Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
27/07/2024, 10:31
Static task
static1
Behavioral task
behavioral1
Sample
c4455930a4ee15f3a7abecc4b0dc97911baf6b65b625849bc309fda3929432b4.msi
Resource
win7-20240708-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
c4455930a4ee15f3a7abecc4b0dc97911baf6b65b625849bc309fda3929432b4.msi
Resource
win10v2004-20240709-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
c4455930a4ee15f3a7abecc4b0dc97911baf6b65b625849bc309fda3929432b4.msi
-
Size
1.5MB
-
MD5
1ab7db273d2431aed5d5bab9c1847246
-
SHA1
95393b511fad6e7017f3a7c57014004a2ebca17d
-
SHA256
c4455930a4ee15f3a7abecc4b0dc97911baf6b65b625849bc309fda3929432b4
-
SHA512
50add971d394ccbc31b145466ebc8611b6e030d69de0bf2475175ceedf2426f1460ca6c0d0d8ff8d216c557e03fca2788b75c80e161fcf934649cc42f9946d08
-
SSDEEP
24576:DKxfS0jEhnJ/mhGd6NFTzqh0lhSMXlTnD55U0zjjZqKtaTakjWCtFGuUK7XgW2:DiycFTznj95U0zjjZZtmzjRGuUK75
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe -
Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\MSIB55B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB6E2.tmp msiexec.exe File created C:\Windows\Installer\f76b500.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File created C:\Windows\Installer\f76b4fd.msi msiexec.exe File opened for modification C:\Windows\Installer\f76b4fd.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIB77F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB9E0.tmp msiexec.exe File opened for modification C:\Windows\Installer\f76b500.ipi msiexec.exe -
Loads dropped DLL 4 IoCs
pid Process 1608 MsiExec.exe 1608 MsiExec.exe 1608 MsiExec.exe 1608 MsiExec.exe -
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2556 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe -
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2752 msiexec.exe 2752 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2556 msiexec.exe Token: SeIncreaseQuotaPrivilege 2556 msiexec.exe Token: SeRestorePrivilege 2752 msiexec.exe Token: SeTakeOwnershipPrivilege 2752 msiexec.exe Token: SeSecurityPrivilege 2752 msiexec.exe Token: SeCreateTokenPrivilege 2556 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2556 msiexec.exe Token: SeLockMemoryPrivilege 2556 msiexec.exe Token: SeIncreaseQuotaPrivilege 2556 msiexec.exe Token: SeMachineAccountPrivilege 2556 msiexec.exe Token: SeTcbPrivilege 2556 msiexec.exe Token: SeSecurityPrivilege 2556 msiexec.exe Token: SeTakeOwnershipPrivilege 2556 msiexec.exe Token: SeLoadDriverPrivilege 2556 msiexec.exe Token: SeSystemProfilePrivilege 2556 msiexec.exe Token: SeSystemtimePrivilege 2556 msiexec.exe Token: SeProfSingleProcessPrivilege 2556 msiexec.exe Token: SeIncBasePriorityPrivilege 2556 msiexec.exe Token: SeCreatePagefilePrivilege 2556 msiexec.exe Token: SeCreatePermanentPrivilege 2556 msiexec.exe Token: SeBackupPrivilege 2556 msiexec.exe Token: SeRestorePrivilege 2556 msiexec.exe Token: SeShutdownPrivilege 2556 msiexec.exe Token: SeDebugPrivilege 2556 msiexec.exe Token: SeAuditPrivilege 2556 msiexec.exe Token: SeSystemEnvironmentPrivilege 2556 msiexec.exe Token: SeChangeNotifyPrivilege 2556 msiexec.exe Token: SeRemoteShutdownPrivilege 2556 msiexec.exe Token: SeUndockPrivilege 2556 msiexec.exe Token: SeSyncAgentPrivilege 2556 msiexec.exe Token: SeEnableDelegationPrivilege 2556 msiexec.exe Token: SeManageVolumePrivilege 2556 msiexec.exe Token: