Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
02-10-2024 01:32
Static task
static1
Behavioral task
behavioral1
Sample
ToDesk_Win_6.5.3.msi
Resource
win7-20240708-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
ToDesk_Win_6.5.3.msi
Resource
win10v2004-20240802-en
windows10-2004-x64
19 signatures
150 seconds
General
-
Target
ToDesk_Win_6.5.3.msi
-
Size
106.3MB
-
MD5
c35a739a215927552c93499d6c8d8665
-
SHA1
0e6241f007f00d461d39ec5940eb9535b73ffd61
-
SHA256
91d8e570cb066a6f1071f8317582dce171f02b6b251b1f3ae0c05c3daed1cf76
-
SHA512
f51242cdf99849ad9b54c529670aea3eb2a18c65b8b26474c4f1645f55bda1efed9fd64e10debc1f37886b0f5338092a97e2d99b4dc17368bb21be8525ec731b
-
SSDEEP
3145728:b5VQYFW8BWuesWnkksidfvCDagHKABtUUYOSZ:dVK8teiwndgqstU
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe -
Loads dropped DLL 5 IoCs
pid Process 1908 MsiExec.exe 1908 MsiExec.exe 1908 MsiExec.exe 1908 MsiExec.exe 1908 MsiExec.exe -
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 3012 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3012 msiexec.exe Token: SeIncreaseQuotaPrivilege 3012 msiexec.exe Token: SeRestorePrivilege 1708 msiexec.exe Token: SeTakeOwnershipPrivilege 1708 msiexec.exe Token: SeSecurityPrivilege 1708 msiexec.exe Token: SeCreateTokenPrivilege 3012 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3012 msiexec.exe Token: SeLockMemoryPrivilege 3012 msiexec.exe Token: SeIncreaseQuotaPrivilege 3012 msiexec.exe Token: SeMachineAccountPrivilege 3012 msiexec.exe Token: SeTcbPrivilege 3012 msiexec.exe Token: SeSecurityPrivilege 3012 msiexec.exe Token: SeTakeOwnershipPrivilege 3012 msiexec.exe Token: SeLoadDriverPrivilege 3012 msiexec.exe Token: SeSystemProfilePrivilege 3012 msiexec.exe Token: SeSystemtimePrivilege 3012 msiexec.exe Token: SeProfSingleProcessPrivilege 3012 msiexec.exe Token: SeIncBasePriorityPrivilege 3012 msiexec.exe Token: SeCreatePagefilePrivilege 3012 msiexec.exe Token: SeCreatePermanentPrivilege 3012 msiexec.exe Token: SeBackupPrivilege 3012 msiexec.exe Token: SeRestorePrivilege 3012 msiexec.exe Token: SeShutdownPrivilege 3012 msiexec.exe Token: SeDebugPrivilege 3012 msiexec.exe Token: SeAuditPrivilege 3012 msiexec.exe Token: SeSystemEnvironmentPrivilege 3012 msiexec.exe Token: SeChangeNotifyPrivilege 3012 msiexec.exe Token: SeRemoteShutdownPrivilege 3012 msiexec.exe Token: SeUndockPrivilege 3012 msiexec.exe Token: SeSyncAgentPrivilege 3012 msiexec.exe Token: SeEnableDelegationPrivilege 3012 msiexec.exe Token: SeManageVolumePrivilege 3012 msiexec.exe Token: SeImpersonatePrivilege 3012 msiexec.exe Token: SeCreateGlobalPrivilege 3012 msiexec.exe Token: SeCreateTokenPrivilege 3012 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3012 msiexec.exe Token: SeLockMemoryPrivilege 3012 msiexec.exe Token: SeIncreaseQuotaPrivilege 3012 msiexec.exe Token: SeMachineAccountPrivilege 3012 msiexec.exe Token: SeTcbPrivilege 3012 msiexec.exe Token: SeSecurityPrivilege 3012 msiexec.exe Token: SeTakeOwnershipPrivilege 3012 msiexec.exe Token: SeLoadDriverPrivilege 3012 msiexec.exe Token: SeSystemProfilePrivilege 3012 msiexec.exe Token: SeSystemtimePrivilege 3012 msiexec.exe Token: SeProfSingleProcessPrivilege 3012 msiexec.exe Token: SeIncBasePriorityPrivilege 3012 msiexec.exe Token: SeCreatePagefilePrivilege 3012 msiexec.exe Token: SeCreatePermanentPrivilege 3012 msiexec.exe Token: SeBackupPrivilege 3012 msiexec.exe Token: SeRestorePrivilege 3012 msiexec.exe Token: SeShutdownPrivilege 3012 msiexec.exe Token: SeDebugPrivilege 3012 msiexec.exe Token: SeAuditPrivilege 3012 msiexec.exe Token: SeSystemEnvironmentPrivilege 3012 msiexec.exe Token: SeChangeNotifyPrivilege 3012 msiexec.exe Token: SeRemoteShutdownPrivilege 3012 msiexec.exe Token: SeUndockPrivilege 3012 msiexec.exe Token: SeSyncAgentPrivilege 3012 msiexec.exe Token: SeEnableDelegationPrivilege 3012 msiexec.exe Token: SeManageVolumePrivilege 3012 msiexec.exe Token: SeImpersonatePrivilege 3012 msiexec.exe Token: SeCreateGlobalPrivilege 3012 msiexec.exe Token: SeCreateTokenPrivilege 3012 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3012 msiexec.exe 3012 msiexec.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1708 wrote to memory of 1908 1708 msiexec.exe 31 PID 1708 wrote to memory of 1908 1708 msiexec.exe 31 PID 1708 wrote to memory of 1908 1708 msiexec.exe 31 PID 1708 wrote to memory of 1908 1708 msiexec.exe 31 PID 1708 wrote to memory of 1908 1708 msiexec.exe 31 PID 1708 wrote to memory of 1908 1708 msiexec.exe 31 PID 1708 wrote to memory of 1908 1708 msiexec.exe 31 PID 1708 wrote to memory of 3060 1708 msiexec.exe 35 PID 1708 wrote to memory of 3060 1708 msiexec.exe 35 PID 1708 wrote to memory of 3060 1708 msiexec.exe 35 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ToDesk_Win_6.5.3.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3012
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 86FC387118D927A4E15EC296DD158574 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1908
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1708 -s 8202⤵PID:3060
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:2636
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
588KB
MD5a9941233b9415b479d3b4f3732161eab
SHA1cb2d99af52b3b1c712943b13e45d85c80c732e57
SHA256ce34cc14e8d26119e1bf28a3a8368da6e10d13851004e2675976c5ad58b122e2
SHA512cfd6c425587e5e7c57b6f4655e2a48c871313e2bacf63cc0955ccae1a384610644f26aa76bee0a2a327cd77c2ae7def8ea9cb0c7c7c87fab1c8196bac82037f7