40f51a4ed7f506126d4c36
-
SHA512
84d0ec6948a1f511bfe0d25af19cb015ee1efe4351706f15587aee56f45e3a91abc4f40a0f3e8894deaf789deb04b46135deeba20c4a34dfec08d595e2b71987
-
SSDEEP
786432:Ilk27h2QVu9cCct5rB9rIX9gW6cnzELhEe2x53gp2KM:IlfA+ptO2Cnne2xU2
Malware Config
Signatures
-
Blocklisted process makes network request 3 IoCs
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Windows directory 14 IoCs
-
Loads dropped DLL 6 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\bbb45077f52c14bda8e240fc2e94e36efc1d45c24a40f51a4ed7f506126d4c36.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6C1BC1FCC57AAA92DDAA466A8D172E822⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe-NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss5528.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msi5525.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scr5526.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scr5527.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD582e398e46b235b45cddb79ccda47d210
SHA13909f350add24586ce70c665f5116bdb3397a13c
SHA256ab270a407cf7e3d9261b1378299f7f09dbeb41eb537e88e8e95c92cad5d8705b
SHA512a36533a85b51e439bfad94f2464a9f9ea0cf99d60edb34b9c9d9973a14584219dcdfb7ec92200b9577a77909be94917489f9a7c3b9d6b32f63ff97deeea38735
-
Filesize
1KB
MD5d89c55ff8e3cfc6accb7dcc297d8ef03
SHA1694e9bb9fac9ad1d91bc7e63516f79f842f1df6f
SHA2568da7a595a350c41611defe6b0f2abd25c9fea7b32659b029b2746ff9a7204e70
SHA5124a4cc999e01277150482b759e9330658261dd4ed71bc034293ab6336eb6235d2200dcf8afd6b8423339e6ad6118b71efa1d6cdb288d7474a83237c9422e53667
-
Filesize
1KB
MD57a7509ca0e2995d6042284443c53cb08
SHA1dedb677578e93bddc8e2b655079d35fb7edfa191
SHA256e179293c626e4f9fab7e2154bca0323bd8f0f33a66d1e146b8a3a8c05c3762a5
SHA51244b3e6cc710dea38e7019f74f76a5b99418221a8e30a65ef4f676a165f0bb48abb946151ac269e3728760cf03d52f17e9cff5e1abaa503a4b85d7553e2434879
-
Filesize
536B
MD510cb207311b4150f6d999ba097d702c7
SHA19424c16410c05fcb552bc92bcb56055611a8b076
SHA256c632412ac407111a2cc479ebdf256ac91a21a756ca497a7a5b1193b1ec76690f
SHA51237ab0ca945554b54b94a40ef6094c5d614e743e19290c3502e93fa80c0d53e635ae89591274a2715b35a02a5b154cfc042c6f327dc4b3609a25cd9b76d6017ba
-
Filesize
536B
MD54869c51b426549c2ab8f8ffeae8726af
SHA13b4db566a3aa239aca0ba70fa9c0c92c79240ad4
SHA256c8f5c0eb2133307ffcfcf6a432e1fd6de919dcfd6f2005395ddcbc553d00e7c0
SHA51289d44fdd3438aeab74270ad1f1cc7031e081659b073a0ef95288804798b64fc94ce10b607f9acc57f768113b87e67345560994cae6541ac99c5cd85eb2942a87
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
54B
MD5db420131f396adc6189eb74ccab4ef61
SHA1f7a0653289e00ae8a37836e4bb0c484a5434f4db
SHA25620712a091c0903c153ec0394f349e4e687fc16980c77434fab8af6c768b4de22
SHA5128f29ec5eae268faa330bc71859bada8e36b6f53e27d819dff04451de2cb644307c80f64f71b5768906a6c5eb28e5e77f4a1b23dde01bbfa0e6b9575c4fd92f73
-
Filesize
6KB
MD530c30ef2cb47e35101d13402b5661179
SHA125696b2aab86a9233f19017539e2dd83b2f75d4e
SHA25653094df6fa4e57a3265ff04bc1e970c10bcdb3d4094ad6dd610c05b7a8b79e0f
SHA512882be2768138bb75ff7dde7d5ca4c2e024699398baacd0ce1d4619902402e054297e4f464d8cb3c22b2f35d3dabc408122c207facad64ec8014f2c54834cf458
-
Filesize
558B
MD532aaf95e81f7c25950c11c53615c753a
SHA1603ae202e859261d2ea09ac44f84d98a44007316
SHA256e523cdefc4d381fd0bb040f80f8ebcba9a022c7b731d1e3fba27ef0ad8643a58
SHA5124076c6b5a77ebc5c5e02c28269cf4751644a508c9661806e7560664e9c9379c808ca8c0860e6efd4ea3c837edbcbc4b20060413012e5f446f17a44efcef517db
-
Filesize
975KB
MD524dac6152c216a1b7b1afef7c36e2b65
SHA1a832467931f07b3f41772d89feb194a90be4119b
SHA256784af4a0d287a6611d5ee4fda32e31d7b3d5afcd14bca75d2564bb9f0045b449
SHA512b4da7fe3e32fe1dc89197ec4f0a84c1cb38ff4d872f842f4692d1520e2b39efd2d7e3b928a8e225d2504aadf72a923ed7ee7e3552988c6365b9b30358912d6ce
-
Filesize
738KB
MD5b158d8d605571ea47a238df5ab43dfaa
SHA1bb91ae1f2f7142b9099e3cc285f4f5b84de568e4
SHA256ca763693cc25d316f14a9ebad80ebf00590329550c45adb7e5205486533c2504
SHA51256aef59c198acf2fcd0d95ea6e32ce1c706e5098a0800feff13ddb427bfb4d538de1c415a5cb5496b09a5825155e3abb1c13c8c37dc31549604bd4d63cb70591
-
Filesize
758KB
MD5fb4665320c9da54598321c59cc5ed623
SHA189e87b3cc569edd26b5805244cfacb2f9c892bc7
SHA2569fb3156c665211a0081b189142c1d1ab18cda601ee54d5f5d8883ecfa4177a59
SHA512b205552a3cfbaa2202e6ef7e39e229af167b2342a7dc4a2f4cadfe4d05000966cf19e9e208e44d6bb0fd6a56f4283caeed9c13f523e5b301b87f79febb1840cf
-
Filesize
35.0MB
MD594089be88986618b7be913ee8b0d8a67
SHA1377ecca72bbdf278cb2a15531188e14eb59145e4
SHA256bbb45077f52c14bda8e240fc2e94e36efc1d45c24a40f51a4ed7f506126d4c36
SHA51284d0ec6948a1f511bfe0d25af19cb015ee1efe4351706f15587aee56f45e3a91abc4f40a0f3e8894deaf789deb04b46135deeba20c4a34dfec08d595e2b71987
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
120KB
-
Filesize
6.5MB
-
Filesize
104KB
-
Filesize
600KB
-
Filesize
136KB
-
Filesize
5.6MB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
136KB
-
Filesize
6.2MB
-
Filesize
216KB