2ba8759f5242caae300a97a0b39c89170b985db477e48b201d1c6747f586f0bd

General

Target

2ba8759f5242caae300a97a0b39c89170b985db477e48b201d1c6747f586f0bd.msi
Size

7.5MB
MD5

2c1a16976c0ddf925ab45466dce7e03d
SHA1

5b260dd8aac2e881eed23053461223d5f0882b06
SHA256

2ba8759f5242caae300a97a0b39c89170b985db477e48b201d1c6747f586f0bd
SHA512

0f387930657043f23c97490a16d088f583b1d66440c833744ed84f1f5493d5bdd073e56e55ad11ada5c70305a7824868db78307e498520a45268514c7a4f9be7
SSDEEP

196608:SJB4ZesJ8uae1gnwpQOODlOt+lvToBwiIGMYioceaa1YqXpaU:SJWZesmX2xL+lFG5ser1la

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

dDt.P.exe

pid process

2352 dDt.P.exe

pid	process
2352	dDt.P.exe

Drops file in Windows directory 11 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Windows\Installer\f761ef6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f761ef6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1F34.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2263.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2330.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1FE1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2030.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI20AD.tmp	msiexec.exe
File created	C:\Windows\Installer\f761ef9.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\f761ef9.ipi	msiexec.exe

Executes dropped EXE 2 IoCs

Processes:

MSI2330.tmpdDt.P.exe

pid process

2948 MSI2330.tmp
2352 dDt.P.exe
Loads dropped DLL 5 IoCs

Processes:

MsiExec.exedDt.P.exe

pid process

2064 MsiExec.exe
2064 MsiExec.exe
2064 MsiExec.exe
2064 MsiExec.exe
2352 dDt.P.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

dDt.P.exe

pid process

2352 dDt.P.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

msiexec.exedDt.P.exe

pid process

1744 msiexec.exe
1744 msiexec.exe
2352 dDt.P.exe

pid	process
2948	MSI2330.tmp
2352	dDt.P.exe

pid	process
2064	MsiExec.exe
2064	MsiExec.exe
2064	MsiExec.exe
2064	MsiExec.exe
2352	dDt.P.exe

pid	process
2352	dDt.P.exe

pid	process
1744	msiexec.exe
1744	msiexec.exe
2352	dDt.P.exe

Suspicious use of AdjustPrivilegeToken 54 IoCs

Processes:

msiexec.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	2004	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2004	msiexec.exe
Token: SeRestorePrivilege	1744	msiexec.exe
Token: SeTakeOwnershipPrivilege	1744	msiexec.exe
Token: SeSecurityPrivilege	1744	msiexec.exe
Token: SeCreateTokenPrivilege	2004	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2004	msiexec.exe
Token: SeLockMemoryPrivilege	2004	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2004	msiexec.exe
Token: SeMachineAccountPrivilege	2004	msiexec.exe
Token: SeTcbPrivilege	2004	msiexec.exe
Token: SeSecurityPrivilege	2004	msiexec.exe
Token: SeTakeOwnershipPrivilege	2004	msiexec.exe
Token: SeLoadDriverPrivilege	2004	msiexec.exe
Token: SeSystemProfilePrivilege	2004	msiexec.exe
Token: SeSystemtimePrivilege	2004	msiexec.exe
Token: SeProfSingleProcessPrivilege	2004	msiexec.exe
Token: SeIncBasePriorityPrivilege	2004	msiexec.exe
Token: SeCreatePagefilePrivilege	2004	msiexec.exe
Token: SeCreatePermanentPrivilege	2004	msiexec.exe
Token: SeBackupPrivilege	2004	msiexec.exe
Token: SeRestorePrivilege	2004	msiexec.exe
Token: SeShutdownPrivilege	2004	msiexec.exe
Token: SeDebugPrivilege	2004	msiexec.exe
Token: SeAuditPrivilege	2004	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2004	msiexec.exe
Token: SeChangeNotifyPrivilege	2004	msiexec.exe
Token: SeRemoteShutdownPrivilege	2004	msiexec.exe
Token: SeUndockPrivilege	2004	msiexec.exe
Token: SeSyncAgentPrivilege	2004	msiexec.exe
Token: SeEnableDelegationPrivilege	2004	msiexec.exe
Token: SeManageVolumePrivilege	2004	msiexec.exe
Token: SeImpersonatePrivilege	2004	msiexec.exe
Token: SeCreateGlobalPrivilege	2004	msiexec.exe
Token: SeRestorePrivilege	1744	msiexec.exe
Token: SeTakeOwnershipPrivilege	1744	msiexec.exe
Token: SeRestorePrivilege	1744	msiexec.exe
Token: SeTakeOwnershipPrivilege	1744	msiexec.exe
Token: SeRestorePrivilege	1744	msiexec.exe
Token: SeTakeOwnershipPrivilege	1744	msiexec.exe
Token: SeRestorePrivilege	1744	msiexec.exe
Token: SeTakeOwnershipPrivilege	1744	msiexec.exe
Token: SeRestorePrivilege	1744	msiexec.exe
Token: SeTakeOwnershipPrivilege	1744	msiexec.exe
Token: SeRestorePrivilege	1744	msiexec.exe
Token: SeTakeOwnershipPrivilege	1744	msiexec.exe
Token: SeRestorePrivilege	1744	msiexec.exe
Token: SeTakeOwnershipPrivilege	1744	msiexec.exe
Token: SeRestorePrivilege	1744	msiexec.exe
Token: SeTakeOwnershipPrivilege	1744	msiexec.exe
Token: SeRestorePrivilege	1744	msiexec.exe
Token: SeTakeOwnershipPrivilege	1744	msiexec.exe
Token: SeRestorePrivilege	1744	msiexec.exe
Token: SeTakeOwnershipPrivilege	1744	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

