Analysis
-
max time kernel
15s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/06/2024, 15:47
Static task
static1
Behavioral task
behavioral1
Sample
factura546532.msi_factura546532.msi_77938.msi
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
factura546532.msi_factura546532.msi_77938.msi
Resource
win10v2004-20240508-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
factura546532.msi_factura546532.msi_77938.msi
-
Size
27.3MB
-
MD5
d5853c4d813b09d80738c808e91675e8
-
SHA1
648867888645fb9c50d2d98ea15f214878e56b46
-
SHA256
8a7559fdc195c6a6bc0ba79ff154c17ca2c8cabbd7f6f5275895caa516448393
-
SHA512
eaed46e72d4fcfad12d10a8d034dfbf0e048792cc0b4aaa317267f9200f06407de8cf83296c520be0603f7b7df0916b597393873d1653922e1e17fcba7f86cc9
-
SSDEEP
393216:Utwqv0kSEeEqwODp2QLALCKip6SGM4srjbPl5RhpvH3LHZEBFis:Q+x2Sxzn9PHPbZEus
Score
6/10
Malware Config
Signatures
-
Blocklisted process makes network request 4 IoCs
flow pid Process 4 2308 MsiExec.exe 7 2308 MsiExec.exe 9 2308 MsiExec.exe 10 2308 MsiExec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 ipinfo.io 4 ipinfo.io -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2308 MsiExec.exe 2308 MsiExec.exe -
Drops file in Windows directory 13 IoCs
description ioc Process File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\f761803.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI1CDE.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1A09.tmp msiexec.exe File created C:\Windows\Installer\f761806.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI1B13.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1BD0.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1BE2.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1C12.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI197C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1870.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI193C.tmp msiexec.exe File created C:\Windows\Installer\f761803.msi msiexec.exe -
Loads dropped DLL 7 IoCs
pid Process 2308 MsiExec.exe 2308 MsiExec.exe 2308 MsiExec.exe 2308 MsiExec.exe 2308 MsiExec.exe 2308 MsiExec.exe 2308 MsiExec.exe -
Event Triggered Execution: Installer Packages 1 TTPs 1 IoCs
pid Process 2324 msiexec.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 3048 msiexec.exe 3048 msiexec.exe 2308 MsiExec.exe -
Suspicious use of AdjustPrivilegeToken 60 IoCs
description pid Process Token: SeShutdownPrivilege 2324 msiexec.exe Token: SeIncreaseQuotaPrivilege 2324 msiexec.exe Token: SeRestorePrivilege 3048 msiexec.exe Token: SeTakeOwnershipPrivilege 3048 msiexec.exe Token: SeSecurityPrivilege 3048 msiexec.exe Token: SeCreateTokenPrivilege 2324 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2324 msiexec.exe Token: SeLockMemoryPrivilege 2324 msiexec.exe Token: SeIncreaseQuotaPrivilege 2324 msiexec.exe Token: SeMachineAccountPrivilege 2324 msiexec.exe Token: SeTcbPrivilege 2324 msiexec.exe Token: SeSecurityPrivilege 2324 msiexec.exe Token: SeTakeOwnershipPrivilege 2324 msiexec.exe Token: SeLoadDriverPrivilege 2324 msiexec.exe Token: SeSystemProfilePrivilege 2324 msiexec.exe Token: SeSystemtimePrivilege 2324 msiexec.exe Token: SeProfSingleProcessPrivilege 2324 msiexec.exe Token: SeIncBasePriorityPrivilege 2324 msiexec.exe Token: SeCreatePagefilePrivilege 2324 msiexec.exe Token: SeCreatePermanentPrivilege 2324 msiexec.exe Token: SeBackupPrivilege 2324 msiexec.exe Token: SeRestorePrivilege 2324 msiexec.exe Token: SeShutdownPrivilege 2324 