Analysis
-
max time kernel
94s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2024, 03:31
Static task
static1
Behavioral task
behavioral1
Sample
1e5ee42dc85bc51fb13f1665e66a9a6950f98f8aba3e260627d5be99db95b1eeN.msi
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
1e5ee42dc85bc51fb13f1665e66a9a6950f98f8aba3e260627d5be99db95b1eeN.msi
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
1e5ee42dc85bc51fb13f1665e66a9a6950f98f8aba3e260627d5be99db95b1eeN.msi
-
Size
3.0MB
-
MD5
76fa57efd571ccbf3b122223f1fcff90
-
SHA1
573fdcc3f2e7c6d96f585b95140a0036392c4454
-
SHA256
1e5ee42dc85bc51fb13f1665e66a9a6950f98f8aba3e260627d5be99db95b1ee
-
SHA512
1ca6622104d51c695ea9233ca31bba55ec1fd1ff2df3534f5851ac545383ce099753f8a119902ccf1194da5bde8d13c007a5a057b52a74da0ca019841de474eb
-
SSDEEP
49152:nB4yNYyAUd7ROHLtup6NQ3A+7d7v6I4HGJ/wxIa0x9B:lYyFd4HLA6O3T7bzJ/sIa0xf
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe -
Loads dropped DLL 3 IoCs
pid Process 2396 MsiExec.exe 2396 MsiExec.exe 2396 MsiExec.exe -
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 232 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 232 msiexec.exe Token: SeIncreaseQuotaPrivilege 232 msiexec.exe Token: SeSecurityPrivilege 3100 msiexec.exe Token: SeCreateTokenPrivilege 232 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 232 msiexec.exe Token: SeLockMemoryPrivilege 232 msiexec.exe Token: SeIncreaseQuotaPrivilege 232 msiexec.exe Token: SeMachineAccountPrivilege 232 msiexec.exe Token: SeTcbPrivilege 232 msiexec.exe Token: SeSecurityPrivilege 232 msiexec.exe Token: SeTakeOwnershipPrivilege 232 msiexec.exe Token: SeLoadDriverPrivilege 232 msiexec.exe Token: SeSystemProfilePrivilege 232 msiexec.exe Token: SeSystemtimePrivilege 232 msiexec.exe Token: SeProfSingleProcessPrivilege 232 msiexec.exe Token: SeIncBasePriorityPrivilege 232 msiexec.exe Token: SeCreatePagefilePrivilege 232 msiexec.exe Token: SeCreatePermanentPrivilege 232 msiexec.exe Token: SeBackupPrivilege 232 msiexec.exe Token: SeRestorePrivilege 232 msiexec.exe Token: SeShutdownPrivilege 232 msiexec.exe Token: SeDebugPrivilege 232 msiexec.exe Token: SeAuditPrivilege 232 msiexec.exe Token: SeSystemEnvironmentPrivilege 232 msiexec.exe Token: SeChangeNotifyPrivilege 232 msiexec.exe Token: SeRemoteShutdownPrivilege 232 msiexec.exe Token: SeUndockPrivilege 232 msiexec.exe Token: SeSyncAgentPrivilege 232 msiexec.exe Token: SeEnableDelegationPrivilege 232 msiexec.exe Token: SeManageVolumePrivilege 232 msiexec.exe Token: SeImpersonatePrivilege 232 msiexec.exe Token: SeCreateGlobalPrivilege 232 msiexec.exe Token: SeCreateTokenPrivilege 232 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 232 msiexec.exe Token: SeLockMemoryPrivilege 232 msiexec.exe Token: SeIncreaseQuotaPrivilege 232 msiexec.exe Token: SeMachineAccountPrivilege 232 msiexec.exe Token: SeTcbPrivilege 232 msiexec.exe Token: SeSecurityPrivilege 232 msiexec.exe Token: SeTakeOwnershipPrivilege 232 msiexec.exe Token: SeLoadDriverPrivilege 232 msiexec.exe Token: SeSystemProfilePrivilege 232 msiexec.exe Token: SeSystemtimePrivilege 232 msiexec.exe Token: SeProfSingleProcessPrivilege 232 msiexec.exe Token: SeIncBasePriorityPrivilege 232 msiexec.exe Token: SeCreatePagefilePrivilege 232 msiexec.exe Token: SeCreatePermanentPrivilege 232 msiexec.exe Token: SeBackupPrivilege 232 msiexec.exe Token: SeRestorePrivilege 232 msiexec.exe Token: SeShutdownPrivilege 232 msiexec.exe Token: SeDebugPrivilege 232 msiexec.exe Token: SeAuditPrivilege 232 msiexec.exe Token: SeSystemEnvironmentPrivilege 232 msiexec.exe Token: SeChangeNotifyPrivilege 232 msiexec.exe Token: SeRemoteShutdownPrivilege 232 msiexec.exe Token: SeUndockPrivilege 232 msiexec.exe Token: SeSyncAgentPrivilege 232 msiexec.exe Token: SeEnableDelegationPrivilege 232 msiexec.exe Token: SeManageVolumePrivilege 232 msiexec.exe Token: SeImpersonatePrivilege 232 msiexec.exe Token: SeCreateGlobalPrivilege 232 msiexec.exe Token: SeCreateTokenPrivilege 232 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 232 msiexec.exe Token: SeLockMemoryPrivilege 232 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 232 msiexec.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3100 wrote to memory of 2396 3100 msiexec.exe 84 PID 3100 wrote to memory of 2396 3100 msiexec.exe 84 PID 3100 wrote to memory of 2396 3100 msiexec.exe 84
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\1e5ee42dc85bc51fb13f1665e66a9a6950f98f8aba3e260627d5be99db95b1eeN.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:232
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A81FA8BFD079FC4782068B3A9F418BC2 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2396
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
57KB
MD590ed4938fd712e3ac49dfdff0ff63cc0
SHA1f3ae0ec59bd8fcb578310942bbf17c047d4895c9
SHA2569d3eee64d97e0b082a2ab26f997b29fd6f16bb49a70b711fdc241fca079c788b
SHA512c35ae7a402a01155a9aca294ee88a4029eeb2c560c25a33acb3e35d7060f8fa02d6bc0289b6cf44ed4e516cbd21a7c7b0843172d2686dc3a7270f40be08e0f70
-
Filesize
125KB
MD5b0bcc622f1fff0eec99e487fa1a4ddd9
SHA149aa392454bd5869fa23794196aedc38e8eea6f5
SHA256b32687eaaad888410718875dcbff9f6a552e29c4d76af33e06e59859e1054081
SHA5121572c1d07df2e9262d05a915d69ec4ebeb92eab50b89ce27dd290fb5a8e1de2c97d9320a3bb006834c98b3f6afcd7d2c29f039d9ca9afaa09c714406dedbc3c7
-
Filesize
184KB
MD53404519eb0b2108a460e5da2be63d10a
SHA1cbea0062bb579e77c19bfbbd3834a5c1a301e6ff
SHA2562fd2ea60b1f47753ff4e0db6f21344cdbaea14ccbe46b20fa5504702d3aeaed6
SHA5120c2d2db2c3e528ca2a735cb33a1c441a61d666b50a893c28dae6fb039e4ff3e0435a98af26c41f5fb978f9906b88eed846e276842c15caf6080ed8baaad562f0