Analysis
-
max time kernel
93s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04-10-2024 15:23
Static task
static1
Behavioral task
behavioral1
Sample
ea2d5c28c0fd62ceb7237c0b7718223b4c0572cd2770137ef321dbe116f6d1a2.msi
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ea2d5c28c0fd62ceb7237c0b7718223b4c0572cd2770137ef321dbe116f6d1a2.msi
Resource
win10v2004-20240802-en
General
-
Target
ea2d5c28c0fd62ceb7237c0b7718223b4c0572cd2770137ef321dbe116f6d1a2.msi
-
Size
54.5MB
-
MD5
656325df0e1bc2e38e31e40fd0f300f1
-
SHA1
cf94b7503d582f8fad39c44ab21f600a1a3a5faa
-
SHA256
ea2d5c28c0fd62ceb7237c0b7718223b4c0572cd2770137ef321dbe116f6d1a2
-
SHA512
3fddacaa56279884a4cf39c172b6c9a449f99e1826497773941b786513c098ff7ad9d8839aa0ed0c041c6081aa6c8987b62936156137eae42543d31e999911ce
-
SSDEEP
1572864:Jp+Ty2SfWnHDk8FjVbfzPTq4R+R6YoFczfDiQPU8azMCAJ5m:0/0WnHDkkjBPTq43YoFefTPU8awCm5
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 21 1420 MsiExec.exe 23 1420 MsiExec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe -
Drops file in Windows directory 18 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI6FA2.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7159.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8A97.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI70EB.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7199.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7217.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7285.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{9CC1CCE0-262A-4F0F-BAE0-668EB2174F47} msiexec.exe File opened for modification C:\Windows\Installer\e576f15.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI72C5.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI89F8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8A57.tmp msiexec.exe File created C:\Windows\Installer\e576f15.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI89A9.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9016.tmp msiexec.exe -
Loads dropped DLL 11 IoCs
pid Process 1420 MsiExec.exe 1420 MsiExec.exe 1420 MsiExec.exe 1420 MsiExec.exe 1420 MsiExec.exe 1420 MsiExec.exe 1420 MsiExec.exe 1420 MsiExec.exe 1420 MsiExec.exe 1420 MsiExec.exe 1420 MsiExec.exe -
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 852 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4396 msiexec.exe 4396 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 58 IoCs
description pid Process Token: SeShutdownPrivilege 852 msiexec.exe Token: SeIncreaseQuotaPrivilege 852 msiexec.exe Token: SeSecurityPrivilege 4396 msiexec.exe Token: SeCreateTokenPrivilege 852 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 852 msiexec.exe Token: SeLockMemoryPrivilege 852 msiexec.exe Token: SeIncreaseQuotaPrivilege 852 msiexec.exe Token: SeMachineAccountPrivilege 852 msiexec.exe Token: SeTcbPrivilege 852 msiexec.exe Token: SeSecurityPrivilege 852 msiexec.exe Token: SeTakeOwnershipPrivilege 852 msiexec.exe Token: SeLoadDriverPrivilege 852 msiexec.exe Token: SeSystemProfilePrivilege 852 msiexec.exe Token: SeSystemtimePrivilege 852 msiexec.exe Token: SeProfSingleProcessPrivilege 852 msiexec.exe Token: SeIncBasePriorityPrivilege 852 msiexec.exe Token: SeCreatePagefilePrivilege 852 msiexec.exe Token: SeCreatePermanentPrivilege 852 msiexec.exe Token: SeBackupPrivilege 852 msiexec.exe Token: SeRestorePrivilege 852 msiexec.exe Token: SeShutdownPrivilege 852 msiexec.exe Token: SeDebugPrivilege 852 msiexec.exe Token: SeAuditPrivilege 852 msiexec.exe Token: SeSystemEnvironmentPrivilege 852 msiexec.exe Token: SeChangeNotifyPrivilege 852 msiexec.exe Token: SeRemoteShutdownPrivilege 852 msiexec.exe Token: SeUndockPrivilege 852 msiexec.exe Token: SeSyncAgentPrivilege 852 msiexec.exe Token: SeEnableDelegationPrivilege 852 msiexec.exe Token: SeManageVolumePrivilege 852 msiexec.exe Token: SeImpersonatePrivilege 852 msiexec.exe Token: SeCreateGlobalPrivilege 852 msiexec.exe Token: SeRestorePrivilege 4396 msiexec.exe Token: SeTakeOwnershipPrivilege 4396 msiexec.exe Token: SeRestorePrivilege 4396 msiexec.exe Token: SeTakeOwnershipPrivilege 4396 msiexec.exe Token: SeRestorePrivilege 4396 msiexec.exe Token: SeTakeOwnershipPrivilege 4396 msiexec.exe Token: SeRestorePrivilege 4396 msiexec.exe Token: SeTakeOwnershipPrivilege 4396 msiexec.exe Token: SeRestorePrivilege 4396 msiexec.exe Token: SeTakeOwnershipPrivilege 4396 msiexec.exe Token: SeRestorePrivilege 4396 msiexec.exe Token: SeTakeOwnershipPrivilege 4396 msiexec.exe Token: SeRestorePrivilege 4396 msiexec.exe Token: SeTakeOwnershipPrivilege 4396 msiexec.exe Token: SeRestorePrivilege 4396 msiexec.exe Token: SeTakeOwnershipPrivilege 4396 msiexec.exe Token: SeRestorePrivilege 4396 msiexec.exe Token: SeTakeOwnershipPrivilege 4396 msiexec.exe Token: SeRestorePrivilege 4396 msiexec.exe Token: SeTakeOwnershipPrivilege 4396 msiexec.exe Token: SeRestorePrivilege 4396 msiexec.exe Token: SeTakeOwnershipPrivilege 4396 msiexec.exe Token: SeRestorePrivilege 4396 msiexec.exe Token: SeTakeOwnershipPrivilege 4396 msiexec.exe Token: SeRestorePrivilege 4396 msiexec.exe Token: SeTakeOwnershipPrivilege 4396 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 852 msiexec.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4396 wrote to memory of 1420 4396 msiexec.exe 84 PID 4396 wrote to memory of 1420 4396 msiexec.exe 84 PID 4396 wrote to memory of 1420 4396 msiexec.exe 84
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ea2d5c28c0fd62ceb7237c0b7718223b4c0572cd2770137ef321dbe116f6d1a2.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:852
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 26CD3321630F03B3EABE5CD6E6B397902⤵
- Blocklisted process makes network request
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1420
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
738KB
MD5b158d8d605571ea47a238df5ab43dfaa
SHA1bb91ae1f2f7142b9099e3cc285f4f5b84de568e4
SHA256ca763693cc25d316f14a9ebad80ebf00590329550c45adb7e5205486533c2504
SHA51256aef59c198acf2fcd0d95ea6e32ce1c706e5098a0800feff13ddb427bfb4d538de1c415a5cb5496b09a5825155e3abb1c13c8c37dc31549604bd4d63cb70591
-
Filesize
870KB
MD56119e62d8047032a715ba0670fc476c5
SHA152e639024460bf111c469e95fb011c07d6fc89e8
SHA256bc31f85266df2cdfdbe22149937105388fa3adc17e3646fa4a167736e819af77
SHA512e7301fa21f01f7f7562b853e9bb246ed051951e3cef152bb0b3558d4863f141edbbc0c4d439c30f51f9997805490f131a5e4cd00872b61ccb08ba9d200f811d8
-
Filesize
1.1MB
MD51a2b237796742c26b11a008d0b175e29
SHA1cfd5affcfb3b6fd407e58dfc7187fad4f186ea18
SHA25681e0df47bcb2b3380fb0fb58b0d673be4ef1b0367fd2b0d80ab8ee292fc8f730
SHA5123135d866bf91f9e09b980dd649582072df1f53eabe4c5ac5d34fff1aeb5b6fa01d38d87fc31de19a0887a910e95309bcf0e7ae54e6e8ed2469feb64da4a4f9e5
-
Filesize
314KB
MD561123cbc153cb7f178ddbb318a7ea000
SHA10cfb1faa4c166d2a335ee62b05dd62b730ded9d6
SHA256e5e0183dfd9f65406042762c0427bbcff010402b9934dadd2bddbb6c382d625c
SHA5123249f814c9e4c472b5962ab159729bb44e28314e2e402abf4b5ec6789cb729192b662c948d362fa71f4284038544e4fdbb8f6d55b6ec0fb92c4de04840a15926
-
Filesize
364KB
MD554d74546c6afe67b3d118c3c477c159a
SHA1957f08beb7e27e657cd83d8ee50388b887935fae
SHA256f9956417af079e428631a6c921b79716d960c3b4917c6b7d17ff3cb945f18611
SHA512d27750b913cc2b7388e9948f42385d0b4124e48335ae7fc0bc6971f4f807dbc9af63fe88675bc440eb42b9a92551bf2d77130b1633ddda90866616b583ae924f