Analysis
- max time kernel
93s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20241007-es - submitted
05/01/2025, 17:07
Static task
static1
Behavioral task
behavioral1
Sample
setup.msi
Resource
win7-20240903-es
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
setup.msi
Resource
win10v2004-20241007-es
windows10-2004-x64
11 signatures
150 seconds
General
- Target setup.msi
- Size 57.9MB
- Sample250105-vmze6asmer
- SHA256 f371f210de8c0e127feec5e3b9f52592656ec82cabff42dd6c32f38a28fe7e32
- MD5 7c1483f7e76fd97ecae77db49c8bc689
- SHA1 5e0bf8b4995aab4bc3f1abb17b673d6656598d67
- SHA512 cef7a5e2c4a2e51ac159322fc5f4571a5969c34019e5750986e148569fbc34fa7e6754e83b01d0b0c61c2853d982cd1eefb8cf2dc05c492fb820e57a0cc2e138
- SSDEEP 786432:srBpuVmrjV7eIAtenOTZCoh7Da6QUmsLquaPdBOfCPY:srSVmrjV7eIvnOTZCca6QUmsLLuOo
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Blocklisted process makes network request 2 IoCs
flow pid Process 15 3520 MsiExec.exe 17 3520 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe - Drops file in Windows directory 16 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSIBC8B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIBCDB.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIBEF1.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSICC30.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\e57ba18.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIBAC4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIBBEE.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIBE24.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID3D3.tmp msiexec.exe File opened for modification C:\Windows\Installer\e57ba18.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIBE92.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\SourceHash{BA2FC2FA-8AD1-483C-BAA6-EAEE13985C74} msiexec.exe File opened for modification C:\Windows\Installer\MSID3F3.tmp msiexec.exe - Loads dropped DLL 9 IoCs
pid Process 3520 MsiExec.exe 3520 MsiExec.exe 3520 MsiExec.exe 3520 MsiExec.exe 3520 MsiExec.exe 3520 MsiExec.exe 3520 MsiExec.exe 3520 MsiExec.exe 3520 MsiExec.exe -
pid Process 4752 powershell.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4668 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3452 msiexec.exe 3452 msiexec.exe 4752 powershell.exe 4752 powershell.exe - Suspicious use of AdjustPrivilegeToken 55 IoCs
description pid Process Token: SeShutdownPrivilege 4668 msiexec.exe Token: SeIncreaseQuotaPrivilege 4668 msiexec.exe Token: SeSecurityPrivilege 3452 msiexec.exe Token: SeCreateTokenPrivilege 4668 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4668 msiexec.exe Token: SeLockMemoryPrivilege 4668 msiexec.exe Token: SeIncreaseQuotaPrivilege 4668 msiexec.exe Token: SeMachineAccountPrivilege 4668 msiexec.exe Token: SeTcbPrivilege 4668 msiexec.exe Token: SeSecurityPrivilege 4668 msiexec.exe Token: SeTakeOwnershipPrivilege 4668 msiexec.exe Token: SeLoadDriverPrivilege 4668 msiexec.exe Token: SeSystemProfilePrivilege 4668 msiexec.exe Token: SeSystemtimePrivilege 4668 msiexec.exe