Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
31-12-2024 09:36
Static task
static1
Behavioral task
behavioral1
Sample
441e504c70e28d1d46194ce389141db7.msi
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
441e504c70e28d1d46194ce389141db7.msi
Resource
win10v2004-20241007-en
windows10-2004-x64
25 signatures
150 seconds
General
-
Target
441e504c70e28d1d46194ce389141db7.msi
-
Size
2.0MB
-
MD5
441e504c70e28d1d46194ce389141db7
-
SHA1
876fe9fec362419c809eec1ef97682f0045f62a7
-
SHA256
dde8620f2939fee20bb2ce914a18589c77010ffa5058e70aebea3ff1286d3d94
-
SHA512
1b68c24b4f2fee2f100d9ef2f477bcd83ca07457967abb4cd4d4bd15312959a60b1ae3b8da7e6d692c12b078ae4ce079fed4a4ba9bdb437e3948776e49b9389b
-
SSDEEP
24576:Kt9cpVDhbkEUnIVp7w4dXR7yu2tTUMseARcqqfZNy3V/3xdurB7F/1O:9pRhbUnIVpZB7Mzoc7NS/3xdurndO
Score
7/10
Malware Config
Signatures
-
Modifies file permissions 1 TTPs 2 IoCs
pid Process 2316 ICACLS.EXE 2824 ICACLS.EXE -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File created C:\Windows\Installer\f76beae.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIBF59.tmp msiexec.exe File opened for modification C:\Windows\Installer\f76beae.ipi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\f76bead.msi msiexec.exe File opened for modification C:\Windows\Installer\f76bead.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Logs\DPX\setupact.log EXPAND.EXE File opened for modification C:\Windows\Logs\DPX\setuperr.log EXPAND.EXE -
Loads dropped DLL 1 IoCs
pid Process 2172 MsiExec.exe -
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2136 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ICACLS.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXPAND.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ICACLS.EXE -
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2304 msiexec.exe 2304 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 53 IoCs
description pid Process Token: SeShutdownPrivilege 2136 msiexec.exe Token: SeIncreaseQuotaPrivilege 2136 msiexec.exe Token: SeRestorePrivilege 2304 msiexec.exe Token: SeTakeOwnershipPrivilege 2304 msiexec.exe Token: SeSecurityPrivilege 2304 msiexec.exe Token: SeCreateTokenPrivilege 2136 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2136 msiexec.exe Token: SeLockMemoryPrivilege 2136 msiexec.exe Token: SeIncreaseQuotaPrivilege 2136 msiexec.exe Token: SeMachineAccountPrivilege 2136 msiexec.exe Token: SeTcbPrivilege 2136 msiexec.exe Token: SeSecurityPrivilege 2136 msiexec.exe Token: SeTakeOwnershipPrivilege 2136 msiexec.exe Token: SeLoadDriverPrivilege 2136 msiexec.exe Token: SeSystemProfilePrivilege 2136 msiexec.exe Token: SeSystemtimePrivilege 2136 msiexec.exe Token: SeProfSingleProcessPrivilege 2136 msiexec.exe Token: SeIncBasePriorityPrivilege 2136 msiexec.exe Token: SeCreatePagefilePrivilege 2136 msiexec.exe Token: SeCreatePermanentPrivilege 2136 msiexec.exe Token: SeBackupPrivilege 2136 msiexec.exe Token: SeRestorePrivilege 2136 msiexec.exe Token: SeShutdownPrivilege 2136 msiexec.exe Token: SeDebugPrivilege 2136 msiexec.exe Token: SeAuditPrivilege 2136 msiexec.exe Token: SeSystemEnvironmentPrivilege 2136 msiexec.exe Token: SeChangeNotifyPrivilege 2136 msiexec.exe Token: SeRemoteShutdownPrivilege 2136 msiexec.exe Token: SeUndockPrivilege 2136 msiexec.exe Token: SeSyncAgentPrivilege 2136 msiexec.exe Token: SeEnableDelegationPrivilege 2136 msiexec.exe Token: SeManageVolumePrivilege 2136 msiexec.exe Token: SeImpersonatePrivilege 2136 msiexec.exe Token: SeCreateGlobalPrivilege 2136 msiexec.exe Token: SeBackupPrivilege 1988 vssvc.exe Token: SeRestorePrivilege 1988 vssvc.exe Token: SeAuditPrivilege 1988 vssvc.exe Token: SeBackupPrivilege 2304 msiexec.exe Token: SeRestorePrivilege 2304 msiexec.exe Token: SeRestorePrivilege 2200 DrvInst.exe Token: SeRestorePrivilege 2200 DrvInst.exe Token: SeRestorePrivilege 2200 DrvInst.exe Token: SeRestorePrivilege 2200 DrvInst.exe Token: SeRestorePrivilege 2200 DrvInst.exe Token: SeRestorePrivilege 2200 DrvInst.exe Token: SeRestorePrivilege 2200 DrvInst.exe Token: SeLoadDriverPrivilege 2200 DrvInst.exe Token: SeLoadDriverPrivilege 2200 DrvInst.exe Token: SeLoadDriverPrivilege 2200 DrvInst.exe Token: SeRestorePrivilege 2304 msiexec.exe Token: SeTakeOwnershipPrivilege 2304 msiexec.exe Token: SeRestorePrivilege 2304 msiexec.exe Token: SeTakeOwnershipPrivilege 2304 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2136 msiexec.exe 2136 msiexec.