Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29/11/2024, 19:16
Static task
static1
Behavioral task
behavioral1
Sample
node-v22.11.0-x64.msi
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
node-v22.11.0-x64.msi
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
node-v22.11.0-x64.msi
-
Size
28.9MB
-
MD5
fa9e1f3064a66913362e9bff7097cef5
-
SHA1
b34f1f9a9f6242c54486a4bc453a9336840b4425
-
SHA256
9eea480bd30c98ae11a97cb89a9278235cbbbd03c171ee5e5198bd86b7965b4b
-
SHA512
ad3e9469326dccac6b49185b5b2814ba700b5d83b4b3ce17f85a9adc5f90bdebf54d79800b253ed5c371ab82d27304841f86ab1a8a3c7ffade8a2d78e55dc99f
-
SSDEEP
786432:EtShU+9S49htlhk3tKuiU9IsO9IP1/lBMS8k4:EAUK/U9IN961/l
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 2 2788 msiexec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe -
Loads dropped DLL 2 IoCs
pid Process 2068 MsiExec.exe 2068 MsiExec.exe -
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2788 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2788 msiexec.exe Token: SeIncreaseQuotaPrivilege 2788 msiexec.exe Token: SeRestorePrivilege 2628 msiexec.exe Token: SeTakeOwnershipPrivilege 2628 msiexec.exe Token: SeSecurityPrivilege 2628 msiexec.exe Token: SeCreateTokenPrivilege 2788 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2788 msiexec.exe Token: SeLockMemoryPrivilege 2788 msiexec.exe Token: SeIncreaseQuotaPrivilege 2788 msiexec.exe Token: SeMachineAccountPrivilege 2788 msiexec.exe Token: SeTcbPrivilege 2788 msiexec.exe Token: SeSecurityPrivilege 2788 msiexec.exe Token: SeTakeOwnershipPrivilege 2788 msiexec.exe Token: SeLoadDriverPrivilege 2788 msiexec.exe Token: SeSystemProfilePrivilege 2788 msiexec.exe Token: SeSystemtimePrivilege 2788 msiexec.exe Token: SeProfSingleProcessPrivilege 2788 msiexec.exe Token: SeIncBasePriorityPrivilege 2788 msiexec.exe Token: SeCreatePagefilePrivilege 2788 msiexec.exe Token: SeCreatePermanentPrivilege 2788 msiexec.exe Token: SeBackupPrivilege 2788 msiexec.exe Token: SeRestorePrivilege 2788 msiexec.exe Token: SeShutdownPrivilege 2788 msiexec.exe Token: SeDebugPrivilege 2788 msiexec.exe Token: SeAuditPrivilege 2788 msiexec.exe Token: SeSystemEnvironmentPrivilege 2788 msiexec.exe Token: SeChangeNotifyPrivilege 2788 msiexec.exe Token: SeRemoteShutdownPrivilege 2788 msiexec.exe Token: SeUndockPrivilege 2788 msiexec.exe Token: SeSyncAgentPrivilege 2788 msiexec.exe Token: SeEnableDelegationPrivilege 2788 msiexec.exe Token: SeManageVolumePrivilege 2788 msiexec.exe Token: SeImpersonatePrivilege 2788 msiexec.exe Token: SeCreateGlobalPrivilege 2788 msiexec.exe Token: SeCreateTokenPrivilege 2788 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2788 msiexec.exe Token: SeLockMemoryPrivilege 2788 msiexec.exe Token: SeIncreaseQuotaPrivilege 2788 msiexec.exe Token: SeMachineAccountPrivilege 2788 msiexec.exe Token: SeTcbPrivilege 2788 msiexec.exe Token: SeSecurityPrivilege 2788 msiexec.exe Token: SeTakeOwnershipPrivilege 2788 msiexec.exe Token: SeLoadDriverPrivilege 2788 msiexec.exe Token: SeSystemProfilePrivilege 2788 msiexec.exe Token: SeSystemtimePrivilege 2788 msiexec.exe Token: SeProfSingleProcessPrivilege 2788 msiexec.exe Token: SeIncBasePriorityPrivilege 2788 msiexec.exe Token: SeCreatePagefilePrivilege 2788 msiexec.exe Token: SeCreatePermanentPrivilege 2788 msiexec.exe Token: SeBackupPrivilege 2788 msiexec.exe Token: SeRestorePrivilege 2788 msiexec.exe Token: SeShutdownPrivilege 2788 msiexec.exe Token: SeDebugPrivilege 2788 msiexec.exe Token: SeAuditPrivilege 2788 msiexec.exe Token: SeSystemEnvironmentPrivilege 2788 msiexec.exe Token: SeChangeNotifyPrivilege 2788 msiexec.exe Token: SeRemoteShutdownPrivilege 2788 msiexec.exe Token: SeUndockPrivilege 2788 msiexec.exe Token: SeSyncAgentPrivilege 2788 msiexec.exe Token: SeEnableDelegationPrivilege 2788 msiexec.exe Token: SeManageVolumePrivilege 2788 msiexec.exe Token: SeImpersonatePrivilege 2788 msiexec.exe Token: SeCreateGlobalPrivilege 2788 msiexec.exe Token: SeCreateTokenPrivilege 2788 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2788 msiexec.exe 2788 msiexec.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2628 wrote to memory of 2068 2628 msiexec.exe 31 PID 2628 wrote to memory of 2068 2628 msiexec.exe 31 PID 2628 wrote to memory of 2068 2628 msiexec.exe 31 PID 2628 wrote to memory of 2068 2628 msiexec.exe 31 PID 2628 wrote to memory of 2068 2628 msiexec.exe 31
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\node-v22.11.0-x64.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2788
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\system32\MsiExec.exeC:\Windows\system32\MsiExec.exe -Embedding ADA876A4C0A1005C4ED93833AD249F0F C2⤵
- Loads dropped DLL
PID:2068
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
390KB
MD580bebea11fbe87108b08762a1bbff2cd
SHA1a7ec111a792fd9a870841be430d130a545613782
SHA256facf518f88cd67afd959c99c3ba233f78a4fbfe7fd3565489da74a585b55e9d1
SHA512a760debb2084d801b6381a0e1dcef66080df03a768cc577b20b8472be87ad8477d59c331159555de10182d87340aa68fe1f3f5d0212048fd7692d85f4da656f6
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
144KB
MD57fa9d662d634534d7c2240dd126bdeee
SHA1bd01e22ed2da0d0d485824b372ac67da683863d2
SHA256c0e8683b697b3c6e55deb4497d3434d6e2cc841eb8c9a1b7d3f8907cff7de206
SHA512cbc737e3eb94151c9dacaa5ee780cb550176ca2be2e0c66925884b5bc6222b7bcde5ed66e881f2a76f3d26edf5331abf0e74c819ad4f5fd7d0819bc4c138bb81