Analysis
- max time kernel
96s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
26/12/2024, 12:20
Static task
static1
Behavioral task
behavioral1
Sample
setup.msi
Resource
win7-20240729-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
setup.msi
Resource
win10v2004-20241007-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target setup.msi
- Size 57.5MB
- Sample241226-phq1bsvrep
- SHA256 404e2b3ecd486cf7a533790edbe22ab145c767f8c413a95570b0cc41c3b46143
- MD5 99c84a1c2cf1acd2ddeb621561789acb
- SHA1 c5efa38a646b02ea2263dacd5a17586295c6fcd3
- SHA512 c0d72a1189f09e9f67400e93ccd797618f9cc17f3a67c91f6e38ff99399f3a51452661bf133227d4991071ba1a402916bf46c049ba501ce69a80276f546ec5af
- SSDEEP 786432:zGZojVmrjV7eIAtehOTZ0oZ4sdUuzt/NCaY2ksCo:zGcVmrjV7eIvhOTZ5RjVCa1tP
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Blocklisted process makes network request 2 IoCs
flow pid Process 15 408 MsiExec.exe 17 408 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe - Drops file in Windows directory 16 IoCs
description ioc Process File created C:\Windows\Installer\e578e84.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI9281.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI8F11.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI906A.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{1C4A5FBA-760B-4754-A971-45D0AA1EA01D} msiexec.exe File opened for modification C:\Windows\Installer\e578e84.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI9146.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA918.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB06D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI90C8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI91F3.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI92E0.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIB04D.tmp msiexec.exe - Loads dropped DLL 9 IoCs
pid Process 408 MsiExec.exe 408 MsiExec.exe 408 MsiExec.exe 408 MsiExec.exe 408 MsiExec.exe 408 MsiExec.exe 408 MsiExec.exe 408 MsiExec.exe 408 MsiExec.exe -
pid Process 1180 powershell.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 1504 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4208 msiexec.exe 4208 msiexec.exe 1180 powershell.exe 1180 powershell.exe - Suspicious use of AdjustPrivilegeToken 55 IoCs
description pid Process Token: SeShutdownPrivilege 1504 msiexec.exe Token: SeIncreaseQuotaPrivilege 1504 msiexec.exe Token: SeSecurityPrivilege 4208 msiexec.exe Token: SeCreateTokenPrivilege 1504 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1504 msiexec.exe Token: SeLockMemoryPrivilege 1504 msiexec.exe Token: SeIncreaseQuotaPrivilege 1504 msiexec.exe Token: SeMachineAccountPrivilege 1504 msiexec.exe Token: SeTcbPrivilege 1504 msiexec.exe Token: SeSecurityPrivilege 1504 msiexec.exe Token: SeTakeOwnershipPrivilege 1504 msiexec.exe Token: SeLoadDriverPrivilege 1504 msiexec.exe Token: SeSystemProfilePrivilege 1504 msiexec.exe Token: SeSystemtimePrivilege 1504 msiexec.exe Token: SeProfSingleProcessPrivilege 1504 msiexec.exe Token: SeIncBasePriorityPrivilege 1504 msiexec.exe Token: SeCreatePagefilePrivilege 1504 msiexec.exe Token: SeCreatePermanentPrivilege 1504 msiexec.exe Token: SeBackupPrivilege 1504 msiexec.exe Token: SeRestorePrivilege 1504 msiexec.exe Token: SeShutdownPrivilege 1504 msiexec.exe Token: SeDebugPrivilege 1504 msiexec.exe Token: SeAuditPrivilege 1504 msiexec.exe Token: SeSystemEnvironmentPrivilege 1504 msiexec.exe Token: SeChangeNotifyPrivilege 1504 msiexec.exe Token: SeRemoteShutdownPrivilege 1504 msiexec.exe Token: SeUndockPrivilege 1504 msiexec.exe Token: SeSyncAgentPrivilege 1504 msiexec.exe Token: SeEnableDelegationPrivilege 1504 msiexec.exe Token: SeManageVolumePrivilege 1504 msiexec.exe Token: SeImpersonatePrivilege 1504 msiexec.exe Token: SeCreateGlobalPrivilege 1504 msiexec.exe Token: SeRestorePrivilege 4208 msiexec.exe Token: SeTakeOwnershipPrivilege 4208 msiexec.exe Token: SeRestorePrivilege 4208 msiexec.exe Token: SeTakeOwnershipPrivilege 4208 msiexec.exe Token: SeRestorePrivilege 4208 msiexec.exe Token: SeTakeOwnershipPrivilege 4208 msiexec.exe Token: SeRestorePrivilege 4208 msiexec.exe Token: SeTakeOwnershipPrivilege 4208 msiexec.exe Token: SeRestorePrivilege 4208 msiexec.exe Token: SeTakeOwnershipPrivilege 4208 msiexec.exe Token: SeRestorePrivilege 4208 msiexec.exe Token: SeTakeOwnershipPrivilege 4208 msiexec.exe Token: SeRestorePrivilege 4208 msiexec.exe Token: SeTakeOwnershipPrivilege 4208 msiexec.exe Token: SeRestorePrivilege 4208 msiexec.exe Token: SeTakeOwnershipPrivilege 4208 msiexec.exe Token: SeRestorePrivilege 4208 msiexec.exe Token: SeTakeOwnershipPrivilege 4208 msiexec.exe Token: SeRestorePrivilege 4208 msiexec.exe Token: SeTakeOwnershipPrivilege 4208 msiexec.exe Token: SeRestorePrivilege 4208 msiexec.exe Token: SeTakeOwnershipPrivilege 4208 msiexec.exe Token: SeDebugPrivilege 1180 powershell.