Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
27-07-2024 01:34
Static task
static1
Behavioral task
behavioral1
Sample
c4455930a4ee15f3a7abecc4b0dc97911baf6b65b625849bc309fda3929432b4.msi
Resource
win7-20240708-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
c4455930a4ee15f3a7abecc4b0dc97911baf6b65b625849bc309fda3929432b4.msi
Resource
win10v2004-20240709-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
c4455930a4ee15f3a7abecc4b0dc97911baf6b65b625849bc309fda3929432b4.msi
-
Size
1.5MB
-
MD5
1ab7db273d2431aed5d5bab9c1847246
-
SHA1
95393b511fad6e7017f3a7c57014004a2ebca17d
-
SHA256
c4455930a4ee15f3a7abecc4b0dc97911baf6b65b625849bc309fda3929432b4
-
SHA512
50add971d394ccbc31b145466ebc8611b6e030d69de0bf2475175ceedf2426f1460ca6c0d0d8ff8d216c557e03fca2788b75c80e161fcf934649cc42f9946d08
-
SSDEEP
24576:DKxfS0jEhnJ/mhGd6NFTzqh0lhSMXlTnD55U0zjjZqKtaTakjWCtFGuUK7XgW2:DiycFTznj95U0zjjZZtmzjRGuUK75
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe -
Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI60A8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI61B2.tmp msiexec.exe File created C:\Windows\Installer\f775bf8.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\f775bf5.msi msiexec.exe File opened for modification C:\Windows\Installer\f775bf5.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI67BB.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\Installer\MSI5D0E.tmp msiexec.exe File opened for modification C:\Windows\Installer\f775bf8.ipi msiexec.exe -
Loads dropped DLL 4 IoCs
pid Process 1364 MsiExec.exe 1364 MsiExec.exe 1364 MsiExec.exe 1364 MsiExec.exe -
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2984 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe -
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 620 msiexec.exe 620 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2984 msiexec.exe Token: SeIncreaseQuotaPrivilege 2984 msiexec.exe Token: SeRestorePrivilege 620 msiexec.exe Token: SeTakeOwnershipPrivilege 620 msiexec.exe Token: SeSecurityPrivilege 620 msiexec.exe Token: SeCreateTokenPrivilege 2984 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2984 msiexec.exe Token: SeLockMemoryPrivilege 2984 msiexec.exe Token: SeIncreaseQuotaPrivilege 2984 msiexec.exe Token: SeMachineAccountPrivilege 2984 msiexec.exe Token: SeTcbPrivilege 2984 msiexec.exe Token: SeSecurityPrivilege 2984 msiexec.exe Token: SeTakeOwnershipPrivilege 2984 msiexec.exe Token: SeLoadDriverPrivilege 2984 msiexec.exe Token: SeSystemProfilePrivilege 2984 msiexec.exe Token: SeSystemtimePrivilege 2984 msiexec.exe Token: SeProfSingleProcessPrivilege 2984 msiexec.exe Token: SeIncBasePriorityPrivilege 2984 msiexec.exe Token: SeCreatePagefilePrivilege 2984 msiexec.exe Token: SeCreatePermanentPrivilege 2984 msiexec.exe Token: SeBackupPrivilege 2984 msiexec.exe Token: SeRestorePrivilege 2984 msiexec.exe Token: SeShutdownPrivilege 2984 msiexec.exe Token: SeDebugPrivilege 2984 msiexec.exe Token: SeAuditPrivilege 2984 msiexec.exe Token: SeSystemEnvironmentPrivilege 2984 msiexec.exe Token: SeChangeNotifyPrivilege 2984 msiexec.exe Token: SeRemoteShutdownPrivilege 2984 msiexec.exe Token: SeUndockPrivilege 2984 msiexec.exe Token: SeSyncAgentPrivilege 2984 msiexec.exe Token: SeEnableDelegationPrivilege 2984 msiexec.exe Token: SeManageVolumePrivilege 2984 msiexec.exe Token: