Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
06/06/2024, 12:50
Static task
static1
Behavioral task
behavioral1
Sample
SZSJFC-LYGGCEAETGRK2024OGXZ.msi
Resource
win10v2004-20240426-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
SZSJFC-LYGGCEAETGRK2024OGXZ.msi
Resource
win11-20240419-en
windows11-21h2-x64
8 signatures
150 seconds
General
-
Target
SZSJFC-LYGGCEAETGRK2024OGXZ.msi
-
Size
21.6MB
-
MD5
86d7e56b57cb3a329273c61c0a3f4b1f
-
SHA1
125c0ef312b657fba1562eb5d15168d3f9297f7e
-
SHA256
fd24e279901c43d2f105e65f7834d5e8c31b5811a600dc621322201b81d2e06e
-
SHA512
860231937aba8b59d8f8e120fdc376c834667331a74aa788da268d486bc4de6b82095a21f8803b05d005f3bb537d9496e6925a27dcef366efe5050883700a9fc
-
SSDEEP
196608:y9MZTzhJa7S+XeAxsopO5epA38FhlIrHttuAkEQob:y6ZTVtAykO5yA3GhlIrNcEjb
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe -
Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e573846.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI38B3.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{5Z3LO8WF-J8CA-UKS1-2XH6-QUBCXGIHWNQW} msiexec.exe File opened for modification C:\Windows\Installer\MSI3AFA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3B39.tmp msiexec.exe File created C:\Windows\Installer\e573846.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI39AE.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI39DE.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI39FF.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe -
Loads dropped DLL 5 IoCs
pid Process 3052 MsiExec.exe 3052 MsiExec.exe 3052 MsiExec.exe 3052 MsiExec.exe 3052 MsiExec.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3492 msiexec.exe 3492 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 50 IoCs
description pid Process Token: SeShutdownPrivilege 2268 msiexec.exe Token: SeIncreaseQuotaPrivilege 2268 msiexec.exe Token: SeSecurityPrivilege 3492 msiexec.exe Token: SeCreateTokenPrivilege 2268 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2268 msiexec.exe Token: SeLockMemoryPrivilege 2268 msiexec.exe Token: SeIncreaseQuotaPrivilege 2268 msiexec.exe Token: SeMachineAccountPrivilege 2268 msiexec.exe Token: SeTcbPrivilege 2268 msiexec.exe Token: SeSecurityPrivilege 2268 msiexec.exe Token: SeTakeOwnershipPrivilege 2268 msiexec.exe Token: SeLoadDriverPrivilege 2268 msiexec.exe Token: SeSystemProfilePrivilege 2268 msiexec.exe Token: SeSystemtimePrivilege 2268 msiexec.exe Token: SeProfSingleProcessPrivilege 2268 msiexec.exe Token: SeIncBasePriorityPrivilege 2268 msiexec.exe Token: SeCreatePagefilePrivilege 2268 msiexec.exe Token: SeCreatePermanentPrivilege 2268 msiexec.exe Token: SeBackupPrivilege 2268 msiexec.exe Token: SeRestorePrivilege 2268 msiexec.exe Token: SeShutdownPrivilege 2268 msiexec.exe Token: SeDebugPrivilege 2268 msiexec.exe Token: SeAuditPrivilege 2268 msiexec.exe Token: SeSystemEnvironmentPrivilege 2268 msiexec.exe Token: SeChangeNotifyPrivilege 2268 msiexec.exe Token: SeRemoteShutdownPrivilege 2268 msiexec.exe Token: SeUndockPrivilege 2268 msiexec.exe Token: SeSyncAgentPrivilege 2268 msiexec.exe Token: SeEnableDelegationPrivilege 2268 msiexec.exe Token: SeManageVolumePrivilege 2268 msiexec.exe Token: SeImpersonatePrivilege 2268 msiexec.exe Token: SeCreateGlobalPrivilege 2268 msiexec.exe Token: SeRestorePrivilege 3492 msiexec.exe Token: SeTakeOwnershipPrivilege 3492 msiexec.exe Token: SeRestorePrivilege 3492 msiexec.exe Token: SeTakeOwnershipPrivilege 3492 msiexec.exe Token: SeRestorePrivilege 3492 msiexec.exe Token: SeTakeOwnershipPrivilege 3492 msiexec.exe Token: SeRestorePrivilege 3492 msiexec.exe Token: SeTakeOwnershipPrivilege 3492 msiexec.exe Token: SeRestorePrivilege 3492 msiexec.exe Token: SeTakeOwnershipPrivilege 3492 msiexec.exe Token: SeRestorePrivilege 3492 msiexec.exe Token: SeTakeOwnershipPrivilege 3492 msiexec.exe Token: SeRestorePrivilege 3492 msiexec.exe Token: SeTakeOwnershipPrivilege 3492 msiexec.exe Token: SeRestorePrivilege 3492 msiexec.exe Token: SeTakeOwnershipPrivilege 3492 msiexec.exe Token: SeRestorePrivilege 3492 msiexec.exe Token: SeTakeOwnershipPrivilege 3492 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2268 msiexec.exe 2268 msiexec.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3052 MsiExec.exe 3052 MsiExec.exe 3052 MsiExec.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3492 wrote to memory of 3052 3492 msiexec.exe 83 PID 3492 wrote to memory of 3052 3492 msiexec.exe 83 PID 3492 wrote to memory of 3052 3492 msiexec.exe 83
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\SZSJFC-LYGGCEAETGRK2024OGXZ.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2268
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 78525EB4A5E7D5A487D5B85ABDC4D1D02⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3052
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
581B
MD5a837260198bd0703b28b2dacf5bed4b5
SHA1137c4e2eeb6c6072fcf3f820c296f77a5d5ac1ce
SHA256638b217720c7fb90a85554c66783d1b75f4ef19bc83d7b5669b01d1b43ce3eb9
SHA5127a3e66e5d6de6b5c09f9d77e215b63a4cc80ac30250dab5e63ab1382cc9fd0904f82a15b3835658a08bf22e023c8379100153e3d01861c1a4c1f30828b7dacdb
-
Filesize
554KB
MD53b171ce087bb799aafcbbd93bab27f71
SHA17bd69efbc7797bdff5510830ca2cc817c8b86d08
SHA256bb9a3c8972d89ad03c1dee3e91f03a13aca8d370185ac521b8c48040cc285ef4
SHA5127700d86f6f2c6798bed1be6cd651805376d545f48f0a89c08f7032066431cb4df980688a360c44275b8d7f8010769dc236fbdaa0184125d016acdf158989ee38
-
Filesize
20.4MB
MD57b84d437f625427767037f40d61ea4eb
SHA12998a3ea50486395dbc3d6adb72549ca2b7ecaab
SHA256ca4eb72b1ae58c8e32070ff91377f9404d3d2ec6fb86c110092cf6ecd4699120
SHA5124f1deb38b639c287799b5a4ee53934a1edd81f892c6c76b17a9a6ab0929db9ce139933774deba5757de282b860a81250e5917e86bdb9ded95929847779db7b55