Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 01:25
Static task
static1
Behavioral task
behavioral1
Sample
677e9d60fdfd7b374d9d3f764f4ef4a15924779990f83d221c8957a51715b470.js
Resource
win7-20240708-en
windows7-x64
12 signatures
150 seconds
General
-
Target
677e9d60fdfd7b374d9d3f764f4ef4a15924779990f83d221c8957a51715b470.js
-
Size
1.1MB
-
MD5
b76091245411a29ba40c3ece08e76490
-
SHA1
f88efc6a3ff16cfe0b82f2c3068f2f113a083510
-
SHA256
677e9d60fdfd7b374d9d3f764f4ef4a15924779990f83d221c8957a51715b470
-
SHA512
23ba586f4ebb15d608af25e0b1aee919b6d40f8044fdbd97d4d5277c0aaf48649232b91a2911e4d225655af9544ad4a1c1a934d63821e1fde12d17942a836d99
-
SSDEEP
24576:nwuZZ9D0v/d7C4t0kQhlTqtxQatGnE2xmYhdTz:wsHD03d7C4trQhlTQxTtGnzhdTz
Malware Config
Signatures
-
Blocklisted process makes network request 50 IoCs
flow pid Process 4 456 msiexec.exe 8 2444 rundll32.exe 10 2444 rundll32.exe 12 2444 rundll32.exe 13 2444 rundll32.exe 15 2444 rundll32.exe 17 2444 rundll32.exe 18 2444 rundll32.exe 21 2444 rundll32.exe 22 2444 rundll32.exe 23 2444 rundll32.exe 24 2444 rundll32.exe 25 2444 rundll32.exe 26 2444 rundll32.exe 27 2444 rundll32.exe 28 2444 rundll32.exe 29 2444 rundll32.exe 38 2444 rundll32.exe 39 2444 rundll32.exe 40 2444 rundll32.exe 41 2444 rundll32.exe 42 2444 rundll32.exe 43 2444 rundll32.exe 44 2444 rundll32.exe 45 2444 rundll32.exe 46 2444 rundll32.exe 47 2444 rundll32.exe 49 2444 rundll32.exe 50 2444 rundll32.exe 51 2444 rundll32.exe 52 2444 rundll32.exe 53 2444 rundll32.exe 54 2444 rundll32.exe 55 2444 rundll32.exe 56 2444 rundll32.exe 57 2444 rundll32.exe 58 2444 rundll32.exe 59 2444 rundll32.exe 60 2444 rundll32.exe 61 2444 rundll32.exe 62 2444 rundll32.exe 63 2444 rundll32.exe 64 2444 rundll32.exe 65 2444 rundll32.exe 66 2444 rundll32.exe 67 2444 rundll32.exe 68 2444 rundll32.exe 69 2444 rundll32.exe 70 2444 rundll32.exe 71 2444 rundll32.exe -
Executes dropped EXE 1 IoCs
pid Process 2664 MSI54F9.tmp -
Loads dropped DLL 7 IoCs
pid Process 2744 MsiExec.exe 2744 MsiExec.exe 2744 MsiExec.exe 2444 rundll32.exe 2444 rundll32.exe 2444 rundll32.exe 2444 rundll32.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe -
Drops file in Windows directory 9 IoCs
description ioc Process File created C:\Windows\Installer\f78537f.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI54C9.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI54F9.tmp msiexec.exe File opened for modification C:\Windows\Installer\f78537f.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI51F8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI52E4.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI4D17.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI52B4.tmp msiexec.exe -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSI54F9.tmp -
Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad msiexec.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 rundll32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 48 IoCs