SeImpersonatePrivilege 2556 msiexec.exe Token: SeCreateGlobalPrivilege 2556 msiexec.exe Token: SeBackupPrivilege 2892 vssvc.exe Token: SeRestorePrivilege 2892 vssvc.exe Token: SeAuditPrivilege 2892 vssvc.exe Token: SeBackupPrivilege 2752 msiexec.exe Token: SeRestorePrivilege 2752 msiexec.exe Token: SeRestorePrivilege 2056 DrvInst.exe Token: SeRestorePrivilege 2056 DrvInst.exe Token: SeRestorePrivilege 2056 DrvInst.exe Token: SeRestorePrivilege 2056 DrvInst.exe Token: SeRestorePrivilege 2056 DrvInst.exe Token: SeRestorePrivilege 2056 DrvInst.exe Token: SeRestorePrivilege 2056 DrvInst.exe Token: SeLoadDriverPrivilege 2056 DrvInst.exe Token: SeLoadDriverPrivilege 2056 DrvInst.exe Token: SeLoadDriverPrivilege 2056 DrvInst.exe Token: SeRestorePrivilege 2752 msiexec.exe Token: SeTakeOwnershipPrivilege 2752 msiexec.exe Token: SeRestorePrivilege 2752 msiexec.exe Token: SeTakeOwnershipPrivilege 2752 msiexec.exe Token: SeRestorePrivilege 2752 msiexec.exe Token: SeTakeOwnershipPrivilege 2752 msiexec.exe Token: SeRestorePrivilege 2752 msiexec.exe Token: SeTakeOwnershipPrivilege 2752 msiexec.exe Token: SeRestorePrivilege 2752 msiexec.exe Token: SeTakeOwnershipPrivilege 2752 msiexec.exe Token: SeRestorePrivilege 2752 msiexec.exe Token: SeTakeOwnershipPrivilege 2752 msiexec.exe Token: SeRestorePrivilege 2752 msiexec.exe Token: SeTakeOwnershipPrivilege 2752 msiexec.exe Token: SeRestorePrivilege 2752 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2556 msiexec.exe 2556 msiexec.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2752 wrote to memory of 1608 2752 msiexec.exe 34 PID 2752 wrote to memory of 1608 2752 msiexec.exe 34 PID 2752 wrote to memory of 1608 2752 msiexec.exe 34 PID 2752 wrote to memory of 1608 2752 msiexec.exe 34 PID 2752 wrote to memory of 1608 2752 msiexec.exe 34 PID 2752 wrote to memory of 1608 2752 msiexec.exe 34 PID 2752 wrote to memory of 1608 2752 msiexec.exe 34 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\c4455930a4ee15f3a7abecc4b0dc97911baf6b65b625849bc309fda3929432b4.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2556
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9629C11CC15E1749A73CDDB6D7DBF50E2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1608
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2892
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003E4" "00000000000003D4"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2056
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
995B
MD5a900ec50689a199a888ad3db9881b200
SHA1496d55fe080c1e9c933b39e6a508446e12c29807
SHA256b37d1ae277be2804514c1af8a532fd5abf13e59aad703a345ecea5a34c57fad6
SHA5128715785eae28ca19dabc98fb6db247fa3b9a178b7a8dc4d414096fb1974f8d8ca961c54ffe5cab0e693e2a4b01082ea7109aee3a0b529e8a963e714344762ab1
-
Filesize
2.5MB
MD50e8161c93aa083c2649182ec398e5a27
SHA1fa0ae74e18b45378f0c7abb1b8a080a1702e6efb
SHA256522b7a28eb6cfdf01c631f6007f46cabf2578d82a3ef027cd33c69628ed2fd97
SHA51203920f59200d44710d035768970f51a896601ac6bbf7543823dda81949d5e80f7c083a2cc548226d86fdf837a957ed62ac7d4d2326e5176fb83da79d8b6f5a5b
-
Filesize
738KB
MD58e65fea37f700d948d1b67afd43b97fc
SHA1823d2b30ec0372e0dc36f7983ad2de1ceda4036c
SHA25620c648a2a4313b1b20da50a9b788d8a1b9637e154adae4541b65badaa40266c9
SHA51207faf03685fde9c71f6bc4b3caecfe4d3c707a8bec5bce1a544f59c1f853edde8f37c019c16bffd3e8fbe5c72c0666ffe0e2dffd878744da64f47e52c7625084