msiexec.exe Token: SeDebugPrivilege 2324 msiexec.exe Token: SeAuditPrivilege 2324 msiexec.exe Token: SeSystemEnvironmentPrivilege 2324 msiexec.exe Token: SeChangeNotifyPrivilege 2324 msiexec.exe Token: SeRemoteShutdownPrivilege 2324 msiexec.exe Token: SeUndockPrivilege 2324 msiexec.exe Token: SeSyncAgentPrivilege 2324 msiexec.exe Token: SeEnableDelegationPrivilege 2324 msiexec.exe Token: SeManageVolumePrivilege 2324 msiexec.exe Token: SeImpersonatePrivilege 2324 msiexec.exe Token: SeCreateGlobalPrivilege 2324 msiexec.exe Token: SeRestorePrivilege 3048 msiexec.exe Token: SeTakeOwnershipPrivilege 3048 msiexec.exe Token: SeRestorePrivilege 3048 msiexec.exe Token: SeTakeOwnershipPrivilege 3048 msiexec.exe Token: SeRestorePrivilege 3048 msiexec.exe Token: SeTakeOwnershipPrivilege 3048 msiexec.exe Token: SeRestorePrivilege 3048 msiexec.exe Token: SeTakeOwnershipPrivilege 3048 msiexec.exe Token: SeRestorePrivilege 3048 msiexec.exe Token: SeTakeOwnershipPrivilege 3048 msiexec.exe Token: SeSecurityPrivilege 2308 MsiExec.exe Token: SeRestorePrivilege 2308 MsiExec.exe Token: SeRestorePrivilege 3048 msiexec.exe Token: SeTakeOwnershipPrivilege 3048 msiexec.exe Token: SeRestorePrivilege 3048 msiexec.exe Token: SeTakeOwnershipPrivilege 3048 msiexec.exe Token: SeRestorePrivilege 3048 msiexec.exe Token: SeTakeOwnershipPrivilege 3048 msiexec.exe Token: SeRestorePrivilege 3048 msiexec.exe Token: SeTakeOwnershipPrivilege 3048 msiexec.exe Token: SeRestorePrivilege 3048 msiexec.exe Token: SeTakeOwnershipPrivilege 3048 msiexec.exe Token: SeRestorePrivilege 3048 msiexec.exe Token: SeTakeOwnershipPrivilege 3048 msiexec.exe Token: SeRestorePrivilege 3048 msiexec.exe Token: SeTakeOwnershipPrivilege 3048 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2324 msiexec.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3048 wrote to memory of 2308 3048 msiexec.exe 29 PID 3048 wrote to memory of 2308 3048 msiexec.exe 29 PID 3048 wrote to memory of 2308 3048 msiexec.exe 29 PID 3048 wrote to memory of 2308 3048 msiexec.exe 29 PID 3048 wrote to memory of 2308 3048 msiexec.exe 29 PID 3048 wrote to memory of 2308 3048 msiexec.exe 29 PID 3048 wrote to memory of 2308 3048 msiexec.exe 29
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\factura546532.msi_factura546532.msi_77938.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2324
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5C9F91E924FC0E43257417811C03A35F2⤵
- Blocklisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2308
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
867KB
MD519969c19c98a3459ebeb8f6d31ef4bb6
SHA1899ee8eff774c5440a2b906e05d11258e0d81707
SHA2568cea66c4bd7b03666a88e80791edb015df847381702a356eae0c2f8b6dd08e71
SHA512c3776a4a564c2f9aa0fd89e39ea93e0508029677e5945c99daf74977026255b01630e9cb0c3513b136b2902a19c3aea506364bb1a2858ca73695021a0749ada4
-
Filesize
24.5MB
MD59d51a5943e208abd91ffbd53b45fae82
SHA10d7f07df15f78070f4744880fa2654f26135b906
SHA256f3e25ef103db5d307e3fdb36d9f08246e1d4f3a8418f1f519ffbceb6dd1e8870
SHA512c6b3f7a0c1b51630ca5188a1b17327e629f65f2531709a9efb4224c1742843bb87bc40776cc0af38c7a70588525cd3d98b2a9646afc1cef464b7a94824688320
-
Filesize
738KB
MD5b158d8d605571ea47a238df5ab43dfaa
SHA1bb91ae1f2f7142b9099e3cc285f4f5b84de568e4
SHA256ca763693cc25d316f14a9ebad80ebf00590329550c45adb7e5205486533c2504
SHA51256aef59c198acf2fcd0d95ea6e32ce1c706e5098a0800feff13ddb427bfb4d538de1c415a5cb5496b09a5825155e3abb1c13c8c37dc31549604bd4d63cb70591