Analysis
-
max time kernel
14s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
07-08-2024 12:48
Static task
static1
Behavioral task
behavioral1
Sample
FaturaVivo.pdf96.msi
Resource
win7-20240729-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
FaturaVivo.pdf96.msi
Resource
win10v2004-20240802-en
windows10-2004-x64
16 signatures
150 seconds
Errors
Reason
Machine shutdown
General
-
Target
FaturaVivo.pdf96.msi
-
Size
4.6MB
-
MD5
4d5f7f3d73e21811b607b14070935390
-
SHA1
f8d216641c89ca58df0f5ed0b8543f68f02ef1c9
-
SHA256
cd0d64c504bcb77944ea917ec72d8fd95d2c3c6a073f0b19b2e7beedfa0b85e4
-
SHA512
c0e25f68dc681835021e6238c08ed33430275a520df68d4a831d2788d22a514d44c2803b581ad720ecf1f948318ea9898c63c596de57ff5a18ade73992df59a9
-
SSDEEP
98304:IY5AqbFUXb52TaeHbV7FVAs/i24NaHdAeah32ILTauGLCY4YUR5IhciUHc4kJT:NxUXb5saeHbVBVAsOaHdSQ2BfYY5Kcif
Score
7/10
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bate.cmd msiexec.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\AdminvJhbX© = "\"C:\\AdminvJhbX©\\cWHGr©.exe\"" reg.exe -
Blocklisted process makes network request 1 IoCs
flow pid Process 3 2360 MsiExec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe -
Drops file in Windows directory 8 IoCs
description ioc Process File created C:\Windows\Installer\f76f24b.msi msiexec.exe File opened for modification C:\Windows\Installer\f76f24b.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIF27A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF2E8.tmp msiexec.exe File created C:\Windows\Installer\f76f24e.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIF402.tmp msiexec.exe File opened for modification C:\Windows\Installer\f76f24e.ipi msiexec.exe -
Loads dropped DLL 2 IoCs
pid Process 2360 MsiExec.exe 2360 MsiExec.exe -
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2544 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language shutdown.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 1528 reg.exe -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 3 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2516 msiexec.exe 2516 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 50 IoCs
description pid Process Token: SeShutdownPrivilege 2544 msiexec.exe Token: SeIncreaseQuotaPrivilege 2544 msiexec.exe Token: SeRestorePrivilege 2516 msiexec.exe Token: SeTakeOwnershipPrivilege 2516 msiexec.exe Token: SeSecurityPrivilege 2516 msiexec.exe Token: SeCreateTokenPrivilege 2544 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2544 msiexec.exe Token: SeLockMemoryPrivilege 2544 msiexec.exe Token: SeIncreaseQuotaPrivilege 2544 msiexec.exe Token: SeMachineAccountPrivilege 2544 msiexec.exe Token: SeTcbPrivilege 2544 msiexec.exe Token: SeSecurityPrivilege 2544 msiexec.exe Token: SeTakeOwnershipPrivilege 2544 msiexec.exe Token: SeLoadDriverPrivilege 2544 msiexec.exe Token: SeSystemProfilePrivilege 2544 msiexec.exe Token: SeSystemtimePrivilege 2544 msiexec.exe Token: SeProfSingleProcessPrivilege 2544 msiexec.exe Token: SeIncBasePriorityPrivilege 2544 msiexec.exe Token: SeCreatePagefilePrivilege 2544 msiexec.exe Token: SeCreatePermanentPrivilege 2544 msiexec.exe Token: SeBackupPrivilege 2544 msiexec.exe Token: SeRestorePrivilege 2544 msiexec.exe Token: SeShutdownPrivilege 2544 msiexec.exe Token: SeDebugPrivilege 2544 msiexec.exe Token: SeAuditPrivilege 2544 msiexec.exe Token: SeSystemEnvironmentPrivilege 2544 msiexec.exe Token: SeChangeNotifyPrivilege 2544 msiexec.exe Token: SeRemoteShutdownPrivilege 2544 msiexec.exe Token: SeUndockPrivilege 2544 msiexec.exe Token: SeSyncAgentPrivilege 2544 msiexec.exe Token: SeEnableDelegationPrivilege 2544 msiexec.exe Token: SeManageVolumePrivilege 2544 msiexec.exe Token: SeImpersonatePrivilege 2544 msiexec.exe Token: SeCreateGlobalPrivilege 2544 msiexec.exe Token: SeRestorePrivilege 2516 msiexec.exe Token: SeTakeOwnershipPrivilege 2516 msiexec.exe Token: SeRestorePrivilege 2516 msiexec.exe Token: SeTakeOwnershipPrivilege 2516 msiexec.exe Token: SeRestorePrivilege 2516 msiexec.exe Token: SeTakeOwnershipPrivilege 2516 msiexec.exe Token: SeRestorePrivilege 2516 msiexec.exe Token: SeTakeOwnershipPrivilege 2516 msiexec.exe Token: SeRestorePrivilege 2516 msiexec.exe Token: SeTakeOwnershipPrivilege 2516 msiexec.exe Token: SeRestorePrivilege 2516 msiexec.exe Token: SeTakeOwnershipPrivilege 2516 msiexec.exe Token: SeRestorePrivilege 2516 msiexec.exe Token: SeTakeOwnershipPrivilege 2516 msiexec.exe Token: SeShutdownPrivilege 888 shutdown.exe Token: SeRemoteShutdownPrivilege 888 shutdown.