Analysis
-
max time kernel
61s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04/10/2024, 04:36
Static task
static1
Behavioral task
behavioral1
Sample
软件包安装.msi
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
软件包安装.msi
Resource
win10v2004-20240802-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
软件包安装.msi
-
Size
1.8MB
-
MD5
ba615bbffbb5a4604ee2ddf9a2972333
-
SHA1
229540b47f5248997257946a0fab693c070ed436
-
SHA256
854f026f4e3071e41c828edcb350c049b74211ce7b653d8161a32d345257afcf
-
SHA512
6c0b2f108e06873c3d09e8f0f9a20583b134a356b9cb775d44f4ee3a0807ad7d86b30b7aa60eafdd6dbf6fdf18f0f70ec0b45fef66f31ac4adb214511388d4bb
-
SSDEEP
49152:r3YYgIR6zuEV571wHtGXLTi1Qn0UkFyr:r3cya1wNcMQ9e
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\U: msiexec.exe -
Drops file in Program Files directory 8 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Windows NT\Update.png MsiExec.exe File created C:\Program Files (x86)\Windows NT\7za.bin msiexec.exe File created C:\Program Files (x86)\Windows NT\bin.dat msiexec.exe File created C:\Program Files (x86)\Windows NT\locale.dat msiexec.exe File created C:\Program Files (x86)\Windows NT\locale2.dat msiexec.exe File created C:\Program Files (x86)\Windows NT\locale3.dat msiexec.exe File created C:\Program Files (x86)\Windows NT\locale4.dat msiexec.exe File created C:\Program Files (x86)\Windows NT\Update.png MsiExec.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI7C43.tmp msiexec.exe File created C:\Windows\Installer\f79788b.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\f79788d.msi msiexec.exe File created C:\Windows\Installer\f79788a.msi msiexec.exe File opened for modification C:\Windows\Installer\f79788a.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI7B57.tmp msiexec.exe File opened for modification C:\Windows\Installer\f79788b.ipi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe -
Loads dropped DLL 1 IoCs
pid Process 2460 MsiExec.exe -
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 1568 msiexec.exe -
Modifies data under HKEY_USERS 46 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E msiexec.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2E msiexec.exe -
Modifies registry class 22 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\765D6DA3F1D34AC4BAA27DB2C32341A5\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\765D6DA3F1D34AC4BAA27DB2C32341A5\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\765D6DA3F1D34AC4BAA27DB2C32341A5\PackageCode = "FF39A9CB9576CE54B99F10924185FA14" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\765D6DA3F1D34AC4BAA27DB2C32341A5\Version = "17367048" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\765D6DA3F1D34AC4BAA27DB2C32341A5\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\ABCBA521D21C113428DCA45BEA7C434C\765D6DA3F1D34AC4BAA27DB2C32341A5 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\765D6DA3F1D34AC4BAA27DB2C32341A5\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\765D6DA3F1D34AC4BAA27DB2C32341A5\SourceList\Net msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\765D6DA3F1D34AC4BAA27DB2C32341A5\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\765D6DA3F1D34AC4BAA27DB2C32341A5\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\765D6DA3F1D34AC4BAA27DB2C32341A5\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\765D6DA3F1D34AC4BAA27DB2C32341A5\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\765D6DA3F1D34AC4BAA27DB2C32341A5\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\765D6DA3F1D34AC4BAA27DB2C32341A5 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\765D6DA3F1D34AC4BAA27DB2C32341A5\ProductFeature msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\765D6DA3F1D34AC4BAA27DB2C32341A5 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\765D6DA3F1D34AC4BAA27DB2C32341A5\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\ABCBA521D21C113428DCA45BEA7C434C msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\765D6DA3F1D34AC4BAA27DB2C32341A5\SourceList\PackageName = "软件包安装.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\765D6DA3F1D34AC4BAA27DB2C32341A5\ProductName = "Setup Program" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\765D6DA3F1D34AC4BAA27DB2C32341A5\AdvertiseFlags = "388" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\765D6DA3F1D34AC4BAA27DB2C32341A5\Clients = 3a0000000000 msiexec.