Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2024 06:43
Static task
static1
Behavioral task
behavioral1
Sample
8ef787b0f11fcb0d5d9fe3b209bb5526.msi
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
8ef787b0f11fcb0d5d9fe3b209bb5526.msi
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
8ef787b0f11fcb0d5d9fe3b209bb5526.msi
-
Size
1.8MB
-
MD5
8ef787b0f11fcb0d5d9fe3b209bb5526
-
SHA1
e5f31bfe6f080679807333760f18281abfd17adc
-
SHA256
d66bdcb1c0a4f2e5452c852e24e001d153a9c9de1d7a692cb5f1ede5e056f1fa
-
SHA512
e492f1c086caef83ef92fd8ad8dc569a6ebe8a1d18499845b7ce2cb2dddaed30bb193ee5f7fe581b67e838fee81a8e689cd377e0053b201b2590faff796d00a0
-
SSDEEP
24576:Mt9cpVDhSsbTnopGR274VCg0MOg44CGgRynfWMSrcJ:rpRhSppGR0ACg0MOWCwnuMacJ
Malware Config
Signatures
-
Modifies file permissions 1 TTPs 1 IoCs
pid Process 4880 ICACLS.EXE -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe -
Drops file in Windows directory 7 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSICD23.tmp msiexec.exe File created C:\Windows\Installer\e57cc58.msi msiexec.exe File opened for modification C:\Windows\Installer\e57cc58.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\SourceHash{D425ECE9-AA22-4FB8-9E95-B5A59C391C55} msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe -
Loads dropped DLL 1 IoCs
pid Process 4816 MsiExec.exe -
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2416 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ICACLS.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXPAND.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language anterra.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000038a6760542cf76680000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000038a676050000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090038a67605000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d38a67605000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000038a6760500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4940 msiexec.exe 4940 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 49 IoCs
description pid Process Token: SeShutdownPrivilege 2416 msiexec.exe Token: SeIncreaseQuotaPrivilege 2416 msiexec.exe Token: SeSecurityPrivilege 4940 msiexec.exe Token: SeCreateTokenPrivilege 2416 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2416 msiexec.exe Token: SeLockMemoryPrivilege 2416 msiexec.exe Token: SeIncreaseQuotaPrivilege 2416 msiexec.exe Token: SeMachineAccountPrivilege 2416 msiexec.exe Token: SeTcbPrivilege 2416 msiexec.exe Token: SeSecurityPrivilege 2416 msiexec.exe Token: SeTakeOwnershipPrivilege 2416 msiexec.exe Token: SeLoadDriverPrivilege 2416 msiexec.exe Token: SeSystemProfilePrivilege 2416 msiexec.exe Token: SeSystemtimePrivilege 2416 msiexec.exe Token: SeProfSingleProcessPrivilege 2416 msiexec.exe Token: SeIncBasePriorityPrivilege 2416 msiexec.exe Token: SeCreatePagefilePrivilege 2416 msiexec.exe Token: SeCreatePermanentPrivilege 2416 msiexec.exe Token: SeBackupPrivilege 2416 msiexec.exe Token: SeRestorePrivilege 2416 msiexec.exe Token: SeShutdownPrivilege 2416 msiexec.exe Token: SeDebugPrivilege 2416 msiexec.exe Token: SeAuditPrivilege 2416 msiexec.exe Token: SeSystemEnvironmentPrivilege 2416 msiexec.exe Token: SeChangeNotifyPrivilege 2416 msiexec.exe Token: SeRemoteShutdownPrivilege 2416 msiexec.exe Token: SeUndockPrivilege 2416 msiexec.exe Token: SeSyncAgentPrivilege 2416 msiexec.exe Token: SeEnableDelegationPrivilege 2416 msiexec.exe Token: SeManageVolumePrivilege 2416 msiexec.exe Token: SeImpersonatePrivilege 2416 msiexec.exe Token: SeCreateGlobalPrivilege 2416 msiexec.exe Token: SeBackupPrivilege 1728 vssvc.exe Token: SeRestorePrivilege 1728 vssvc.exe Token: SeAuditPrivilege 1728 vssvc.exe Token: SeBackupPrivilege 4940 msiexec.exe Token: SeRestorePrivilege 4940 msiexec.exe Token: SeRestorePrivilege 4940 msiexec.exe Token: SeTakeOwnershipPrivilege 4940 msiexec.exe Token: SeRestorePrivilege 4940 msiexec.exe Token: SeTakeOwnershipPrivilege 4940 msiexec.exe Token: SeBackupPrivilege 3124 srtasks.exe Token: SeRestorePrivilege 3124 srtasks.exe Token: SeSecurityPrivilege 3124 srtasks.exe Token: SeTakeOwnershipPrivilege 3124 srtasks.exe Token: SeBackupPrivilege 3124 srtasks.exe Token: SeRestorePrivilege 3124 srtasks.exe Token: SeSecurityPrivilege 3124 srtasks.exe Token: SeTakeOwnershipPrivilege 3124 srtasks.