d1a0115f4afe30d9a973cb18bf95d34b67b2d548b4d49989fd0e36399dc562d0

Resubmissions

23-06-2024 14:14

240623-rj8ymsxdnn 10

17-06-2024 16:58

240617-vg68tazhkm 10

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17-06-2024 16:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

__x64___setup___x32__/setup.msi
Size

25.2MB
MD5

9e10d740b32cd15a4fb9a947f911b924
SHA1

6ed60f2f79f986cbf4cc6ab1076522b9c762c272
SHA256

ce35819b8e52f92738534f2b0c0d468bdade96eba64a41915618ab11c04c994a
SHA512

d793f50e6a417a8c75da3a3e809c9cb2d2724d92600e994a90c4198f47937ad462d1682a5277fcb3f0d6648fee2511a2b43c96ff96e8e6a7bec4e461b6bd7a08
SSDEEP

393216:o+OBUMu/xfGNU/6EiKJ5q7cPYALEUEZZ5XXMHjmPaKshz8Rk3KRrREZ78t0N:o+FMSuNCXFYHnbBXHaJ8a3wrREit0

Score

6^/10

Malware Config

Signatures

Blocklisted process makes network request 4 IoCs

Processes:

MsiExec.exe

flow pid process

4 2592 MsiExec.exe
7 2592 MsiExec.exe
9 2592 MsiExec.exe
11 2592 MsiExec.exe

flow	pid	process
4	2592	MsiExec.exe
7	2592	MsiExec.exe
9	2592	MsiExec.exe
11	2592	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe

Drops file in Windows directory 13 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSI3D14.tmp	msiexec.exe
File created	C:\Windows\Installer\f7622e1.msi	msiexec.exe
File created	C:\Windows\Installer\f7622dc.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3D82.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2510.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2482.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI25EB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4946.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f7622df.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\f7622dc.msi	msiexec.exe
File created	C:\Windows\Installer\f7622df.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2388.tmp	msiexec.exe

Executes dropped EXE 2 IoCs

Processes:

UnRAR.exesteamerrorreporter64.exe

pid process

2404 UnRAR.exe
1376 steamerrorreporter64.exe
Loads dropped DLL 10 IoCs

Processes:

MsiExec.exemsiexec.exesteamerrorreporter64.exe

pid process

2592 MsiExec.exe
2592 MsiExec.exe
2592 MsiExec.exe
2592 MsiExec.exe
2592 MsiExec.exe
2592 MsiExec.exe
2188 msiexec.exe
2188 msiexec.exe
1376 steamerrorreporter64.exe
1376 steamerrorreporter64.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

msiexec.exe

pid process

2188 msiexec.exe
2188 msiexec.exe

pid	process
2404	UnRAR.exe
1376	steamerrorreporter64.exe

pid	process
2592	MsiExec.exe
2592	MsiExec.exe
2592	MsiExec.exe
2592	MsiExec.exe
2592	MsiExec.exe
2592	MsiExec.exe
2188	msiexec.exe
2188	msiexec.exe
1376	steamerrorreporter64.exe
1376	steamerrorreporter64.exe

