9ab1f0f955d23c0a2a0e3727a9f778bef9057d4b615df3f6194906dac49e2c26

Resubmissions

21/09/2024, 02:03

240921-cgz6dszfpl 8

21/09/2024, 01:42

21/09/2024, 01:37

21/09/2024, 01:13

21/09/2024, 01:00

21/09/2024, 00:55

Analysis

max time kernel
101s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 00:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

EZFNLauncher.msi
Size

8.8MB
MD5

c094ae439f4a97409d752fa64f6eab86
SHA1

e607d4616a2262bb245c43269d7c3f769269e5d0
SHA256

9ab1f0f955d23c0a2a0e3727a9f778bef9057d4b615df3f6194906dac49e2c26
SHA512

df8bd4db2130cdf94493caa170801cfc1e273aa22253d33b066db3be56b164c904f54172bb6f60afd131f9459a8e9895d718bb905420f067936862d86ed9506e
SSDEEP

196608:hwrQNEqoCdzOx618QNSi2lfVc6VpvPH62RM7tBIbK1/JuhC:hgcOxvQgllfjXtr8/kh

Score

6^/10

persistence privilege_escalation

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2068	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2068	msiexec.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2068	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2068	msiexec.exe
Token: SeRestorePrivilege	2364	msiexec.exe
Token: SeTakeOwnershipPrivilege	2364	msiexec.exe
Token: SeSecurityPrivilege	2364	msiexec.exe
Token: SeCreateTokenPrivilege	2068	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2068	msiexec.exe
Token: SeLockMemoryPrivilege	2068	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2068	msiexec.exe
Token: SeMachineAccountPrivilege	2068	msiexec.exe
Token: SeTcbPrivilege	2068	msiexec.exe
Token: SeSecurityPrivilege	2068	msiexec.exe
Token: SeTakeOwnershipPrivilege	2068	msiexec.exe
Token: SeLoadDriverPrivilege	2068	msiexec.exe
Token: SeSystemProfilePrivilege	2068	msiexec.exe
Token: SeSystemtimePrivilege	2068	msiexec.exe
Token: SeProfSingleProcessPrivilege	2068	msiexec.exe
Token: SeIncBasePriorityPrivilege	2068	msiexec.exe
Token: SeCreatePagefilePrivilege	2068	msiexec.exe
Token: SeCreatePermanentPrivilege	2068	msiexec.exe
Token: SeBackupPrivilege	2068	msiexec.exe
Token: SeRestorePrivilege	2068	msiexec.exe
Token: SeShutdownPrivilege	2068	msiexec.exe
Token: SeDebugPrivilege	2068	msiexec.exe
Token: SeAuditPrivilege	2068	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2068	msiexec.exe
Token: SeChangeNotifyPrivilege	2068	msiexec.exe
Token: SeRemoteShutdownPrivilege	2068	msiexec.exe
Token: SeUndockPrivilege	2068	msiexec.exe
Token: SeSyncAgentPrivilege	2068	msiexec.exe
Token: SeEnableDelegationPrivilege	2068	msiexec.exe
Token: SeManageVolumePrivilege	2068	msiexec.exe
Token: SeImpersonatePrivilege	2068	msiexec.exe
Token: SeCreateGlobalPrivilege	2068	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2068	msiexec.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\EZFNLauncher.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2068