Overview
overview
10Static
static
102024-08-08.zip
windows10-1703-x64
10163684970...64.exe
windows10-1703-x64
80581756a65...1b.exe
windows10-1703-x64
306fcfd75f4...40.exe
windows10-1703-x64
6083b02e212...c7.exe
windows10-1703-x64
3087a3b8725...c9.jar
windows10-1703-x64
708c7fb6067...a2.exe
windows10-1703-x64
30e85d0a9fc...50.exe
windows10-1703-x64
60f1b66752d...9d.exe
windows10-1703-x64
30f2abe41f4...70.exe
windows10-1703-x64
100f8a6d8705...e5.exe
windows10-1703-x64
101026da21d9...42.exe
windows10-1703-x64
10109927ded1...91.exe
windows10-1703-x64
615c71b616f...79.exe
windows10-1703-x64
1017b5394a5c...70.exe
windows10-1703-x64
101873c4b2bd...d4.exe
windows10-1703-x64
1019efe1624f...3c.exe
windows10-1703-x64
101de0ce90e5...f7.vbe
windows10-1703-x64
11e6ad08c5e...5f.exe
windows10-1703-x64
101f7cedbe04...4c.exe
windows10-1703-x64
1022586df437...62.exe
windows10-1703-x64
1029f90a4f62...e6.xls
windows10-1703-x64
12b34ad054e...da.exe
windows10-1703-x64
102bb032333f...2c.exe
windows10-1703-x64
32bda6048a8...dc.exe
windows10-1703-x64
72c7da6690b...6a.exe
windows10-1703-x64
42caf283566...2e.exe
windows10-1703-x64
10300d87987d...45.exe
windows10-1703-x64
7353a75d0ad...a5.exe
windows10-1703-x64
7391ac1ceed...57.exe
windows10-1703-x64
7d4cb60a0e9...01.hta
windows10-1703-x64
10e0fa6d69b2...1e.msi
windows10-1703-x64
6Analysis
-
max time kernel
125s -
max time network
139s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
10-08-2024 17:49
Behavioral task
behavioral1
Sample
2024-08-08.zip
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral2
Sample
01636849700a046589f6e2b58ca6b02ec108fd20534973f83737f1749af16e64.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral3
Sample
0581756a656ace2e7d164b1f66846e9d079755bd7a5cead72e73b53ab534531b.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral4
Sample
06fcfd75f456e542f161dc3e74b1c7ccc52e6cded909f5f06e00c847e5bedf40.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral5
Sample
083b02e21246fa17ee9ac50eab39033abd920274259ad848df9eb412d4350ec7.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral6
Sample
087a3b87252a021f6f3696f496d4fd890f28fc31735d8f850aa1184ed7bf59c9.jar
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral7
Sample
08c7fb6067acc8ac207d28ab616c9ea5bc0d394956455d6a3eecb73f8010f7a2.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral8
Sample
0e85d0a9fcf30f823c43e697f99cf61743ef1d29228e160f19005e343f2a5b50.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral9
Sample
0f1b66752dea36f9ad237a452b4bfb2950ab3ce90fcd920c6708f69ee8ce8c9d.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral10
Sample
0f2abe41f47c8287b81f6f5be7983b8486b298d7121bbc8435ccd334a5f7ce70.exe
Resource
win10-20240611-en
windows10-1703-x64
Behavioral task
behavioral11
Sample
0f8a6d8705eba15b8958bd7984d9c46f1f5510790249b3fa330740a626ef45e5.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral12
Sample
1026da21d95ab9bc3a5dff5163d8029ea6ca3413e586272074105e4727ab1342.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral13
Sample
109927ded1c6f8ce79192bc804efab8f52e6924d16476236eef82a1631349d91.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral14
Sample
15c71b616f8ff314907e2e9f15601adc81529f6129acd67751bf7d16b4d52479.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral15
Sample
17b5394a5cea17aa14672179b10eb87f650675bbabb6bbf12e5cb62916c62770.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral16
Sample
1873c4b2bde16da1d2e923d66d20eea2536bc824e5134b60f3df4b770edf72d4.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral17
Sample
19efe1624f526c084e096431a4b1e5bf63c299351751fa0bf466106a99196d3c.exe
Resource
win10-20240611-en
windows10-1703-x64
Behavioral task
behavioral18
Sample
1de0ce90e503e10f763f00b591d48973bb213d3979c517097b252881630257f7.vbe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral19
Sample
1e6ad08c5ed9b4fdbef86181e8cd01170fe9ec5615d9a37f90e7ea43bcad175f.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral20
Sample
1f7cedbe04af43e29efdfecce0580ab826b577bd0d7c9f6db3d1c58a8eeffb4c.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral21
Sample
22586df4379d432c8e5d2d852bbecf70558da09f77ec0f7ac46d28e4928a7462.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral22
Sample
29f90a4f6266e43e668b41187ef4e8c2acdfccab8a8c898e64349a5432081ce6.xls
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral23
Sample
2b34ad054e9dde8cbc0abfbe1379a7f0343cb32d92f3411ec2c2ff02ae5673da.exe
Resource
win10-20240611-en
windows10-1703-x64
Behavioral task
behavioral24
Sample
2bb032333f6f2199f35a512aa920a651975ea1b4c3aa7fac0ad69efa2539f42c.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral25
Sample
2bda6048a888003443cd18df65f75441974ea3dfa04d524c957b0d7c268654dc.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral26
Sample
2c7da6690be26bd6b5ceea90b233fdd26589d7a72b2a62468903aba887e7ad6a.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral27
Sample
2caf283566656a13bf71f8ceac3c81f58a049c92a788368323b1ba25d872372e.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral28
Sample
300d87987d360bd4abc2927a791031f41450cdf547c830902107daceba263a45.exe
Resource
win10-20240611-en
windows10-1703-x64
Behavioral task
behavioral29
Sample
353a75d0ad34c89fbdd11ec9cc6f6ea302f5669c5c1326686f7d328e656d1ea5.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral30
Sample
391ac1ceedd3c960f32890f834a86ba1570ee5a0cc12dcef1714d43bb29fc457.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral31
Sample
d4cb60a0e93c856f642f862e51cf4af34f626c8d1e1b995b5e9dfb3e72db1101.hta
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral32
Sample
e0fa6d69b26f18cfdef3bd930d067eca476b3d2cb78d14bec88f05ae87d25b1e.msi
Resource
win10-20240404-en
windows10-1703-x64
General
-
Target
e0fa6d69b26f18cfdef3bd930d067eca476b3d2cb78d14bec88f05ae87d25b1e.msi
-
Size
18.0MB
-
MD5
6d7878a7e0a19655f118dc7143b601db
-
SHA1
4c439efe22e99fe21ade50cf115baf3b710db0fa
-
SHA256
e0fa6d69b26f18cfdef3bd930d067eca476b3d2cb78d14bec88f05ae87d25b1e
-
SHA512
54020a29d792b5c57a2dd83f43998248703079c0e36306631d10005c77a8301f770dcadccaef31c48600ace2a86b90be617b5ac5bd383d97c9b8c8a3921e976e
-
SSDEEP
393216:UN/bZNw7oDqYT2XiU5XZPcX7c498R/KkHX:0br9Ta/PAc4oKk
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\SystemTemp\viewer.exe MsiExec.exe -
Loads dropped DLL 10 IoCs
pid Process 4920 MsiExec.exe 4920 MsiExec.exe 4920 MsiExec.exe 4920 MsiExec.exe 4920 MsiExec.exe 4920 MsiExec.exe 4920 MsiExec.exe 4920 MsiExec.exe 4920 MsiExec.exe 4920 MsiExec.exe -
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 5084 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5084 msiexec.exe Token: SeIncreaseQuotaPrivilege 5084 msiexec.exe Token: SeSecurityPrivilege 3572 msiexec.exe Token: SeCreateTokenPrivilege 5084 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5084 msiexec.exe Token: SeLockMemoryPrivilege 5084 msiexec.exe Token: SeIncreaseQuotaPrivilege 5084 msiexec.exe Token: SeMachineAccountPrivilege 5084 msiexec.exe Token: SeTcbPrivilege 5084 msiexec.exe Token: SeSecurityPrivilege 5084 msiexec.exe Token: SeTakeOwnershipPrivilege 5084 msiexec.exe Token: SeLoadDriverPrivilege 5084 msiexec.exe Token: SeSystemProfilePrivilege 5084 msiexec.exe Token: SeSystemtimePrivilege 5084 msiexec.exe Token: SeProfSingleProcessPrivilege 5084 msiexec.exe Token: SeIncBasePriorityPrivilege 5084 msiexec.exe Token: SeCreatePagefilePrivilege 5084 msiexec.exe Token: SeCreatePermanentPrivilege 5084 msiexec.exe Token: SeBackupPrivilege 5084 msiexec.exe Token: SeRestorePrivilege 5084 msiexec.exe Token: SeShutdownPrivilege 5084 msiexec.exe Token: SeDebugPrivilege 5084 msiexec.exe Token: SeAuditPrivilege 5084 msiexec.exe Token: SeSystemEnvironmentPrivilege 5084 msiexec.exe Token: SeChangeNotifyPrivilege 5084 msiexec.exe Token: SeRemoteShutdownPrivilege 5084 msiexec.exe Token: SeUndockPrivilege 5084 msiexec.exe Token: SeSyncAgentPrivilege 5084 msiexec.exe Token: SeEnableDelegationPrivilege 5084 msiexec.exe Token: SeManageVolumePrivilege 5084 msiexec.exe Token: SeImpersonatePrivilege 5084 msiexec.exe Token: SeCreateGlobalPrivilege 5084 msiexec.exe Token: SeCreateTokenPrivilege 5084 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5084 msiexec.exe Token: SeLockMemoryPrivilege 5084 msiexec.exe Token: SeIncreaseQuotaPrivilege 5084 msiexec.exe Token: SeMachineAccountPrivilege 5084 msiexec.exe Token: SeTcbPrivilege 5084 msiexec.exe Token: SeSecurityPrivilege 5084 msiexec.exe Token: SeTakeOwnershipPrivilege 5084 msiexec.exe Token: SeLoadDriverPrivilege 5084 msiexec.exe Token: SeSystemProfilePrivilege 5084 msiexec.exe Token: SeSystemtimePrivilege 5084 msiexec.exe Token: SeProfSingleProcessPrivilege 5084 msiexec.exe Token: SeIncBasePriorityPrivilege 5084 msiexec.exe Token: SeCreatePagefilePrivilege 5084 msiexec.exe Token: SeCreatePermanentPrivilege 5084 msiexec.exe Token: SeBackupPrivilege 5084 msiexec.exe Token: SeRestorePrivilege 5084 msiexec.exe Token: SeShutdownPrivilege 5084 msiexec.exe Token: SeDebugPrivilege 5084 msiexec.exe Token: SeAuditPrivilege 5084 msiexec.exe Token: SeSystemEnvironmentPrivilege 5084 msiexec.exe Token: SeChangeNotifyPrivilege 5084 msiexec.exe Token: SeRemoteShutdownPrivilege 5084 msiexec.exe Token: SeUndockPrivilege 5084 msiexec.exe Token: SeSyncAgentPrivilege 5084 msiexec.exe Token: SeEnableDelegationPrivilege 5084 msiexec.exe Token: SeManageVolumePrivilege 5084 msiexec.exe Token: SeImpersonatePrivilege 5084 msiexec.exe Token: SeCreateGlobalPrivilege 5084 msiexec.exe Token: SeCreateTokenPrivilege 5084 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5084 msiexec.exe Token: SeLockMemoryPrivilege 5084 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5084 msiexec.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3572 wrote to memory of 4920 3572 msiexec.exe 77 PID 3572 wrote to memory of 4920 3572 msiexec.exe 77 PID 3572 wrote to memory of 4920 3572 msiexec.exe 77
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\e0fa6d69b26f18cfdef3bd930d067eca476b3d2cb78d14bec88f05ae87d25b1e.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5084
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding BF1E73506452012D594711D173868F2A C2⤵
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4920
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
557KB
MD5e1423fc5ddaedc0152a09f4796243e31
SHA1c92cec1fb6093d6922fe64719e583048fca12153
SHA2563042d947f0e3accd3307d4d983aba352c4b01f6ca10aa45dbe660ca0a0a107de
SHA512fc21fadb5b86dc0c4fc8fea5d166b9b8a500df2b662c201626a8bcf6d3f7bd590b8ec3bae31f2f558b74ccb49ca74f51ee48b19bd047a27ef0c794b21cc84b39
-
Filesize
703KB
MD559f4b7e8b960987b68b311660c99957a
SHA13ba452e27d4bf53e72bf28cde68240290e72e46f
SHA2563b43d469e1f3656f948eabbd9e1ed99570a7962118fcfc9ccaa309eb657502bf
SHA51264bd1ddbc90dfae6a7b34b67eaa32a0fd03e5ccff7e25f997dfb488f56b7ab2c7fab867915d05ba40f215216f87942d035e740edd64db7cb6df049a589dde27b
-
Filesize
1.0MB
MD55566149fc623f29d55ca72018369c780
SHA18ae947ab0ae9182f1c09bd266ff360c0e8b88326
SHA256a8c8ff2a0e754059b1f44ef69df492ef3cd582f3750f8c374037c9621069c608
SHA512f9f49c930c3ead40f208482ab6f70a21a8495fd1c50b56a3f689eb53e8e7b8ca9a642bae2199fc80b6099bd3fdd3c4cfcd0d3a8cada47ebf23c7fcef87064cb5