msiexec.exedDt.P.exe

pid process

2004 msiexec.exe
2004 msiexec.exe
2352 dDt.P.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

dDt.P.exe

pid process

2352 dDt.P.exe

pid	process
2004	msiexec.exe
2004	msiexec.exe
2352	dDt.P.exe

pid	process
2352	dDt.P.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

msiexec.execmd.execmd.exe

description	pid	process	target process
PID 1744 wrote to memory of 2064	1744	msiexec.exe	MsiExec.exe
PID 1744 wrote to memory of 2064	1744	msiexec.exe	MsiExec.exe
PID 1744 wrote to memory of 2064	1744	msiexec.exe	MsiExec.exe
PID 1744 wrote to memory of 2064	1744	msiexec.exe	MsiExec.exe
PID 1744 wrote to memory of 2064	1744	msiexec.exe	MsiExec.exe
PID 1744 wrote to memory of 2064	1744	msiexec.exe	MsiExec.exe
PID 1744 wrote to memory of 2064	1744	msiexec.exe	MsiExec.exe
PID 1744 wrote to memory of 2948	1744	msiexec.exe	MSI2330.tmp
PID 1744 wrote to memory of 2948	1744	msiexec.exe	MSI2330.tmp
PID 1744 wrote to memory of 2948	1744	msiexec.exe	MSI2330.tmp
PID 1744 wrote to memory of 2948	1744	msiexec.exe	MSI2330.tmp
PID 1744 wrote to memory of 2948	1744	msiexec.exe	MSI2330.tmp
PID 1744 wrote to memory of 2948	1744	msiexec.exe	MSI2330.tmp
PID 1744 wrote to memory of 2948	1744	msiexec.exe	MSI2330.tmp
PID 320 wrote to memory of 1680	320	cmd.exe	cmd.exe
PID 320 wrote to memory of 1680	320	cmd.exe	cmd.exe
PID 320 wrote to memory of 1680	320	cmd.exe	cmd.exe
PID 1680 wrote to memory of 2352	1680	cmd.exe	dDt.P.exe
PID 1680 wrote to memory of 2352	1680	cmd.exe	dDt.P.exe
PID 1680 wrote to memory of 2352	1680	cmd.exe	dDt.P.exe
PID 1680 wrote to memory of 2352	1680	cmd.exe	dDt.P.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\2ba8759f5242caae300a97a0b39c89170b985db477e48b201d1c6747f586f0bd.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2004

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1744

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding F8D0B227B7A40329A7913CA03389AA29
2⤵
- Loads dropped DLL
PID:2064

C:\Windows\Installer\MSI2330.tmp
"C:\Windows\Installer\MSI2330.tmp" /DontWait /HideWindow "C:\Users\Admin\Pictures\MercadoEnvios\SuporteColeta\1.bat"
2⤵
- Executes dropped EXE
PID:2948

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\Pictures\MercadoEnvios\SuporteColeta\1.bat" "
1⤵
- Suspicious use of WriteProcessMemory
PID:320

C:\Windows\system32\cmd.exe
cmd /c dDt.P.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:1680

C:\Users\Admin\Pictures\MercadoEnvios\SuporteColeta\dDt.P.exe
dDt.P.exe
3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f761efa.rbs

