Analysis
- max time kernel
147s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
18/06/2024, 15:50
Static task
static1
Behavioral task
behavioral1
Sample
28b23f944ea8d1cc47e7d24e84ef5726481e070a0a42d6eb903316b1f15aa403.msi
Resource
win7-20240611-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
28b23f944ea8d1cc47e7d24e84ef5726481e070a0a42d6eb903316b1f15aa403.msi
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 28b23f944ea8d1cc47e7d24e84ef5726481e070a0a42d6eb903316b1f15aa403.msi
- Size 5.0MB
- Sample240618-s97c6szerc
- SHA256 28b23f944ea8d1cc47e7d24e84ef5726481e070a0a42d6eb903316b1f15aa403
- MD5 5754830eb5984d79180f34ff73ed6e46
- SHA1 90d188fce3cf6fa91ec497663c0df24da5a7a278
- SHA512 7962766c21d0bd16833fa47984a167cb87db0671a7ed2214c0e3d30caceced9a5114e6f70ac20543b7d11710198ef79c39bf688c16f52d8c85f48be63d574ab4
- SSDEEP 49152:tQEc/f9r84jEHYDgA5+7vCycFTznm9500zjjZT9eFOsmBBU7FFUG0yzAaeTG8qds:9VHYDgFuyclbrPcGJsEa2uDmxhffUme
- MD5 SHA1 SHA512 SSDEEP
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe - Loads dropped DLL 8 IoCs
pid Process 5100 MsiExec.exe 5100 MsiExec.exe 5100 MsiExec.exe 5100 MsiExec.exe 5100 MsiExec.exe 5100 MsiExec.exe 5100 MsiExec.exe 5100 MsiExec.exe - Event Triggered Execution: Installer Packages 1 TTPs 1 IoCs
pid Process 3496 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3496 msiexec.exe Token: SeIncreaseQuotaPrivilege 3496 msiexec.exe Token: SeSecurityPrivilege 1820 msiexec.exe Token: SeCreateTokenPrivilege 3496 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3496 msiexec.exe Token: SeLockMemoryPrivilege 3496 msiexec.exe Token: SeIncreaseQuotaPrivilege 3496 msiexec.exe Token: SeMachineAccountPrivilege 3496 msiexec.exe Token: SeTcbPrivilege 3496 msiexec.exe Token: SeSecurityPrivilege 3496 msiexec.exe Token: SeTakeOwnershipPrivilege 3496 msiexec.exe Token: SeLoadDriverPrivilege 3496 msiexec.exe Token: SeSystemProfilePrivilege 3496 msiexec.exe Token: SeSystemtimePrivilege 3496 msiexec.exe Token: SeProfSingleProcessPrivilege 3496 msiexec.exe Token: SeIncBasePriorityPrivilege 3496 msiexec.exe Token: SeCreatePagefilePrivilege 3496 msiexec.exe Token: SeCreatePermanentPrivilege 3496 msiexec.exe Token: SeBackupPrivilege 3496 msiexec.exe Token: SeRestorePrivilege 3496 msiexec.exe Token: SeShutdownPrivilege 3496 msiexec.exe Token: SeDebugPrivilege 3496 msiexec.exe Token: SeAuditPrivilege 3496 msiexec.exe Token: SeSystemEnvironmentPrivilege 3496 msiexec.exe Token: SeChangeNotifyPrivilege 3496 msiexec.exe Token: SeRemoteShutdownPrivilege 3496 msiexec.exe Token: SeUndockPrivilege 3496 msiexec.exe Token: SeSyncAgentPrivilege 3496 msiexec.exe Token: SeEnableDelegationPrivilege 3496 msiexec.exe Token: SeManageVolumePrivilege 3496 msiexec.exe Token: SeImpersonatePrivilege 3496 msiexec.exe Token: SeCreateGlobalPrivilege 3496 msiexec.exe Token: SeCreateTokenPrivilege 3496 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3496 msiexec.exe Token: SeLockMemoryPrivilege 3496 msiexec.exe Token: SeIncreaseQuotaPrivilege 3496 msiexec.exe Token: SeMachineAccountPrivilege 3496 msiexec.exe Token: SeTcbPrivilege 3496 msiexec.exe Token: SeSecurityPrivilege 3496 msiexec.exe Token: SeTakeOwnershipPrivilege 3496 msiexec.exe Token: SeLoadDriverPrivilege 3496 msiexec.exe Token: SeSystemProfilePrivilege 3496 msiexec.exe Token: SeSystemtimePrivilege 3496 msiexec.exe Token: SeProfSingleProcessPrivilege 3496 msiexec.exe Token: SeIncBasePriorityPrivilege 3496 msiexec.exe Token: SeCreatePagefilePrivilege 3496 msiexec.exe Token: SeCreatePermanentPrivilege 3496 msiexec.exe Token: SeBackupPrivilege 3496 msiexec.exe Token: SeRestorePrivilege 3496 msiexec.exe Token: SeShutdownPrivilege 3496 msiexec.exe Token: SeDebugPrivilege 3496 msiexec.exe Token: SeAuditPrivilege 3496 msiexec.exe Token: SeSystemEnvironmentPrivilege 3496 msiexec.exe Token: SeChangeNotifyPrivilege 3496 msiexec.exe Token: SeRemoteShutdownPrivilege 3496 msiexec.exe Token: SeUndockPrivilege 3496 msiexec.exe Token: SeSyncAgentPrivilege 3496 msiexec.exe Token: SeEnableDelegationPrivilege 3496 msiexec.exe Token: SeManageVolumePrivilege 3496 msiexec.exe Token: SeImpersonatePrivilege 3496 msiexec.exe Token: SeCreateGlobalPrivilege 3496 msiexec.exe Token: SeCreateTokenPrivilege 3496 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3496 msiexec.exe Token: SeLockMemoryPrivilege 3496 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3496 msiexec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1820 wrote to memory of 5100 1820 msiexec.exe 88 PID 1820 wrote to memory of 5100 1820 msiexec.exe 88 PID 1820 wrote to memory of 5100 1820 msiexec.exe 88
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\28b23f944ea8d1cc47e7d24e84ef5726481e070a0a42d6eb903316b1f15aa403.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3496
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4CD604885044489ABC8009F49185E8CA C2⤵
- Loads dropped DLL
PID:5100
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MSIA6A0.tmp
- Size 738KB
- SHA256 8bd84f1156ebdfa44afaac8a4579ba56a8c7513e3d51e00822167ea144923726
- MD5 d0c9613582605f3793fdad7279de428b
- SHA1 8b3e9fb67c7beb20706544d360ee13c3aad9c1d1
- SHA512 3640a0f53730cad7323473f99a2049833db58eaed00f94b75b4a03b07cc8af99c104a40b2e888307055a5c9740b5fea4b394aa15bc78a3102088cc0770713eac
- SSDEEP 12288:ECIETjR8kJ/FQhGd6rZj5Tzlqph0lhSMXle1nD55vccNzjjZqr:EjEhnJ/mhGd6NFTzqh0lhSMXlWnD550X
- MD5 SHA1 SHA512 SSDEEP