SeImpersonatePrivilege 2984 msiexec.exe Token: SeCreateGlobalPrivilege 2984 msiexec.exe Token: SeBackupPrivilege 236 vssvc.exe Token: SeRestorePrivilege 236 vssvc.exe Token: SeAuditPrivilege 236 vssvc.exe Token: SeBackupPrivilege 620 msiexec.exe Token: SeRestorePrivilege 620 msiexec.exe Token: SeRestorePrivilege 2720 DrvInst.exe Token: SeRestorePrivilege 2720 DrvInst.exe Token: SeRestorePrivilege 2720 DrvInst.exe Token: SeRestorePrivilege 2720 DrvInst.exe Token: SeRestorePrivilege 2720 DrvInst.exe Token: SeRestorePrivilege 2720 DrvInst.exe Token: SeRestorePrivilege 2720 DrvInst.exe Token: SeLoadDriverPrivilege 2720 DrvInst.exe Token: SeLoadDriverPrivilege 2720 DrvInst.exe Token: SeLoadDriverPrivilege 2720 DrvInst.exe Token: SeRestorePrivilege 620 msiexec.exe Token: SeTakeOwnershipPrivilege 620 msiexec.exe Token: SeRestorePrivilege 620 msiexec.exe Token: SeTakeOwnershipPrivilege 620 msiexec.exe Token: SeRestorePrivilege 620 msiexec.exe Token: SeTakeOwnershipPrivilege 620 msiexec.exe Token: SeRestorePrivilege 620 msiexec.exe Token: SeTakeOwnershipPrivilege 620 msiexec.exe Token: SeRestorePrivilege 620 msiexec.exe Token: SeTakeOwnershipPrivilege 620 msiexec.exe Token: SeRestorePrivilege 620 msiexec.exe Token: SeTakeOwnershipPrivilege 620 msiexec.exe Token: SeRestorePrivilege 620 msiexec.exe Token: SeTakeOwnershipPrivilege 620 msiexec.exe Token: SeRestorePrivilege 620 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2984 msiexec.exe 2984 msiexec.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 620 wrote to memory of 1364 620 msiexec.exe 35 PID 620 wrote to memory of 1364 620 msiexec.exe 35 PID 620 wrote to memory of 1364 620 msiexec.exe 35 PID 620 wrote to memory of 1364 620 msiexec.exe 35 PID 620 wrote to memory of 1364 620 msiexec.exe 35 PID 620 wrote to memory of 1364 620 msiexec.exe 35 PID 620 wrote to memory of 1364 620 msiexec.exe 35 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\c4455930a4ee15f3a7abecc4b0dc97911baf6b65b625849bc309fda3929432b4.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2984
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A37199347DE931B1E1CF46B72E194EA52⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1364
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:236
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000002FC" "00000000000005E0"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2720
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
995B
MD521379fb650cc9ae35643d27a8ce279ff
SHA1eda18eeaf7ebab1a5aaecc907390a93645ac5043
SHA256056d19c7ed0dfd7af62b8d4fc84db2e56d1035d8b554b7de00eecf298ef8aa2f
SHA51240a534857815f588648f22cf132a1d3840c2710f7aec070840ec9d0d6bc83e541bd013da836d3e338b845a48fba5ed60168890996d0df0ffd70a470a77c694c4
-
Filesize
2.5MB
MD50e8161c93aa083c2649182ec398e5a27
SHA1fa0ae74e18b45378f0c7abb1b8a080a1702e6efb
SHA256522b7a28eb6cfdf01c631f6007f46cabf2578d82a3ef027cd33c69628ed2fd97
SHA51203920f59200d44710d035768970f51a896601ac6bbf7543823dda81949d5e80f7c083a2cc548226d86fdf837a957ed62ac7d4d2326e5176fb83da79d8b6f5a5b
-
Filesize
738KB
MD58e65fea37f700d948d1b67afd43b97fc
SHA1823d2b30ec0372e0dc36f7983ad2de1ceda4036c
SHA25620c648a2a4313b1b20da50a9b788d8a1b9637e154adae4541b65badaa40266c9
SHA51207faf03685fde9c71f6bc4b3caecfe4d3c707a8bec5bce1a544f59c1f853edde8f37c019c16bffd3e8fbe5c72c0666ffe0e2dffd878744da64f47e52c7625084