Token: SeProfSingleProcessPrivilege 4668 msiexec.exe Token: SeIncBasePriorityPrivilege 4668 msiexec.exe Token: SeCreatePagefilePrivilege 4668 msiexec.exe Token: SeCreatePermanentPrivilege 4668 msiexec.exe Token: SeBackupPrivilege 4668 msiexec.exe Token: SeRestorePrivilege 4668 msiexec.exe Token: SeShutdownPrivilege 4668 msiexec.exe Token: SeDebugPrivilege 4668 msiexec.exe Token: SeAuditPrivilege 4668 msiexec.exe Token: SeSystemEnvironmentPrivilege 4668 msiexec.exe Token: SeChangeNotifyPrivilege 4668 msiexec.exe Token: SeRemoteShutdownPrivilege 4668 msiexec.exe Token: SeUndockPrivilege 4668 msiexec.exe Token: SeSyncAgentPrivilege 4668 msiexec.exe Token: SeEnableDelegationPrivilege 4668 msiexec.exe Token: SeManageVolumePrivilege 4668 msiexec.exe Token: SeImpersonatePrivilege 4668 msiexec.exe Token: SeCreateGlobalPrivilege 4668 msiexec.exe Token: SeRestorePrivilege 3452 msiexec.exe Token: SeTakeOwnershipPrivilege 3452 msiexec.exe Token: SeRestorePrivilege 3452 msiexec.exe Token: SeTakeOwnershipPrivilege 3452 msiexec.exe Token: SeRestorePrivilege 3452 msiexec.exe Token: SeTakeOwnershipPrivilege 3452 msiexec.exe Token: SeRestorePrivilege 3452 msiexec.exe Token: SeTakeOwnershipPrivilege 3452 msiexec.exe Token: SeRestorePrivilege 3452 msiexec.exe Token: SeTakeOwnershipPrivilege 3452 msiexec.exe Token: SeRestorePrivilege 3452 msiexec.exe Token: SeTakeOwnershipPrivilege 3452 msiexec.exe Token: SeRestorePrivilege 3452 msiexec.exe Token: SeTakeOwnershipPrivilege 3452 msiexec.exe Token: SeRestorePrivilege 3452 msiexec.exe Token: SeTakeOwnershipPrivilege 3452 msiexec.exe Token: SeRestorePrivilege 3452 msiexec.exe Token: SeTakeOwnershipPrivilege 3452 msiexec.exe Token: SeRestorePrivilege 3452 msiexec.exe Token: SeTakeOwnershipPrivilege 3452 msiexec.exe Token: SeRestorePrivilege 3452 msiexec.exe Token: SeTakeOwnershipPrivilege 3452 msiexec.exe Token: SeDebugPrivilege 4752 powershell.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4668 msiexec.exe 4668 msiexec.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3452 wrote to memory of 3520 3452 msiexec.exe 84 PID 3452 wrote to memory of 3520 3452 msiexec.exe 84 PID 3452 wrote to memory of 3520 3452 msiexec.exe 84 PID 3520 wrote to memory of 4752 3520 MsiExec.exe 86 PID 3520 wrote to memory of 4752 3520 MsiExec.exe 86 PID 3520 wrote to memory of 4752 3520 MsiExec.exe 86
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\setup.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4668
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding BEE97AF4FD6D2832F42E5AF92C333D002⤵
- Blocklisted process makes network request
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe-NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssD489.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msiD486.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scrD487.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scrD488.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4752
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nk0td0ho.hqx.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\msiD486.txt