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 2544 msiexec.exe 2360 MsiExec.exe 2360 MsiExec.exe 2360 MsiExec.exe 2544 msiexec.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 2516 wrote to memory of 2360 2516 msiexec.exe 32 PID 2516 wrote to memory of 2360 2516 msiexec.exe 32 PID 2516 wrote to memory of 2360 2516 msiexec.exe 32 PID 2516 wrote to memory of 2360 2516 msiexec.exe 32 PID 2516 wrote to memory of 2360 2516 msiexec.exe 32 PID 2516 wrote to memory of 2360 2516 msiexec.exe 32 PID 2516 wrote to memory of 2360 2516 msiexec.exe 32 PID 2360 wrote to memory of 1988 2360 MsiExec.exe 33 PID 2360 wrote to memory of 1988 2360 MsiExec.exe 33 PID 2360 wrote to memory of 1988 2360 MsiExec.exe 33 PID 2360 wrote to memory of 1988 2360 MsiExec.exe 33 PID 2360 wrote to memory of 2892 2360 MsiExec.exe 35 PID 2360 wrote to memory of 2892 2360 MsiExec.exe 35 PID 2360 wrote to memory of 2892 2360 MsiExec.exe 35 PID 2360 wrote to memory of 2892 2360 MsiExec.exe 35 PID 1988 wrote to memory of 1528 1988 cmd.exe 37 PID 1988 wrote to memory of 1528 1988 cmd.exe 37 PID 1988 wrote to memory of 1528 1988 cmd.exe 37 PID 1988 wrote to memory of 1528 1988 cmd.exe 37 PID 2892 wrote to memory of 888 2892 cmd.exe 38 PID 2892 wrote to memory of 888 2892 cmd.exe 38 PID 2892 wrote to memory of 888 2892 cmd.exe 38 PID 2892 wrote to memory of 888 2892 cmd.exe 38
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\FaturaVivo.pdf96.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2544
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Drops startup file
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C129E9568971318C0ED9225738995CCE2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C start /MIN reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "AdminvJhbX©" /t reg_sz /d "\"C:\AdminvJhbX©\cWHGr©.exe\"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\SysWOW64\reg.exereg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "AdminvJhbX©" /t reg_sz /d "\"C:\AdminvJhbX©\cWHGr©.exe\"4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:1528
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C start /MIN shutdown -r -f -t 003⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Windows\SysWOW64\shutdown.exeshutdown -r -f -t 004⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:888
-
-
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵PID:1720
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵PID:1500
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14.5MB
MD5a3a91dbee0686872da99c9b5af8c92ce
SHA15a9e830e9da11c0ce0e7b9227ee12333f89b4015
SHA2563d4ba4825beb10790650c8badb9d6e4c7eabbf5252e5731fb63a737a20c2e99c
SHA512dfd1d0c8a32786de636a4dd663d85fadccf02a468bafcadfc85c3687281a89b7bdb7cab860cf73aa3cee6b255d72c63de9aaac617c66f0dbcbe3b32bc06b3059
-
Filesize
1KB
MD5ba58e76f1427a42936a15c557db74157
SHA1eb1bb8d4a2695408c22920d048ddbae761e2f438
SHA256df05de96ea1232aa10c24bcbabf9f64a6d06b44a8b5ad3027a956592d92433fc
SHA512fa156d37a2b8b47943cf43110f877ba97c84a174c0477b21d158c8ff2b3ecb7e9c0a282372ae59be225a9bdea2233720b4ab694e39cf49420d341bfaa2f4dfd1
-
Filesize
20KB
MD5faa97ebb26b210be97de3c847af1071e
SHA118ac39661770be9adb0cd132bd32be04108e8ca7
SHA2564129d45ce7ef6d02399ff900cbe0bdcdf1dca2add386625b8d5822255ef4667a
SHA5121faaee0636cde02a4ba1cdeb9face6a3d40d7f64e6ae87f71c3831b0fde220233260de2f8a8792948ac5398c8e40bf8953c0e0eefab8b9f6200a609867a6cec0
-
Filesize
91KB
MD55c5bef05b6f3806106f8f3ce13401cc1
SHA16005fbe17f6e917ac45317552409d7a60976db14
SHA256f2f3ae8ca06f5cf320ca1d234a623bf55cf2b84c1d6dea3d85d5392e29aaf437
SHA51297933227b6002127385ace025f85a26358e47ee79c883f03180d474c15dbaf28a88492c8e53aefc0d305872edd27db0b4468da13e6f0337988f58d2ee35fd797