Resubmissions
25/03/2025, 10:46
250325-mve3gsvvbz 1024/03/2025, 06:56
250324-hqll9awjs8 604/02/2025, 13:21
250204-ql4k9synbq 1004/02/2025, 13:18
250204-qj2znaymfj 10Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24/03/2025, 06:56
Static task
static1
Behavioral task
behavioral1
Sample
f82d15eed385a7a913b98a28bce9b27a7e3611e1c0c4d9fa65741d3fdd76d23c.msi
Resource
win7-20240903-en
windows7-x64
8 signatures
300 seconds
Behavioral task
behavioral2
Sample
f82d15eed385a7a913b98a28bce9b27a7e3611e1c0c4d9fa65741d3fdd76d23c.msi
Resource
win10v2004-20250314-en
windows10-2004-x64
7 signatures
300 seconds
General
-
Target
f82d15eed385a7a913b98a28bce9b27a7e3611e1c0c4d9fa65741d3fdd76d23c.msi
-
Size
85.7MB
-
MD5
bf866d9b4395b3c819a4cd3fd639c412
-
SHA1
79b7f01af68b13036a493e25c83d80457a654c4c
-
SHA256
f82d15eed385a7a913b98a28bce9b27a7e3611e1c0c4d9fa65741d3fdd76d23c
-
SHA512
8c80f7d86d8b4df1c73b2da3cecd09f02a28b57edcf3e2597e874e549ff7cf183acb644a731ed95fb29aeea3334fc72d9144f536ad7e4868b6eec63a4bd83e13
-
SSDEEP
1572864:BWVw9CW/3bB1B68jRGRdJFqisNA6IwEU7dwq3LnEpF2UOrZ+c4CGFyzodK2aZq9:BW5SrB6uRG6iQIu5LEzVON+vCjVY
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: msiexec.exe -
Loads dropped DLL 6 IoCs
pid Process 3048 MsiExec.exe 3048 MsiExec.exe 3048 MsiExec.exe 3048 MsiExec.exe 3048 MsiExec.exe 3048 MsiExec.exe -
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2840 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2840 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2840 msiexec.exe Token: SeIncreaseQuotaPrivilege 2840 msiexec.exe Token: SeRestorePrivilege 2732 msiexec.exe Token: SeTakeOwnershipPrivilege 2732 msiexec.exe Token: SeSecurityPrivilege 2732 msiexec.exe Token: SeCreateTokenPrivilege 2840 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2840 msiexec.exe Token: SeLockMemoryPrivilege 2840 msiexec.exe Token: SeIncreaseQuotaPrivilege 2840 msiexec.exe Token: SeMachineAccountPrivilege 2840 msiexec.exe Token: SeTcbPrivilege 2840 msiexec.exe Token: SeSecurityPrivilege 2840 msiexec.exe Token: SeTakeOwnershipPrivilege 2840 msiexec.exe Token: SeLoadDriverPrivilege 2840 msiexec.exe Token: SeSystemProfilePrivilege 2840 msiexec.exe Token: SeSystemtimePrivilege 2840 msiexec.exe Token: SeProfSingleProcessPrivilege 2840 msiexec.exe Token: SeIncBasePriorityPrivilege 2840 msiexec.exe Token: SeCreatePagefilePrivilege 2840 msiexec.exe Token: SeCreatePermanentPrivilege 2840 msiexec.exe Token: SeBackupPrivilege 2840 msiexec.exe Token: SeRestorePrivilege 2840 msiexec.exe Token: SeShutdownPrivilege 2840 msiexec.exe Token: SeDebugPrivilege 2840 msiexec.exe Token: SeAuditPrivilege 2840 msiexec.exe Token: SeSystemEnvironmentPrivilege 2840 msiexec.exe Token: SeChangeNotifyPrivilege 2840 msiexec.exe Token: SeRemoteShutdownPrivilege 2840 msiexec.exe Token: SeUndockPrivilege 2840 msiexec.exe Token: SeSyncAgentPrivilege 2840 msiexec.exe Token: SeEnableDelegationPrivilege 2840 msiexec.exe Token: SeManageVolumePrivilege 2840 