Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    19-06-2024 14:58

General

  • Target

    finalshell_install.msi

  • Size

    114.0MB

  • MD5

    513c6f171a71ade9e117a08345cd589d

  • SHA1

    57a4a508e5d7d76aa1cfe883af4f0a1c3bdd47ca

  • SHA256

    9861a44622f62ea87dd8ce53ef752d5af92dc60f8e012f72f1873fd462b4e0e0

  • SHA512

    0287bc684c4947b79e4f80629bbe7fb5850bc2659f04d6dbfc15116bafa2d10eb362ace9cb581147b6f5ae09491f4ad63c3bf2f115f09ce9cba89209bfbfc1c9

  • SSDEEP

    1572864:OMNdS0K7cM0Smj/NP6r32RVzpMqHzjlZiuFp0SB3P/pL/lA5jY5/GA+Y13LJyPOZ:OMNdxoONP6r32HGOzJpLdA5+zrpm3r6

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 6 IoCs
  • Drops file in Windows directory 22 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 17 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 1 TTPs 1 IoCs
  • Program crash 1 IoCs
  • NSIS installer 2 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 24 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\finalshell_install.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:108
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2416
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding A5E1C7F10E63ADD0D9E931768EDCDE27 C
      2⤵
      • Loads dropped DLL
      PID:3020
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding DB032785993C818CC9960F73A8C0D9A1
      2⤵
      • Loads dropped DLL
      PID:2168
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 57B26C51C01BF424E65E7215FC54B247
      2⤵
      • Drops file in Program Files directory
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2100
      • C:\Program Files\Windows Defenderr\Phone.exe
        "C:\Program Files\Windows Defenderr\Phone.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2780
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2780 -s 176
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:2656
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
      PID:2484
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot18" "" "" "6792c44eb" "0000000000000000" "00000000000003D4" "00000000000005AC"
      1⤵
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      PID:852
    • C:\Windows\System32\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\WindowsProgram.msi"
      1⤵
      • Enumerates connected drives
      • Suspicious use of FindShellTrayWindow
      PID:2552
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000544" "0000000000000530"
      1⤵
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      PID:2384
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {3D965777-3E24-47D1-9490-8787365DC536} S-1-5-21-3691908287-3775019229-3534252667-1000:UOTHCPHQ\Admin:Interactive:[1]
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1632
      • C:\ProgramData\{14B2A052-3CA3-4d7d-8CE0-A8xvDFw50F17}\{F47128F7-F7A3-4631-85BA-07xv2Dw5260F}\Phone.exe
        C:\ProgramData\{14B2A052-3CA3-4d7d-8CE0-A8xvDFw50F17}\{F47128F7-F7A3-4631-85BA-07xv2Dw5260F}\Phone.exe
        2⤵
        • Executes dropped EXE
        PID:948
      • C:\ProgramData\{14B2A052-3CA3-4d7d-8CE0-A8xvDFw50F17}\{F47128F7-F7A3-4631-85BA-07xv2Dw5260F}\Phone.exe
        C:\ProgramData\{14B2A052-3CA3-4d7d-8CE0-A8xvDFw50F17}\{F47128F7-F7A3-4631-85BA-07xv2Dw5260F}\Phone.exe
        2⤵
        • Executes dropped EXE
        PID:1960

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Persistence

    Event Triggered Execution

    1
    T1546

    Installer Packages

    1
    T1546.016

    Privilege Escalation

    Event Triggered Execution

    1
    T1546

    Installer Packages

    1
    T1546.016

    Discovery

    Query Registry

    1
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    2
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Config.Msi\f769ea2.rbs
      Filesize

      39KB

      MD5

      b870dd2509003ee77d9483926a65fdbd

      SHA1

      5e6b23ef36a51db74d19271d65344859ffd73131

      SHA256

      fa482a42f8885fa7fd650897c9eeddeb8335086bf362561f8ae067e62c239ef1

      SHA512

      5b9eb5929ee36c11ed23956e944ab146fad603b982da0e202438e476d7d3da356c6b238416111b45e3038a59225924f22e605bf2a106303ce703ac660d22f3ac

    • C:\Config.Msi\f769ea8.rbs
      Filesize

      7KB

      MD5

      ef00698b55c79980dadc6a9df1f4e820

      SHA1

      d45e661787283a83029d6b3b618264c9c860c79e

      SHA256

      4eae406fb5af1acf65d7dbf88e253253812446e19867990b2a1220f13f235e23

      SHA512

      03b71ec72a02be88ca8987c36ac90794c35c4e77193cb82fd9bb2ddcf3b616faadaa367d5813ffc232741a78f1035ad557d11d7e13208c642a1836a893418975

    • C:\Program Files\Windows Defenderr\1
      Filesize

      978KB

      MD5

      a8a5c802a0ba7779cd378a4ed88a1645

      SHA1

      c78967d9cf1fa6017757b93891b423854952b4ef

      SHA256

      b7247f59f232b373c2473f869c8269a7ef46ad29bbc64403a29c697313b6ae74

      SHA512

      329b43bbf38ac5b547c69f1301c8899ae24a044009051236df2678911cd636961731a4f274cd55381a86cab3dd74dabee2cb25d8968361991d516cdf7d945709

