f548d1ad81af9ffb56e07ae96aef96702160d06a84db8802679686ef2b51d85e

Analysis

max time kernel
119s
max time network
129s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
24-06-2024 14:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

setup.msi
Size

25.2MB
MD5

be2a13cfa57db16d3f654c5e444c360b
SHA1

7f45d2a4debbbca678cc5c300c59af01ca197bca
SHA256

b086cb6063a6fe194342b3dbe7639aebab02513305c95a914d052e87b54e0523
SHA512

978f4fb1e9df0785bbcd2734d4a7b32d3acab4a215075f0860ccc879bf65714e2c6eabba41ee7c38c0394a9a08b60757544034b21c336c2a3f233a411744953e
SSDEEP

786432:++aMGdE4CF4EgcHxa3pS58g0nfZ3AOnr:++aMGrCKEg+xwS5MGOr

Score

6^/10

persistence privilege_escalation

Malware Config

Signatures

Blocklisted process makes network request 4 IoCs

flow	pid	Process
5	844	MsiExec.exe
7	844	MsiExec.exe
9	844	MsiExec.exe
11	844	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI9A8B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9CEC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9DD7.tmp	msiexec.exe
File created	C:\Windows\Installer\f769984.ipi	msiexec.exe
File created	C:\Windows\Installer\f769981.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9F00.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\f769984.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\f769981.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICD63.tmp	msiexec.exe
File created	C:\Windows\Installer\f769986.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA4DB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA5F5.tmp	msiexec.exe

Executes dropped EXE 2 IoCs

pid	Process
2148	UnRAR.exe
2312	steamerrorreporter64.exe

Loads dropped DLL 10 IoCs

pid	Process
844	MsiExec.exe
844	MsiExec.exe
844	MsiExec.exe
844	MsiExec.exe
844	MsiExec.exe
844	MsiExec.exe
2200	msiexec.exe
2200	msiexec.exe
2312	steamerrorreporter64.exe
2312	steamerrorreporter64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 1 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

pid	Process
2248	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2200	msiexec.exe
2200	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2248	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2248	msiexec.exe
Token: SeRestorePrivilege	2200	msiexec.exe
Token: SeTakeOwnershipPrivilege	2200	msiexec.exe
Token: SeSecurityPrivilege	2200	msiexec.exe
Token: SeCreateTokenPrivilege	2248	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2248	msiexec.exe
Token: SeLockMemoryPrivilege	2248	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2248	msiexec.exe
Token: SeMachineAccountPrivilege	2248	msiexec.exe
Token: SeTcbPrivilege	2248	msiexec.exe
Token: SeSecurityPrivilege	2248	msiexec.exe
Token: SeTakeOwnershipPrivilege	2248	msiexec.exe
Token: SeLoadDriverPrivilege	2248	msiexec.exe
Token: SeSystemProfilePrivilege	2248	msiexec.exe
Token: SeSystemtimePrivilege	2248	msiexec.exe
Token: SeProfSingleProcessPrivilege	2248	msiexec.exe
Token: SeIncBasePriorityPrivilege	2248	msiexec.exe
Token: SeCreatePagefilePrivilege	2248	msiexec.exe
Token: SeCreatePermanentPrivilege	2248	msiexec.exe
Token: SeBackupPrivilege	2248	msiexec.exe
Token: SeRestorePrivilege	2248	msiexec.exe
Token: SeShutdownPrivilege	2248	msiexec.exe
Token: SeDebugPrivilege	2248	msiexec.exe
Token: SeAuditPrivilege	2248	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2248	msiexec.exe
Token: SeChangeNotifyPrivilege	2248	msiexec.exe
Token: SeRemoteShutdownPrivilege	2248	msiexec.exe
Token: SeUndockPrivilege	2248	msiexec.exe
Token: SeSyncAgentPrivilege	2248	msiexec.exe
Token: SeEnableDelegationPrivilege	2248	msiexec.exe
Token: SeManageVolumePrivilege	2248	msiexec.exe
Token: SeImpersonatePrivilege	2248	msiexec.exe
Token: SeCreateGlobalPrivilege	2248	msiexec.exe
Token: SeRestorePrivilege	2200	msiexec.exe
Token: SeTakeOwnershipPrivilege	2200	msiexec.exe
Token: SeRestorePrivilege	2200	msiexec.exe
Token: SeTakeOwnershipPrivilege	2200	msiexec.exe
Token: SeRestorePrivilege	2200	msiexec.exe
Token: SeTakeOwnershipPrivilege	2200	msiexec.exe
Token: SeRestorePrivilege	2200	msiexec.exe
Token: SeTakeOwnershipPrivilege	2200	msiexec.exe
Token: SeRestorePrivilege	2200	msiexec.exe
Token: SeTakeOwnershipPrivilege	2200	msiexec.exe
Token: SeRestorePrivilege	2200	msiexec.exe
Token: SeTakeOwnershipPrivilege	2200	msiexec.exe
Token: SeRestorePrivilege	2200	msiexec.exe
Token: SeTakeOwnershipPrivilege	2200	msiexec.exe
Token: SeRestorePrivilege	2200	msiexec.exe
Token: SeTakeOwnershipPrivilege	2200	msiexec.exe
Token: SeRestorePrivilege	2200	msiexec.exe
Token: SeTakeOwnershipPrivilege	2200	msiexec.exe
Token: SeRestorePrivilege	2200	msiexec.exe
Token: SeTakeOwnershipPrivilege	2200	msiexec.exe
Token: SeRestorePrivilege	2200	msiexec.exe
Token: SeTakeOwnershipPrivilege	2200	msiexec.exe
Token: SeRestorePrivilege	2200	msiexec.exe
Token: SeTakeOwnershipPrivilege	2200	msiexec.exe
Token: SeRestorePrivilege	2200	msiexec.exe
Token: SeTakeOwnershipPrivilege	2200	msiexec.exe
Token: SeRestorePrivilege	2200	msiexec.exe
Token: SeTakeOwnershipPrivilege	2200	msiexec.exe
Token: SeRestorePrivilege	2200	msiexec.exe
Token: SeTakeOwnershipPrivilege	2200	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2248	msiexec.exe
2248	msiexec.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 844	2200	msiexec.exe	29
PID 2200 wrote to memory of 844	2200	msiexec.exe	29
PID 2200 wrote to memory of 844	2200	msiexec.exe	29
PID 2200 wrote to memory of 844	2200	msiexec.exe	29
PID 2200 wrote to memory of 844	2200	msiexec.exe	29
PID 2200 wrote to memory of 844	2200	msiexec.exe	29
PID 2200 wrote to memory of 844	2200	msiexec.exe	29
PID 2200 wrote to memory of 2148	2200	msiexec.exe	33
PID 2200 wrote to memory of 2148	2200	msiexec.exe	33
PID 2200 wrote to memory of 2148	2200	msiexec.exe	33
PID 2200 wrote to memory of 2312	2200	msiexec.exe	35
PID 2200 wrote to memory of 2312	2200	msiexec.exe	35
PID 2200 wrote to memory of 2312	2200	msiexec.exe	35

