Analysis
-
max time kernel
95s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/11/2024, 15:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Snook13s.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
Snook13s.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
Snook13s.exe
-
Size
1.3MB
-
MD5
fcefd307d52481eb67325b3fc295980a
-
SHA1
70ff818096785a113d0ca2c12019d14bc80fa390
-
SHA256
bf91d4e9c63aec0b8dbab17b6e13187fd910428ec883b4a080054b03f4584cc7
-
SHA512
3440dc3b5133d27a7e6ec232861ae69b44d52d4108fd268b280d37c162fb4c5e4f08e7221a58ebde06c6d36088841a6b908ab9a73eb1e911c26a55ca16ce981f
-
SSDEEP
24576:NMcUX4eLAzYQswBIA4w1dvchvRcjWLyA8pIG6+9zcpKSj2erDnB4TdIw+FwqgW1:NMd4eLAzYdX6dvooW84pPj2KDnaxEj1
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 3632 MsiExec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Snook13s.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3984 msiexec.exe Token: SeIncreaseQuotaPrivilege 3984 msiexec.exe Token: SeSecurityPrivilege 4468 msiexec.exe Token: SeCreateTokenPrivilege 3984 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3984 msiexec.exe Token: SeLockMemoryPrivilege 3984 msiexec.exe Token: SeIncreaseQuotaPrivilege 3984 msiexec.exe Token: SeMachineAccountPrivilege 3984 msiexec.exe Token: SeTcbPrivilege 3984 msiexec.exe Token: SeSecurityPrivilege 3984 msiexec.exe Token: SeTakeOwnershipPrivilege 3984 msiexec.exe Token: SeLoadDriverPrivilege 3984 msiexec.exe Token: SeSystemProfilePrivilege 3984 msiexec.exe Token: SeSystemtimePrivilege 3984 msiexec.exe Token: SeProfSingleProcessPrivilege 3984 msiexec.exe Token: SeIncBasePriorityPrivilege 3984 msiexec.exe Token: SeCreatePagefilePrivilege 3984 msiexec.exe Token: SeCreatePermanentPrivilege 3984 msiexec.exe Token: SeBackupPrivilege 3984 msiexec.exe Token: SeRestorePrivilege 3984 msiexec.exe Token: SeShutdownPrivilege 3984 msiexec.exe Token: SeDebugPrivilege 3984 msiexec.exe Token: SeAuditPrivilege 3984 msiexec.exe Token: SeSystemEnvironmentPrivilege 3984 msiexec.exe Token: SeChangeNotifyPrivilege 3984 msiexec.exe Token: SeRemoteShutdownPrivilege 3984 msiexec.exe Token: SeUndockPrivilege 3984 msiexec.exe Token: SeSyncAgentPrivilege 3984 msiexec.exe Token: SeEnableDelegationPrivilege 3984 msiexec.exe Token: SeManageVolumePrivilege 3984 msiexec.exe Token: SeImpersonatePrivilege 3984 msiexec.exe Token: SeCreateGlobalPrivilege 3984 msiexec.exe Token: SeCreateTokenPrivilege 3984 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3984 msiexec.exe Token: SeLockMemoryPrivilege 3984 msiexec.exe Token: SeIncreaseQuotaPrivilege 3984 msiexec.exe Token: SeMachineAccountPrivilege 3984 msiexec.exe Token: SeTcbPrivilege 3984 msiexec.exe Token: SeSecurityPrivilege 3984 msiexec.exe Token: SeTakeOwnershipPrivilege 3984 msiexec.exe Token: SeLoadDriverPrivilege 3984 msiexec.exe Token: SeSystemProfilePrivilege 3984 msiexec.exe Token: SeSystemtimePrivilege 3984 msiexec.exe Token: SeProfSingleProcessPrivilege 3984 msiexec.exe Token: SeIncBasePriorityPrivilege 3984 msiexec.exe Token: SeCreatePagefilePrivilege 3984 msiexec.exe Token: SeCreatePermanentPrivilege 3984 msiexec.exe Token: SeBackupPrivilege 3984 msiexec.exe Token: SeRestorePrivilege 3984 msiexec.exe Token: SeShutdownPrivilege 3984 msiexec.exe Token: SeDebugPrivilege 3984 msiexec.exe Token: SeAuditPrivilege 3984 msiexec.exe Token: SeSystemEnvironmentPrivilege 3984 msiexec.exe Token: SeChangeNotifyPrivilege 3984 msiexec.exe Token: SeRemoteShutdownPrivilege 3984 msiexec.exe Token: SeUndockPrivilege 3984 msiexec.exe Token: SeSyncAgentPrivilege 3984 msiexec.exe Token: SeEnableDelegationPrivilege 3984 msiexec.exe Token: SeManageVolumePrivilege 3984 msiexec.exe Token: SeImpersonatePrivilege 3984 msiexec.exe Token: SeCreateGlobalPrivilege 3984 msiexec.exe Token: SeCreateTokenPrivilege 3984 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3984 msiexec.exe Token: SeLockMemoryPrivilege 3984 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3984 msiexec.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2648 wrote to memory of 3984 2648 Snook13s.exe 84 PID 2648 wrote to memory of 3984 2648 Snook13s.exe 84 PID 4468 wrote to memory of 3632 4468 msiexec.exe 87 PID 4468 wrote to memory of 3632 4468 msiexec.exe 87 PID 4468 wrote to memory of 3632 4468 msiexec.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\Snook13s.exe"C:\Users\Admin\AppData\Local\Temp\Snook13s.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\system32\msiexec.exe/i "C:\Users\Admin\AppData\Roaming\JHC Software Limited\Snooker147 & Poolster\install\SnookerPoolster.msi" AI_SETUPEXEPATH="C:\Users\Admin\AppData\Local\Temp\Snook13s.exe" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp\"2⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3984
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 245F67F392B6900E22C6028BBCB7EC5B C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3632
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD5dceb7732ed78c465c4d759956501b171
SHA12da8964ad354a0a53cdac281ebdadbe9dfa22c2b
SHA256150b4a3ca67ea766b282a0a75651b43058f593c5083eb7b5893f031619c9dd07
SHA512655ce5c1d3f13fd8e5b559bf5bded5465f71438c7a0a280e9f95d352984b8ad836ab77c4e2bcbbce8c15ff1ebe6e1dca6a9f1282144880977b77ced7dd38f380
-
Filesize
102B
MD50dbb32aad2d012c35ff729e9d4113c95
SHA17283421c8179ac72c849fc4a93d4a3be1dc828b9
SHA256775ad9a68d14f2ac7aaa0b6a2209ae1fe0c3033aa0c8ff41b84527008580c75c
SHA51242d62b609581ed9fc7bc0e3d6a0ba74233d9cf6d1f526cc8480edee543957bb1c54eee3b58c62b7a023750e0f856e23e42da94cedb04ada190eba23dd37c5dc4
-
C:\Users\Admin\AppData\Roaming\JHC Software Limited\Snooker147 & Poolster\install\SnookerPoolster.msi
Filesize182KB
MD55d68055820370dc8f1d4e8f37173c85c
SHA12f0d590467bf64f7249c60a35e97582d96497e85
SHA25655aa27845681f7c1d2be64389f6f38c346da4801ef017a95901bc326b4664955
SHA512d65eb4a7c330e3812d40d51d9feb1c55a780bd0382a60723cec6426b3655af3a2564996a11abcb66d4b80ed3a91d6028df4831466d5f84540a0716156204eb13