Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/11/2024, 15:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Snook13s.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
Snook13s.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
Snook13s.exe
-
Size
1.3MB
-
MD5
fcefd307d52481eb67325b3fc295980a
-
SHA1
70ff818096785a113d0ca2c12019d14bc80fa390
-
SHA256
bf91d4e9c63aec0b8dbab17b6e13187fd910428ec883b4a080054b03f4584cc7
-
SHA512
3440dc3b5133d27a7e6ec232861ae69b44d52d4108fd268b280d37c162fb4c5e4f08e7221a58ebde06c6d36088841a6b908ab9a73eb1e911c26a55ca16ce981f
-
SSDEEP
24576:NMcUX4eLAzYQswBIA4w1dvchvRcjWLyA8pIG6+9zcpKSj2erDnB4TdIw+FwqgW1:NMd4eLAzYdX6dvooW84pPj2KDnaxEj1
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2704 MsiExec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Snook13s.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2988 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2988 msiexec.exe Token: SeIncreaseQuotaPrivilege 2988 msiexec.exe Token: SeRestorePrivilege 2984 msiexec.exe Token: SeTakeOwnershipPrivilege 2984 msiexec.exe Token: SeSecurityPrivilege 2984 msiexec.exe Token: SeCreateTokenPrivilege 2988 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2988 msiexec.exe Token: SeLockMemoryPrivilege 2988 msiexec.exe Token: SeIncreaseQuotaPrivilege 2988 msiexec.exe Token: SeMachineAccountPrivilege 2988 msiexec.exe Token: SeTcbPrivilege 2988 msiexec.exe Token: SeSecurityPrivilege 2988 msiexec.exe Token: SeTakeOwnershipPrivilege 2988 msiexec.exe Token: SeLoadDriverPrivilege 2988 msiexec.exe Token: SeSystemProfilePrivilege 2988 msiexec.exe Token: SeSystemtimePrivilege 2988 msiexec.exe Token: SeProfSingleProcessPrivilege 2988 msiexec.exe Token: SeIncBasePriorityPrivilege 2988 msiexec.exe Token: SeCreatePagefilePrivilege 2988 msiexec.exe Token: SeCreatePermanentPrivilege 2988 msiexec.exe Token: SeBackupPrivilege 2988 msiexec.exe Token: SeRestorePrivilege 2988 msiexec.exe Token: SeShutdownPrivilege 2988 msiexec.exe Token: SeDebugPrivilege 2988 msiexec.exe Token: SeAuditPrivilege 2988 msiexec.exe Token: SeSystemEnvironmentPrivilege 2988 msiexec.exe Token: SeChangeNotifyPrivilege 2988 msiexec.exe Token: SeRemoteShutdownPrivilege 2988 msiexec.exe Token: SeUndockPrivilege 2988 msiexec.exe Token: SeSyncAgentPrivilege 2988 msiexec.exe Token: SeEnableDelegationPrivilege 2988 msiexec.exe Token: SeManageVolumePrivilege 2988 msiexec.exe Token: SeImpersonatePrivilege 2988 msiexec.exe Token: SeCreateGlobalPrivilege 2988 msiexec.exe Token: SeCreateTokenPrivilege 2988 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2988 msiexec.exe Token: SeLockMemoryPrivilege 2988 msiexec.exe Token: SeIncreaseQuotaPrivilege 2988 msiexec.exe Token: SeMachineAccountPrivilege 2988 msiexec.exe Token: SeTcbPrivilege 2988 msiexec.exe Token: SeSecurityPrivilege 2988 msiexec.exe Token: SeTakeOwnershipPrivilege 2988 msiexec.exe Token: SeLoadDriverPrivilege 2988 msiexec.exe Token: SeSystemProfilePrivilege 2988 msiexec.exe Token: SeSystemtimePrivilege 2988 msiexec.exe Token: SeProfSingleProcessPrivilege 2988 msiexec.exe Token: SeIncBasePriorityPrivilege 2988 msiexec.exe Token: SeCreatePagefilePrivilege 2988 msiexec.exe Token: SeCreatePermanentPrivilege 2988 