pid	process
2188	msiexec.exe
2188	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	1976	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1976	msiexec.exe
Token: SeRestorePrivilege	2188	msiexec.exe
Token: SeTakeOwnershipPrivilege	2188	msiexec.exe
Token: SeSecurityPrivilege	2188	msiexec.exe
Token: SeCreateTokenPrivilege	1976	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1976	msiexec.exe
Token: SeLockMemoryPrivilege	1976	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1976	msiexec.exe
Token: SeMachineAccountPrivilege	1976	msiexec.exe
Token: SeTcbPrivilege	1976	msiexec.exe
Token: SeSecurityPrivilege	1976	msiexec.exe
Token: SeTakeOwnershipPrivilege	1976	msiexec.exe
Token: SeLoadDriverPrivilege	1976	msiexec.exe
Token: SeSystemProfilePrivilege	1976	msiexec.exe
Token: SeSystemtimePrivilege	1976	msiexec.exe
Token: SeProfSingleProcessPrivilege	1976	msiexec.exe
Token: SeIncBasePriorityPrivilege	1976	msiexec.exe
Token: SeCreatePagefilePrivilege	1976	msiexec.exe
Token: SeCreatePermanentPrivilege	1976	msiexec.exe
Token: SeBackupPrivilege	1976	msiexec.exe
Token: SeRestorePrivilege	1976	msiexec.exe
Token: SeShutdownPrivilege	1976	msiexec.exe
Token: SeDebugPrivilege	1976	msiexec.exe
Token: SeAuditPrivilege	1976	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1976	msiexec.exe
Token: SeChangeNotifyPrivilege	1976	msiexec.exe
Token: SeRemoteShutdownPrivilege	1976	msiexec.exe
Token: SeUndockPrivilege	1976	msiexec.exe
Token: SeSyncAgentPrivilege	1976	msiexec.exe
Token: SeEnableDelegationPrivilege	1976	msiexec.exe
Token: SeManageVolumePrivilege	1976	msiexec.exe
Token: SeImpersonatePrivilege	1976	msiexec.exe
Token: SeCreateGlobalPrivilege	1976	msiexec.exe
Token: SeRestorePrivilege	2188	msiexec.exe
Token: SeTakeOwnershipPrivilege	2188	msiexec.exe
Token: SeRestorePrivilege	2188	msiexec.exe
Token: SeTakeOwnershipPrivilege	2188	msiexec.exe
Token: SeRestorePrivilege	2188	msiexec.exe
Token: SeTakeOwnershipPrivilege	2188	msiexec.exe
Token: SeRestorePrivilege	2188	msiexec.exe
Token: SeTakeOwnershipPrivilege	2188	msiexec.exe
Token: SeRestorePrivilege	2188	msiexec.exe
Token: SeTakeOwnershipPrivilege	2188	msiexec.exe
Token: SeRestorePrivilege	2188	msiexec.exe
Token: SeTakeOwnershipPrivilege	2188	msiexec.exe
Token: SeRestorePrivilege	2188	msiexec.exe
Token: SeTakeOwnershipPrivilege	2188	msiexec.exe
Token: SeRestorePrivilege	2188	msiexec.exe
Token: SeTakeOwnershipPrivilege	2188	msiexec.exe
Token: SeRestorePrivilege	2188	msiexec.exe
Token: SeTakeOwnershipPrivilege	2188	msiexec.exe
Token: SeRestorePrivilege	2188	msiexec.exe
Token: SeTakeOwnershipPrivilege	2188	msiexec.exe
Token: SeRestorePrivilege	2188	msiexec.exe
Token: SeTakeOwnershipPrivilege	2188	msiexec.exe
Token: SeRestorePrivilege	2188	msiexec.exe
Token: SeTakeOwnershipPrivilege	2188	msiexec.exe
Token: SeRestorePrivilege	2188	msiexec.exe
Token: SeTakeOwnershipPrivilege	2188	msiexec.exe
Token: SeRestorePrivilege	2188	msiexec.exe
Token: SeTakeOwnershipPrivilege	2188	msiexec.exe
Token: SeRestorePrivilege	2188	msiexec.exe
Token: SeTakeOwnershipPrivilege	2188	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

1976 msiexec.exe
1976 msiexec.exe

pid	process
1976	msiexec.exe
1976	msiexec.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

msiexec.exe

description	pid	process	target process
PID 2188 wrote to memory of 2592	2188	msiexec.exe	MsiExec.exe
PID 2188 wrote to memory of 2592	2188	msiexec.exe	MsiExec.exe
PID 2188 wrote to memory of 2592	2188	msiexec.exe	MsiExec.exe
PID 2188 wrote to memory of 2592	2188	msiexec.exe	MsiExec.exe
PID 2188 wrote to memory of 2592	2188	msiexec.exe	MsiExec.exe
PID 2188 wrote to memory of 2592	2188	msiexec.exe	MsiExec.exe
PID 2188 wrote to memory of 2592	2188	msiexec.exe	MsiExec.exe
PID 2188 wrote to memory of 2404	2188	msiexec.exe	UnRAR.exe
PID 2188 wrote to memory of 2404	2188	msiexec.exe	UnRAR.exe
PID 2188 wrote to memory of 2404	2188	msiexec.exe	UnRAR.exe
PID 2188 wrote to memory of 1376	2188	msiexec.exe	steamerrorreporter64.exe
PID 2188 wrote to memory of 1376	2188	msiexec.exe	steamerrorreporter64.exe
PID 2188 wrote to memory of 1376	2188	msiexec.exe	steamerrorreporter64.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\__x64___setup___x32__\setup.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1976

