Analysis

  • max time kernel
    119s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    22-11-2024 03:22

General

  • Target

    ff389718792f877fbdabe5cb02a1b3d5de5be988f9b5690250ffdf3409f04000.msi

  • Size

    1.7MB

  • MD5

    7c26877fcd894cc1355f2a31a551243c

  • SHA1

    80104216da4cd3449eabf0e0de2bb3a5b2de85ca

  • SHA256

    ff389718792f877fbdabe5cb02a1b3d5de5be988f9b5690250ffdf3409f04000

  • SHA512

    a57a961a3339b105f9d5653b69269ed7aab952a4e16600426edee80d628a9ac62a13b5ea642ffd9765fdada7b0db5c5a85a21bc88c125be122bf3c4e89d0cfb8

  • SSDEEP

    49152:BpRhaYJ+2/8yJ5OA4COg9lyp31X01clj+u1GTsF:BpDJ+2pgA4+6p31is+u1G4

Malware Config

Signatures

  • Modifies file permissions 1 TTPs 2 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 11 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 6 IoCs
  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 43 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 53 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ff389718792f877fbdabe5cb02a1b3d5de5be988f9b5690250ffdf3409f04000.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2392
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2800
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 31290E3318C1FCD04DE715D90D5C220F
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1044
      • C:\Windows\SysWOW64\ICACLS.EXE
        "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-ac480613-8079-4bfa-b43a-bc364fc4d067\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
        3⤵
        • Modifies file permissions
        • System Location Discovery: System Language Discovery
        PID:2792
      • C:\Windows\SysWOW64\EXPAND.EXE
        "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
        3⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:1664
      • C:\Users\Admin\AppData\Local\Temp\MW-ac480613-8079-4bfa-b43a-bc364fc4d067\files\task.exe
        "C:\Users\Admin\AppData\Local\Temp\MW-ac480613-8079-4bfa-b43a-bc364fc4d067\files\task.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1272
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\Admin\AppData\Local\Temp\MW-ac480613-8079-4bfa-b43a-bc364fc4d067\files"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1808
      • C:\Windows\SysWOW64\ICACLS.EXE
        "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-ac480613-8079-4bfa-b43a-bc364fc4d067\." /SETINTEGRITYLEVEL (CI)(OI)LOW
        3⤵
        • Modifies file permissions
        • System Location Discovery: System Language Discovery
        PID:1496
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2984
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000528" "00000000000003BC"
    1⤵
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    PID:2596

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

    Filesize

    471B

    MD5

    719182e07998ae9226d45680aa1fe178

    SHA1

    8f8b03c110c129cb3a35841ed959de7a7266ffec

    SHA256

    8f1d64c2c4dbb6ca892083e4b4a8bdb4585597e1269c218340c6b12517bb3dbe

    SHA512

    2df474f0ac4d1ef93b14deda32c5476da130bc41f37c0a5cd0c271c990914613c3c788116a4b87d44876695f71e5a131847fdf96d609364c06cb2f5ed6ce76a3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_6F243E053ACC5B86B13C52D626927FC5

    Filesize

    751B

    MD5

    20160bc3c7d11c08009f481fdd6e9aaa

    SHA1

    eec31aa7573632ec555d1ae21086e2cc21d39c46

    SHA256

    b847e2554ddb230d842476c8df308b899f4b9010e80d83bbf935f6ae1ca95552

    SHA512

    561e8a98d137a13f91e1c162fb2ff8b0a642cf0121d1d2619194ad82235dcae6b4381a66f69eec7622682c9304c3816c0bacb86910061e204b2b05591afcb7cd

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

    Filesize

    727B

    MD5

    c59fe2122c01472472b32153f9357db9

    SHA1

    ffd45432839790442f659390e16b2b4f96c066c5

    SHA256

    fbe269cbc7e81263ef32c8a3b320697dc8d0b9f90d72c13b7e74b482a640b71b

    SHA512

    51ae31fd5603d1b6038a3ed1134143bfb757372b8daf06f471d7ca5e54c4fb2bb27c4b257149861e5e3e841070f7d1bc7488bf3f799ea39c7daa7ec62fe5eb31

