Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
25/03/2025, 21:03
Static task
static1
Behavioral task
behavioral1
Sample
08.msi
Resource
win7-20240729-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
08.msi
Resource
win10v2004-20250314-en
windows10-2004-x64
18 signatures
150 seconds
General
-
Target
08.msi
-
Size
5.7MB
-
MD5
436b14fb3637af66cfd787869decbb6f
-
SHA1
b94dab2a8de781973507172017019f0d89527056
-
SHA256
1bd7e0c46933e8dc11cb5375fe14600575ceed6f09fc14fc8b56032524f8bb42
-
SHA512
caad869b295e222c0999a8eee8f270e2d1b937484c69cbf9154211db4f30237d4277ae1549e34fe842f8dbf72660c2d3023eb65bad90d07cec2a23f902b2c0dd
-
SSDEEP
98304:9Yrd1ALFlGmyUMCW/x/64I7gXbzZFx7eG7eI243u/HyuuOneWFug3X:2yFlPyU32i4ISNh5243u/HAlW
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe -
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 1488 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeShutdownPrivilege 1488 msiexec.exe Token: SeIncreaseQuotaPrivilege 1488 msiexec.exe Token: SeRestorePrivilege 1016 msiexec.exe Token: SeTakeOwnershipPrivilege 1016 msiexec.exe Token: SeSecurityPrivilege 1016 msiexec.exe Token: SeCreateTokenPrivilege 1488 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1488 msiexec.exe Token: SeLockMemoryPrivilege 1488 msiexec.exe Token: SeIncreaseQuotaPrivilege 1488 msiexec.exe Token: SeMachineAccountPrivilege 1488 msiexec.exe Token: SeTcbPrivilege 1488 msiexec.exe Token: SeSecurityPrivilege 1488 msiexec.exe Token: SeTakeOwnershipPrivilege 1488 msiexec.exe Token: SeLoadDriverPrivilege 1488 msiexec.exe Token: SeSystemProfilePrivilege 1488 msiexec.exe Token: SeSystemtimePrivilege 1488 msiexec.exe Token: SeProfSingleProcessPrivilege 1488 msiexec.exe Token: SeIncBasePriorityPrivilege 1488 msiexec.exe Token: SeCreatePagefilePrivilege 1488 msiexec.exe Token: SeCreatePermanentPrivilege 1488 msiexec.exe Token: SeBackupPrivilege 1488 msiexec.exe Token: SeRestorePrivilege 1488 msiexec.exe Token: SeShutdownPrivilege 1488 msiexec.exe Token: SeDebugPrivilege 1488 msiexec.exe Token: SeAuditPrivilege 1488 msiexec.exe Token: SeSystemEnvironmentPrivilege 1488 msiexec.exe Token: SeChangeNotifyPrivilege 1488 msiexec.exe Token: SeRemoteShutdownPrivilege 1488 msiexec.exe Token: SeUndockPrivilege 1488 msiexec.exe Token: SeSyncAgentPrivilege 1488 msiexec.exe Token: SeEnableDelegationPrivilege 1488 msiexec.exe Token: SeManageVolumePrivilege 1488 msiexec.exe Token: SeImpersonatePrivilege 1488 msiexec.exe Token: SeCreateGlobalPrivilege 1488 msiexec.exe Token: SeBackupPrivilege 2100 vssvc.exe Token: SeRestorePrivilege 2100 vssvc.exe Token: SeAuditPrivilege 2100 vssvc.exe Token: SeBackupPrivilege 1016 msiexec.exe Token: SeRestorePrivilege 1016 msiexec.exe Token: SeRestorePrivilege 956 msiexec.exe Token: SeTakeOwnershipPrivilege 956 msiexec.exe Token: SeSecurityPrivilege 956 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1488 msiexec.exe 1488 msiexec.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1016 wrote to memory of 2860 1016 msiexec.exe 32 PID 1016 wrote to memory of 2860 1016 msiexec.exe 32 PID 1016 wrote to memory of 2860 1016 msiexec.exe 32 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\08.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1488
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1016 -s 8442⤵PID:2860
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2100
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:956