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2188

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 71AA49A1C9B1BADF291CE9C222B6310E
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:2592

C:\Users\Admin\AppData\Roaming\Yinanob Coop Aq\PubSurf\UnRAR.exe
"C:\Users\Admin\AppData\Roaming\Yinanob Coop Aq\PubSurf\UnRAR.exe" x -p2664926658a "C:\Users\Admin\AppData\Roaming\Yinanob Coop Aq\PubSurf\ruw9eigh.rar" "C:\Users\Admin\AppData\Roaming\Yinanob Coop Aq\PubSurf\"
2⤵
- Executes dropped EXE
PID:2404

C:\Users\Admin\AppData\Roaming\Yinanob Coop Aq\PubSurf\steamerrorreporter64.exe
"C:\Users\Admin\AppData\Roaming\Yinanob Coop Aq\PubSurf\steamerrorreporter64.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1376

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f7622e0.rbs
Filesize
21KB

MD5
67a1d300d0dc83ff2d1ce49bdd43a1d3

SHA1
9822d32e7b345c512fee5cc3c3c16125fd4cb354

SHA256
d59b9ee18696805c129b6d675c5f589f0f783c45c6cb2eefa2bfffa67a9f7a13

SHA512
33c2f8551e77eca1490423525ee9beeda65163e0cc1e2a5d727cd59f2df97426b440a713c0bfe30ca6245e18335d35744badda85a9a3b43fefa038c69b9bf32a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
3161fceb7282e00cf73a86802d2fd936

SHA1
0969a9476cf56064de1ac7fe16338668d6deaea8

SHA256
9cac74dea3a80fcda34f017bc181c85982197437f81b0fafbeca697f0a052860

SHA512
7faecb80d05d1d9aa0c7ee45b7177580a7c876fca0a2d0113bd1f70291eacb8f8b840c324585e74738d34ab5cdbc5bd576a170ab842985c6753544c4d76e143b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3FA1.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4083.tmp
Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\Yinanob Coop Aq\PubSurf\ruw9eigh.rar
Filesize
376KB

MD5
ea08767396983ec8541f755e5dcbb389

SHA1
503098b82190f7b7245263e08f07e29ec92d224f

SHA256
57eb7c34efeb833930848cd219776a592a659517c157452a841bca2873784b7a

SHA512
2f82757a21e39a08d4da29645d3ffaad867560a634600d25e45aa63fa8b07db1e752d47925018b3d323f748e79b76f063004b2eb18649d5fd7e4432f1a28829a

Download Submit
C:\Users\Admin\AppData\Roaming\Yinanob Coop Aq\PubSurf\vstdlib_s64.dll
Filesize
1000KB

MD5
e547cefe210d3072f60f4c4cd402d8bb

SHA1
17ac4a1184283f98eafe2378bf4908940b63c307

SHA256
a970226823fe040895e40b04bfc56b871c0450c2107594f42109f46f48b5e972

SHA512
d72b052427cf3434282fd894f66969883c42d360dff1a577514aa1e2f8a98583ff3a63205a3b14bb3d1a5c85a0938509fe343e7830c559d16eaa80331e1febfe