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1780 msiexec.exe 1780 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1568 msiexec.exe Token: SeIncreaseQuotaPrivilege 1568 msiexec.exe Token: SeRestorePrivilege 1780 msiexec.exe Token: SeTakeOwnershipPrivilege 1780 msiexec.exe Token: SeSecurityPrivilege 1780 msiexec.exe Token: SeCreateTokenPrivilege 1568 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1568 msiexec.exe Token: SeLockMemoryPrivilege 1568 msiexec.exe Token: SeIncreaseQuotaPrivilege 1568 msiexec.exe Token: SeMachineAccountPrivilege 1568 msiexec.exe Token: SeTcbPrivilege 1568 msiexec.exe Token: SeSecurityPrivilege 1568 msiexec.exe Token: SeTakeOwnershipPrivilege 1568 msiexec.exe Token: SeLoadDriverPrivilege 1568 msiexec.exe Token: SeSystemProfilePrivilege 1568 msiexec.exe Token: SeSystemtimePrivilege 1568 msiexec.exe Token: SeProfSingleProcessPrivilege 1568 msiexec.exe Token: SeIncBasePriorityPrivilege 1568 msiexec.exe Token: SeCreatePagefilePrivilege 1568 msiexec.exe Token: SeCreatePermanentPrivilege 1568 msiexec.exe Token: SeBackupPrivilege 1568 msiexec.exe Token: SeRestorePrivilege 1568 msiexec.exe Token: SeShutdownPrivilege 1568 msiexec.exe Token: SeDebugPrivilege 1568 msiexec.exe Token: SeAuditPrivilege 1568 msiexec.exe Token: SeSystemEnvironmentPrivilege 1568 msiexec.exe Token: SeChangeNotifyPrivilege 1568 msiexec.exe Token: SeRemoteShutdownPrivilege 1568 msiexec.exe Token: SeUndockPrivilege 1568 msiexec.exe Token: SeSyncAgentPrivilege 1568 msiexec.exe Token: SeEnableDelegationPrivilege 1568 msiexec.exe Token: SeManageVolumePrivilege 1568 msiexec.exe Token: SeImpersonatePrivilege 1568 msiexec.exe Token: SeCreateGlobalPrivilege 1568 msiexec.exe Token: SeBackupPrivilege 1240 vssvc.exe Token: SeRestorePrivilege 1240 vssvc.exe Token: SeAuditPrivilege 1240 vssvc.exe Token: SeBackupPrivilege 1780 msiexec.exe Token: SeRestorePrivilege 1780 msiexec.exe Token: SeRestorePrivilege 2776 DrvInst.exe Token: SeRestorePrivilege 2776 DrvInst.exe Token: SeRestorePrivilege 2776 DrvInst.exe Token: SeRestorePrivilege 2776 DrvInst.exe Token: SeRestorePrivilege 2776 DrvInst.exe Token: SeRestorePrivilege 2776 DrvInst.exe Token: SeRestorePrivilege 2776 DrvInst.exe Token: SeLoadDriverPrivilege 2776 DrvInst.exe Token: SeLoadDriverPrivilege 2776 DrvInst.exe Token: SeLoadDriverPrivilege 2776 DrvInst.exe Token: SeRestorePrivilege 1780 msiexec.exe Token: SeTakeOwnershipPrivilege 1780 msiexec.exe Token: SeRestorePrivilege 1780 msiexec.exe Token: SeTakeOwnershipPrivilege 1780 msiexec.exe Token: SeRestorePrivilege 1780 msiexec.exe Token: SeTakeOwnershipPrivilege 1780 msiexec.exe Token: SeRestorePrivilege 1780 msiexec.exe Token: SeTakeOwnershipPrivilege 1780 msiexec.exe Token: SeRestorePrivilege 1780 msiexec.exe Token: SeTakeOwnershipPrivilege 1780 msiexec.exe Token: SeRestorePrivilege 1780 msiexec.exe Token: SeTakeOwnershipPrivilege 1780 msiexec.exe Token: SeRestorePrivilege 1780 msiexec.exe Token: SeTakeOwnershipPrivilege 1780 msiexec.exe Token: SeRestorePrivilege 1780 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1568 msiexec.exe 1568 msiexec.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1780 wrote to memory of 2460 1780 msiexec.exe 33 PID 1780 wrote to memory of 2460 1780 msiexec.exe 33 PID 1780 wrote to memory of 2460 1780 msiexec.exe 33 PID 1780 wrote to memory of 2460 1780 msiexec.exe 33 PID 1780 wrote to memory of 2460 1780 msiexec.exe 33 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\软件包安装.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1568
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Windows\system32\MsiExec.exeC:\Windows\system32\MsiExec.exe -Embedding 33AD7DBA5E5C1CDC7E5F2E86B7BBA79E M Global\MSI00002⤵
- Drops file in Program Files directory
- Loads dropped DLL
PID:2460
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1240
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000538" "00000000000004A0"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2776
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
991KB
MD56c29160e7399f9b4946f6435429730f7
SHA1b341b2c780db589e840379e9fb1c565d09ebd251
SHA2562b380e135cab0a6b3012966f83f6ed38ae17ed6100fc7c017e6f3d9e65f88f98
SHA512503f26b7ff824792292523fdfc14daf538a1cf9357fc4caa61510ba31436104df161253e8da37cb061ec152f61d8fb589146054e2e2f52b58cf8209e7058ea9b
-
Filesize
984KB
MD52d7cb93530254216475becb691121dfb
SHA1309f5fe7e5114307590cb870ed2be65999092e2d
SHA256a00aefa8248081a627d0b8db0960b9e8a624ca348a3f4a1768727d070d2af4e6
SHA5123658b3b28facf267f06fe1388754c60784e8d2e293c1585a3a07ef97d6f9fe3e28de0cb4a90b1485f47ea034e10e6b550b97ca9af102c7db51ddca155bad8936
-
Filesize
1.8MB
MD5ba615bbffbb5a4604ee2ddf9a2972333
SHA1229540b47f5248997257946a0fab693c070ed436
SHA256854f026f4e3071e41c828edcb350c049b74211ce7b653d8161a32d345257afcf
SHA5126c0b2f108e06873c3d09e8f0f9a20583b134a356b9cb775d44f4ee3a0807ad7d86b30b7aa60eafdd6dbf6fdf18f0f70ec0b45fef66f31ac4adb214511388d4bb