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2416 msiexec.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 4940 wrote to memory of 3124 4940 msiexec.exe 99 PID 4940 wrote to memory of 3124 4940 msiexec.exe 99 PID 4940 wrote to memory of 4816 4940 msiexec.exe 101 PID 4940 wrote to memory of 4816 4940 msiexec.exe 101 PID 4940 wrote to memory of 4816 4940 msiexec.exe 101 PID 4816 wrote to memory of 4880 4816 MsiExec.exe 102 PID 4816 wrote to memory of 4880 4816 MsiExec.exe 102 PID 4816 wrote to memory of 4880 4816 MsiExec.exe 102 PID 4816 wrote to memory of 2976 4816 MsiExec.exe 104 PID 4816 wrote to memory of 2976 4816 MsiExec.exe 104 PID 4816 wrote to memory of 2976 4816 MsiExec.exe 104 PID 4816 wrote to memory of 2528 4816 MsiExec.exe 107 PID 4816 wrote to memory of 2528 4816 MsiExec.exe 107 PID 4816 wrote to memory of 2528 4816 MsiExec.exe 107 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\8ef787b0f11fcb0d5d9fe3b209bb5526.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2416
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:3124
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B62FD081C59736530065BC21ABEF730D2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-937117ff-c3f1-460d-9bd1-d745065fbfd7\." /SETINTEGRITYLEVEL (CI)(OI)HIGH3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:4880
-
-
C:\Windows\SysWOW64\EXPAND.EXE"C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files3⤵
- System Location Discovery: System Language Discovery
PID:2976
-
-
C:\Users\Admin\AppData\Local\Temp\MW-937117ff-c3f1-460d-9bd1-d745065fbfd7\files\anterra.exe"C:\Users\Admin\AppData\Local\Temp\MW-937117ff-c3f1-460d-9bd1-d745065fbfd7\files\anterra.exe" /VERYSILENT /VERYSILENT3⤵
- System Location Discovery: System Language Discovery
PID:2528
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1728
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD53ea8f867c2dad306173d24f0a0f1c763
SHA1e44eef4fc152dc00c2ab01ff3042dfec100bd37d
SHA25633a956fd56612688e6339d4d4486e8767aac967a2ac808eb9fad1af20b4ac9b6
SHA512cb8f4dd7ba9789d4d19c038b6fbcd3412f7315381d56943bbe3c9bad17f1c3bfbef36e3e2564ca4fa0cad3e0f4bebf70ec93a2584dec43b70d13acc6b2a56680
-
Filesize
384B
MD563c1bbd341a35d62ed8eddc3e64a6d59
SHA14fa05be08997e7e04ea9e834a61b25be043cabec
SHA2564929fbac313b0554fc6363a0fa6de98b446449102d7d6b66432b193ad0c8d95b
SHA5129bd34373de8a928891b5133343e924eb49003cf6bf1144c342c756f4a769fdd427475e4a584b26ddf9535951562af7ee47adc6ee54dd791c1c3eca8913d5d97e
-
Filesize
1KB
MD5e1c497b3d5a7638b56ab3ec0eefd5741
SHA10f1beeb637d3a93e591fdb1cd13bd53a25593114
SHA25643a0eaac0a4e6e8dce833188762a3907c1a5fe328241495db042ad58d4d8fb00
SHA512307d9d290939adc82d972d213cf10ef17fe9c5e2c445f8d4c606d9a030910f5be677c6ab280718059336704ee285a125bdf74f0bb7aa252903f56fe9a7508f23
-
Filesize
1KB
MD50500f8564774846292673c81589beb18
SHA1ba8e746daaf4f4d171653bb18147a94aa0e2f6af
SHA25652a747cbaa3d314083ef1ab88a07eba60735a139e1e850993a84d7a53940f8ff
SHA512cca7dd197d65ad06ee4d64f624b478520a66acb764e0055a424e8ef602d6baad70cfe72cfaea4faa89aed546c3598619cbeba0f936d94c93db862bda308217f2
-
Filesize
208KB
MD50c8921bbcc37c6efd34faf44cf3b0cb5
SHA1dcfa71246157edcd09eecaf9d4c5e360b24b3e49
SHA256fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1
SHA512ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108
-
Filesize
24.1MB
MD58adab31f56bb8881df1488767e2f4389
SHA19145fada9595356f8f9e76b15f830d66b8f4cbf5
SHA256c0058578d513eec350b10b991a7af8c3cb16a14a6981741e52d8b093a59be6a0
SHA5127cd727300bdf37d4035b0bcff74bcf937fc7ba8e5b1e3b6477a28b3f9f544cfeea362e50c8a738b2c276b4efb88f9f3ef2b33dbb3f5d6b85a67cc727a99d132e
-
\??\Volume{0576a638-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{5e091a4f-4426-4c6e-a939-c63f78156b38}_OnDiskSnapshotProp
Filesize6KB
MD5584a7f214ab7dacea3a2043eb01fd311
SHA1c59714fb549cb26995394f0daa72e1d5e949aeee
SHA256212143f99a3a13239adaa8d9ef97770c297ce3aeba1a4936300c6f6e8a449ed3
SHA512c1dea816785f50b7e6e2b97e41ac29801a6f112fb241d5f42f0ea4a09467743c5c47e870b885bfe7b435b8eedd950b0c873ffdc9a995f4171a8d2ec43a14a318