pid Process 456 msiexec.exe 456 msiexec.exe 2444 rundll32.exe 2444 rundll32.exe 2444 rundll32.exe 2444 rundll32.exe 2444 rundll32.exe 2444 rundll32.exe 2444 rundll32.exe 2444 rundll32.exe 2444 rundll32.exe 2444 rundll32.exe 2444 rundll32.exe 2444 rundll32.exe 2444 rundll32.exe 2444 rundll32.exe 2444 rundll32.exe 2444 rundll32.exe 2444 rundll32.exe 2444 rundll32.exe 2444 rundll32.exe 2444 rundll32.exe 2444 rundll32.exe 2444 rundll32.exe 2444 rundll32.exe 2444 rundll32.exe 2444 rundll32.exe 2444 rundll32.exe 2444 rundll32.exe 2444 rundll32.exe 2444 rundll32.exe 2444 rundll32.exe 2444 rundll32.exe 2444 rundll32.exe 2444 rundll32.exe 2444 rundll32.exe 2444 rundll32.exe 2444 rundll32.exe 2444 rundll32.exe 2444 rundll32.exe 2444 rundll32.exe 2444 rundll32.exe 2444 rundll32.exe 2444 rundll32.exe 2444 rundll32.exe 2444 rundll32.exe 2444 rundll32.exe 2444 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 52 IoCs
description pid Process Token: SeShutdownPrivilege 2528 wscript.exe Token: SeIncreaseQuotaPrivilege 2528 wscript.exe Token: SeRestorePrivilege 456 msiexec.exe Token: SeTakeOwnershipPrivilege 456 msiexec.exe Token: SeSecurityPrivilege 456 msiexec.exe Token: SeCreateTokenPrivilege 2528 wscript.exe Token: SeAssignPrimaryTokenPrivilege 2528 wscript.exe Token: SeLockMemoryPrivilege 2528 wscript.exe Token: SeIncreaseQuotaPrivilege 2528 wscript.exe Token: SeMachineAccountPrivilege 2528 wscript.exe Token: SeTcbPrivilege 2528 wscript.exe Token: SeSecurityPrivilege 2528 wscript.exe Token: SeTakeOwnershipPrivilege 2528 wscript.exe Token: SeLoadDriverPrivilege 2528 wscript.exe Token: SeSystemProfilePrivilege 2528 wscript.exe Token: SeSystemtimePrivilege 2528 wscript.exe Token: SeProfSingleProcessPrivilege 2528 wscript.exe Token: SeIncBasePriorityPrivilege 2528 wscript.exe Token: SeCreatePagefilePrivilege 2528 wscript.exe Token: SeCreatePermanentPrivilege 2528 wscript.exe Token: SeBackupPrivilege 2528 wscript.exe Token: SeRestorePrivilege 2528 wscript.exe Token: SeShutdownPrivilege 2528 wscript.exe Token: SeDebugPrivilege 2528 wscript.exe Token: SeAuditPrivilege 2528 wscript.exe Token: SeSystemEnvironmentPrivilege 2528 wscript.exe Token: SeChangeNotifyPrivilege 2528 wscript.exe Token: SeRemoteShutdownPrivilege 2528 wscript.exe Token: SeUndockPrivilege 2528 wscript.exe Token: SeSyncAgentPrivilege 2528 wscript.exe Token: SeEnableDelegationPrivilege 2528 wscript.exe Token: SeManageVolumePrivilege 2528 wscript.exe Token: SeImpersonatePrivilege 2528 wscript.exe Token: SeCreateGlobalPrivilege 2528 wscript.exe Token: SeRestorePrivilege 456 msiexec.exe Token: SeTakeOwnershipPrivilege 456 msiexec.exe Token: SeRestorePrivilege 456 msiexec.exe Token: SeTakeOwnershipPrivilege 456 msiexec.exe Token: SeRestorePrivilege 456 msiexec.exe Token: SeTakeOwnershipPrivilege 456 msiexec.exe Token: SeRestorePrivilege 456 msiexec.exe Token: SeTakeOwnershipPrivilege 456 msiexec.exe Token: SeRestorePrivilege 456 msiexec.exe Token: SeTakeOwnershipPrivilege 456 msiexec.exe Token: SeRestorePrivilege 456 msiexec.exe Token: SeTakeOwnershipPrivilege 456 msiexec.exe Token: SeRestorePrivilege 456 msiexec.exe Token: SeTakeOwnershipPrivilege 456 msiexec.exe Token: SeRestorePrivilege 456 msiexec.exe Token: SeTakeOwnershipPrivilege 456 msiexec.exe Token: SeRestorePrivilege 456 msiexec.exe Token: SeTakeOwnershipPrivilege 456 msiexec.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 456 wrote to memory of 2744 456 msiexec.exe 30 PID 456 wrote to memory of 2744 456 msiexec.exe 30 PID 456 wrote to memory of 2744 456 msiexec.exe 30 PID 456 wrote to memory of 2744 456 msiexec.exe 30 PID 456 wrote to memory of 2744 456 msiexec.exe 30 PID 456 wrote to memory of 2744 456 msiexec.exe 30 PID 456 wrote to memory of 2744 456 msiexec.exe 30 PID 456 wrote to memory of 2664 456 msiexec.exe 31 PID 456 wrote to memory of 2664 456 msiexec.exe 31 PID 456 wrote to memory of 2664 456 msiexec.exe 31 PID 456 wrote to memory of 2664 456 msiexec.exe 31 PID 456 wrote to memory of 2664 456 msiexec.exe 31 PID 456 wrote to memory of 2664 456 msiexec.exe 31 PID 456 wrote to memory of 2664 456 msiexec.exe 31
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\677e9d60fdfd7b374d9d3f764f4ef4a15924779990f83d221c8957a51715b470.js1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2528
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 8931A024DF71C2A7544D81BB86A374762⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2744
-
-
C:\Windows\Installer\MSI54F9.tmp"C:\Windows\Installer\MSI54F9.tmp" /DontWait C:/Windows/System32/rundll32.exe C:\Users\Admin\AppData\Roaming\x64_stealth.dll, clBuildProgram2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2664
-
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\x64_stealth.dll, clBuildProgram1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:2444
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD54af24469b4a48654df9f4b3960980509
SHA1f433ccc1e6298ee656f7dda8800c66a1e4d6e4d2
SHA2566eb292a20c9e526a38e4b7a5725e0cd814f4023004c7e18a28f48172e28f2afa
SHA5121e614d950a3b2182320c40c0a61fe1705a95be5be68ac32bf590e5974aef3cfce6baaaa14ed1281ffc683d479c5a779aadb5dd773e40f84964303aa2bc4320e7
-
Filesize
1.7MB
MD54d343ce28a572f1bca64473232a039a9
SHA1aaf14040d4ee2a03d48d961f7d70970d4513237f
SHA2565c7a3bd2baa8303354d8098b8d5961f111e467002bb0c6fee120825b32798228
SHA512bd723a89aef1778fff3af72459b59aa2316cb010b290e9d5679c8e72959db70086d65ee0ef16e8cb45349be04b3ae9daeb53b63defbebfac8452a97ce46da814
-
Filesize
2.1MB
MD5d75db138a6519ace7795ba35ea62a498
SHA1dc8ec40f846dd55be5661d43a80acb4d442f6cd3
SHA2561b9e17bfbd292075956cc2006983f91e17aed94ebbb0fb370bf83d23b14289fa
SHA512eeef3b0620cfbd332110b8123e2548b8b6a6b4d2259932463755aae2569440a8807eed7a5b5274b9bb01cde7604bc7aeb560b606609d7fc885cd97621c9106c1
-
Filesize
436KB
MD5475d20c0ea477a35660e3f67ecf0a1df
SHA167340739f51e1134ae8f0ffc5ae9dd710e8e3a08
SHA256426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
SHA51299525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
-
Filesize
389KB
MD5b9545ed17695a32face8c3408a6a3553
SHA1f6c31c9cd832ae2aebcd88e7b2fa6803ae93fc83
SHA2561e0e63b446eecf6c9781c7d1cae1f46a3bb31654a70612f71f31538fb4f4729a
SHA512f6d6dc40dcba5ff091452d7cc257427dcb7ce2a21816b4fec2ee249e63246b64667f5c4095220623533243103876433ef8c12c9b612c0e95fdfffe41d1504e04