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\setup.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2248

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C124545C8557ACA7F1DBB786CF4DC01C
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:844
- C:\Users\Admin\AppData\Roaming\Yinanob Coop Aq\PubSurf\UnRAR.exe
  "C:\Users\Admin\AppData\Roaming\Yinanob Coop Aq\PubSurf\UnRAR.exe" x -p2664926658a "C:\Users\Admin\AppData\Roaming\Yinanob Coop Aq\PubSurf\ruw9eigh.rar" "C:\Users\Admin\AppData\Roaming\Yinanob Coop Aq\PubSurf\"
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Users\Admin\AppData\Roaming\Yinanob Coop Aq\PubSurf\steamerrorreporter64.exe
  "C:\Users\Admin\AppData\Roaming\Yinanob Coop Aq\PubSurf\steamerrorreporter64.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f769985.rbs

Filesize
21KB

MD5
63f807ae769658d7c5520cd4610a3ca4

SHA1
121a79e4989eb0571d2dbeed6ef72143ef818ccd

SHA256
be2108a9b7ab0e7a472ad36c685623ea65d3a50cf163193299dbaaff88002ab0

SHA512
612517ee1e04f37e35fd42266d297e8b106ccb20a22d7ab219fe0a8c109d8b058b2e830a8fb57150273809ce05406f148e0ce9582f619ad7ec653e58ccd9184f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b32cbe297a618dc8923af99cf0129032

SHA1
b52b843042fa3cbc8a74694e54483091bfdc62d8

SHA256
a64db1805bdcfa42f4f7f0c46ee475f0dfd7741bb81309e39fe0a8e6ba7846a9

SHA512
3fd0e73cb489f38bf0e2e1dbe78a7b880f4da11eede2cfc4778abf9c4476ab97643652de7a45ec4070fd5e4d424f715650503c9bd3f7f2424b2044c0c40130a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB260.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB36C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\Yinanob Coop Aq\PubSurf\ruw9eigh.rar

Filesize
378KB

MD5
35af121e2e55c85b99cb7daf396fb523

SHA1
f2b073afafa04d96f0bc191e280ac3b658afb404

SHA256
c64353f1e6327254ba4813d246e591f435a6f599bff9f8deb303557a73cd4257

SHA512
24bbaa40c6c5c349dabb9c132fbf1113bc0d8116bf97229ad275d198ae05505699a9f33f9926d2147a6a036f849b928970f18aad6e8837c82f5dcc23cb28dcb0

Download Submit
C:\Users\Admin\AppData\Roaming\Yinanob Coop Aq\PubSurf\tier0_s64.dll

