0f962b19b3405722d618ca44beea3240f8c809723b9f7735828db59d061fcd42

General

Target

0f962b19b3405722d618ca44beea3240f8c809723b9f7735828db59d061fcd42.msi
Size

18.7MB
MD5

4cbfb798bb6076378fc96c9c4b1a80fc
SHA1

5fadac688f773244af547411b22d44d757c4c829
SHA256

0f962b19b3405722d618ca44beea3240f8c809723b9f7735828db59d061fcd42
SHA512

55a254aa2b30604bf66d7f2feeecd395c8624b4b9892898f7e9689e85ec4772c386989d91b72cb681ab614e59f2174ae705fd39ae892cb10f431d9f67aa3b15f
SSDEEP

393216:ZavYmPEVSlMJHe3qS4Lt0aXQ5VFVxdPqsvV34kX:gNcLe3qFZ0mQdd9VIkX

Score

9^/10

upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 6 IoCs

Processes:

resource	yara_rule
\??\c:\programdata\libeay32.dll	UPX
behavioral2/memory/4964-44-0x0000000010000000-0x0000000010149000-memory.dmp	UPX
\??\c:\programdata\ssleay32.dll	UPX
behavioral2/memory/4964-48-0x0000000006EB0000-0x0000000006EFC000-memory.dmp	UPX
behavioral2/memory/4964-57-0x0000000006EB0000-0x0000000006EFC000-memory.dmp	UPX
behavioral2/memory/4964-56-0x0000000010000000-0x0000000010149000-memory.dmp	UPX

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
\??\c:\programdata\libeay32.dll	acprotect
\??\c:\programdata\ssleay32.dll	acprotect

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\??\c:\programdata\libeay32.dll	upx
behavioral2/memory/4964-44-0x0000000010000000-0x0000000010149000-memory.dmp	upx
\??\c:\programdata\ssleay32.dll	upx
behavioral2/memory/4964-48-0x0000000006EB0000-0x0000000006EFC000-memory.dmp	upx
behavioral2/memory/4964-57-0x0000000006EB0000-0x0000000006EFC000-memory.dmp	upx
behavioral2/memory/4964-56-0x0000000010000000-0x0000000010149000-memory.dmp	upx

Blocklisted process makes network request 4 IoCs

Processes:

MsiExec.exe

flow pid process

21 4964 MsiExec.exe
24 4964 MsiExec.exe
26 4964 MsiExec.exe
30 4964 MsiExec.exe

flow	pid	process
21	4964	MsiExec.exe
24	4964	MsiExec.exe
26	4964	MsiExec.exe
30	4964	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

20 ipinfo.io
21 ipinfo.io
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

MsiExec.exe

pid process

4964 MsiExec.exe
4964 MsiExec.exe

flow	ioc
20	ipinfo.io
21	ipinfo.io

Drops file in Windows directory 13 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSI7408.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B5ADF640-A79B-4E9B-9542-67405133EF82}	msiexec.exe
File created	C:\Windows\Installer\e577203.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7280.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7543.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7600.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e577203.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI77B6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7496.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI74D5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Loads dropped DLL 10 IoCs

Processes:

MsiExec.exe

pid	process
4964	MsiExec.exe
4964	MsiExec.exe
4964	MsiExec.exe
4964	MsiExec.exe
4964	MsiExec.exe
4964	MsiExec.exe
4964	MsiExec.exe
4964	MsiExec.exe
4964	MsiExec.exe
4964	MsiExec.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msiexec.exeMsiExec.exe

pid process

3152 msiexec.exe
3152 msiexec.exe
4964 MsiExec.exe
4964 MsiExec.exe
4964 MsiExec.exe
4964 MsiExec.exe
4964 MsiExec.exe
4964 MsiExec.exe

pid	process
3152	msiexec.exe
3152	msiexec.exe
4964	MsiExec.exe
4964	MsiExec.exe
4964	MsiExec.exe
4964	MsiExec.exe
4964	MsiExec.exe
4964	MsiExec.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

Processes:

