Analysis
-
max time kernel
62s -
max time network
93s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
21-11-2024 10:06
Static task
static1
Behavioral task
behavioral1
Sample
1.e.msi
Resource
win7-20241010-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
1.e.msi
Resource
win10v2004-20241007-en
windows10-2004-x64
30 signatures
150 seconds
General
-
Target
1.e.msi
-
Size
42.1MB
-
MD5
c6482889fe38ab6fac54f0b220ac5407
-
SHA1
0a69fbde5b864d04ac9c28e2361b2d2e684c8f38
-
SHA256
0c70a985493b30edda772a39d108743e11b52569bccbb8e5b48a271765fb998d
-
SHA512
7e952a053c54cfd5dcc3854459ac53ccbf56880e4978030f32f55d433f545002683fc1a43a0e0d919f1b8608e84da72c7c1fa0b575171c91ca1d75048bee8934
-
SSDEEP
786432:Ik4FDMyBJdSbNA0Dmrv+XkyxQ+wFyz1thYPATnoYELCw:VkncYTRGyPqoLCw
Score
6/10
Malware Config
Signatures
-
Blocklisted process makes network request 3 IoCs
Processes:
msiexec.exemsiexec.exeflow pid Process 3 2604 msiexec.exe 5 2604 msiexec.exe 7 2820 msiexec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc Process File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Q: msiexec.exe -
Drops file in Windows directory 10 IoCs
Processes:
msiexec.exeDrvInst.exedescription ioc Process File opened for modification C:\Windows\Installer\MSIE258.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File created C:\Windows\Installer\f78dbee.msi msiexec.exe File created C:\Windows\Installer\f78dbef.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\f78dbef.ipi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\f78dbee.msi msiexec.exe File created C:\Windows\Installer\f78dbf1.msi msiexec.exe -
Executes dropped EXE 1 IoCs
Processes:
DiffDog.exepid Process 588 DiffDog.exe -
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
-
Modifies data under HKEY_USERS 43 IoCs
Processes:
DrvInst.exedescription ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
msiexec.exepid Process 2820 msiexec.exe 2820 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
msiexec.exemsiexec.exevssvc.exeDrvInst.exedescription pid Process Token: SeShutdownPrivilege 2604 msiexec.exe Token: SeIncreaseQuotaPrivilege 2604 msiexec.exe Token: SeRestorePrivilege 2820 msiexec.exe Token: SeTakeOwnershipPrivilege 2820 msiexec.exe Token: SeSecurityPrivilege 2820 msiexec.exe Token: SeCreateTokenPrivilege 2604 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2604 msiexec.exe Token: SeLockMemoryPrivilege 2604 msiexec.exe Token: SeIncreaseQuotaPrivilege 2604 msiexec.exe Token: SeMachineAccountPrivilege 2604 msiexec.exe Token: SeTcbPrivilege 2604 msiexec.exe Token: SeSecurityPrivilege 2604 msiexec.exe Token: SeTakeOwnershipPrivilege 2604 msiexec.exe Token: SeLoadDriverPrivilege 2604 msiexec.exe Token: SeSystemProfilePrivilege 2604 msiexec.exe Token: SeSystemtimePrivilege 2604 msiexec.exe Token: SeProfSingleProcessPrivilege 2604 msiexec.exe Token: SeIncBasePriorityPrivilege 2604 msiexec.exe Token: SeCreatePagefilePrivilege 2604 msiexec.exe Token: SeCreatePermanentPrivilege 2604 msiexec.exe Token: SeBackupPrivilege 2604 msiexec.exe Token: SeRestorePrivilege 2604 msiexec.exe Token: SeShutdownPrivilege 2604 msiexec.exe Token: SeDebugPrivilege 2604 msiexec.exe Token: SeAuditPrivilege 2604 msiexec.exe Token: SeSystemEnvironmentPrivilege 2604 msiexec.exe Token: SeChangeNotifyPrivilege 2604 msiexec.exe Token: SeRemoteShutdownPrivilege 2604 msiexec.exe Token: SeUndockPrivilege 2604 msiexec.exe Token: SeSyncAgentPrivilege 2604 msiexec.exe Token: SeEnableDelegationPrivilege 2604 msiexec.exe Token: SeManageVolumePrivilege 2604 msiexec.exe Token: SeImpersonatePrivilege 2604 msiexec.exe Token: SeCreateGlobalPrivilege 2604 msiexec.exe Token: SeBackupPrivilege 2928 vssvc.exe Token: SeRestorePrivilege 2928 vssvc.exe Token: SeAuditPrivilege 2928 vssvc.exe Token: SeBackupPrivilege 2820 msiexec.exe Token: SeRestorePrivilege 2820 msiexec.exe Token: SeRestorePrivilege 2764 DrvInst.exe Token: SeRestorePrivilege 2764 DrvInst.exe Token: SeRestorePrivilege 2764 DrvInst.exe Token: SeRestorePrivilege 2764 DrvInst.exe Token: SeRestorePrivilege 2764 DrvInst.exe Token: SeRestorePrivilege 2764 DrvInst.exe Token: SeRestorePrivilege 2764 DrvInst.exe Token: SeLoadDriverPrivilege 2764 DrvInst.exe Token: SeLoadDriverPrivilege 2764 DrvInst.exe Token: SeLoadDriverPrivilege 2764 DrvInst.exe Token: SeRestorePrivilege 2820 msiexec.exe Token: SeTakeOwnershipPrivilege 2820 msiexec.exe Token: SeRestorePrivilege 2820 msiexec.exe Token: SeTakeOwnershipPrivilege 2820 msiexec.exe Token: SeRestorePrivilege 2820 msiexec.exe Token: SeTakeOwnershipPrivilege 2820 msiexec.exe Token: SeRestorePrivilege 2820 msiexec.exe Token: SeTakeOwnershipPrivilege 2820 msiexec.exe Token: SeRestorePrivilege 2820 msiexec.exe Token: SeTakeOwnershipPrivilege 2820 msiexec.exe Token: SeRestorePrivilege 2820 msiexec.exe Token: SeTakeOwnershipPrivilege 2820 msiexec.exe Token: SeRestorePrivilege 2820 msiexec.exe Token: SeTakeOwnershipPrivilege 2820 msiexec.exe Token: SeRestorePrivilege 2820 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
msiexec.exepid Process 2604 msiexec.exe 2604 msiexec.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
msiexec.exedescription pid Process procid_target PID 2820 wrote to memory of 588 2820 msiexec.exe 33 PID 2820 wrote to memory of 588 2820 msiexec.exe 33 PID 2820 wrote to memory of 588 2820 msiexec.exe 33 PID 2820 wrote to memory of 588 2820 msiexec.exe 33 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\1.e.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2604
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Programs\MotiveWave Proffesional\DiffDog.exe"C:\Users\Admin\AppData\Local\Programs\MotiveWave Proffesional\DiffDog.exe"2⤵
- Executes dropped EXE
PID:588
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2928
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000574" "00000000000003F0"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2764
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13KB
MD536f53592617936eb5de17d16b1fb324a
SHA146baa3f169c5fa332544175b1b3b33de6a356b58
SHA256ca99c06c7e1c984b8b73e36b517c4ff71e00871dd8d31cd14afe8b3db7193165
SHA51282a8c7a90607866b3e4bf70c1967f660c6b96f2548b2da5e8d4e93a42164e5361971eef5eae0c45af0429e8583dc43e90a02ebe948c508ba72dd3700aa79e515
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a00e9aeceec532c8cfca45d0c33d7e57
SHA153f9fb587701252751a3d2ee826606e54b276b65
SHA256f046473552b4dc2988846e622f1a4562d2cfdc31440bf1856905fd31e839d241
SHA51278dc49dea5bf062391c6d95c008684ea87c87ef2d40bfdd964227ede2e7e0e7611c14f18374842d01dfc87552b84d45a2c051a8ed14769eb84aa9b6d3b190729
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
42.1MB
MD5c6482889fe38ab6fac54f0b220ac5407
SHA10a69fbde5b864d04ac9c28e2361b2d2e684c8f38
SHA2560c70a985493b30edda772a39d108743e11b52569bccbb8e5b48a271765fb998d
SHA5127e952a053c54cfd5dcc3854459ac53ccbf56880e4978030f32f55d433f545002683fc1a43a0e0d919f1b8608e84da72c7c1fa0b575171c91ca1d75048bee8934