Download Submit
C:\Windows\Installer\MSI2510.tmp
Filesize
1.1MB

MD5
1a2b237796742c26b11a008d0b175e29

SHA1
cfd5affcfb3b6fd407e58dfc7187fad4f186ea18

SHA256
81e0df47bcb2b3380fb0fb58b0d673be4ef1b0367fd2b0d80ab8ee292fc8f730

SHA512
3135d866bf91f9e09b980dd649582072df1f53eabe4c5ac5d34fff1aeb5b6fa01d38d87fc31de19a0887a910e95309bcf0e7ae54e6e8ed2469feb64da4a4f9e5

Download Submit
C:\Windows\Installer\MSI3D82.tmp
Filesize
364KB

MD5
54d74546c6afe67b3d118c3c477c159a

SHA1
957f08beb7e27e657cd83d8ee50388b887935fae

SHA256
f9956417af079e428631a6c921b79716d960c3b4917c6b7d17ff3cb945f18611

SHA512
d27750b913cc2b7388e9948f42385d0b4124e48335ae7fc0bc6971f4f807dbc9af63fe88675bc440eb42b9a92551bf2d77130b1633ddda90866616b583ae924f

Download Submit
C:\Windows\Installer\f7622dc.msi
Filesize
25.2MB

MD5
9e10d740b32cd15a4fb9a947f911b924

SHA1
6ed60f2f79f986cbf4cc6ab1076522b9c762c272

SHA256
ce35819b8e52f92738534f2b0c0d468bdade96eba64a41915618ab11c04c994a

SHA512
d793f50e6a417a8c75da3a3e809c9cb2d2724d92600e994a90c4198f47937ad462d1682a5277fcb3f0d6648fee2511a2b43c96ff96e8e6a7bec4e461b6bd7a08

Download Submit
\Users\Admin\AppData\Roaming\Yinanob Coop Aq\PubSurf\UnRAR.exe
Filesize
494KB

MD5
98ccd44353f7bc5bad1bc6ba9ae0cd68

SHA1
76a4e5bf8d298800c886d29f85ee629e7726052d

SHA256
e51021f6cb20efbd2169f2a2da10ce1abca58b4f5f30fbf4bae931e4ecaac99b

SHA512
d6e8146a1055a59cba5e2aaf47f6cb184acdbe28e42ec3daebf1961a91cec5904554d9d433ebf943dd3639c239ef11560fa49f00e1cff02e11cd8d3506c4125f

Download Submit
\Users\Admin\AppData\Roaming\Yinanob Coop Aq\PubSurf\steamerrorreporter64.exe
Filesize
639KB

MD5
fd3ce044ac234fdab3df9d7f492c470a

SHA1
a74a287d5d82a8071ab36c72b2786342d83a8ef7

SHA256
0a0c09753b5103e86e32c2d8086dd1399f0d97a00e1525ec9c390067cdb242ba

SHA512
86d7e805fab0e5130003facbb1525ee261440846f342f53ae64c3f8d676d1208d5fd9bd91e3222c63cc30c443348eb5ddedab14c8847dae138fba7e9be69d08d

Download Submit
\Users\Admin\AppData\Roaming\Yinanob Coop Aq\PubSurf\tier0_s64.dll
Filesize
386KB

MD5
7e60404cfb232a1d3708a9892d020e84

SHA1
31328d887bee17641608252fb2f9cd6caf8ba522

SHA256
5a3e15cb90baf4b3ebe0621fa6f5f37b0fe99848387d6f2fd99ae770d1e6d766

SHA512
4d8abd59bd77bdb6e5b5e5f902d2a10fa5136437c51727783e79aed6a796f9ee1807faf14f1a72a1341b9f868f61de8c676b00a4b07a2a26cfb8a4db1b77eb3c

Download Submit
\Windows\Installer\MSI2388.tmp
Filesize
738KB

MD5
b158d8d605571ea47a238df5ab43dfaa

SHA1
bb91ae1f2f7142b9099e3cc285f4f5b84de568e4

SHA256
ca763693cc25d316f14a9ebad80ebf00590329550c45adb7e5205486533c2504

SHA512
56aef59c198acf2fcd0d95ea6e32ce1c706e5098a0800feff13ddb427bfb4d538de1c415a5cb5496b09a5825155e3abb1c13c8c37dc31549604bd4d63cb70591

Download Submit