msiexec.exe Token: SeBackupPrivilege 2988 msiexec.exe Token: SeRestorePrivilege 2988 msiexec.exe Token: SeShutdownPrivilege 2988 msiexec.exe Token: SeDebugPrivilege 2988 msiexec.exe Token: SeAuditPrivilege 2988 msiexec.exe Token: SeSystemEnvironmentPrivilege 2988 msiexec.exe Token: SeChangeNotifyPrivilege 2988 msiexec.exe Token: SeRemoteShutdownPrivilege 2988 msiexec.exe Token: SeUndockPrivilege 2988 msiexec.exe Token: SeSyncAgentPrivilege 2988 msiexec.exe Token: SeEnableDelegationPrivilege 2988 msiexec.exe Token: SeManageVolumePrivilege 2988 msiexec.exe Token: SeImpersonatePrivilege 2988 msiexec.exe Token: SeCreateGlobalPrivilege 2988 msiexec.exe Token: SeCreateTokenPrivilege 2988 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2988 msiexec.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2148 wrote to memory of 2988 2148 Snook13s.exe 31 PID 2148 wrote to memory of 2988 2148 Snook13s.exe 31 PID 2148 wrote to memory of 2988 2148 Snook13s.exe 31 PID 2148 wrote to memory of 2988 2148 Snook13s.exe 31 PID 2148 wrote to memory of 2988 2148 Snook13s.exe 31 PID 2148 wrote to memory of 2988 2148 Snook13s.exe 31 PID 2148 wrote to memory of 2988 2148 Snook13s.exe 31 PID 2984 wrote to memory of 2704 2984 msiexec.exe 33 PID 2984 wrote to memory of 2704 2984 msiexec.exe 33 PID 2984 wrote to memory of 2704 2984 msiexec.exe 33 PID 2984 wrote to memory of 2704 2984 msiexec.exe 33 PID 2984 wrote to memory of 2704 2984 msiexec.exe 33 PID 2984 wrote to memory of 2704 2984 msiexec.exe 33 PID 2984 wrote to memory of 2704 2984 msiexec.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\Snook13s.exe"C:\Users\Admin\AppData\Local\Temp\Snook13s.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\system32\msiexec.exe/i "C:\Users\Admin\AppData\Roaming\JHC Software Limited\Snooker147 & Poolster\install\SnookerPoolster.msi" AI_SETUPEXEPATH="C:\Users\Admin\AppData\Local\Temp\Snook13s.exe" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp\"2⤵
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2988
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1CDFDE8C20B79F460F15B6FCAD054DE5 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2704
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD5dceb7732ed78c465c4d759956501b171
SHA12da8964ad354a0a53cdac281ebdadbe9dfa22c2b
SHA256150b4a3ca67ea766b282a0a75651b43058f593c5083eb7b5893f031619c9dd07
SHA512655ce5c1d3f13fd8e5b559bf5bded5465f71438c7a0a280e9f95d352984b8ad836ab77c4e2bcbbce8c15ff1ebe6e1dca6a9f1282144880977b77ced7dd38f380
-
Filesize
102B
MD50dbb32aad2d012c35ff729e9d4113c95
SHA17283421c8179ac72c849fc4a93d4a3be1dc828b9
SHA256775ad9a68d14f2ac7aaa0b6a2209ae1fe0c3033aa0c8ff41b84527008580c75c
SHA51242d62b609581ed9fc7bc0e3d6a0ba74233d9cf6d1f526cc8480edee543957bb1c54eee3b58c62b7a023750e0f856e23e42da94cedb04ada190eba23dd37c5dc4
-
C:\Users\Admin\AppData\Roaming\JHC Software Limited\Snooker147 & Poolster\install\SnookerPoolster.msi
Filesize182KB
MD55d68055820370dc8f1d4e8f37173c85c
SHA12f0d590467bf64f7249c60a35e97582d96497e85
SHA25655aa27845681f7c1d2be64389f6f38c346da4801ef017a95901bc326b4664955
SHA512d65eb4a7c330e3812d40d51d9feb1c55a780bd0382a60723cec6426b3655af3a2564996a11abcb66d4b80ed3a91d6028df4831466d5f84540a0716156204eb13