Analysis
-
max time kernel
46s -
max time network
37s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
05-07-2024 16:00
Static task
static1
Behavioral task
behavioral1
Sample
Custom Theme.msi
Resource
win7-20240704-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
Custom Theme.msi
Resource
win10v2004-20240704-en
windows10-2004-x64
16 signatures
150 seconds
General
-
Target
Custom Theme.msi
-
Size
1.9MB
-
MD5
3a6d228f64408b62459124daf05bb83f
-
SHA1
a0c43230ae4eb0611052b78053214a5e8898a9a4
-
SHA256
90673e8a84408b0bf7c029cf6b3c1394a52bb32f318770a0328d7904256e7643
-
SHA512
1cfc629d234cb97a40c154a3beeef2f822bbf86c6d90c8df026cf249afd6b7b062ce7a0f6f1b8e787a3972848b42b5320c1ed7ff99c91e00c1d494d412c52c13
-
SSDEEP
24576:IxoNa2uPYAGxUherZNh0lhSMXlrI5s2JK5kmwy0CfKAe7:9GP5Ferq7I5RJK5k1jCfKAe7
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe -
Loads dropped DLL 5 IoCs
pid Process 2712 MsiExec.exe 2712 MsiExec.exe 2712 MsiExec.exe 2712 MsiExec.exe 2712 MsiExec.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1756 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1756 vlc.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2720 msiexec.exe Token: SeIncreaseQuotaPrivilege 2720 msiexec.exe Token: SeRestorePrivilege 2852 msiexec.exe Token: SeTakeOwnershipPrivilege 2852 msiexec.exe Token: SeSecurityPrivilege 2852 msiexec.exe Token: SeCreateTokenPrivilege 2720 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2720 msiexec.exe Token: SeLockMemoryPrivilege 2720 msiexec.exe Token: SeIncreaseQuotaPrivilege 2720 msiexec.exe Token: SeMachineAccountPrivilege 2720 msiexec.exe Token: SeTcbPrivilege 2720 msiexec.exe Token: SeSecurityPrivilege 2720 msiexec.exe Token: SeTakeOwnershipPrivilege 2720 msiexec.exe Token: SeLoadDriverPrivilege 2720 msiexec.exe Token: SeSystemProfilePrivilege 2720 msiexec.exe Token: SeSystemtimePrivilege 2720 msiexec.exe Token: SeProfSingleProcessPrivilege 2720 msiexec.exe Token: SeIncBasePriorityPrivilege 2720 msiexec.exe Token: SeCreatePagefilePrivilege 2720 msiexec.exe Token: SeCreatePermanentPrivilege 2720 msiexec.exe Token: SeBackupPrivilege 2720 msiexec.exe Token: SeRestorePrivilege 2720 msiexec.exe Token: SeShutdownPrivilege 2720 msiexec.exe Token: SeDebugPrivilege 2720 msiexec.exe Token: SeAuditPrivilege 2720 msiexec.exe Token: SeSystemEnvironmentPrivilege 2720 msiexec.exe Token: SeChangeNotifyPrivilege 2720 msiexec.exe Token: SeRemoteShutdownPrivilege 2720 msiexec.exe Token: SeUndockPrivilege 2720 msiexec.exe Token: SeSyncAgentPrivilege 2720 msiexec.exe Token: SeEnableDelegationPrivilege 2720 msiexec.exe Token: SeManageVolumePrivilege 2720 msiexec.exe Token: SeImpersonatePrivilege 2720 msiexec.exe Token: SeCreateGlobalPrivilege 2720 msiexec.exe Token: SeCreateTokenPrivilege 2720 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2720 msiexec.exe Token: SeLockMemoryPrivilege 2720 msiexec.exe Token: SeIncreaseQuotaPrivilege 2720 msiexec.exe Token: SeMachineAccountPrivilege 2720 msiexec.exe Token: SeTcbPrivilege 2720 msiexec.exe Token: SeSecurityPrivilege 2720 msiexec.exe Token: SeTakeOwnershipPrivilege 2720 msiexec.exe Token: SeLoadDriverPrivilege 2720 msiexec.exe Token: SeSystemProfilePrivilege 2720 msiexec.exe Token: SeSystemtimePrivilege 2720 msiexec.exe Token: SeProfSingleProcessPrivilege 2720 msiexec.exe Token: SeIncBasePriorityPrivilege 2720 msiexec.exe Token: SeCreatePagefilePrivilege 2720 msiexec.exe Token: SeCreatePermanentPrivilege 2720 msiexec.exe Token: SeBackupPrivilege 2720 msiexec.exe Token: SeRestorePrivilege 2720 msiexec.exe Token: SeShutdownPrivilege 2720 msiexec.exe Token: SeDebugPrivilege 2720 msiexec.exe Token: SeAuditPrivilege 2720 msiexec.exe Token: SeSystemEnvironmentPrivilege 2720 msiexec.exe Token: SeChangeNotifyPrivilege 2720 msiexec.exe Token: SeRemoteShutdownPrivilege 2720 msiexec.exe Token: SeUndockPrivilege 2720 msiexec.exe Token: SeSyncAgentPrivilege 2720 msiexec.exe Token: SeEnableDelegationPrivilege 2720 msiexec.exe Token: SeManageVolumePrivilege 2720 msiexec.exe Token: SeImpersonatePrivilege 2720 msiexec.exe Token: SeCreateGlobalPrivilege 2720 msiexec.exe Token: SeCreateTokenPrivilege 2720 msiexec.exe -
Suspicious use of FindShellTrayWindow 11 IoCs
pid Process 2720 msiexec.exe 2720 msiexec.exe 1756 vlc.exe 1756 vlc.exe 1756 vlc.exe 1756 vlc.exe 1756 vlc.exe 1756 vlc.exe 1756 vlc.exe 1756 vlc.exe 1756 vlc.exe -
Suspicious use of SendNotifyMessage 8 IoCs
pid Process 1756 vlc.exe 1756 vlc.exe 1756 vlc.exe 1756 vlc.exe 1756 vlc.exe 1756 vlc.exe 1756 vlc.exe 1756 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1756 vlc.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2852 wrote to memory of 2712 2852 msiexec.exe 31 PID 2852 wrote to memory of 2712 2852 msiexec.exe 31 PID 2852 wrote to memory of 2712 2852 msiexec.exe 31 PID 2852 wrote to memory of 2712 2852 msiexec.exe 31 PID 2852 wrote to memory of 2712 2852 msiexec.exe 31 PID 2852 wrote to memory of 2712 2852 msiexec.exe 31 PID 2852 wrote to memory of 2712 2852 msiexec.exe 31 PID 2852 wrote to memory of 2172 2852 msiexec.exe 34 PID 2852 wrote to memory of 2172 2852 msiexec.exe 34 PID 2852 wrote to memory of 2172 2852 msiexec.exe 34 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\Custom Theme.msi"1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2720
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9953D91CA824B7DC6ED029FC717D46A7 C2⤵
- Loads dropped DLL
PID:2712
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2852 -s 8882⤵PID:2172
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:2592
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:3016
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\ConfirmInstall.WTV"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1756
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
904KB
MD5421643ee7bb89e6df092bc4b18a40ff8
SHA1e801582a6dd358060a699c9c5cde31cd07ee49ab
SHA256d6b89fd5a95071e7b144d8bedcb09b694e9cd14bfbfafb782b17cf8413eac6da
SHA512d59c4ec7690e535da84f94bef2be7f94d6bfd0b2908fa9a67d0897abe8a2825fd52354c495ea1a7f133f727c2ee356869cc80bacf5557864d535a72d8c396023