Analysis

  • max time kernel
    93s
  • max time network
    130s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-10-2024 15:23

General

  • Target

    ea2d5c28c0fd62ceb7237c0b7718223b4c0572cd2770137ef321dbe116f6d1a2.msi

  • Size

    54.5MB

  • MD5

    656325df0e1bc2e38e31e40fd0f300f1

  • SHA1

    cf94b7503d582f8fad39c44ab21f600a1a3a5faa

  • SHA256

    ea2d5c28c0fd62ceb7237c0b7718223b4c0572cd2770137ef321dbe116f6d1a2

  • SHA512

    3fddacaa56279884a4cf39c172b6c9a449f99e1826497773941b786513c098ff7ad9d8839aa0ed0c041c6081aa6c8987b62936156137eae42543d31e999911ce

  • SSDEEP

    1572864:Jp+Ty2SfWnHDk8FjVbfzPTq4R+R6YoFczfDiQPU8azMCAJ5m:0/0WnHDkkjBPTq43YoFefTPU8awCm5

Malware Config

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 18 IoCs
  • Loads dropped DLL 11 IoCs
  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 58 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ea2d5c28c0fd62ceb7237c0b7718223b4c0572cd2770137ef321dbe116f6d1a2.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:852
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4396
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 26CD3321630F03B3EABE5CD6E6B39790
      2⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:1420

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\Installer\MSI6FA2.tmp

    Filesize

    738KB

    MD5

    b158d8d605571ea47a238df5ab43dfaa

    SHA1

    bb91ae1f2f7142b9099e3cc285f4f5b84de568e4

    SHA256

    ca763693cc25d316f14a9ebad80ebf00590329550c45adb7e5205486533c2504

    SHA512

    56aef59c198acf2fcd0d95ea6e32ce1c706e5098a0800feff13ddb427bfb4d538de1c415a5cb5496b09a5825155e3abb1c13c8c37dc31549604bd4d63cb70591

  • C:\Windows\Installer\MSI7217.tmp

    Filesize

    870KB

    MD5

    6119e62d8047032a715ba0670fc476c5

    SHA1

    52e639024460bf111c469e95fb011c07d6fc89e8

    SHA256

    bc31f85266df2cdfdbe22149937105388fa3adc17e3646fa4a167736e819af77

    SHA512

    e7301fa21f01f7f7562b853e9bb246ed051951e3cef152bb0b3558d4863f141edbbc0c4d439c30f51f9997805490f131a5e4cd00872b61ccb08ba9d200f811d8

  • C:\Windows\Installer\MSI7285.tmp

    Filesize

    1.1MB

    MD5

    1a2b237796742c26b11a008d0b175e29

    SHA1

    cfd5affcfb3b6fd407e58dfc7187fad4f186ea18

    SHA256

    81e0df47bcb2b3380fb0fb58b0d673be4ef1b0367fd2b0d80ab8ee292fc8f730

    SHA512

    3135d866bf91f9e09b980dd649582072df1f53eabe4c5ac5d34fff1aeb5b6fa01d38d87fc31de19a0887a910e95309bcf0e7ae54e6e8ed2469feb64da4a4f9e5

  • C:\Windows\Installer\MSI89F8.tmp

    Filesize

    314KB

    MD5

    61123cbc153cb7f178ddbb318a7ea000

    SHA1

    0cfb1faa4c166d2a335ee62b05dd62b730ded9d6

    SHA256

    e5e0183dfd9f65406042762c0427bbcff010402b9934dadd2bddbb6c382d625c

    SHA512

    3249f814c9e4c472b5962ab159729bb44e28314e2e402abf4b5ec6789cb729192b662c948d362fa71f4284038544e4fdbb8f6d55b6ec0fb92c4de04840a15926

  • C:\Windows\Installer\MSI8A97.tmp

    Filesize

    364KB

    MD5

    54d74546c6afe67b3d118c3c477c159a

    SHA1

    957f08beb7e27e657cd83d8ee50388b887935fae

    SHA256

    f9956417af079e428631a6c921b79716d960c3b4917c6b7d17ff3cb945f18611

    SHA512

    d27750b913cc2b7388e9948f42385d0b4124e48335ae7fc0bc6971f4f807dbc9af63fe88675bc440eb42b9a92551bf2d77130b1633ddda90866616b583ae924f