Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
01/07/2024, 01:12
Static task
static1
Behavioral task
behavioral1
Sample
8a7559fdc195c6a6bc0ba79ff154c17ca2c8cabbd7f6f5275895caa516448393.msi
Resource
win7-20240611-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
8a7559fdc195c6a6bc0ba79ff154c17ca2c8cabbd7f6f5275895caa516448393.msi
Resource
win10v2004-20240611-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
8a7559fdc195c6a6bc0ba79ff154c17ca2c8cabbd7f6f5275895caa516448393.msi
-
Size
27.3MB
-
MD5
d5853c4d813b09d80738c808e91675e8
-
SHA1
648867888645fb9c50d2d98ea15f214878e56b46
-
SHA256
8a7559fdc195c6a6bc0ba79ff154c17ca2c8cabbd7f6f5275895caa516448393
-
SHA512
eaed46e72d4fcfad12d10a8d034dfbf0e048792cc0b4aaa317267f9200f06407de8cf83296c520be0603f7b7df0916b597393873d1653922e1e17fcba7f86cc9
-
SSDEEP
393216:Utwqv0kSEeEqwODp2QLALCKip6SGM4srjbPl5RhpvH3LHZEBFis:Q+x2Sxzn9PHPbZEus
Score
6/10
Malware Config
Signatures
-
Blocklisted process makes network request 4 IoCs
flow pid Process 28 368 MsiExec.exe 30 368 MsiExec.exe 33 368 MsiExec.exe 40 368 MsiExec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 27 ipinfo.io 28 ipinfo.io -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 368 MsiExec.exe 368 MsiExec.exe -
Drops file in Windows directory 17 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI53EC.tmp msiexec.exe File created C:\Windows\Installer\e575350.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI55B5.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI55F5.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5A2D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5ACA.tmp msiexec.exe File opened for modification C:\Windows\Installer\e575350.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI5499.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI54D9.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{CEA1AFD8-2FC2-42FE-A2CB-822317A26156} msiexec.exe File opened for modification C:\Windows\Installer\MSI56C1.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5537.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI5AEA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5CEF.tmp msiexec.exe -
Loads dropped DLL 9 IoCs
pid Process 368 MsiExec.exe 368 MsiExec.exe 368 MsiExec.exe 368 MsiExec.exe 368 MsiExec.exe 368 MsiExec.exe 368 MsiExec.exe 368 MsiExec.exe 368 MsiExec.exe -
Event Triggered Execution: Installer Packages 1 TTPs 1 IoCs
pid Process 4704 msiexec.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4880 msiexec.exe 4880 msiexec.exe 368 MsiExec.exe 368 MsiExec.exe -
Suspicious use of AdjustPrivilegeToken 62 IoCs
description pid Process Token: SeShutdownPrivilege 4704 msiexec.exe Token: SeIncreaseQuotaPrivilege 4704 msiexec.exe Token: SeSecurityPrivilege 4880 msiexec.exe Token: SeCreateTokenPrivilege 4704 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4704 msiexec.exe Token: SeLockMemoryPrivilege 4704 msiexec.exe Token: SeIncreaseQuotaPrivilege 4704 msiexec.exe Token: SeMachineAccountPrivilege 4704 msiexec.exe Token: SeTcbPrivilege 4704 msiexec.exe Token: SeSecurityPrivilege 4704 msiexec.exe Token: SeTakeOwnershipPrivilege 4704 msiexec.exe Token: SeLoadDriverPrivilege 4704 msiexec.exe Token: SeSystemProfilePrivilege 4704 msiexec.exe Token: SeSystemtimePrivilege 4704 msiexec.exe Token: SeProfSingleProcessPrivilege 4704 msiexec.exe Token: SeIncBasePriorityPrivilege 4704 msiexec.exe Token: SeCreatePagefilePrivilege 4704 msiexec.exe Token: SeCreatePermanentPrivilege 4704 msiexec.exe Token: SeBackupPrivilege 4704 