Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
30-06-2024 10:01
Static task
static1
Behavioral task
behavioral1
Sample
8a7559fdc195c6a6bc0ba79ff154c17ca2c8cabbd7f6f5275895caa516448393.msi
Resource
win7-20240508-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
8a7559fdc195c6a6bc0ba79ff154c17ca2c8cabbd7f6f5275895caa516448393.msi
Resource
win10v2004-20240611-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
8a7559fdc195c6a6bc0ba79ff154c17ca2c8cabbd7f6f5275895caa516448393.msi
-
Size
27.3MB
-
MD5
d5853c4d813b09d80738c808e91675e8
-
SHA1
648867888645fb9c50d2d98ea15f214878e56b46
-
SHA256
8a7559fdc195c6a6bc0ba79ff154c17ca2c8cabbd7f6f5275895caa516448393
-
SHA512
eaed46e72d4fcfad12d10a8d034dfbf0e048792cc0b4aaa317267f9200f06407de8cf83296c520be0603f7b7df0916b597393873d1653922e1e17fcba7f86cc9
-
SSDEEP
393216:Utwqv0kSEeEqwODp2QLALCKip6SGM4srjbPl5RhpvH3LHZEBFis:Q+x2Sxzn9PHPbZEus
Score
6/10
Malware Config
Signatures
-
Blocklisted process makes network request 4 IoCs
flow pid Process 31 3768 MsiExec.exe 34 3768 MsiExec.exe 38 3768 MsiExec.exe 41 3768 MsiExec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 30 ipinfo.io 31 ipinfo.io -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 3768 MsiExec.exe 3768 MsiExec.exe -
Drops file in Windows directory 17 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI4190.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{CEA1AFD8-2FC2-42FE-A2CB-822317A26156} msiexec.exe File opened for modification C:\Windows\Installer\MSI4676.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI46D6.tmp msiexec.exe File created C:\Windows\Installer\e573fd8.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI4035.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI429C.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\e573fd8.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI40D3.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI420E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI43A6.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI4131.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI4696.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI47D1.tmp msiexec.exe -
Loads dropped DLL 9 IoCs
pid Process 3768 MsiExec.exe 3768 MsiExec.exe 3768 MsiExec.exe 3768 MsiExec.exe 3768 MsiExec.exe 3768 MsiExec.exe 3768 MsiExec.exe 3768 MsiExec.exe 3768 MsiExec.exe -
Event Triggered Execution: Installer Packages 1 TTPs 1 IoCs
pid Process 4344 msiexec.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4804 msiexec.exe 4804 msiexec.exe 3768 MsiExec.exe 3768 MsiExec.exe -
Suspicious use of AdjustPrivilegeToken 62 IoCs
description pid Process Token: SeShutdownPrivilege 4344 msiexec.exe Token: SeIncreaseQuotaPrivilege 4344 msiexec.exe Token: SeSecurityPrivilege 4804 msiexec.exe Token: SeCreateTokenPrivilege 4344 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4344 msiexec.exe Token: SeLockMemoryPrivilege 4344 msiexec.exe Token: SeIncreaseQuotaPrivilege 4344 msiexec.exe Token: SeMachineAccountPrivilege 4344 msiexec.exe Token: SeTcbPrivilege 4344 msiexec.exe Token: SeSecurityPrivilege 4344 msiexec.exe Token: SeTakeOwnershipPrivilege 4344 msiexec.exe Token: SeLoadDriverPrivilege 4344 msiexec.exe Token: SeSystemProfilePrivilege 4344 msiexec.exe Token: SeSystemtimePrivilege 4344 msiexec.exe Token: SeProfSingleProcessPrivilege 4344 msiexec.exe Token: SeIncBasePriorityPrivilege 4344 msiexec.exe Token: SeCreatePagefilePrivilege 4344 msiexec.exe Token: SeCreatePermanentPrivilege 4344 msiexec.exe Token: SeBackupPrivilege 4344 