msiexec.exe Token: SeImpersonatePrivilege 2840 msiexec.exe Token: SeCreateGlobalPrivilege 2840 msiexec.exe Token: SeCreateTokenPrivilege 2840 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2840 msiexec.exe Token: SeLockMemoryPrivilege 2840 msiexec.exe Token: SeIncreaseQuotaPrivilege 2840 msiexec.exe Token: SeMachineAccountPrivilege 2840 msiexec.exe Token: SeTcbPrivilege 2840 msiexec.exe Token: SeSecurityPrivilege 2840 msiexec.exe Token: SeTakeOwnershipPrivilege 2840 msiexec.exe Token: SeLoadDriverPrivilege 2840 msiexec.exe Token: SeSystemProfilePrivilege 2840 msiexec.exe Token: SeSystemtimePrivilege 2840 msiexec.exe Token: SeProfSingleProcessPrivilege 2840 msiexec.exe Token: SeIncBasePriorityPrivilege 2840 msiexec.exe Token: SeCreatePagefilePrivilege 2840 msiexec.exe Token: SeCreatePermanentPrivilege 2840 msiexec.exe Token: SeBackupPrivilege 2840 msiexec.exe Token: SeRestorePrivilege 2840 msiexec.exe Token: SeShutdownPrivilege 2840 msiexec.exe Token: SeDebugPrivilege 2840 msiexec.exe Token: SeAuditPrivilege 2840 msiexec.exe Token: SeSystemEnvironmentPrivilege 2840 msiexec.exe Token: SeChangeNotifyPrivilege 2840 msiexec.exe Token: SeRemoteShutdownPrivilege 2840 msiexec.exe Token: SeUndockPrivilege 2840 msiexec.exe Token: SeSyncAgentPrivilege 2840 msiexec.exe Token: SeEnableDelegationPrivilege 2840 msiexec.exe Token: SeManageVolumePrivilege 2840 msiexec.exe Token: SeImpersonatePrivilege 2840 msiexec.exe Token: SeCreateGlobalPrivilege 2840 msiexec.exe Token: SeCreateTokenPrivilege 2840 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2840 msiexec.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2732 wrote to memory of 3048 2732 msiexec.exe 31 PID 2732 wrote to memory of 3048 2732 msiexec.exe 31 PID 2732 wrote to memory of 3048 2732 msiexec.exe 31 PID 2732 wrote to memory of 3048 2732 msiexec.exe 31 PID 2732 wrote to memory of 3048 2732 msiexec.exe 31 PID 2732 wrote to memory of 3048 2732 msiexec.exe 31 PID 2732 wrote to memory of 3048 2732 msiexec.exe 31
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\f82d15eed385a7a913b98a28bce9b27a7e3611e1c0c4d9fa65741d3fdd76d23c.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2840
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B1BAAA17F5A3ADF4F3C7C1D1DC26FC52 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3048
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
816KB
MD5aa88d8f40a286b6d40de0f3abc836cfa
SHA1c24eab9e4b10b159b589f4c3b64ef3db111ea1c8
SHA2568d633efeda1249356b11bf8f46583242356e4f903056b53bd25a99511d1790a1
SHA5126c2f2f6a2d66015f30158962d653e381136f0f30023380a0ce95bd0944d856113fbde65db52dbb3b5de1c0e2edf2cd53184e721c64b916834be4198c61224519
-
Filesize
877KB
MD56a639b68fe7f4e67b7510af13403772b
SHA1255ba543d6fdd8f037823ff321ec00abe3575c54
SHA2567118cd0d6956c84dc8ede10db84491d7884bfb0baa4a0ab96afc7eea47f46dd0
SHA51243cfa4cdf669df71d7da59669ec9653c4facba4c2e6fe52deada469116b5c8b63a927a9ddc2f240ca9e1a2cc4335c12936007662bf47cd11c7e61392af219cef