Analysis
- max time kernel
94s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
26/12/2024, 11:40
Static task
static1
Behavioral task
behavioral1
Sample
setup.msi
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
setup.msi
Resource
win10v2004-20241007-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
setup.msi
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
11 signatures
150 seconds
Behavioral task
behavioral4
Sample
setup.msi
Resource
win11-20241007-en
windows11-21h2-x64
11 signatures
150 seconds
General
- Target setup.msi
- Size 57.5MB
- Sample241226-ns5e2avlep
- SHA256 d14acce52061baa353ffd5698c16dd07a9cca9d86b28c1de64d51e21c3c3c6ac
- MD5 0c7afa785117afdb85ab29b0a12edc51
- SHA1 3b685880e7ec090ab3ead12d591b2aca1ac3dcfe
- SHA512 276ae21daeff60cdce52ade7ada801d89d642092160b1cbd91bec80f5f3e4fb339d79f4871c8eafa07d15763ca59f0b1bd04cb6b95f0f64a132674ae24fcc37d
- SSDEEP 786432:zGZojVmrjV7eIAtehOTZ0oZ4sdUuzt/NCaY2ksCo:zGcVmrjV7eIvhOTZ5RjVCa1tP
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Blocklisted process makes network request 2 IoCs
flow pid Process 16 1736 MsiExec.exe 18 1736 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\L: msiexec.exe - Drops file in Windows directory 16 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSIBAE7.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{1C4A5FBA-760B-4754-A971-45D0AA1EA01D} msiexec.exe File created C:\Windows\Installer\e57b824.msi msiexec.exe File opened for modification C:\Windows\Installer\e57b824.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSICBF3.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSICC04.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIBA48.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIBAB7.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIBB84.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIBBB4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB8C1.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIBBD4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC451.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe - Loads dropped DLL 9 IoCs
pid Process 1736 MsiExec.exe 1736 MsiExec.exe 1736 MsiExec.exe 1736 MsiExec.exe 1736 MsiExec.exe 1736 MsiExec.exe 1736 MsiExec.exe 1736 MsiExec.exe 1736 MsiExec.exe -
pid Process 4268 powershell.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4024 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1076 msiexec.exe 1076 msiexec.exe 4268 powershell.exe 4268 powershell.exe - Suspicious use of AdjustPrivilegeToken 55 IoCs
description pid Process Token: SeShutdownPrivilege 4024 msiexec.exe Token: SeIncreaseQuotaPrivilege 4024 msiexec.exe Token: SeSecurityPrivilege 1076 msiexec.exe Token: SeCreateTokenPrivilege 4024 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4024 msiexec.exe Token: SeLockMemoryPrivilege 4024 msiexec.exe Token: SeIncreaseQuotaPrivilege 4024 msiexec.exe Token: SeMachineAccountPrivilege 4024 msiexec.exe Token: SeTcbPrivilege 4024 msiexec.exe Token: SeSecurityPrivilege 4024 msiexec.exe Token: SeTakeOwnershipPrivilege 4024 msiexec.exe Token: SeLoadDriverPrivilege 