Analysis
- max time kernel
92s - max time network
98s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 03:43
Static task
static1
Behavioral task
behavioral1
Sample
a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe
Resource
win7-20240508-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe
- Size 8.4MB
- Sample240613-eaebfswhlq
- SHA256 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87
- MD5 85c5f876f3fdd140122d4f27caba86bb
- SHA1 b6ca092dc01825dd21469637055bf48a1d614bc0
- SHA512 2d5365a630f2b4e069bf9898eb4e8c49808adbf712ccdfb22a9b074f40a8966d6994669a5d6b84d2a2b3431fa68a490e15e7bdee61a8e7aa934ff21fcac0ab16
- SSDEEP 196608:4Dq6UE7o5QzxheXBT9mVZmziyWT5QhwIFDjvuwvEv:4DaErheZ6lQhwIlvEv
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 6 IoCs
pid Process 844 MsiExec.exe 1008 MsiExec.exe 1008 MsiExec.exe 1008 MsiExec.exe 1008 MsiExec.exe 1008 MsiExec.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe File opened (read-only) \??\Y: a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\J: a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe File opened (read-only) \??\N: a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe File opened (read-only) \??\X: a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe File opened (read-only) \??\R: a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\B: a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe File opened (read-only) \??\Q: a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\V: a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\H: a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe File opened (read-only) \??\I: a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe File opened (read-only) \??\O: a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe File opened (read-only) \??\U: a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe File opened (read-only) \??\T: a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe File opened (read-only) \??\P: a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\K: a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe File opened (read-only) \??\P: msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSecurityPrivilege 3140 msiexec.exe Token: SeCreateTokenPrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeAssignPrimaryTokenPrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeLockMemoryPrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeIncreaseQuotaPrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeMachineAccountPrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeTcbPrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeSecurityPrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeTakeOwnershipPrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeLoadDriverPrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeSystemProfilePrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeSystemtimePrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeProfSingleProcessPrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeIncBasePriorityPrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeCreatePagefilePrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeCreatePermanentPrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeBackupPrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeRestorePrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeShutdownPrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeDebugPrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeAuditPrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeSystemEnvironmentPrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeChangeNotifyPrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeRemoteShutdownPrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeUndockPrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeSyncAgentPrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeEnableDelegationPrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeManageVolumePrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeImpersonatePrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeCreateGlobalPrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeCreateTokenPrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeAssignPrimaryTokenPrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeLockMemoryPrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeIncreaseQuotaPrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeMachineAccountPrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeTcbPrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeSecurityPrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeTakeOwnershipPrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeLoadDriverPrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeSystemProfilePrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeSystemtimePrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeProfSingleProcessPrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeIncBasePriorityPrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeCreatePagefilePrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeCreatePermanentPrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeBackupPrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeRestorePrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeShutdownPrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeDebugPrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeAuditPrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeSystemEnvironmentPrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeChangeNotifyPrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeRemoteShutdownPrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeUndockPrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeSyncAgentPrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeEnableDelegationPrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeManageVolumePrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeImpersonatePrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeCreateGlobalPrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeCreateTokenPrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeAssignPrimaryTokenPrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeLockMemoryPrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeIncreaseQuotaPrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe Token: SeMachineAccountPrivilege 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe 3688 msiexec.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3140 wrote to memory of 844 3140 msiexec.exe 86 PID 3140 wrote to memory of 844 3140 msiexec.exe 86 PID 3140 wrote to memory of 844 3140 msiexec.exe 86 PID 1672 wrote to memory of 3688 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe 87 PID 1672 wrote to memory of 3688 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe 87 PID 1672 wrote to memory of 3688 1672 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe 87 PID 3140 wrote to memory of 1008 3140 msiexec.exe 88 PID 3140 wrote to memory of 1008 3140 msiexec.exe 88 PID 3140 wrote to memory of 1008 3140 msiexec.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe"C:\Users\Admin\AppData\Local\Temp\a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe"1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\iogasgg\压缩软件 中文版 7.70.0\install\压缩软件 中文版.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1718009646 "2⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
PID:3688
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C356850F6F52F941D36EDE50F98423BB C2⤵
- Loads dropped DLL
PID:844
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9B430AE181EAE5C53627B9CEFB3F91B7 C2⤵
- Loads dropped DLL
PID:1008
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MSI3C2F.tmp
- Size 436KB
- SHA256 426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
- MD5 475d20c0ea477a35660e3f67ecf0a1df
- SHA1 67340739f51e1134ae8f0ffc5ae9dd710e8e3a08
- SHA512 99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
- SSDEEP 6144:5x0A4eCDsgvSd7ftYx5fnLHT7ybjfgaUFfQiAOuv2IaZeB+:5x0ECIgYOx5fnL/tYi8OBZr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\iogasgg\压缩软件 中文版 7.70.0\install\压缩软件 中文版.msi
- Size 1.4MB
- SHA256 4cdebe02e79e52e10250b725be6594cc837aa36eadfe57def59f17a7efe99adc
- MD5 da5f920dda440e405ee38d8499017298
- SHA1 2186d78aedd74cd0ce6fffce7b2d29080f78a400
- SHA512 503deb619ffecdcb3c5a52c72879c587f5b949608e8b7a3c76699e7080821ea976244724b920399d3812306c5d9f126ea602925c99f53e4c694f881131f84c52
- SSDEEP 24576:cqEsxLnbY9x0ECIgYmfLVYeBZr7AS5s66EGlA1n2QzwsAArZDrFL:LEgYBZKumZr7A2512QzwcZDrFL
- MD5 SHA1 SHA512 SSDEEP