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1504 msiexec.exe 1504 msiexec.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4208 wrote to memory of 408 4208 msiexec.exe 84 PID 4208 wrote to memory of 408 4208 msiexec.exe 84 PID 4208 wrote to memory of 408 4208 msiexec.exe 84 PID 408 wrote to memory of 1180 408 MsiExec.exe 89 PID 408 wrote to memory of 1180 408 MsiExec.exe 89 PID 408 wrote to memory of 1180 408 MsiExec.exe 89
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\setup.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1504
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C15A32EEFCE500110962F026CA672BD72⤵
- Blocklisted process makes network request
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe-NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssB103.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msiB100.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scrB101.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scrB102.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1180
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cyx5r3zz.ac4.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\msiB100.txt
- Size 54B
- SHA256 5473347620e53c8292b2572924addc315edc96f0d454f43a84bcdfbd964684eb
- MD5 898962bc85ce7701b99cf1d2e14740ca
- SHA1 634edede05caf8a90593b399c084df437b141920
- SHA512 521ee5f49bbb03144e0524b1d8f1ca60be8e97ec4ba69d959d4eae39a589f826ea0c462bc9c64f1ad2e1e3f97af379a7c80100a5a1eb4d1330f074201514f7b8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\pssB103.ps1
- Size 6KB
- SHA256 53094df6fa4e57a3265ff04bc1e970c10bcdb3d4094ad6dd610c05b7a8b79e0f
- MD5 30c30ef2cb47e35101d13402b5661179
- SHA1 25696b2aab86a9233f19017539e2dd83b2f75d4e
- SHA512 882be2768138bb75ff7dde7d5ca4c2e024699398baacd0ce1d4619902402e054297e4f464d8cb3c22b2f35d3dabc408122c207facad64ec8014f2c54834cf458
- SSDEEP 96:5Wb5VNkKmeHn/V2BVrIovmgNlGjxcj6BngOcvjb:5WbyZ/gVyvb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\scrB101.ps1
- Size 250B
- SHA256 700080d274e5629a2bfa0d47b9baf53ad69e67a64a2b04d84115d5851ab3ddbd
- MD5 479fac6e0c05c5a57698619afe51def2
- SHA1 1af4a4db75ace8324ed7bff59d711e80a7bdb821
- SHA512 b0b5065c216ebc1124b985f3ff86ee7c7e7e9b994190d1103c454edd602e0242b7160bffb202538470254675dfacac6159f1a459b979dad563bded84fced193e
- MD5 SHA1 SHA512
- Path C:\Windows\Installer\MSI8F11.tmp
- Size 997KB
- SHA256 7bbf611f5e2a16439dc8cd11936f6364f6d5cc0044545c92775da5646afc7752
- MD5 ee09d6a1bb908b42c05fd0beeb67dfd2
- SHA1 1eb7c1304b7bca649c2a5902b18a1ea57ceaa532
- SHA512 2dd2e4e66d2f2277f031c5f3c829a31c3b29196ab27262c6a8f1896a2113a1be1687c9e8cd9667b89157f099dfb969ef14ae3ea602d4c772e960bc41d39c3d05
- SSDEEP 24576:2Nmq6KGDx4JYKcP/+h0lhSMXl+GGXo8Wea/xwuX:Ymq6KGk/cHrOGGY8Wea/xwuX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI91F3.tmp
- Size 1.1MB
- SHA256 d0a6f6373cfb902fcd95bc12360a9e949f5597b72c01e0bd328f9b1e2080b5b7
- MD5 e83d774f643972b8eccdb3a34da135c5
- SHA1 a58eccfb12d723c3460563c5191d604def235d15
- SHA512 cb5ff0e66827e6a1fa27abdd322987906cfdb3cdb49248efee04d51fee65e93b5d964ff78095866e197448358a9de9ec7f45d4158c0913cbf0dbd849883a6e90
- SSDEEP 24576:W4FsQxRqkY1ngOktwC2Tec+4VGWSlnH/YrjPWeTIUGVUrHtAkJMsFUh29BKjxw:D2QxNwCsec+4VGWSlnfYvO3UGVUrHtAg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSIA918.tmp
- Size 371KB
- SHA256 7484797ea4480bc71509fa28b16e607f82323e05c44f59ffa65db3826ed1b388
- MD5 ffdaacb43c074a8cb9a608c612d7540b
- SHA1 8f054a7f77853de365a7763d93933660e6e1a890
- SHA512 a9bd31377f7a6ecf75b1d90648847cb83d8bd65ad0b408c4f8de6eb50764eef1402e7acdff375b7c3b07ac9f94184bd399a10a22418db474908b5e7a1adfe263
- SSDEEP 6144:ZSXJmYiFGLzkhEFeCPGi5B8dZ6t+6bUSfcqKgAST:ZSXJ9khElPGvcttbxpAST
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSIB06D.tmp
- Size 769KB
- SHA256 ccb57bdbb19e1aeb2c8dd3845cdc53880c1979284e7b26a1d8ae73bbeaf25474
- MD5 8cf47242b5df6a7f6d2d7af9cc3a7921
- SHA1 b51595a8a113cf889b0d1dd4b04df16b3e18f318
- SHA512 748c4767d258bfa6ad2664aa05ef7dc16f2d204fae40530430ef5d1f38c8f61f074c6ec6501489053195b6b6f6e02d29fde970d74c6ae97649d8fe1fd342a288
- SSDEEP 24576:aE33f8zyjmfyY43pNRmkL7mh0lhSMXlEeGXDMGz+:L3fSyjmfyY43pNRp7T0eGwGz+
- MD5 SHA1 SHA512 SSDEEP