Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13-12-2024 17:44
Static task
static1
Behavioral task
behavioral1
Sample
setup.msi
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
setup.msi
Resource
win10v2004-20241007-en
windows10-2004-x64
25 signatures
150 seconds
General
-
Target
setup.msi
-
Size
2.0MB
-
MD5
c4fd4e278fa9213069e5e786606e5120
-
SHA1
452403f6f96b7d61201bd29b1139d65e6e81ad47
-
SHA256
86f2fe4cb375e8a8ac2770c82050a135761a3b58e19232f8eaad3756c6ae94a7
-
SHA512
f0cf5633ec56fb2b88aa8b10119c3b2c2b4af7dc9c216c43c43954225ac9111eb47199adff0b361a0549a4035bc0f9c937a2bd7f4195d5432940bff9089758eb
-
SSDEEP
24576:tt9cpVDh4l3/heB1MMe49nn9avnA/4a/JnFVWNCJGEuST:ipRh45/hefMbInP4axQZST
Score
7/10
Malware Config
Signatures
-
Modifies file permissions 1 TTPs 2 IoCs
pid Process 2140 ICACLS.EXE 1228 ICACLS.EXE -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\Installer\f773534.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI361E.tmp msiexec.exe File opened for modification C:\Windows\Logs\DPX\setuperr.log EXPAND.EXE File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\f773535.ipi msiexec.exe File created C:\Windows\Installer\f773534.msi msiexec.exe File created C:\Windows\Installer\f773535.ipi msiexec.exe File opened for modification C:\Windows\Logs\DPX\setupact.log EXPAND.EXE -
Loads dropped DLL 1 IoCs
pid Process 3028 MsiExec.exe -
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2924 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ICACLS.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ICACLS.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXPAND.EXE -
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2716 msiexec.exe 2716 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 53 IoCs
description pid Process Token: SeShutdownPrivilege 2924 msiexec.exe Token: SeIncreaseQuotaPrivilege 2924 msiexec.exe Token: SeRestorePrivilege 2716 msiexec.exe Token: SeTakeOwnershipPrivilege 2716 msiexec.exe Token: SeSecurityPrivilege 2716 msiexec.exe Token: SeCreateTokenPrivilege 2924 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2924 msiexec.exe Token: SeLockMemoryPrivilege 2924 msiexec.exe Token: SeIncreaseQuotaPrivilege 2924 msiexec.exe Token: SeMachineAccountPrivilege 2924 msiexec.exe Token: SeTcbPrivilege 2924 msiexec.exe Token: SeSecurityPrivilege 2924 msiexec.exe Token: SeTakeOwnershipPrivilege 2924 msiexec.exe Token: SeLoadDriverPrivilege 2924 msiexec.exe Token: SeSystemProfilePrivilege 2924 msiexec.exe Token: SeSystemtimePrivilege 2924 msiexec.exe Token: SeProfSingleProcessPrivilege 2924 msiexec.exe Token: SeIncBasePriorityPrivilege 2924 msiexec.exe Token: SeCreatePagefilePrivilege 2924 msiexec.exe Token: SeCreatePermanentPrivilege 2924 msiexec.exe Token: SeBackupPrivilege 2924 msiexec.exe Token: SeRestorePrivilege 2924 msiexec.exe Token: SeShutdownPrivilege 2924 msiexec.exe Token: SeDebugPrivilege 2924 msiexec.exe Token: SeAuditPrivilege 2924 msiexec.exe Token: SeSystemEnvironmentPrivilege 2924 msiexec.exe Token: SeChangeNotifyPrivilege 2924 msiexec.exe Token: SeRemoteShutdownPrivilege 2924 msiexec.exe Token: SeUndockPrivilege 2924 msiexec.exe Token: SeSyncAgentPrivilege 2924 msiexec.exe Token: SeEnableDelegationPrivilege 2924 msiexec.exe Token: SeManageVolumePrivilege 2924 msiexec.exe Token: SeImpersonatePrivilege 2924 msiexec.exe Token: SeCreateGlobalPrivilege 2924 msiexec.exe Token: SeBackupPrivilege 2908 vssvc.exe Token: SeRestorePrivilege 2908 vssvc.exe Token: SeAuditPrivilege 2908 vssvc.exe Token: SeBackupPrivilege 2716 msiexec.exe Token: SeRestorePrivilege 2716 msiexec.exe Token: SeRestorePrivilege 2612 DrvInst.exe Token: SeRestorePrivilege 2612 DrvInst.exe Token: SeRestorePrivilege 2612 DrvInst.exe Token: SeRestorePrivilege 2612 DrvInst.exe Token: SeRestorePrivilege 2612 DrvInst.exe Token: SeRestorePrivilege 2612 DrvInst.exe Token: SeRestorePrivilege 2612 DrvInst.exe Token: SeLoadDriverPrivilege 2612 DrvInst.exe Token: SeLoadDriverPrivilege 2612 DrvInst.exe Token: SeLoadDriverPrivilege 2612 DrvInst.exe Token: SeRestorePrivilege 2716 msiexec.exe Token: SeTakeOwnershipPrivilege 2716 msiexec.exe Token: SeRestorePrivilege 2716 msiexec.exe Token: SeTakeOwnershipPrivilege 2716 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2924 msiexec.exe 2924 msiexec.