Resubmissions
16-05-2024 19:31
240516-x8dfxscf49 6Analysis
-
max time kernel
143s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16-05-2024 19:31
Static task
static1
Behavioral task
behavioral1
Sample
63cdceb8aa7441039d3cc779706d858944fe95036acc8721467e37bda88be43b.msi
Resource
win7-20240508-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
63cdceb8aa7441039d3cc779706d858944fe95036acc8721467e37bda88be43b.msi
Resource
win10v2004-20240508-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
63cdceb8aa7441039d3cc779706d858944fe95036acc8721467e37bda88be43b.msi
-
Size
16.0MB
-
MD5
b375f77a675d12a4e48edc693cd95ab1
-
SHA1
078372ae4f4bd44d6cd34ec9b9df5e8225ccdc3e
-
SHA256
63cdceb8aa7441039d3cc779706d858944fe95036acc8721467e37bda88be43b
-
SHA512
c6edfa680ff9531ccc6124f2a8cd6426dd2a30f50cd17117d72fc86e5bee88609d1516b79b2795d20d6e1bcaba4ca6a47603a2e292e7b35227bdd9dda32e989e
-
SSDEEP
393216:5BnBRTV2rgpoiz9ZDX7Ckc6WWKhrUKSYFcZZW:rJaQ3ZDm/ZlrRSYFcz
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MultiMoney = "C:\\Users\\Admin\\AppData\\Roaming\\Manual\\PorfileMgr.exe" msiexec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe -
Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI5AC2.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5BB0.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{49556244-814F-4D31-BD4A-37AF13862B69} msiexec.exe File opened for modification C:\Windows\Installer\MSI5C9B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5EBF.tmp msiexec.exe File opened for modification C:\Windows\Installer\e575a45.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI5B50.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5B70.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\e575a45.msi msiexec.exe -
Executes dropped EXE 1 IoCs
pid Process 2924 PorfileMgr.exe -
Loads dropped DLL 6 IoCs
pid Process 3032 MsiExec.exe 3032 MsiExec.exe 3032 MsiExec.exe 3032 MsiExec.exe 2924 PorfileMgr.exe 3032 MsiExec.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2864 msiexec.exe 2864 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 50 IoCs
description pid Process Token: SeShutdownPrivilege 3788 msiexec.exe Token: SeIncreaseQuotaPrivilege 3788 msiexec.exe Token: SeSecurityPrivilege 2864 msiexec.exe Token: SeCreateTokenPrivilege 3788 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3788 msiexec.exe Token: SeLockMemoryPrivilege 3788 msiexec.exe Token: SeIncreaseQuotaPrivilege 3788 msiexec.exe Token: SeMachineAccountPrivilege 3788 msiexec.exe Token: SeTcbPrivilege 3788 msiexec.exe Token: SeSecurityPrivilege 3788 msiexec.exe Token: SeTakeOwnershipPrivilege 3788 msiexec.exe Token: SeLoadDriverPrivilege 3788 msiexec.exe Token: SeSystemProfilePrivilege 3788 msiexec.exe Token: SeSystemtimePrivilege 3788 msiexec.exe Token: SeProfSingleProcessPrivilege 3788 msiexec.exe Token: SeIncBasePriorityPrivilege 3788 msiexec.exe Token: SeCreatePagefilePrivilege 3788 msiexec.exe Token: SeCreatePermanentPrivilege 3788 msiexec.exe Token: SeBackupPrivilege 3788 msiexec.exe Token: SeRestorePrivilege 3788 msiexec.exe Token: SeShutdownPrivilege 3788 msiexec.exe Token: SeDebugPrivilege 3788 msiexec.exe Token: SeAuditPrivilege 3788 msiexec.exe Token: SeSystemEnvironmentPrivilege 3788 msiexec.exe Token: SeChangeNotifyPrivilege 3788 msiexec.exe Token: SeRemoteShutdownPrivilege 3788 msiexec.exe Token: SeUndockPrivilege 3788 msiexec.exe Token: SeSyncAgentPrivilege 3788 msiexec.exe Token: SeEnableDelegationPrivilege 3788 msiexec.exe Token: SeManageVolumePrivilege 3788 msiexec.exe Token: SeImpersonatePrivilege 3788 msiexec.exe Token: SeCreateGlobalPrivilege 3788 msiexec.exe Token: SeRestorePrivilege 2864 msiexec.exe Token: SeTakeOwnershipPrivilege 2864 msiexec.exe Token: SeRestorePrivilege 2864 msiexec.exe Token: SeTakeOwnershipPrivilege 2864 msiexec.exe Token: SeRestorePrivilege 2864 msiexec.exe Token: SeTakeOwnershipPrivilege 2864 msiexec.exe Token: SeRestorePrivilege 2864 msiexec.exe Token: SeTakeOwnershipPrivilege 2864 msiexec.exe Token: SeRestorePrivilege 2864 msiexec.exe Token: SeTakeOwnershipPrivilege 2864 msiexec.exe Token: SeRestorePrivilege 2864 msiexec.exe Token: SeTakeOwnershipPrivilege 2864 msiexec.exe Token: SeRestorePrivilege 2864 msiexec.exe Token: SeTakeOwnershipPrivilege 2864 msiexec.exe Token: SeRestorePrivilege 2864 msiexec.exe Token: SeTakeOwnershipPrivilege 2864 msiexec.exe Token: SeRestorePrivilege 2864 msiexec.exe Token: SeTakeOwnershipPrivilege 2864 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3788 msiexec.exe 3788 msiexec.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2864 wrote to memory of 3032 2864 msiexec.exe 84 PID 2864 wrote to memory of 3032 2864 msiexec.exe 84 PID 2864 wrote to memory of 3032 2864 msiexec.exe 84 PID 2864 wrote to memory of 2924 2864 msiexec.exe 85 PID 2864 wrote to memory of 2924 2864 msiexec.exe 85 PID 2864 wrote to memory of 2924 2864 msiexec.exe 85
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\63cdceb8aa7441039d3cc779706d858944fe95036acc8721467e37bda88be43b.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3788
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding BD1424D2ED5C1BC9CC10304147311D3D2⤵
- Loads dropped DLL
PID:3032
-
-
C:\Users\Admin\AppData\Roaming\Manual\PorfileMgr.exe"C:\Users\Admin\AppData\Roaming\Manual\PorfileMgr.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2924
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD56d6c1b2f485b204be81c23b592b49c53
SHA1a7f0361e2898fa7d97662a991850760772abf11a
SHA256ffff5c4b0541ee3643e9af63289cff10496a05d4c7c430979c1295f1aacb13fc
SHA512cb29f2d05858d82cca52a95b986ed9c99a9e0b584475de00fb865ad236993f3ffb970f5415ae9834d879a85adf15a1f7d89c0c14810d9daf56985d8aca8ba657
-
Filesize
9.5MB
MD54dbf5bcd655c2594174b45e998e14cd2
SHA1cd2b0f5428751503b0ca6f66b95054129ca07a3f
SHA2566a806b3e21d65bdf33c26a676d63cc6b537df67c354270a1e2c297f417c98053
SHA512a56ad243cef53a8fb7f8b8e273a34b876720c1fe2941d8aa50503fbb0097398711c68d38b0e50a9db46c0f68bd12dde83a370b4dbefd1026131b3ccee660c39a
-
Filesize
22.7MB
MD5ece2fab954e54b71f7030aa80905f95e
SHA1051150181377671ded83dff6ef53559c37a038c5
SHA256de016d525a85a8753aafe053640917fb6aa06d8a164967de832686f5de24330e
SHA512215e2db7f95761b91db904d4aaea37da5b1c5c7e072f5f8fe346829a96ade75a391493e422bfcbf3c166d2a392cdcd5af8955073103fbaaeb0615c4c908497a9
-
Filesize
379KB
MD5305a50c391a94b42a68958f3f89906fb
SHA14110d68d71f3594f5d3bdfca91a1c759ab0105d4
SHA256f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f
SHA512fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7