Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15/05/2024, 16:02
Static task
static1
Behavioral task
behavioral1
Sample
3d36a85048e6c35edac1fcc9e9a00bc140f18bac364b61cbe43d04ae7d2c1d70.msi
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
3d36a85048e6c35edac1fcc9e9a00bc140f18bac364b61cbe43d04ae7d2c1d70.msi
Resource
win10v2004-20240508-en
windows10-2004-x64
19 signatures
150 seconds
General
-
Target
3d36a85048e6c35edac1fcc9e9a00bc140f18bac364b61cbe43d04ae7d2c1d70.msi
-
Size
4.9MB
-
MD5
76cb7942862b8e5ac5c86c7cbab709bd
-
SHA1
0c0631dc78a8add250dd225f67a918f3f9c71524
-
SHA256
3d36a85048e6c35edac1fcc9e9a00bc140f18bac364b61cbe43d04ae7d2c1d70
-
SHA512
b9ca576c949f79f123b6cf0d9d3469f47c88ee6f53c9f6e97643fc529ee5a360c95172457b4b2eddb0836baf68d88ffd9a958f8a3cbcca270bcfeb519dc22752
-
SSDEEP
98304:wyclEycl/Y5AbXwNSOgbPJ84mkWQBlVbZ0L8xKpIx0Ttq6zVommY:wyIEyINXwNUJdV9jxK1tqOeQ
Score
6/10
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 3 2544 MsiExec.exe 4 2544 MsiExec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Installer\f7632d3.msi msiexec.exe File opened for modification C:\Windows\Installer\f7632d3.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI421F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI429D.tmp msiexec.exe -
Loads dropped DLL 2 IoCs
pid Process 2544 MsiExec.exe 2544 MsiExec.exe -
Suspicious use of AdjustPrivilegeToken 40 IoCs
description pid Process Token: SeShutdownPrivilege 2008 msiexec.exe Token: SeIncreaseQuotaPrivilege 2008 msiexec.exe Token: SeRestorePrivilege 2812 msiexec.exe Token: SeTakeOwnershipPrivilege 2812 msiexec.exe Token: SeSecurityPrivilege 2812 msiexec.exe Token: SeCreateTokenPrivilege 2008 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2008 msiexec.exe Token: SeLockMemoryPrivilege 2008 msiexec.exe Token: SeIncreaseQuotaPrivilege 2008 msiexec.exe Token: SeMachineAccountPrivilege 2008 msiexec.exe Token: SeTcbPrivilege 2008 msiexec.exe Token: SeSecurityPrivilege 2008 msiexec.exe Token: SeTakeOwnershipPrivilege 2008 msiexec.exe Token: SeLoadDriverPrivilege 2008 msiexec.exe Token: SeSystemProfilePrivilege 2008 msiexec.exe Token: SeSystemtimePrivilege 2008 msiexec.exe Token: SeProfSingleProcessPrivilege 2008 msiexec.exe Token: SeIncBasePriorityPrivilege 2008 msiexec.exe Token: SeCreatePagefilePrivilege 2008 msiexec.exe Token: SeCreatePermanentPrivilege 2008 msiexec.exe Token: SeBackupPrivilege 2008 msiexec.exe Token: SeRestorePrivilege 2008 msiexec.exe Token: SeShutdownPrivilege 2008 msiexec.exe Token: SeDebugPrivilege 2008 msiexec.exe Token: SeAuditPrivilege 2008 msiexec.exe Token: SeSystemEnvironmentPrivilege 2008 msiexec.exe Token: SeChangeNotifyPrivilege 2008 msiexec.exe Token: SeRemoteShutdownPrivilege 2008 msiexec.exe Token: SeUndockPrivilege 2008 msiexec.exe Token: SeSyncAgentPrivilege 2008 msiexec.exe Token: SeEnableDelegationPrivilege 2008 msiexec.exe Token: SeManageVolumePrivilege 2008 msiexec.exe Token: SeImpersonatePrivilege 2008 msiexec.exe Token: SeCreateGlobalPrivilege 2008 msiexec.exe Token: SeRestorePrivilege 2812 msiexec.exe Token: SeTakeOwnershipPrivilege 2812 msiexec.exe Token: SeRestorePrivilege 2812 msiexec.exe Token: SeTakeOwnershipPrivilege 2812 msiexec.exe Token: SeRestorePrivilege 2812 msiexec.exe Token: SeTakeOwnershipPrivilege 2812 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2008 msiexec.exe 2008 msiexec.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2812 wrote to memory of 2544 2812 msiexec.exe 29 PID 2812 wrote to memory of 2544 2812 msiexec.exe 29 PID 2812 wrote to memory of 2544 2812 msiexec.exe 29 PID 2812 wrote to memory of 2544 2812 msiexec.exe 29 PID 2812 wrote to memory of 2544 2812 msiexec.exe 29 PID 2812 wrote to memory of 2544 2812 msiexec.exe 29 PID 2812 wrote to memory of 2544 2812 msiexec.exe 29 PID 2544 wrote to memory of 2604 2544 MsiExec.exe 31 PID 2544 wrote to memory of 2604 2544 MsiExec.exe 31 PID 2544 wrote to memory of 2604 2544 MsiExec.exe 31 PID 2544 wrote to memory of 2604 2544 MsiExec.exe 31 PID 2544 wrote to memory of 2528 2544 MsiExec.exe 33 PID 2544 wrote to memory of 2528 2544 MsiExec.exe 33 PID 2544 wrote to memory of 2528 2544 MsiExec.exe 33 PID 2544 wrote to memory of 2528 2544 MsiExec.exe 33
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\3d36a85048e6c35edac1fcc9e9a00bc140f18bac364b61cbe43d04ae7d2c1d70.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2008
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F3520FDBDC175C27F485D734FCA896A72⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Users\Admin\hAAdmin14\3⤵PID:2604
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Users\Admin\hAAdmin14\hAAdmin143⤵PID:2528
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
738KB
MD58e65fea37f700d948d1b67afd43b97fc
SHA1823d2b30ec0372e0dc36f7983ad2de1ceda4036c
SHA25620c648a2a4313b1b20da50a9b788d8a1b9637e154adae4541b65badaa40266c9
SHA51207faf03685fde9c71f6bc4b3caecfe4d3c707a8bec5bce1a544f59c1f853edde8f37c019c16bffd3e8fbe5c72c0666ffe0e2dffd878744da64f47e52c7625084