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 2716 wrote to memory of 3028 2716 msiexec.exe 35 PID 2716 wrote to memory of 3028 2716 msiexec.exe 35 PID 2716 wrote to memory of 3028 2716 msiexec.exe 35 PID 2716 wrote to memory of 3028 2716 msiexec.exe 35 PID 2716 wrote to memory of 3028 2716 msiexec.exe 35 PID 2716 wrote to memory of 3028 2716 msiexec.exe 35 PID 2716 wrote to memory of 3028 2716 msiexec.exe 35 PID 3028 wrote to memory of 1228 3028 MsiExec.exe 36 PID 3028 wrote to memory of 1228 3028 MsiExec.exe 36 PID 3028 wrote to memory of 1228 3028 MsiExec.exe 36 PID 3028 wrote to memory of 1228 3028 MsiExec.exe 36 PID 3028 wrote to memory of 448 3028 MsiExec.exe 38 PID 3028 wrote to memory of 448 3028 MsiExec.exe 38 PID 3028 wrote to memory of 448 3028 MsiExec.exe 38 PID 3028 wrote to memory of 448 3028 MsiExec.exe 38 PID 3028 wrote to memory of 2776 3028 MsiExec.exe 40 PID 3028 wrote to memory of 2776 3028 MsiExec.exe 40 PID 3028 wrote to memory of 2776 3028 MsiExec.exe 40 PID 3028 wrote to memory of 2776 3028 MsiExec.exe 40 PID 3028 wrote to memory of 1696 3028 MsiExec.exe 42 PID 3028 wrote to memory of 1696 3028 MsiExec.exe 42 PID 3028 wrote to memory of 1696 3028 MsiExec.exe 42 PID 3028 wrote to memory of 1696 3028 MsiExec.exe 42 PID 3028 wrote to memory of 2140 3028 MsiExec.exe 44 PID 3028 wrote to memory of 2140 3028 MsiExec.exe 44 PID 3028 wrote to memory of 2140 3028 MsiExec.exe 44 PID 3028 wrote to memory of 2140 3028 MsiExec.exe 44 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\setup.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2924
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 33DB2420B653C9E9C12E0F3C125142A02⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-876caa9c-d49e-4f34-b978-bfc599948667\." /SETINTEGRITYLEVEL (CI)(OI)HIGH3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:1228
-
-
C:\Windows\SysWOW64\EXPAND.EXE"C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files3⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:448
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start msedge https://www.docusign.com/sites/default/files/Signature_Appliance_Client_Guide_8.0.pdf3⤵
- System Location Discovery: System Language Discovery
PID:2776
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\Admin\AppData\Local\Temp\MW-876caa9c-d49e-4f34-b978-bfc599948667\files"3⤵
- System Location Discovery: System Language Discovery
PID:1696
-
-
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-876caa9c-d49e-4f34-b978-bfc599948667\." /SETINTEGRITYLEVEL (CI)(OI)LOW3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:2140
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2908
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005D0" "0000000000000558"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2612
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD5c2e7c01653046e6b379dab9b2e3aea77
SHA13b6b2d7e88189b8b59b42bfca97daf8c861ea9db
SHA2561f8097cd8c16b83efe4f41bc3ac9137bab69dcbf912cf6ff0e68ddb19318a45a
SHA512a02ce1b231b16f0e1b4fbd3fc880147e3d84388e293976a6d712ee647e51dc7ac8742ad49471df0e3fd5956919f63a97df66e1f8e239ef4be828abf17504fcb1
-
Filesize
342B
MD5dbffde8aa12fe0a1e73a794985c490b3
SHA14293057c4a6a524e81cb96e65ba135a83a6d9c88
SHA256017d6f722425412a1461799d5c61b8095d91401cc44333e9e5b1d56e67519494
SHA512f41150779dd7fa8dcbe7a7dcccb9ed090632167d8d88e2b7c93d71304d55e0cafda6ff3652f6ae3cb72f38898d8f849fbe7ec5791d135c936ddcb015d6422f1f
-
Filesize
1KB
MD58d7925099c278f9e9083e196e1f372ae
SHA1288bb59df56b503f192e57f57d899966127848f4
SHA256e63775639b349c5ead1524d41e72dd87b8effa09130b9d542de0108db9d12517
SHA51248247aa5e89412848833cd36599c65493b8f14acb58087a8bc622d95690ef0181c0049027596892c05cb0be142c6679bf830498005a33140a4cf42aa0b8ed260
-
Filesize
1KB
MD57a0011678d7283f90c5a62554cc8c2d7
SHA1b881a657d3965a50f0abb559af26c37f71c9edd3
SHA2560f5d300e79a606e90ce845f870f8749997ca581c655c5bdaf98520a6614df1a0
SHA512c4ffa570045081fa025555490ea2a3f425265bbcfbd5158eeaf45d350a439d51802e8c7f312023da712d671e4f54f61a70b025ab55b4c06bb970a9f0790fbb78
-
Filesize
208KB
MD50c8921bbcc37c6efd34faf44cf3b0cb5
SHA1dcfa71246157edcd09eecaf9d4c5e360b24b3e49
SHA256fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1
SHA512ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108