msiexec.exe Token: SeRestorePrivilege 4704 msiexec.exe Token: SeShutdownPrivilege 4704 msiexec.exe Token: SeDebugPrivilege 4704 msiexec.exe Token: SeAuditPrivilege 4704 msiexec.exe Token: SeSystemEnvironmentPrivilege 4704 msiexec.exe Token: SeChangeNotifyPrivilege 4704 msiexec.exe Token: SeRemoteShutdownPrivilege 4704 msiexec.exe Token: SeUndockPrivilege 4704 msiexec.exe Token: SeSyncAgentPrivilege 4704 msiexec.exe Token: SeEnableDelegationPrivilege 4704 msiexec.exe Token: SeManageVolumePrivilege 4704 msiexec.exe Token: SeImpersonatePrivilege 4704 msiexec.exe Token: SeCreateGlobalPrivilege 4704 msiexec.exe Token: SeRestorePrivilege 4880 msiexec.exe Token: SeTakeOwnershipPrivilege 4880 msiexec.exe Token: SeRestorePrivilege 4880 msiexec.exe Token: SeTakeOwnershipPrivilege 4880 msiexec.exe Token: SeRestorePrivilege 4880 msiexec.exe Token: SeTakeOwnershipPrivilege 4880 msiexec.exe Token: SeRestorePrivilege 4880 msiexec.exe Token: SeTakeOwnershipPrivilege 4880 msiexec.exe Token: SeRestorePrivilege 4880 msiexec.exe Token: SeTakeOwnershipPrivilege 4880 msiexec.exe Token: SeRestorePrivilege 4880 msiexec.exe Token: SeTakeOwnershipPrivilege 4880 msiexec.exe Token: SeRestorePrivilege 4880 msiexec.exe Token: SeTakeOwnershipPrivilege 4880 msiexec.exe Token: SeSecurityPrivilege 368 MsiExec.exe Token: SeRestorePrivilege 368 MsiExec.exe Token: SeRestorePrivilege 4880 msiexec.exe Token: SeTakeOwnershipPrivilege 4880 msiexec.exe Token: SeRestorePrivilege 4880 msiexec.exe Token: SeTakeOwnershipPrivilege 4880 msiexec.exe Token: SeRestorePrivilege 4880 msiexec.exe Token: SeTakeOwnershipPrivilege 4880 msiexec.exe Token: SeRestorePrivilege 4880 msiexec.exe Token: SeTakeOwnershipPrivilege 4880 msiexec.exe Token: SeRestorePrivilege 4880 msiexec.exe Token: SeTakeOwnershipPrivilege 4880 msiexec.exe Token: SeRestorePrivilege 4880 msiexec.exe Token: SeTakeOwnershipPrivilege 4880 msiexec.exe Token: SeRestorePrivilege 4880 msiexec.exe Token: SeTakeOwnershipPrivilege 4880 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4704 msiexec.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4880 wrote to memory of 368 4880 msiexec.exe 85 PID 4880 wrote to memory of 368 4880 msiexec.exe 85 PID 4880 wrote to memory of 368 4880 msiexec.exe 85
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\8a7559fdc195c6a6bc0ba79ff154c17ca2c8cabbd7f6f5275895caa516448393.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4704
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1A59402A36E54F1C6D0641209BA350DC2⤵
- Blocklisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:368
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
738KB
MD5b158d8d605571ea47a238df5ab43dfaa
SHA1bb91ae1f2f7142b9099e3cc285f4f5b84de568e4
SHA256ca763693cc25d316f14a9ebad80ebf00590329550c45adb7e5205486533c2504
SHA51256aef59c198acf2fcd0d95ea6e32ce1c706e5098a0800feff13ddb427bfb4d538de1c415a5cb5496b09a5825155e3abb1c13c8c37dc31549604bd4d63cb70591
-
Filesize
867KB
MD519969c19c98a3459ebeb8f6d31ef4bb6
SHA1899ee8eff774c5440a2b906e05d11258e0d81707
SHA2568cea66c4bd7b03666a88e80791edb015df847381702a356eae0c2f8b6dd08e71
SHA512c3776a4a564c2f9aa0fd89e39ea93e0508029677e5945c99daf74977026255b01630e9cb0c3513b136b2902a19c3aea506364bb1a2858ca73695021a0749ada4
-
Filesize
24.5MB
MD59d51a5943e208abd91ffbd53b45fae82
SHA10d7f07df15f78070f4744880fa2654f26135b906
SHA256f3e25ef103db5d307e3fdb36d9f08246e1d4f3a8418f1f519ffbceb6dd1e8870
SHA512c6b3f7a0c1b51630ca5188a1b17327e629f65f2531709a9efb4224c1742843bb87bc40776cc0af38c7a70588525cd3d98b2a9646afc1cef464b7a94824688320