4024 msiexec.exe Token: SeSystemProfilePrivilege 4024 msiexec.exe Token: SeSystemtimePrivilege 4024 msiexec.exe Token: SeProfSingleProcessPrivilege 4024 msiexec.exe Token: SeIncBasePriorityPrivilege 4024 msiexec.exe Token: SeCreatePagefilePrivilege 4024 msiexec.exe Token: SeCreatePermanentPrivilege 4024 msiexec.exe Token: SeBackupPrivilege 4024 msiexec.exe Token: SeRestorePrivilege 4024 msiexec.exe Token: SeShutdownPrivilege 4024 msiexec.exe Token: SeDebugPrivilege 4024 msiexec.exe Token: SeAuditPrivilege 4024 msiexec.exe Token: SeSystemEnvironmentPrivilege 4024 msiexec.exe Token: SeChangeNotifyPrivilege 4024 msiexec.exe Token: SeRemoteShutdownPrivilege 4024 msiexec.exe Token: SeUndockPrivilege 4024 msiexec.exe Token: SeSyncAgentPrivilege 4024 msiexec.exe Token: SeEnableDelegationPrivilege 4024 msiexec.exe Token: SeManageVolumePrivilege 4024 msiexec.exe Token: SeImpersonatePrivilege 4024 msiexec.exe Token: SeCreateGlobalPrivilege 4024 msiexec.exe Token: SeRestorePrivilege 1076 msiexec.exe Token: SeTakeOwnershipPrivilege 1076 msiexec.exe Token: SeRestorePrivilege 1076 msiexec.exe Token: SeTakeOwnershipPrivilege 1076 msiexec.exe Token: SeRestorePrivilege 1076 msiexec.exe Token: SeTakeOwnershipPrivilege 1076 msiexec.exe Token: SeRestorePrivilege 1076 msiexec.exe Token: SeTakeOwnershipPrivilege 1076 msiexec.exe Token: SeRestorePrivilege 1076 msiexec.exe Token: SeTakeOwnershipPrivilege 1076 msiexec.exe Token: SeRestorePrivilege 1076 msiexec.exe Token: SeTakeOwnershipPrivilege 1076 msiexec.exe Token: SeRestorePrivilege 1076 msiexec.exe Token: SeTakeOwnershipPrivilege 1076 msiexec.exe Token: SeRestorePrivilege 1076 msiexec.exe Token: SeTakeOwnershipPrivilege 1076 msiexec.exe Token: SeRestorePrivilege 1076 msiexec.exe Token: SeTakeOwnershipPrivilege 1076 msiexec.exe Token: SeRestorePrivilege 1076 msiexec.exe Token: SeTakeOwnershipPrivilege 1076 msiexec.exe Token: SeRestorePrivilege 1076 msiexec.exe Token: SeTakeOwnershipPrivilege 1076 msiexec.exe Token: SeDebugPrivilege 4268 powershell.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4024 msiexec.exe 4024 msiexec.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1076 wrote to memory of 1736 1076 msiexec.exe 85 PID 1076 wrote to memory of 1736 1076 msiexec.exe 85 PID 1076 wrote to memory of 1736 1076 msiexec.exe 85 PID 1736 wrote to memory of 4268 1736 MsiExec.exe 88 PID 1736 wrote to memory of 4268 1736 MsiExec.exe 88 PID 1736 wrote to memory of 4268 1736 MsiExec.exe 88
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\setup.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4024
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 84C80F29D7506DB7037AA2F0FCBC26702⤵
- Blocklisted process makes network request
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe-NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssCC9A.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msiCC97.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scrCC98.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scrCC99.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4268
