Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/02/2025, 00:22
Static task
static1
Behavioral task
behavioral1
Sample
setup4709.msi
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
setup4709.msi
Resource
win10v2004-20250217-en
windows10-2004-x64
19 signatures
150 seconds
General
-
Target
setup4709.msi
-
Size
1.9MB
-
MD5
ed7ed7df3b5dfe065ddae71d976b33a7
-
SHA1
71da11ac3c230459775322213a7517aba8b43925
-
SHA256
bfaeaa21aab8fa63219dd466a337acb420dfe6424c3cb028d2a5be28c733cd75
-
SHA512
d29c61436f8d63a14e3fa6c38897a5d42ca77a62b733faa78a1d74abe22a732124105a58b17fcd17bd6e8697ce6b6ca4a392804044c310d4625ec57781b92210
-
SSDEEP
24576:8t9cpVDhs6Zt94ger5jBGqgoOHw88ogmU92CGYt0:7pRhJZ0drFjOQsgR2CGYt0
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe -
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 1768 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeShutdownPrivilege 1768 msiexec.exe Token: SeIncreaseQuotaPrivilege 1768 msiexec.exe Token: SeRestorePrivilege 1992 msiexec.exe Token: SeTakeOwnershipPrivilege 1992 msiexec.exe Token: SeSecurityPrivilege 1992 msiexec.exe Token: SeCreateTokenPrivilege 1768 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1768 msiexec.exe Token: SeLockMemoryPrivilege 1768 msiexec.exe Token: SeIncreaseQuotaPrivilege 1768 msiexec.exe Token: SeMachineAccountPrivilege 1768 msiexec.exe Token: SeTcbPrivilege 1768 msiexec.exe Token: SeSecurityPrivilege 1768 msiexec.exe Token: SeTakeOwnershipPrivilege 1768 msiexec.exe Token: SeLoadDriverPrivilege 1768 msiexec.exe Token: SeSystemProfilePrivilege 1768 msiexec.exe Token: SeSystemtimePrivilege 1768 msiexec.exe Token: SeProfSingleProcessPrivilege 1768 msiexec.exe Token: SeIncBasePriorityPrivilege 1768 msiexec.exe Token: SeCreatePagefilePrivilege 1768 msiexec.exe Token: SeCreatePermanentPrivilege 1768 msiexec.exe Token: SeBackupPrivilege 1768 msiexec.exe Token: SeRestorePrivilege 1768 msiexec.exe Token: SeShutdownPrivilege 1768 msiexec.exe Token: SeDebugPrivilege 1768 msiexec.exe Token: SeAuditPrivilege 1768 msiexec.exe Token: SeSystemEnvironmentPrivilege 1768 msiexec.exe Token: SeChangeNotifyPrivilege 1768 msiexec.exe Token: SeRemoteShutdownPrivilege 1768 msiexec.exe Token: SeUndockPrivilege 1768 msiexec.exe Token: SeSyncAgentPrivilege 1768 msiexec.exe Token: SeEnableDelegationPrivilege 1768 msiexec.exe Token: SeManageVolumePrivilege 1768 msiexec.exe Token: SeImpersonatePrivilege 1768 msiexec.exe Token: SeCreateGlobalPrivilege 1768 msiexec.exe Token: SeBackupPrivilege 3052 vssvc.exe Token: SeRestorePrivilege 3052 vssvc.exe Token: SeAuditPrivilege 3052 vssvc.exe Token: SeBackupPrivilege 1992 msiexec.exe Token: SeRestorePrivilege 1992 msiexec.exe Token: SeRestorePrivilege 1744 msiexec.exe Token: SeTakeOwnershipPrivilege 1744 msiexec.exe Token: SeSecurityPrivilege 1744 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1768 msiexec.exe 1768 msiexec.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1992 wrote to memory of 2820 1992 msiexec.exe 33 PID 1992 wrote to memory of 2820 1992 msiexec.exe 33 PID 1992 wrote to memory of 2820 1992 msiexec.exe 33 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\setup4709.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1768
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1992 -s 8162⤵PID:2820
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3052
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1744