    • C:\Program Files\Windows Defenderr\2
      Filesize

      135KB

      MD5

      de5b9a4e125ac870b304a80fc829f888

      SHA1

      d82d45dbeb3c2d702b6bb6b4c28a95d357b86316

      SHA256

      992d22609eb21b384ac3965d18cca4fa620e2a743451db60d19794eafe553362

      SHA512

      471249934c2560ccd166ca559e9d73622a4653a7226a2e7ff3c0225dcd882d9d78e8676342938c6c6e56d6167a37d8e96423b2de6f6a5f9740424191481fb725

    • C:\ProgramData\{14B2A052-3CA3-4d7d-8CE0-A8xvDFw50F17}\{F3F305A2-E5E7-488d-A947-75xvA2w51D0B}.exe
      Filesize

      1.0MB

      MD5

      d96a742899aeab9eaba691861908e316

      SHA1

      777f988457a9265431e8119bd2d579f264f565f5

      SHA256

      1d8b0d810d826574637041cc56c5532139eccff5064195bfea0d65ac0c3624d3

      SHA512

      cc3f75a0d2abe5860acefebda2d44dba7259d7f28e32dfd41d3d7361df7f4195deb49e8c7f7d74f09bffdd8a39fde5a0eeee222a92bdef3f773379284aadf582

    • C:\Users\Admin\AppData\Local\FinalShell\Finalshell\finalshell.exe
      Filesize

      101KB

      MD5

      c1c11656f36a5b2b7bf514a6cf4ddf54

      SHA1

      1b99cfe6a5c16c88b3a4efb3874127ea2bb0d420

      SHA256

      47600daab17337f9c268426027ffd9ed2cf1a1774ff84cb81e24ed61b7c7407b

      SHA512

      b546d7b59706b02cffd1ed3927981ff85e6f992afe0f69261780d6c40636b0ce3782954497dfeefea058d196a6e62e2f568da28a90961357b4fe39f3d52a0eae

    • C:\Users\Admin\AppData\Local\FinalShell\Finalshell\jre\legal\java.naming\COPYRIGHT
      Filesize

      35B

      MD5

      4586c3797f538d41b7b2e30e8afebbc9

      SHA1

      3419ebac878fa53a9f0ff1617045ddaafb43dce0

      SHA256

      7afb3a2dc57cb16223dddc970e0b464311e5311484c793abf9327a19ef629018

      SHA512

      f2c722ae80d2c0dcdb30a6993864eb90b85be5311261012d4585c6595579582d1b37323613f5417d189adcd096fa948e0378c1e6c59761bf94d65c0a5c2f2fd3

    • C:\Users\Admin\AppData\Local\FinalShell\Finalshell\jre\legal\java.naming\LICENSE
      Filesize

      33B

      MD5

      16989bab922811e28b64ac30449a5d05

      SHA1

      51ab20e8c19ee570bf6c496ec7346b7cf17bd04a

      SHA256

      86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192

      SHA512

      86571f127a6755a7339a9ed06e458c8dc5898e528de89e369a13c183711831af0646474986bae6573bc5155058d5f38348d6bfdeb3fd9318e98e0bf7916e6608

    • C:\Users\Admin\AppData\Local\Temp\MSI2E41.tmp
      Filesize

      587KB

      MD5

      c7fbd5ee98e32a77edf1156db3fca622

      SHA1

      3e534fc55882e9fb940c9ae81e6f8a92a07125a0

      SHA256

      e140990b509dd6884a5742bde64f2cdaa10012d472b0b32de43ebecbc83242b6

      SHA512

      8691ac8b214cc1e4f34a3ab2bbc0c2391f7f11ebbe5db0dc82825195b5fe5a05310ed1e14d253a9b74a64050d2f2a6623dd2fcd912f80fef51e51845ef1e3a1a

    • C:\Users\Admin\AppData\Local\Temp\WindowsProgram.msi
      Filesize

      1.2MB

      MD5

      7813c15b89e15b8af723338db9bd5936

      SHA1

      2308be3f8f1c3f46cd2eb14189c19c0e2deef8c5

      SHA256

      17fcf1aacf2981cff65f7d0f3f03029c15eebfd7f71790cdf0f03553895d4152

      SHA512

      ef1b63b1b8b670610bcc5b461457d5b58fca57577b7cf8442183c921ed516b7a87f48b4fde9d325dcc087cb090d7f8992f1eec2a68d1c06c263b6ea93470faeb

    • memory/948-334-0x0000000000BB0000-0x0000000000CAE000-memory.dmp
      Filesize

      1016KB

    • memory/1960-353-0x0000000000100000-0x00000000001FE000-memory.dmp
      Filesize

      1016KB

    • memory/2780-314-0x0000000000240000-0x000000000033E000-memory.dmp
      Filesize

      1016KB

    • memory/2780-335-0x0000000000240000-0x000000000033E000-memory.dmp
      Filesize

      1016KB

    • memory/3020-264-0x0000000000290000-0x0000000000292000-memory.dmp
      Filesize

      8KB