Filesize
386KB

MD5
7e60404cfb232a1d3708a9892d020e84

SHA1
31328d887bee17641608252fb2f9cd6caf8ba522

SHA256
5a3e15cb90baf4b3ebe0621fa6f5f37b0fe99848387d6f2fd99ae770d1e6d766

SHA512
4d8abd59bd77bdb6e5b5e5f902d2a10fa5136437c51727783e79aed6a796f9ee1807faf14f1a72a1341b9f868f61de8c676b00a4b07a2a26cfb8a4db1b77eb3c

Download Submit
C:\Windows\Installer\MSI9A8B.tmp

Filesize
738KB

MD5
b158d8d605571ea47a238df5ab43dfaa

SHA1
bb91ae1f2f7142b9099e3cc285f4f5b84de568e4

SHA256
ca763693cc25d316f14a9ebad80ebf00590329550c45adb7e5205486533c2504

SHA512
56aef59c198acf2fcd0d95ea6e32ce1c706e5098a0800feff13ddb427bfb4d538de1c415a5cb5496b09a5825155e3abb1c13c8c37dc31549604bd4d63cb70591

Download Submit
C:\Windows\Installer\MSI9DD7.tmp

Filesize
1.1MB

MD5
1a2b237796742c26b11a008d0b175e29

SHA1
cfd5affcfb3b6fd407e58dfc7187fad4f186ea18

SHA256
81e0df47bcb2b3380fb0fb58b0d673be4ef1b0367fd2b0d80ab8ee292fc8f730

SHA512
3135d866bf91f9e09b980dd649582072df1f53eabe4c5ac5d34fff1aeb5b6fa01d38d87fc31de19a0887a910e95309bcf0e7ae54e6e8ed2469feb64da4a4f9e5

Download Submit
C:\Windows\Installer\MSIA5F5.tmp

Filesize
364KB

MD5
54d74546c6afe67b3d118c3c477c159a

SHA1
957f08beb7e27e657cd83d8ee50388b887935fae

SHA256
f9956417af079e428631a6c921b79716d960c3b4917c6b7d17ff3cb945f18611

SHA512
d27750b913cc2b7388e9948f42385d0b4124e48335ae7fc0bc6971f4f807dbc9af63fe88675bc440eb42b9a92551bf2d77130b1633ddda90866616b583ae924f

Download Submit
C:\Windows\Installer\f769981.msi

Filesize
25.2MB

MD5
be2a13cfa57db16d3f654c5e444c360b

SHA1
7f45d2a4debbbca678cc5c300c59af01ca197bca

SHA256
b086cb6063a6fe194342b3dbe7639aebab02513305c95a914d052e87b54e0523

SHA512
978f4fb1e9df0785bbcd2734d4a7b32d3acab4a215075f0860ccc879bf65714e2c6eabba41ee7c38c0394a9a08b60757544034b21c336c2a3f233a411744953e

Download Submit
\Users\Admin\AppData\Roaming\Yinanob Coop Aq\PubSurf\UnRAR.exe

Filesize
494KB

MD5
98ccd44353f7bc5bad1bc6ba9ae0cd68

SHA1
76a4e5bf8d298800c886d29f85ee629e7726052d

SHA256
e51021f6cb20efbd2169f2a2da10ce1abca58b4f5f30fbf4bae931e4ecaac99b

SHA512
d6e8146a1055a59cba5e2aaf47f6cb184acdbe28e42ec3daebf1961a91cec5904554d9d433ebf943dd3639c239ef11560fa49f00e1cff02e11cd8d3506c4125f

Download Submit
\Users\Admin\AppData\Roaming\Yinanob Coop Aq\PubSurf\steamerrorreporter64.exe

Filesize
639KB

MD5
fd3ce044ac234fdab3df9d7f492c470a

SHA1
a74a287d5d82a8071ab36c72b2786342d83a8ef7

SHA256
0a0c09753b5103e86e32c2d8086dd1399f0d97a00e1525ec9c390067cdb242ba

SHA512
86d7e805fab0e5130003facbb1525ee261440846f342f53ae64c3f8d676d1208d5fd9bd91e3222c63cc30c443348eb5ddedab14c8847dae138fba7e9be69d08d

Download Submit
\Users\Admin\AppData\Roaming\Yinanob Coop Aq\PubSurf\vstdlib_s64.dll

Filesize
1004KB

MD5
21c2ecd34eef7e95016e43fffd704d22

SHA1
5cc5a0305866cca388a80b9f060289c00c5ffc44

SHA256
00fd5db000b6b591e4a843351f31216ddc120d0c417c7174d67027d65f7e9bfc

SHA512
0738b4f562725425f1623b898ce7f744893ca979b492fc6ea4967b01f52386103a4b812a089a17b10bb06cf9da1cd38874e308013c27cd6ad484fe2f1a89b331

Download Submit