Filesize
5KB

MD5
f9e09a671cbc81d15e118570612e0408

SHA1
eb5300d757dde4618c180a7046173978fec230f4

SHA256
f1ef207292bfe1019e243131d3da3a96f89ca293b578ef4e9071955b8c522cd2

SHA512
f8c6e1b1bf3308899b74b4c269040038999fb78ba642e621a958b7aa8be2f4ed2228f5b105420ec85892b0ecd6396309e3f4384c7fcfff143a681f4263c93d3f

Download Submit
C:\Users\Admin\Pictures\MercadoEnvios\SuporteColeta\1.bat

Filesize
62B

MD5
a9feb7994d611a691e1fe7c64f1ddf70

SHA1
226983163ce847ba4002cbc55913f0302510e289

SHA256
23562dec086981d6eef1e7b40acf0fa62b153698f6e0b409de027997a2acd741

SHA512
d05b52452e0968b696802a17e46fe6194c36e3045261729f0d4017700afb3db5a3d65bcd5a60aecd09db8ed8ed56e300204b9ac9bf09fe9593972e878c31cf7c

Download Submit
C:\Users\Admin\Pictures\MercadoEnvios\SuporteColeta\bordbk260.SfF

Filesize
3.5MB

MD5
7ca3e7c7feb597a6058be09008484829

SHA1
b4b129f50dddb6800cfe2a90d1ae590d02298fd5

SHA256
1f125ecf9c8b611e6857446895aaf6141b21d6c3147856b2526f9bbe590e222d

SHA512
09ee2e51efd7c159179ce83fff35ed4536a2ed0a46f274e65c220a5dfe6fb57724356f179e6e67c133ef4c8cef8309ef2a76b29282d8a0d649f2c15f0d649ddf

Download Submit
C:\Users\Admin\Pictures\MercadoEnvios\SuporteColeta\dDt.P.ahk

Filesize
94B

MD5
06776cc1a37e98869a74e6f8759a143e

SHA1
ef7dc871b60c5699ffffbb0213e7f69b98e20d29

SHA256
30585de2dbe9b643e8562c6578a46da05b0a2b4a5d5b6291578e8610687068b3

SHA512
09751f4831a3a3eeb6a9993018b94e38676aeb6dda76e0fced9af8039a2a5b6e271ff6cad59e7bbba28f0135dcef1cf7c3125dab8993e85cfff75f834441f688

Download Submit
C:\Users\Admin\Pictures\MercadoEnvios\SuporteColeta\dDt.P.exe

Filesize
956KB

MD5
e2bc50c3ae1ef4c82e72e5adb3bc8da2

SHA1
b21a7250fba3f033f9f412a8272ee4d7e313862d

SHA256
5909ab34354db1da3a6bd53febd59270e1866221c835c7abaae4885f39421278

SHA512
e730a3ad558e3888c46dc45a34d15727ee9b2cfde4dfbad04a2c281aec01dfec07c68daa0fe314260c2a4fba546b82f43c39c06d74baff5e41d20fcf47de6861

Download Submit
C:\Windows\Installer\MSI1F34.tmp

Filesize
555KB

MD5
53ebdf6bc20011120b06e94de66adc51

SHA1
0c47a3be0ee2dce2e1ffd8c1b40d2ca52d0014f3

SHA256
997b258b3f6dd1448fd4d135a56c138813f45f728e57be0eb1908df5b68f031b

SHA512
16f2b1ec3e6628f49640afedcad302b0af1fe42b8a7a45b99a16fcec5ed68014ee5aa43672ecc92d7fbd83af18bdc3d1ae3efd0a7b7314ba6a4a156aaa5d37cd

Download Submit
C:\Windows\Installer\MSI2030.tmp

Filesize
945KB

MD5
76c976999d9e47327db9ba24c7ea5269

SHA1
1568fd9a66ccc910f479f2120e774d5723872d3a

SHA256
64acd55e74a3f81a636390e6cfa59930af104f3078c3ce6590a9017e821d6503

SHA512
b6a2f2919a04c5b001c68e46f96057f580213c0981d5c45b28562694c6ae81f7624aad9532eda9a29c9503577c6cc392e4dfb969b8fa7d06b5e776f98601644f

Download Submit
C:\Windows\Installer\MSI2330.tmp

Filesize
409KB

MD5
a7286d5354ef27044c98aad51fc4468e

SHA1
c553b71a417baa43758b241673496ee52579ad81

SHA256
747479cf05918baf2fc3e9228778a1fc2aa7e6660c40bd6105519c52b4f28c67

SHA512
7e0d200b9ba5d983234f8da372e9f683bf5f7bd029a0dea3acb725128be631fc2cf34e941b5eed0654d5101ea7dddf7e094248e4bd5f84351b850c5aec4b244f

