Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20/06/2024, 03:20
Static task
static1
Behavioral task
behavioral1
Sample
e24577f37a0125fd49fc2c8b3c76a79f9e574eaa45f64662177b28404ad95b61.msi
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
e24577f37a0125fd49fc2c8b3c76a79f9e574eaa45f64662177b28404ad95b61.msi
Resource
win10v2004-20240508-en
windows10-2004-x64
General
-
Target
e24577f37a0125fd49fc2c8b3c76a79f9e574eaa45f64662177b28404ad95b61.msi
-
Size
22.4MB
-
MD5
63f39d58428e1939915e725a2e9a2100
-
SHA1
639a1e9c8ca3e694bee4e84f32c54819bd46642f
-
SHA256
e24577f37a0125fd49fc2c8b3c76a79f9e574eaa45f64662177b28404ad95b61
-
SHA512
5b23f1267d926e584c2539b6f3e2402bbaaa9063a9b057cc57c83ba21f95f5027fd0848ad5f7a50a5e11c65b13124d148f0505a4565e74f1fd5a6203dbca9cd1
-
SSDEEP
393216:K4Uj58wUV758JDRqrIfTgsfD6Ihxun07tELdW9d9K7zG16Q3:KlfUAqMRL6QxuAELd+G0l
Malware Config
Signatures
-
Blocklisted process makes network request 3 IoCs
flow pid Process 3 1676 msiexec.exe 5 1676 msiexec.exe 7 1676 msiexec.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe -
Drops file in System32 directory 22 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\vccorlib140.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc140cht.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc140esn.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc140fra.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\msvcp140.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\msvcp140_2.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\concrt140.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfcm140.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc140deu.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc140kor.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc140rus.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\vcruntime140.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\msvcp140_atomic_wait.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc140jpn.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc140u.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc140enu.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc140.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfcm140u.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc140chs.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc140ita.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\msvcp140_1.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\msvcp140_codecvt_ids.dll msiexec.exe -
Event Triggered Execution: Installer Packages 1 TTPs 1 IoCs
pid Process 1676 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1676 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 34 IoCs
description pid Process Token: SeShutdownPrivilege 1676 msiexec.exe Token: SeIncreaseQuotaPrivilege 1676 msiexec.exe Token: SeRestorePrivilege 1992 msiexec.exe Token: SeTakeOwnershipPrivilege 1992 msiexec.exe Token: SeSecurityPrivilege 1992 msiexec.exe Token: SeCreateTokenPrivilege 1676 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1676 msiexec.exe Token: SeLockMemoryPrivilege 1676 msiexec.exe Token: SeIncreaseQuotaPrivilege 1676 msiexec.exe Token: SeMachineAccountPrivilege 1676 msiexec.exe Token: SeTcbPrivilege 1676 msiexec.exe Token: SeSecurityPrivilege 1676 msiexec.exe Token: SeTakeOwnershipPrivilege 1676 msiexec.exe Token: SeLoadDriverPrivilege 1676 msiexec.exe Token: SeSystemProfilePrivilege 1676 msiexec.exe Token: SeSystemtimePrivilege 1676 msiexec.exe Token: SeProfSingleProcessPrivilege 1676 msiexec.exe Token: SeIncBasePriorityPrivilege 1676 msiexec.exe Token: SeCreatePagefilePrivilege 1676 msiexec.exe Token: SeCreatePermanentPrivilege 1676 msiexec.exe Token: SeBackupPrivilege 1676 msiexec.exe Token: SeRestorePrivilege 1676 msiexec.exe Token: SeShutdownPrivilege 1676 msiexec.exe Token: SeDebugPrivilege 1676 msiexec.exe Token: SeAuditPrivilege 1676 msiexec.exe Token: SeSystemEnvironmentPrivilege 1676 msiexec.exe Token: SeChangeNotifyPrivilege 1676 msiexec.exe Token: SeRemoteShutdownPrivilege 1676 msiexec.exe Token: SeUndockPrivilege 1676 msiexec.exe Token: SeSyncAgentPrivilege 1676 msiexec.exe Token: SeEnableDelegationPrivilege 1676 msiexec.exe Token: SeManageVolumePrivilege 1676 msiexec.exe Token: SeImpersonatePrivilege 1676 msiexec.exe Token: SeCreateGlobalPrivilege 1676 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1676 msiexec.exe
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\e24577f37a0125fd49fc2c8b3c76a79f9e574eaa45f64662177b28404ad95b61.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Event Triggered Execution: Installer Packages
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1676
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1992
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b