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

    Filesize

    400B

    MD5

    092f7d3cacedf4ec2e17418c9808589a

    SHA1

    1abd4d613976639c6dcf94fcbc08072b8c7e4e23

    SHA256

    fe1d9ebb3f52be50844d1e96a824f512d5b8616c45bfdc89b3b9b7c2e9ad4cae

    SHA512

    e4d26b05b03c0bf77c067d3ff500ac5ad8178d38d7e19d1b3e797e8a3e150f86c08c2c4680aff323695a5cc6c061256b92ffe79ab6de19ab9b52d899a6c2d7aa

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_6F243E053ACC5B86B13C52D626927FC5

    Filesize

    408B

    MD5

    6a4b3bf08fe3958a81749b8c0ead2d45

    SHA1

    695f63839ac68dda6a0a947117b13c3aa21aa0ee

    SHA256

    83e902a5335ed57a48ea8c7fe330634495dd9251559ec4dadd96132f28e3e90f

    SHA512

    71989c8cc08002b63cde358a14d2f58a74976aa323eed0540229bd2729c091ac101ee86cf1440f7a172de213fd93a928acf90fbccce6d6ddd3150b34b03a8d6a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

    Filesize

    412B

    MD5

    b5de54d3b6ee5ae2dadef5890a1a34d2

    SHA1

    250e4fe982653ba04bba75f044b7d7f730292678

    SHA256

    850539f0e481604fecb3d735e74cd5feeb75b44aa50675ba486b3c2b4dc7619a

    SHA512

    d1aae9ec2d9a2aa46d1155e4a3211cb50227725e22a0355cc3190a0fe7a370bff67c4c8e5fbb378bf79e6c6e43de22c9051f08783b7e41ed3a234f73ea29e369

  • C:\Users\Admin\AppData\Local\Temp\CabB962.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\MW-ac480613-8079-4bfa-b43a-bc364fc4d067\files.cab

    Filesize

    1.4MB

    MD5

    240f5d10d0fdc6e3a73b6793e0ea260f

    SHA1

    b6b7549b2c1a98fe88dea9f9fb462cb203647dbc

    SHA256

    5afa0071f63b662d93ab35e8a9a6a44b8ad439c62160388690e5e5793cb2b2d4

    SHA512

    faa0654a4359a90338905bcf627cb75d10d277ce8e2aafc07eca75ea887f54750b118042dd1e25e45c02706791ea5f5741202309928140789c319988e05f5029

  • C:\Users\Admin\AppData\Local\Temp\MW-ac480613-8079-4bfa-b43a-bc364fc4d067\files\YOUR_P~1.DLL

    Filesize

    601KB

    MD5

    8522cf224cb875847762353c89d2dce2

    SHA1

    4947ef0a7b3da4972106a6a97fff8c03f9db6799

    SHA256

    3dc24e9a42d9230f4c0db64bf11b9df544066c80c49b2aa66ce9a01ddb8c4088

    SHA512

    8933f0add139fd10f452ad18bcc400ab288aebe5bf764da66eb332b9b97dc56f7aaab66fd396b0ca1bf3c29a1487255b562a97fdeffaacc142347a95cd503350

  • C:\Users\Admin\AppData\Local\Temp\MW-ac480613-8079-4bfa-b43a-bc364fc4d067\files\data.bin

    Filesize

    741KB

    MD5

    8d9b3ca29d78cda545cf0a3131536f17

    SHA1

    d823975e67320244f3f02a59e5d29b53e16a828b

    SHA256

    97978ec89a58611cdeeffc623805c91966bf1d861395082804efe05302daf7cd

    SHA512

    287799d662bf3f113aab8009503afe7306f489b7fdad69ceffb190c9757412e00f6d3eedf5d5254d90319b27577d9567dc4b67860dc0148e249c042575f4dc0d

  • C:\Users\Admin\AppData\Local\Temp\MW-ac480613-8079-4bfa-b43a-bc364fc4d067\files\g2m.dll

    Filesize

    603KB

    MD5

    fc284eee599385a7ae9f098d123e983f

    SHA1

    acaa1c92d85afd92184d49592aed3aeab6ad2ded

    SHA256

    16414419a8248a4a55c05859c467d1fafc298694f3f71916261fe2e08ebf4abd

    SHA512

    c2538a98de60aeddb72cb14513ecce3493f04e94135182af658d3fc6425ad890560945efb02c956b11aa10606c95e7cb286e73c0d27e71f2b17d3494506e7123

  • C:\Users\Admin\AppData\Local\Temp\MW-ac480613-8079-4bfa-b43a-bc364fc4d067\files\run.bat