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 2304 wrote to memory of 2172 2304 msiexec.exe 32 PID 2304 wrote to memory of 2172 2304 msiexec.exe 32 PID 2304 wrote to memory of 2172 2304 msiexec.exe 32 PID 2304 wrote to memory of 2172 2304 msiexec.exe 32 PID 2304 wrote to memory of 2172 2304 msiexec.exe 32 PID 2304 wrote to memory of 2172 2304 msiexec.exe 32 PID 2304 wrote to memory of 2172 2304 msiexec.exe 32 PID 2172 wrote to memory of 2316 2172 MsiExec.exe 33 PID 2172 wrote to memory of 2316 2172 MsiExec.exe 33 PID 2172 wrote to memory of 2316 2172 MsiExec.exe 33 PID 2172 wrote to memory of 2316 2172 MsiExec.exe 33 PID 2172 wrote to memory of 848 2172 MsiExec.exe 35 PID 2172 wrote to memory of 848 2172 MsiExec.exe 35 PID 2172 wrote to memory of 848 2172 MsiExec.exe 35 PID 2172 wrote to memory of 848 2172 MsiExec.exe 35 PID 2172 wrote to memory of 1952 2172 MsiExec.exe 37 PID 2172 wrote to memory of 1952 2172 MsiExec.exe 37 PID 2172 wrote to memory of 1952 2172 MsiExec.exe 37 PID 2172 wrote to memory of 1952 2172 MsiExec.exe 37 PID 2172 wrote to memory of 2016 2172 MsiExec.exe 39 PID 2172 wrote to memory of 2016 2172 MsiExec.exe 39 PID 2172 wrote to memory of 2016 2172 MsiExec.exe 39 PID 2172 wrote to memory of 2016 2172 MsiExec.exe 39 PID 2172 wrote to memory of 2824 2172 MsiExec.exe 41 PID 2172 wrote to memory of 2824 2172 MsiExec.exe 41 PID 2172 wrote to memory of 2824 2172 MsiExec.exe 41 PID 2172 wrote to memory of 2824 2172 MsiExec.exe 41 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\441e504c70e28d1d46194ce389141db7.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2136
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding ADC0F8D0B6E9F1864DC96371EC0CB2C42⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-3423dc51-a735-424f-907c-fed16e9e134f\." /SETINTEGRITYLEVEL (CI)(OI)HIGH3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:2316
-
-
C:\Windows\SysWOW64\EXPAND.EXE"C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files3⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:848
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start msedge https://s28.q4cdn.com/392171258/files/doc_downloads/test.pdf3⤵
- System Location Discovery: System Language Discovery
PID:1952
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\Admin\AppData\Local\Temp\MW-3423dc51-a735-424f-907c-fed16e9e134f\files"3⤵
- System Location Discovery: System Language Discovery
PID:2016
-
-
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-3423dc51-a735-424f-907c-fed16e9e134f\." /SETINTEGRITYLEVEL (CI)(OI)LOW3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:2824
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1988
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000004B8" "00000000000003F0"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2200
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD5e3146abb462f5c2fa3d129a36501db63
SHA1d059b5dd83852cba19ceb0fee1bfda56fc574c94
SHA256996a889903d82c2e219425a1b8a73fce9642637a3876ab9a4e24102d4ba801bc
SHA512ec7130c017b808cad4ceed16e887af4f67a581ecc73074e0193fbd30e20d5332f2325ee4fdcbd53f8232c0f045f7e0a95c79c97c88fda19536229b040bf5c226
-
Filesize
1KB
MD59bd0841d19b1c05d7f4860b8b044c475
SHA199921182d8059b6a9d84b72c8159d0ef58e74ed4
SHA256094cea24190d5c6bdbd9ade5348bb10077676a82089057b894a80dfb18cea066
SHA512b4c7930cd80754d0f07f0efb382926600285cbd65e7bcb0f34f9ee1d318ca268942dbdf39d07642e6dcebec94c73727bc63c42181722ceb7d893ada738e17444
-
Filesize
1KB
MD53ad889245f83ff4efe6dd13aa82b1e97
SHA194c15fb5a0cb0fc9fc1d7e8b3ed0a0a497256d6f
SHA2564999011101e8f44e8fe163727c8070f2d27603262fae83bd64d441e44c37ed69
SHA512f30cc15ac3539b399bdcf0d978e2acffad2a7a2a9304eed719c134e5b302d1ef43074bfaccfd0b87dc736b74fdf0fda3d7beb36dbf5d1833f17b7ad4ac9e2900
-
Filesize
208KB
MD50c8921bbcc37c6efd34faf44cf3b0cb5
SHA1dcfa71246157edcd09eecaf9d4c5e360b24b3e49
SHA256fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1
SHA512ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108