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wwzg5zga.fxh.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\msiCC97.txt
- Size 54B
- SHA256 5473347620e53c8292b2572924addc315edc96f0d454f43a84bcdfbd964684eb
- MD5 898962bc85ce7701b99cf1d2e14740ca
- SHA1 634edede05caf8a90593b399c084df437b141920
- SHA512 521ee5f49bbb03144e0524b1d8f1ca60be8e97ec4ba69d959d4eae39a589f826ea0c462bc9c64f1ad2e1e3f97af379a7c80100a5a1eb4d1330f074201514f7b8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\pssCC9A.ps1
- Size 6KB
- SHA256 53094df6fa4e57a3265ff04bc1e970c10bcdb3d4094ad6dd610c05b7a8b79e0f
- MD5 30c30ef2cb47e35101d13402b5661179
- SHA1 25696b2aab86a9233f19017539e2dd83b2f75d4e
- SHA512 882be2768138bb75ff7dde7d5ca4c2e024699398baacd0ce1d4619902402e054297e4f464d8cb3c22b2f35d3dabc408122c207facad64ec8014f2c54834cf458
- SSDEEP 96:5Wb5VNkKmeHn/V2BVrIovmgNlGjxcj6BngOcvjb:5WbyZ/gVyvb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\scrCC98.ps1
- Size 250B
- SHA256 700080d274e5629a2bfa0d47b9baf53ad69e67a64a2b04d84115d5851ab3ddbd
- MD5 479fac6e0c05c5a57698619afe51def2
- SHA1 1af4a4db75ace8324ed7bff59d711e80a7bdb821
- SHA512 b0b5065c216ebc1124b985f3ff86ee7c7e7e9b994190d1103c454edd602e0242b7160bffb202538470254675dfacac6159f1a459b979dad563bded84fced193e
- MD5 SHA1 SHA512
- Path C:\Windows\Installer\MSIB8C1.tmp
- Size 997KB
- SHA256 7bbf611f5e2a16439dc8cd11936f6364f6d5cc0044545c92775da5646afc7752
- MD5 ee09d6a1bb908b42c05fd0beeb67dfd2
- SHA1 1eb7c1304b7bca649c2a5902b18a1ea57ceaa532
- SHA512 2dd2e4e66d2f2277f031c5f3c829a31c3b29196ab27262c6a8f1896a2113a1be1687c9e8cd9667b89157f099dfb969ef14ae3ea602d4c772e960bc41d39c3d05
- SSDEEP 24576:2Nmq6KGDx4JYKcP/+h0lhSMXl+GGXo8Wea/xwuX:Ymq6KGk/cHrOGGY8Wea/xwuX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSIBB84.tmp
- Size 1.1MB
- SHA256 d0a6f6373cfb902fcd95bc12360a9e949f5597b72c01e0bd328f9b1e2080b5b7
- MD5 e83d774f643972b8eccdb3a34da135c5
- SHA1 a58eccfb12d723c3460563c5191d604def235d15
- SHA512 cb5ff0e66827e6a1fa27abdd322987906cfdb3cdb49248efee04d51fee65e93b5d964ff78095866e197448358a9de9ec7f45d4158c0913cbf0dbd849883a6e90
- SSDEEP 24576:W4FsQxRqkY1ngOktwC2Tec+4VGWSlnH/YrjPWeTIUGVUrHtAkJMsFUh29BKjxw:D2QxNwCsec+4VGWSlnfYvO3UGVUrHtAg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSIC451.tmp
- Size 371KB
- SHA256 7484797ea4480bc71509fa28b16e607f82323e05c44f59ffa65db3826ed1b388
- MD5 ffdaacb43c074a8cb9a608c612d7540b
- SHA1 8f054a7f77853de365a7763d93933660e6e1a890
- SHA512 a9bd31377f7a6ecf75b1d90648847cb83d8bd65ad0b408c4f8de6eb50764eef1402e7acdff375b7c3b07ac9f94184bd399a10a22418db474908b5e7a1adfe263
- SSDEEP 6144:ZSXJmYiFGLzkhEFeCPGi5B8dZ6t+6bUSfcqKgAST:ZSXJ9khElPGvcttbxpAST
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSICC04.tmp
- Size 769KB
- SHA256 ccb57bdbb19e1aeb2c8dd3845cdc53880c1979284e7b26a1d8ae73bbeaf25474
- MD5 8cf47242b5df6a7f6d2d7af9cc3a7921
- SHA1 b51595a8a113cf889b0d1dd4b04df16b3e18f318
- SHA512 748c4767d258bfa6ad2664aa05ef7dc16f2d204fae40530430ef5d1f38c8f61f074c6ec6501489053195b6b6f6e02d29fde970d74c6ae97649d8fe1fd342a288
- SSDEEP 24576:aE33f8zyjmfyY43pNRmkL7mh0lhSMXlEeGXDMGz+:L3fSyjmfyY43pNRp7T0eGwGz+
- MD5 SHA1 SHA512 SSDEEP