Download Submit
memory/2352-949-0x0000000003BB0000-0x0000000003CC1000-memory.dmp

Filesize
1.1MB

Download
memory/2352-939-0x0000000003BB0000-0x0000000003CC1000-memory.dmp

Filesize
1.1MB

Download
memory/2352-100-0x0000000075270000-0x00000000752B7000-memory.dmp

Filesize
284KB

Download
memory/2352-921-0x0000000003BB0000-0x0000000003CC1000-memory.dmp

Filesize
1.1MB

Download
memory/2352-969-0x0000000003BB0000-0x0000000003CC1000-memory.dmp

Filesize
1.1MB

Download
memory/2352-967-0x0000000003BB0000-0x0000000003CC1000-memory.dmp

Filesize
1.1MB

Download
memory/2352-965-0x0000000003BB0000-0x0000000003CC1000-memory.dmp

Filesize
1.1MB

Download
memory/2352-961-0x0000000003BB0000-0x0000000003CC1000-memory.dmp

Filesize
1.1MB

Download
memory/2352-959-0x0000000003BB0000-0x0000000003CC1000-memory.dmp

Filesize
1.1MB

Download
memory/2352-957-0x0000000003BB0000-0x0000000003CC1000-memory.dmp

Filesize
1.1MB

Download
memory/2352-955-0x0000000003BB0000-0x0000000003CC1000-memory.dmp

Filesize
1.1MB

Download
memory/2352-951-0x0000000003BB0000-0x0000000003CC1000-memory.dmp

Filesize
1.1MB

Download
memory/2352-910-0x0000000003BB0000-0x0000000003CC1000-memory.dmp

Filesize
1.1MB

Download
memory/2352-947-0x0000000003BB0000-0x0000000003CC1000-memory.dmp

Filesize
1.1MB

Download
memory/2352-945-0x0000000003BB0000-0x0000000003CC1000-memory.dmp

Filesize
1.1MB

Download
memory/2352-943-0x0000000003BB0000-0x0000000003CC1000-memory.dmp

Filesize
1.1MB

Download
memory/2352-941-0x0000000003BB0000-0x0000000003CC1000-memory.dmp

Filesize
1.1MB

Download
memory/2352-99-0x0000000002F90000-0x0000000003609000-memory.dmp

Filesize
6.5MB

Download
memory/2352-937-0x0000000003BB0000-0x0000000003CC1000-memory.dmp

Filesize
1.1MB

Download
memory/2352-935-0x0000000003BB0000-0x0000000003CC1000-memory.dmp

Filesize
1.1MB

Download
memory/2352-933-0x0000000003BB0000-0x0000000003CC1000-memory.dmp

Filesize
1.1MB

Download
memory/2352-931-0x0000000003BB0000-0x0000000003CC1000-memory.dmp

Filesize
1.1MB

Download
memory/2352-929-0x0000000003BB0000-0x0000000003CC1000-memory.dmp

Filesize
1.1MB

Download
memory/2352-927-0x0000000003BB0000-0x0000000003CC1000-memory.dmp

Filesize
1.1MB

Download
memory/2352-925-0x0000000003BB0000-0x0000000003CC1000-memory.dmp

Filesize
1.1MB

Download
memory/2352-923-0x0000000003BB0000-0x0000000003CC1000-memory.dmp

Filesize
1.1MB

Download
memory/2352-919-0x0000000003BB0000-0x0000000003CC1000-memory.dmp

Filesize
1.1MB

Download
memory/2352-917-0x0000000003BB0000-0x0000000003CC1000-memory.dmp

Filesize
1.1MB

Download
memory/2352-915-0x0000000003BB0000-0x0000000003CC1000-memory.dmp

Filesize
1.1MB

Download
memory/2352-971-0x0000000003BB0000-0x0000000003CC1000-memory.dmp

Filesize
1.1MB

Download
memory/2352-963-0x0000000003BB0000-0x0000000003CC1000-memory.dmp

Filesize
1.1MB

Download
memory/2352-913-0x0000000003BB0000-0x0000000003CC1000-memory.dmp

Filesize
1.1MB

Download
memory/2352-953-0x0000000003BB0000-0x0000000003CC1000-memory.dmp

Filesize
1.1MB

Download
memory/2352-911-0x0000000003BB0000-0x0000000003CC1000-memory.dmp

Filesize
1.1MB

Download
memory/2948-92-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads