48c616cbb15b33f9f8001ae8074e8f68657f604bb20b923ddb6722f752427a9e

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22-08-2024 06:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$TEMP/GoogleToolbarInstaller_zh-CN_signed.msi
Size

1.1MB
MD5

ec1629e2086cad6ccc4c995630896213
SHA1

e0e1f7720072b85c04318d6d15b595d7e8f52670
SHA256

101fc387cb284a27c943ea087b751aefb5c106a214253b7e29e7381da95beaee
SHA512

3f7157a25a2d1f1fc345e9138ed5c1f17805256be985e8cfe54c60cb5a11d62e13472bdeee187c7b13e5746c8d9e08359d929410d3b5e5ab204cf4f91c02d9b1
SSDEEP

24576:FBkI5/nyOeMDyWd8Dce5HrY5w6Rsa31L5Dh66NIXiQcAqHVIYzgD:jhyOeMPacWHruwOsa31L5Dh66N+iVh1O

Score

6^/10

persistence privilege_escalation

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
3	2736	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2736	msiexec.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2736	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2736	msiexec.exe
Token: SeRestorePrivilege	2636	msiexec.exe
Token: SeTakeOwnershipPrivilege	2636	msiexec.exe
Token: SeSecurityPrivilege	2636	msiexec.exe
Token: SeCreateTokenPrivilege	2736	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2736	msiexec.exe
Token: SeLockMemoryPrivilege	2736	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2736	msiexec.exe
Token: SeMachineAccountPrivilege	2736	msiexec.exe
Token: SeTcbPrivilege	2736	msiexec.exe
Token: SeSecurityPrivilege	2736	msiexec.exe
Token: SeTakeOwnershipPrivilege	2736	msiexec.exe
Token: SeLoadDriverPrivilege	2736	msiexec.exe
Token: SeSystemProfilePrivilege	2736	msiexec.exe
Token: SeSystemtimePrivilege	2736	msiexec.exe
Token: SeProfSingleProcessPrivilege	2736	msiexec.exe
Token: SeIncBasePriorityPrivilege	2736	msiexec.exe
Token: SeCreatePagefilePrivilege	2736	msiexec.exe
Token: SeCreatePermanentPrivilege	2736	msiexec.exe
Token: SeBackupPrivilege	2736	msiexec.exe
Token: SeRestorePrivilege	2736	msiexec.exe
Token: SeShutdownPrivilege	2736	msiexec.exe
Token: SeDebugPrivilege	2736	msiexec.exe
Token: SeAuditPrivilege	2736	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2736	msiexec.exe
Token: SeChangeNotifyPrivilege	2736	msiexec.exe
Token: SeRemoteShutdownPrivilege	2736	msiexec.exe
Token: SeUndockPrivilege	2736	msiexec.exe
Token: SeSyncAgentPrivilege	2736	msiexec.exe
Token: SeEnableDelegationPrivilege	2736	msiexec.exe
Token: SeManageVolumePrivilege	2736	msiexec.exe
Token: SeImpersonatePrivilege	2736	msiexec.exe
Token: SeCreateGlobalPrivilege	2736	msiexec.exe
Token: SeBackupPrivilege	2608	vssvc.exe
Token: SeRestorePrivilege	2608	vssvc.exe
Token: SeAuditPrivilege	2608	vssvc.exe
Token: SeBackupPrivilege	2636	msiexec.exe
Token: SeRestorePrivilege	2636	msiexec.exe
Token: SeRestorePrivilege	2276	msiexec.exe
Token: SeTakeOwnershipPrivilege	2276	msiexec.exe
Token: SeSecurityPrivilege	2276	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2736	msiexec.exe
2736	msiexec.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 880	2636	msiexec.exe	33
PID 2636 wrote to memory of 880	2636	msiexec.exe	33
PID 2636 wrote to memory of 880	2636	msiexec.exe	33

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\$TEMP\GoogleToolbarInstaller_zh-CN_signed.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2736

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2636 -s 860
  2⤵
  PID:880