Analysis

  • max time kernel
    146s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/06/2024, 05:07

General

  • Target

    $_4_.msi

  • Size

    68.0MB

  • MD5

    d338244a4c63c6829ba63a436cd96bca

  • SHA1

    cf5b67a36f27990ae89933913b8e09c48360837c

  • SHA256

    c04393d32a045faa0940dc56f91d456935060cfa995cf3caee948ef09ab5cd33

  • SHA512

    ac5ed089a9ca48a7a997cf6053d7a8dec41b729f1ee456051ffc23373425bf62a2f82df9027176fa614b39c335ca86b4e23633fe50359fc0392a54ff47744b46

  • SSDEEP

    393216:wst/V4e0wTkW4rjtNkWbNUz6sdhq1Dzw7RvPm0DMFGwyZyjVhlwdLnoIXXsagvHs:wUqWYXkW5Ujqhzw7RvtYrHs9os

Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Loads dropped DLL 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\$_4_.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1116
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2628
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 0EC4CF081FD576931736972B2923DDA6 C
      2⤵
      • Loads dropped DLL
      PID:3652

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\MSI8184.tmp

          Filesize

          364KB

          MD5

          ca95f207ec70ba34b46c785f7bcb5570

          SHA1

          25c0d45cb9f94892e2877033d06fe8909e5b9972

          SHA256

          8ac4b42fb36d10194a14c32f6f499a6ac6acb79adbec858647495ba64f6dd2bb

          SHA512

          c7003a2159f5adab0a3b4a4f3c0dd494d916062a57e84a23ccc18410fa394438d49208769027c641569b3025616e99ca1730a540846aaf1c5d91338b90008831

        • C:\Users\Admin\AppData\Local\Temp\MSI83AC.tmp

          Filesize

          561KB

          MD5

          5576bf4d22dc695564e49a68cbc98bc2

          SHA1

          80e0e045162a65d84939e22a821ecbbbde3f31d6

          SHA256

          20f76ffd846155a41633d75cb2e784e54f6ec77ca9ca9d52d9510c3e2e918801

          SHA512

          4b952ce6ef08c86d8594fadd1069c3af39c3465314716dc7e7d9937befab8f4db5e4920a901920af4f937e5bb80ca02c33406d54cc766920b8ebba3855500972