- Size 50B
- SHA256 8254e75f56495b01503f897ed96d29df16f767031f158eb6b62d6808b5227873
- MD5 fd0097363ad04fe5e810e505ef65dc96
- SHA1 e662ef459fe21bacf9b0fe1c8aacdd0b052979c6
- SHA512 44df9a0e2e38209fac0cc3ccf4bf64b9e68102e80731579e77a66107a282ff21bb41434163a7469e8ebec0d279bc58698b0da7c8bd34a8d298b5035f31ec3655
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\pssD489.ps1
- Size 6KB
- SHA256 53094df6fa4e57a3265ff04bc1e970c10bcdb3d4094ad6dd610c05b7a8b79e0f
- MD5 30c30ef2cb47e35101d13402b5661179
- SHA1 25696b2aab86a9233f19017539e2dd83b2f75d4e
- SHA512 882be2768138bb75ff7dde7d5ca4c2e024699398baacd0ce1d4619902402e054297e4f464d8cb3c22b2f35d3dabc408122c207facad64ec8014f2c54834cf458
- SSDEEP 96:5Wb5VNkKmeHn/V2BVrIovmgNlGjxcj6BngOcvjb:5WbyZ/gVyvb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\scrD487.ps1
- Size 266B
- SHA256 c4ef109dd1fef1a7e4af385377801eea0e7936d207ebcebbe078bad56fb1f4ab
- MD5 a18ea6e053d5061471852a4151a7d4d0
- SHA1 aea460891f599c4484f04a3bc5acc62e9d5ad9f7
- SHA512 7530e2974622bb6649c895c062c151ac7c496ccc0bdae4eb53c6f29888fa7b1e184026fbb39ddb5d8741378bee969dd70b34ac7459f3387d92d21dbcfe28dc9a
- MD5 SHA1 SHA512
- Path C:\Windows\Installer\MSIBAC4.tmp
- Size 997KB
- SHA256 7bbf611f5e2a16439dc8cd11936f6364f6d5cc0044545c92775da5646afc7752
- MD5 ee09d6a1bb908b42c05fd0beeb67dfd2
- SHA1 1eb7c1304b7bca649c2a5902b18a1ea57ceaa532
- SHA512 2dd2e4e66d2f2277f031c5f3c829a31c3b29196ab27262c6a8f1896a2113a1be1687c9e8cd9667b89157f099dfb969ef14ae3ea602d4c772e960bc41d39c3d05
- SSDEEP 24576:2Nmq6KGDx4JYKcP/+h0lhSMXl+GGXo8Wea/xwuX:Ymq6KGk/cHrOGGY8Wea/xwuX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSIBE24.tmp
- Size 1.1MB
- SHA256 d0a6f6373cfb902fcd95bc12360a9e949f5597b72c01e0bd328f9b1e2080b5b7
- MD5 e83d774f643972b8eccdb3a34da135c5
- SHA1 a58eccfb12d723c3460563c5191d604def235d15
- SHA512 cb5ff0e66827e6a1fa27abdd322987906cfdb3cdb49248efee04d51fee65e93b5d964ff78095866e197448358a9de9ec7f45d4158c0913cbf0dbd849883a6e90
- SSDEEP 24576:W4FsQxRqkY1ngOktwC2Tec+4VGWSlnH/YrjPWeTIUGVUrHtAkJMsFUh29BKjxw:D2QxNwCsec+4VGWSlnfYvO3UGVUrHtAg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSICC30.tmp
- Size 371KB
- SHA256 7484797ea4480bc71509fa28b16e607f82323e05c44f59ffa65db3826ed1b388
- MD5 ffdaacb43c074a8cb9a608c612d7540b
- SHA1 8f054a7f77853de365a7763d93933660e6e1a890
- SHA512 a9bd31377f7a6ecf75b1d90648847cb83d8bd65ad0b408c4f8de6eb50764eef1402e7acdff375b7c3b07ac9f94184bd399a10a22418db474908b5e7a1adfe263
- SSDEEP 6144:ZSXJmYiFGLzkhEFeCPGi5B8dZ6t+6bUSfcqKgAST:ZSXJ9khElPGvcttbxpAST
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSID3F3.tmp
- Size 769KB
- SHA256 ccb57bdbb19e1aeb2c8dd3845cdc53880c1979284e7b26a1d8ae73bbeaf25474
- MD5 8cf47242b5df6a7f6d2d7af9cc3a7921
- SHA1 b51595a8a113cf889b0d1dd4b04df16b3e18f318
- SHA512 748c4767d258bfa6ad2664aa05ef7dc16f2d204fae40530430ef5d1f38c8f61f074c6ec6501489053195b6b6f6e02d29fde970d74c6ae97649d8fe1fd342a288
- SSDEEP 24576:aE33f8zyjmfyY43pNRmkL7mh0lhSMXlEeGXDMGz+:L3fSyjmfyY43pNRp7T0eGwGz+
- MD5 SHA1 SHA512 SSDEEP