msiexec.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	3872	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3872	msiexec.exe
Token: SeSecurityPrivilege	3152	msiexec.exe
Token: SeCreateTokenPrivilege	3872	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3872	msiexec.exe
Token: SeLockMemoryPrivilege	3872	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3872	msiexec.exe
Token: SeMachineAccountPrivilege	3872	msiexec.exe
Token: SeTcbPrivilege	3872	msiexec.exe
Token: SeSecurityPrivilege	3872	msiexec.exe
Token: SeTakeOwnershipPrivilege	3872	msiexec.exe
Token: SeLoadDriverPrivilege	3872	msiexec.exe
Token: SeSystemProfilePrivilege	3872	msiexec.exe
Token: SeSystemtimePrivilege	3872	msiexec.exe
Token: SeProfSingleProcessPrivilege	3872	msiexec.exe
Token: SeIncBasePriorityPrivilege	3872	msiexec.exe
Token: SeCreatePagefilePrivilege	3872	msiexec.exe
Token: SeCreatePermanentPrivilege	3872	msiexec.exe
Token: SeBackupPrivilege	3872	msiexec.exe
Token: SeRestorePrivilege	3872	msiexec.exe
Token: SeShutdownPrivilege	3872	msiexec.exe
Token: SeDebugPrivilege	3872	msiexec.exe
Token: SeAuditPrivilege	3872	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3872	msiexec.exe
Token: SeChangeNotifyPrivilege	3872	msiexec.exe
Token: SeRemoteShutdownPrivilege	3872	msiexec.exe
Token: SeUndockPrivilege	3872	msiexec.exe
Token: SeSyncAgentPrivilege	3872	msiexec.exe
Token: SeEnableDelegationPrivilege	3872	msiexec.exe
Token: SeManageVolumePrivilege	3872	msiexec.exe
Token: SeImpersonatePrivilege	3872	msiexec.exe
Token: SeCreateGlobalPrivilege	3872	msiexec.exe
Token: SeRestorePrivilege	3152	msiexec.exe
Token: SeTakeOwnershipPrivilege	3152	msiexec.exe
Token: SeRestorePrivilege	3152	msiexec.exe
Token: SeTakeOwnershipPrivilege	3152	msiexec.exe
Token: SeRestorePrivilege	3152	msiexec.exe
Token: SeTakeOwnershipPrivilege	3152	msiexec.exe
Token: SeRestorePrivilege	3152	msiexec.exe
Token: SeTakeOwnershipPrivilege	3152	msiexec.exe
Token: SeRestorePrivilege	3152	msiexec.exe
Token: SeTakeOwnershipPrivilege	3152	msiexec.exe
Token: SeRestorePrivilege	3152	msiexec.exe
Token: SeTakeOwnershipPrivilege	3152	msiexec.exe
Token: SeRestorePrivilege	3152	msiexec.exe
Token: SeTakeOwnershipPrivilege	3152	msiexec.exe
Token: SeRestorePrivilege	3152	msiexec.exe
Token: SeTakeOwnershipPrivilege	3152	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

msiexec.exe

pid process

3872 msiexec.exe

pid	process
3872	msiexec.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

msiexec.exe

description	pid	process	target process
PID 3152 wrote to memory of 4964	3152	msiexec.exe	MsiExec.exe
PID 3152 wrote to memory of 4964	3152	msiexec.exe	MsiExec.exe
PID 3152 wrote to memory of 4964	3152	msiexec.exe	MsiExec.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\0f962b19b3405722d618ca44beea3240f8c809723b9f7735828db59d061fcd42.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3872

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3152

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 6E4BA6C74EDEAE06663F7C56080C357D
2⤵
- Blocklisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Installer\MSI7280.tmp

Filesize
738KB

MD5
36cd2870d577ff917ba93c9f50f86374

SHA1
e51baf257f5a3c3cd7b68690e36945fa3284e710

SHA256
8d3e94c47af3da706a9fe9e4428b2fefd5e9e6c7145e96927fffdf3dd5e472b8

SHA512
426fe493a25e99ca9630ad4706ca5ac062445391ab2087793637339f3742a5e1af2cedb4682babc0c4e7f9e06fed0b4ed543ddeb6f4e6f75c50349c0354aceda

Download Submit
C:\Windows\Installer\MSI77B6.tmp

Filesize
16.5MB

MD5
2e2a5db0e8e5a8a65f89d11330de872e

SHA1
116dd648183dca8e9f6d1e345962924aaab7fccd

SHA256
6bcd4341830d410f5e274fedfc44f6b1b1df574337492ced997af85e1433e617

SHA512
6cda7a7ba89aeb75824e99112178f17b3cfe63966abd9bf8a5b363f05ade184711f0cfbf7aacc50f6926808bc1b2d6b081b13f6ef553320e6dfea7df3e7622e8

Download Submit
\??\c:\programdata\libeay32.dll

Filesize
482KB

MD5
c2703965b8ba0ecf8c5d8a043976facc

SHA1
c578c694d4fe5c15acc3b7aa60e9874d0ded3d54

SHA256
e28e34fbdaff077669586dcdb4e10f0ba2ca6c9973ed4d372a5c3ec3b8ad20e7

SHA512
cb729665206594928a90b29e5c7592120345e92a605122ec6aea564250c4d5d48e1d39c8803820eccde7920aa4d9af99fb3748671de076476d833710b9491d61

Download Submit
\??\c:\programdata\ssleay32.dll

Filesize
106KB

MD5
931c97553b3319f21b9ef249aa3cd244

SHA1
42c6611da2154bb6e0911993cf97071908b48bf2

SHA256
7e643c188a1ee3b0251b7dfcab000b7c48fd840eff35189e8a45901852e3910a

SHA512
790141b758aa68c6384aaf6f85b09f9bc641a300a4e7fa05a74c3f89af090fbbfdcfe3dce24842a8d0c75b874839d505692c1951ed66f57e9840c559820514d3

Download Submit
memory/4964-38-0x0000000002D10000-0x0000000002D11000-memory.dmp

Filesize
4KB

Download
memory/4964-39-0x0000000002E60000-0x0000000004F4C000-memory.dmp

Filesize
32.9MB

Download
memory/4964-44-0x0000000010000000-0x0000000010149000-memory.dmp

Filesize
1.3MB

Download
memory/4964-48-0x0000000006EB0000-0x0000000006EFC000-memory.dmp

Filesize
304KB

Download
memory/4964-57-0x0000000006EB0000-0x0000000006EFC000-memory.dmp

Filesize
304KB

Download
memory/4964-56-0x0000000010000000-0x0000000010149000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads