Analysis
-
max time kernel
95s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19-09-2024 06:57
Static task
static1
Behavioral task
behavioral1
Sample
谷歌官网安装包.msi
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
谷歌官网安装包.msi
Resource
win10v2004-20240802-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
谷歌官网安装包.msi
-
Size
18.9MB
-
MD5
613f5baf5dc10b078583d76dc524638c
-
SHA1
e418401b983ff628622f972e2b9c72f21e2e104b
-
SHA256
4f814cc796e43cb4214554dc9e3d7c8512f8f6e6fa6969b3f6e781c1476968d5
-
SHA512
822581b42b507bed664fc3f00db18a865011f23a547d6f73762a8d948b8f0e8791c624192dad3b6b00acb061d75d43208cdf09fbd90a5554638b10b56d1d8b5b
-
SSDEEP
393216:9vbbOv23u55DQRaGtTT6GoX1YOL7/0Nib+EFpvMVdoH:xn4nftUVoXp7/0EyAMVdoH
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\U: msiexec.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\谷歌\谷歌\ChromeSetup.exe msiexec.exe File created C:\Program Files (x86)\谷歌\谷歌\Eas安装7.exe msiexec.exe File created C:\Program Files (x86)\谷歌\谷歌\资源之家（无限宇宙壁纸） (63).jpg msiexec.exe -
Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e57b0d1.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIB21B.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{7898A3C6-0096-4E88-8EFE-D32956A3AE9A} msiexec.exe File opened for modification C:\Windows\Installer\MSIB3C2.tmp msiexec.exe File created C:\Windows\Installer\e57b0d3.msi msiexec.exe File created C:\Windows\SystemTemp\viewer.exe MsiExec.exe File created C:\Windows\Installer\e57b0d1.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIB15E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB26A.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe -
Executes dropped EXE 1 IoCs
pid Process 4488 Eas安装7.exe -
Loads dropped DLL 15 IoCs
pid Process 2852 MsiExec.exe 2852 MsiExec.exe 2852 MsiExec.exe 2852 MsiExec.exe 2852 MsiExec.exe 2852 MsiExec.exe 2852 MsiExec.exe 2852 MsiExec.exe 2852 MsiExec.exe 2852 MsiExec.exe 2344 MsiExec.exe 2344 MsiExec.exe 2344 MsiExec.exe 2852 MsiExec.exe 2852 MsiExec.exe -
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 3196 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eas安装7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe -
Modifies registry class 23 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6C3A8987690088E4E8EF3D92653AEAA9 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6C3A8987690088E4E8EF3D92653AEAA9\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6C3A8987690088E4E8EF3D92653AEAA9\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6C3A8987690088E4E8EF3D92653AEAA9\Language = "2052" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6C3A8987690088E4E8EF3D92653AEAA9\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6C3A8987690088E4E8EF3D92653AEAA9\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AEAECD6040D6B38478A3FBF5A1028295\6C3A8987690088E4E8EF3D92653AEAA9 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6C3A8987690088E4E8EF3D92653AEAA9\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6C3A8987690088E4E8EF3D92653AEAA9\PackageCode = "7AAB85E818862414DBDD0E3E8F3FCA98" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6C3A8987690088E4E8EF3D92653AEAA9\SourceList\PackageName = "谷歌官网安装包.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6C3A8987690088E4E8EF3D92653AEAA9\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6C3A8987690088E4E8EF3D92653AEAA9\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AEAECD6040D6B38478A3FBF5A1028295 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6C3A8987690088E4E8EF3D92653AEAA9\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6C3A8987690088E4E8EF3D92653AEAA9\MainFeature msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6C3A8987690088E4E8EF3D92653AEAA9 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6C3A8987690088E4E8EF3D92653AEAA9\ProductName = "谷歌" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6C3A8987690088E4E8EF3D92653AEAA9\Version = "16777216" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6C3A8987690088E4E8EF3D92653AEAA9\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6C3A8987690088E4E8EF3D92653AEAA9\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6C3A8987690088E4E8EF3D92653AEAA9\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6C3A8987690088E4E8EF3D92653AEAA9\SourceList\Media\1 = ";" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6C3A8987690088E4E8EF3D92653AEAA9\Clients = 3a0000000000 msiexec.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1648 msiexec.exe 1648 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3196 msiexec.exe Token: SeIncreaseQuotaPrivilege 3196 msiexec.exe Token: SeSecurityPrivilege 1648 msiexec.exe Token: SeCreateTokenPrivilege 3196 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3196 msiexec.exe Token: SeLockMemoryPrivilege 3196 msiexec.exe Token: SeIncreaseQuotaPrivilege 3196 msiexec.exe Token: SeMachineAccountPrivilege 3196 msiexec.exe Token: SeTcbPrivilege 3196 msiexec.exe Token: SeSecurityPrivilege 3196 msiexec.exe Token: SeTakeOwnershipPrivilege 3196 msiexec.exe Token: SeLoadDriverPrivilege 3196 msiexec.exe Token: SeSystemProfilePrivilege 3196 msiexec.exe Token: SeSystemtimePrivilege 3196 msiexec.exe Token: SeProfSingleProcessPrivilege 3196 msiexec.exe Token: SeIncBasePriorityPrivilege 3196 msiexec.exe Token: SeCreatePagefilePrivilege 3196 msiexec.exe Token: SeCreatePermanentPrivilege 3196 msiexec.exe Token: SeBackupPrivilege 3196 msiexec.exe Token: SeRestorePrivilege 3196 msiexec.exe Token: SeShutdownPrivilege 3196 msiexec.exe Token: SeDebugPrivilege 3196 msiexec.exe Token: SeAuditPrivilege 3196 msiexec.exe Token: SeSystemEnvironmentPrivilege 3196 msiexec.exe Token: SeChangeNotifyPrivilege 3196 msiexec.exe Token: SeRemoteShutdownPrivilege 3196 msiexec.exe Token: SeUndockPrivilege 3196 msiexec.exe Token: SeSyncAgentPrivilege 3196 msiexec.exe Token: SeEnableDelegationPrivilege 3196 msiexec.exe Token: SeManageVolumePrivilege 3196 msiexec.exe Token: SeImpersonatePrivilege 3196 msiexec.exe Token: SeCreateGlobalPrivilege 3196 msiexec.exe Token: SeCreateTokenPrivilege 3196 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3196 msiexec.exe Token: SeLockMemoryPrivilege 3196 msiexec.exe Token: SeIncreaseQuotaPrivilege 3196 msiexec.exe Token: SeMachineAccountPrivilege 3196 msiexec.exe Token: SeTcbPrivilege 3196 msiexec.exe Token: SeSecurityPrivilege 3196 msiexec.exe Token: SeTakeOwnershipPrivilege 3196 msiexec.exe Token: SeLoadDriverPrivilege 3196 msiexec.exe Token: SeSystemProfilePrivilege 3196 msiexec.exe Token: SeSystemtimePrivilege 3196 msiexec.exe Token: SeProfSingleProcessPrivilege 3196 msiexec.exe Token: SeIncBasePriorityPrivilege 3196 msiexec.exe Token: SeCreatePagefilePrivilege 3196 msiexec.exe Token: SeCreatePermanentPrivilege 3196 msiexec.exe Token: SeBackupPrivilege 3196 msiexec.exe Token: SeRestorePrivilege 3196 msiexec.exe Token: SeShutdownPrivilege 3196 msiexec.exe Token: SeDebugPrivilege 3196 msiexec.exe Token: SeAuditPrivilege 3196 msiexec.exe Token: SeSystemEnvironmentPrivilege 3196 msiexec.exe Token: SeChangeNotifyPrivilege 3196 msiexec.exe Token: SeRemoteShutdownPrivilege 3196 msiexec.exe Token: SeUndockPrivilege 3196 msiexec.exe Token: SeSyncAgentPrivilege 3196 msiexec.exe Token: SeEnableDelegationPrivilege 3196 msiexec.exe Token: SeManageVolumePrivilege 3196 msiexec.exe Token: SeImpersonatePrivilege 3196 msiexec.exe Token: SeCreateGlobalPrivilege 3196 msiexec.exe Token: SeCreateTokenPrivilege 3196 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3196 msiexec.exe Token: SeLockMemoryPrivilege 3196 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3196 msiexec.exe 3196 msiexec.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1648 wrote to memory of 2852 1648 msiexec.exe 84 PID 1648 wrote to memory of 2852 1648 msiexec.exe 84 PID 1648 wrote to memory of 2852 1648 msiexec.exe 84 PID 1648 wrote to memory of 2344 1648 msiexec.exe 90 PID 1648 wrote to memory of 2344 1648 msiexec.exe 90 PID 1648 wrote to memory of 2344 1648 msiexec.exe 90 PID 2852 wrote to memory of 4488 2852 MsiExec.exe 93 PID 2852 wrote to memory of 4488 2852 MsiExec.exe 93 PID 2852 wrote to memory of 4488 2852 MsiExec.exe 93
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\谷歌官网安装包.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3196
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9419F875445833522528193D3B6CE58C C2⤵
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Program Files (x86)\谷歌\谷歌\Eas安装7.exe"C:\Program Files (x86)\谷歌\谷歌\Eas安装7.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4488
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1B4F1DA56BBDD7A8B01F07F498B8B06F2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2344
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD5a8661a9c91fad21ebb4fb6b04bbf0500
SHA1a94cafede989f098f15bf69801128f9d2512aa47
SHA256a88a3d0180161fb8a910e5e01325e98dd57d4458bc43eab9a8527c556d788fc2
SHA5124aa6d67cc6099c5672c22b5dfa2323657541cdc4453273051f6452aed9ec483f2fa540cbc6f50ea399a577ec3ab71e49d924f532bec2abba41778d52ddc3894e
-
Filesize
8.0MB
MD56146d80ddb9ab1d200feaef5c5782668
SHA10630776275c0186ed80796b502f93f49e5f4f07d
SHA256c50158d713846589ea9021e7dd7ee845f261576b5ab919bf39262bc62cf1aa49
SHA512eec3fe32ee0f223d52788464f33c146e38286c9a1d59f23dfb77bb9d7976fe89516da17fbe858c99f3811687a053eaf79a9e26df7cca29cd15696915cd3af44b
-
Filesize
12.0MB
MD5a36426519198480cfd977926587ca5ad
SHA147308f2d1c6d546edcbc1d1523e932afd40e8736
SHA2568e9bc7263f880f504d8dce9e7cac6f144aa897f335975c154b60ffb07ae4962a
SHA5121096a90a941c7725bfe4ba4273d3dad20bea7a31aeefda734e01142ad4664355f30f64dd94d5c03505bb416af99e2760778e2498763c0f483c7dbc93f251b583
-
Filesize
557KB
MD5e1423fc5ddaedc0152a09f4796243e31
SHA1c92cec1fb6093d6922fe64719e583048fca12153
SHA2563042d947f0e3accd3307d4d983aba352c4b01f6ca10aa45dbe660ca0a0a107de
SHA512fc21fadb5b86dc0c4fc8fea5d166b9b8a500df2b662c201626a8bcf6d3f7bd590b8ec3bae31f2f558b74ccb49ca74f51ee48b19bd047a27ef0c794b21cc84b39
-
Filesize
703KB
MD559f4b7e8b960987b68b311660c99957a
SHA13ba452e27d4bf53e72bf28cde68240290e72e46f
SHA2563b43d469e1f3656f948eabbd9e1ed99570a7962118fcfc9ccaa309eb657502bf
SHA51264bd1ddbc90dfae6a7b34b67eaa32a0fd03e5ccff7e25f997dfb488f56b7ab2c7fab867915d05ba40f215216f87942d035e740edd64db7cb6df049a589dde27b
-
Filesize
1.0MB
MD55566149fc623f29d55ca72018369c780
SHA18ae947ab0ae9182f1c09bd266ff360c0e8b88326
SHA256a8c8ff2a0e754059b1f44ef69df492ef3cd582f3750f8c374037c9621069c608
SHA512f9f49c930c3ead40f208482ab6f70a21a8495fd1c50b56a3f689eb53e8e7b8ca9a642bae2199fc80b6099bd3fdd3c4cfcd0d3a8cada47ebf23c7fcef87064cb5
-
Filesize
18.9MB
MD5613f5baf5dc10b078583d76dc524638c
SHA1e418401b983ff628622f972e2b9c72f21e2e104b
SHA2564f814cc796e43cb4214554dc9e3d7c8512f8f6e6fa6969b3f6e781c1476968d5
SHA512822581b42b507bed664fc3f00db18a865011f23a547d6f73762a8d948b8f0e8791c624192dad3b6b00acb061d75d43208cdf09fbd90a5554638b10b56d1d8b5b