    Filesize

    70B

    MD5

    f8abf91d350d39ff1a48934b88624291

    SHA1

    88ef29fd18441c628a43925a8b32535d39e07979

    SHA256

    5b4e3e3f739b1ae3cd907a0abe9d5aaf51455551f69f9da57e668f749584efd6

    SHA512

    3c572c7415fbc8ee5f976ac9b6cce43c901174777c859e9461451676bd5158e940e0bd173d83d980958295cb9daacc489f0d596d98e93f71cb81d2603f037876

  • C:\Users\Admin\AppData\Local\Temp\MW-ac480613-8079-4bfa-b43a-bc364fc4d067\files\task.exe

    Filesize

    39KB

    MD5

    f1b14f71252de9ac763dbfbfbfc8c2dc

    SHA1

    dcc2dcb26c1649887f1d5ae557a000b5fe34bb98

    SHA256

    796ea1d27ed5825e300c3c9505a87b2445886623235f3e41258de90ba1604cd5

    SHA512

    636a32fb8a88a542783aa57fe047b6bca47b2bd23b41b3902671c4e9036c6dbb97576be27fd2395a988653e6b63714277873e077519b4a06cdc5f63d3c4224e0

  • C:\Users\Admin\AppData\Local\Temp\MW-ac480613-8079-4bfa-b43a-bc364fc4d067\files\task22.msi

    Filesize

    1.2MB

    MD5

    6406cce810c8aaa887ca6b8e004776d2

    SHA1

    1698d3d12341f3824e14f4dae75300eea9670797

    SHA256

    fbfde6f43c30f454b07dbd2fdcd83685ae0016227f5489c13ccb510a0cff00a6

    SHA512

    3cd6f24c1892abd1b12a02dac5ab53e2afe1c68bc366d1ddb26df1e56312da7ff5caca255e78cb61e3fcbbed21cd03fb8909c61302af4dbcdda7ad37eac73ffa

  • C:\Users\Admin\AppData\Local\Temp\MW-ac480613-8079-4bfa-b43a-bc364fc4d067\msiwrapper.ini

    Filesize

    386B

    MD5

    e3d5ec8bbbb3a14e8cef77f9ba3150e5

    SHA1

    4c46000b70f1a7faaf65b4c84ffb3980327ccdb0

    SHA256

    c22154a52a9d94a834564c545c04b152871b486e726ee66620ebb1b436d66952

    SHA512

    b3178bd2fd464f60dc9c42ef1df597e558e8443ea93d64d88736ebf838a5fefa11e8c70269a562a08a31109fcc00d9c16ba74d6890d9f577a253230a116920d0

  • C:\Users\Admin\AppData\Local\Temp\MW-ac480613-8079-4bfa-b43a-bc364fc4d067\msiwrapper.ini

    Filesize

    1KB

    MD5

    cfcf3faed51eb51e228057812d6c3972

    SHA1

    b13e982f2b93b037a49606c78db5afd786b1015d

    SHA256

    5c38af53bf91e17486f3cf2a03d767cfa6e7fe9b38f6518888d77cd63644c1f2

    SHA512

    c7f70695f7128e685577141d0d909ea19de24757fa40b665d362e1cdf4ef61132c5f3dfc8c21beb9961c1defc5a86e1af850d024ace61c1e46ef35c502556b82

  • C:\Users\Admin\AppData\Local\Temp\TarBB49.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Windows\Installer\MSIDB34.tmp

    Filesize

    208KB

    MD5

    0c8921bbcc37c6efd34faf44cf3b0cb5

    SHA1

    dcfa71246157edcd09eecaf9d4c5e360b24b3e49

    SHA256

    fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1

    SHA512

    ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108

  • C:\Windows\Installer\f76da58.msi

    Filesize

    1.7MB

    MD5

    7c26877fcd894cc1355f2a31a551243c

    SHA1

    80104216da4cd3449eabf0e0de2bb3a5b2de85ca

    SHA256

    ff389718792f877fbdabe5cb02a1b3d5de5be988f9b5690250ffdf3409f04000

    SHA512

    a57a961a3339b105f9d5653b69269ed7aab952a4e16600426edee80d628a9ac62a13b5ea642ffd9765fdada7b0db5c5a85a21bc88c125be122bf3c4e89d0cfb8