Analysis
-
max time kernel
554s -
max time network
369s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
08/07/2024, 17:23
Static task
static1
Behavioral task
behavioral1
Sample
Nextcloud-3.13.0-x64.msi
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral2
Sample
Nextcloud-3.13.0-x64.msi
Resource
win10v2004-20240704-en
windows10-2004-x64
General
-
Target
Nextcloud-3.13.0-x64.msi
-
Size
108.1MB
-
MD5
114c21c4f75b276f4cbfe689adb1c90e
-
SHA1
e4e894deba34059dd2c3b20983a36a5afc4c3df3
-
SHA256
0b28c27158794156bc42ddd90bb8a5911cf930e3e4c2fda10221503a1511269a
-
SHA512
60ca85e6185fa49002701c747d9f8662c98fd71b90bfe622f70c7e2a2b7a057c4753e2b8c903b44c510a311607c483fcb2f0929810e92b312108de1662de769f
-
SSDEEP
3145728:La0CVWXnQjr6sZBvX4CrT4XNCNurVDWNgGidVYE:La0m+w6clFrvUhWNgGcB
Malware Config
Signatures
-
Blocklisted process makes network request 3 IoCs
flow pid Process 3 3020 msiexec.exe 5 3020 msiexec.exe 7 3020 msiexec.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe -
Event Triggered Execution: Installer Packages 1 TTPs 1 IoCs
pid Process 3020 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeShutdownPrivilege 3020 msiexec.exe Token: SeIncreaseQuotaPrivilege 3020 msiexec.exe Token: SeRestorePrivilege 2884 msiexec.exe Token: SeTakeOwnershipPrivilege 2884 msiexec.exe Token: SeSecurityPrivilege 2884 msiexec.exe Token: SeCreateTokenPrivilege 3020 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3020 msiexec.exe Token: SeLockMemoryPrivilege 3020 msiexec.exe Token: SeIncreaseQuotaPrivilege 3020 msiexec.exe Token: SeMachineAccountPrivilege 3020 msiexec.exe Token: SeTcbPrivilege 3020 msiexec.exe Token: SeSecurityPrivilege 3020 msiexec.exe Token: SeTakeOwnershipPrivilege 3020 msiexec.exe Token: SeLoadDriverPrivilege 3020 msiexec.exe Token: SeSystemProfilePrivilege 3020 msiexec.exe Token: SeSystemtimePrivilege 3020 msiexec.exe Token: SeProfSingleProcessPrivilege 3020 msiexec.exe Token: SeIncBasePriorityPrivilege 3020 msiexec.exe Token: SeCreatePagefilePrivilege 3020 msiexec.exe Token: SeCreatePermanentPrivilege 3020 msiexec.exe Token: SeBackupPrivilege 3020 msiexec.exe Token: SeRestorePrivilege 3020 msiexec.exe Token: SeShutdownPrivilege 3020 msiexec.exe Token: SeDebugPrivilege 3020 msiexec.exe Token: SeAuditPrivilege 3020 msiexec.exe Token: SeSystemEnvironmentPrivilege 3020 msiexec.exe Token: SeChangeNotifyPrivilege 3020 msiexec.exe Token: SeRemoteShutdownPrivilege 3020 msiexec.exe Token: SeUndockPrivilege 3020 msiexec.exe Token: SeSyncAgentPrivilege 3020 msiexec.exe Token: SeEnableDelegationPrivilege 3020 msiexec.exe Token: SeManageVolumePrivilege 3020 msiexec.exe Token: SeImpersonatePrivilege 3020 msiexec.exe Token: SeCreateGlobalPrivilege 3020 msiexec.exe Token: SeBackupPrivilege 2676 vssvc.exe Token: SeRestorePrivilege 2676 vssvc.exe Token: SeAuditPrivilege 2676 vssvc.exe Token: SeBackupPrivilege 2884 msiexec.exe Token: SeRestorePrivilege 2884 msiexec.exe Token: SeRestorePrivilege 2180 msiexec.exe Token: SeTakeOwnershipPrivilege 2180 msiexec.exe Token: SeSecurityPrivilege 2180 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3020 msiexec.exe 3020 msiexec.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2884 wrote to memory of 1736 2884 msiexec.exe 34 PID 2884 wrote to memory of 1736 2884 msiexec.exe 34 PID 2884 wrote to memory of 1736 2884 msiexec.exe 34 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Nextcloud-3.13.0-x64.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3020
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2884 -s 8682⤵PID:1736
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2676
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2180
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b