1c3c3560906974161f25f5f81de4620787b55ca76002ac3c4fc846d57a06df99

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 07:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7z2401.msi
Size

1.4MB
MD5

a141303fe3fd74208c1c8a1121a7f67d
SHA1

b55c286e80a9e128fbf615da63169162c08aef94
SHA256

1c3c3560906974161f25f5f81de4620787b55ca76002ac3c4fc846d57a06df99
SHA512

2323c292bfa7ea712d39a4d33cdd19563dd073fee6c684d02e7e931abe72af92f85e5bf8bff7c647e4fcdc522b148e9b8d1dd43a9d37c73c0ae86d5efb1885c8
SSDEEP

24576:S+xMHACSK47NXchb6OqTHHBniI4BqHsE4RKKKGE32/XlOA+gYy4isa444GuOlr3B:NMX747NXch+Oq7VsE44KPE3qlHyjwlrx

Score

6^/10

persistence privilege_escalation

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
persistence privilege_escalation

Installer Packages
T1546.016

Msiexec
T1218.007

Processes:

msiexec.exe

pid process

2552 msiexec.exe

pid	process
2552	msiexec.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

Processes:

msiexec.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	2552	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2552	msiexec.exe
Token: SeRestorePrivilege	2396	msiexec.exe
Token: SeTakeOwnershipPrivilege	2396	msiexec.exe
Token: SeSecurityPrivilege	2396	msiexec.exe
Token: SeCreateTokenPrivilege	2552	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2552	msiexec.exe
Token: SeLockMemoryPrivilege	2552	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2552	msiexec.exe
Token: SeMachineAccountPrivilege	2552	msiexec.exe
Token: SeTcbPrivilege	2552	msiexec.exe
Token: SeSecurityPrivilege	2552	msiexec.exe
Token: SeTakeOwnershipPrivilege	2552	msiexec.exe
Token: SeLoadDriverPrivilege	2552	msiexec.exe
Token: SeSystemProfilePrivilege	2552	msiexec.exe
Token: SeSystemtimePrivilege	2552	msiexec.exe
Token: SeProfSingleProcessPrivilege	2552	msiexec.exe
Token: SeIncBasePriorityPrivilege	2552	msiexec.exe
Token: SeCreatePagefilePrivilege	2552	msiexec.exe
Token: SeCreatePermanentPrivilege	2552	msiexec.exe
Token: SeBackupPrivilege	2552	msiexec.exe
Token: SeRestorePrivilege	2552	msiexec.exe
Token: SeShutdownPrivilege	2552	msiexec.exe
Token: SeDebugPrivilege	2552	msiexec.exe
Token: SeAuditPrivilege	2552	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2552	msiexec.exe
Token: SeChangeNotifyPrivilege	2552	msiexec.exe
Token: SeRemoteShutdownPrivilege	2552	msiexec.exe
Token: SeUndockPrivilege	2552	msiexec.exe
Token: SeSyncAgentPrivilege	2552	msiexec.exe
Token: SeEnableDelegationPrivilege	2552	msiexec.exe
Token: SeManageVolumePrivilege	2552	msiexec.exe
Token: SeImpersonatePrivilege	2552	msiexec.exe
Token: SeCreateGlobalPrivilege	2552	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

msiexec.exe

pid process

2552 msiexec.exe

pid	process
2552	msiexec.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\7z2401.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2552