msiexec.exe Token: SeRestorePrivilege 4344 msiexec.exe Token: SeShutdownPrivilege 4344 msiexec.exe Token: SeDebugPrivilege 4344 msiexec.exe Token: SeAuditPrivilege 4344 msiexec.exe Token: SeSystemEnvironmentPrivilege 4344 msiexec.exe Token: SeChangeNotifyPrivilege 4344 msiexec.exe Token: SeRemoteShutdownPrivilege 4344 msiexec.exe Token: SeUndockPrivilege 4344 msiexec.exe Token: SeSyncAgentPrivilege 4344 msiexec.exe Token: SeEnableDelegationPrivilege 4344 msiexec.exe Token: SeManageVolumePrivilege 4344 msiexec.exe Token: SeImpersonatePrivilege 4344 msiexec.exe Token: SeCreateGlobalPrivilege 4344 msiexec.exe Token: SeRestorePrivilege 4804 msiexec.exe Token: SeTakeOwnershipPrivilege 4804 msiexec.exe Token: SeRestorePrivilege 4804 msiexec.exe Token: SeTakeOwnershipPrivilege 4804 msiexec.exe Token: SeRestorePrivilege 4804 msiexec.exe Token: SeTakeOwnershipPrivilege 4804 msiexec.exe Token: SeRestorePrivilege 4804 msiexec.exe Token: SeTakeOwnershipPrivilege 4804 msiexec.exe Token: SeRestorePrivilege 4804 msiexec.exe Token: SeTakeOwnershipPrivilege 4804 msiexec.exe Token: SeRestorePrivilege 4804 msiexec.exe Token: SeTakeOwnershipPrivilege 4804 msiexec.exe Token: SeRestorePrivilege 4804 msiexec.exe Token: SeTakeOwnershipPrivilege 4804 msiexec.exe Token: SeSecurityPrivilege 3768 MsiExec.exe Token: SeRestorePrivilege 3768 MsiExec.exe Token: SeRestorePrivilege 4804 msiexec.exe Token: SeTakeOwnershipPrivilege 4804 msiexec.exe Token: SeRestorePrivilege 4804 msiexec.exe Token: SeTakeOwnershipPrivilege 4804 msiexec.exe Token: SeRestorePrivilege 4804 msiexec.exe Token: SeTakeOwnershipPrivilege 4804 msiexec.exe Token: SeRestorePrivilege 4804 msiexec.exe Token: SeTakeOwnershipPrivilege 4804 msiexec.exe Token: SeRestorePrivilege 4804 msiexec.exe Token: SeTakeOwnershipPrivilege 4804 msiexec.exe Token: SeRestorePrivilege 4804 msiexec.exe Token: SeTakeOwnershipPrivilege 4804 msiexec.exe Token: SeRestorePrivilege 4804 msiexec.exe Token: SeTakeOwnershipPrivilege 4804 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4344 msiexec.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4804 wrote to memory of 3768 4804 msiexec.exe 86 PID 4804 wrote to memory of 3768 4804 msiexec.exe 86 PID 4804 wrote to memory of 3768 4804 msiexec.exe 86
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\8a7559fdc195c6a6bc0ba79ff154c17ca2c8cabbd7f6f5275895caa516448393.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4344
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 3A08679CDB985F2BD7668DD0CB598BA42⤵
- Blocklisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3768
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
738KB
MD5b158d8d605571ea47a238df5ab43dfaa
SHA1bb91ae1f2f7142b9099e3cc285f4f5b84de568e4
SHA256ca763693cc25d316f14a9ebad80ebf00590329550c45adb7e5205486533c2504
SHA51256aef59c198acf2fcd0d95ea6e32ce1c706e5098a0800feff13ddb427bfb4d538de1c415a5cb5496b09a5825155e3abb1c13c8c37dc31549604bd4d63cb70591
-
Filesize
867KB
MD519969c19c98a3459ebeb8f6d31ef4bb6
SHA1899ee8eff774c5440a2b906e05d11258e0d81707
SHA2568cea66c4bd7b03666a88e80791edb015df847381702a356eae0c2f8b6dd08e71
SHA512c3776a4a564c2f9aa0fd89e39ea93e0508029677e5945c99daf74977026255b01630e9cb0c3513b136b2902a19c3aea506364bb1a2858ca73695021a0749ada4
-
Filesize
24.5MB
MD59d51a5943e208abd91ffbd53b45fae82
SHA10d7f07df15f78070f4744880fa2654f26135b906
SHA256f3e25ef103db5d307e3fdb36d9f08246e1d4f3a8418f1f519ffbceb6dd1e8870
SHA512c6b3f7a0c1b51630ca5188a1b17327e629f65f2531709a9efb4224c1742843bb87bc40776cc0af38c7a70588525cd3d98b2a9646afc1cef464b7a94824688320