Analysis
-
max time kernel
147s -
max time network
64s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
28-06-2020 20:54
Behavioral task
behavioral1
Sample
New.Shipment.Delivery.jar.msi
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
New.Shipment.Delivery.jar.msi
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
New.Shipment.Delivery.jar.msi
-
Size
967KB
-
MD5
fa8118a9fa20a17018cb2f60fd28a5b7
-
SHA1
548b525309b3746b808c4645f7a727af2dc1ec0c
-
SHA256
a2e6fae445f2fc021874a54a9525a0a35004e25c6df1a8648eb602868de1b8e9
-
SHA512
b2c61459013ab978e12ac7c3ba1a39396d06917b85dfd2c5997ddddf2b78eee43032355223afe2a52b07de296af27dc7c2497de05e28b215992bb21f7c441d70
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
Processes:
MsiExec.exepid process 1596 MsiExec.exe 1596 MsiExec.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\B: msiexec.exe -
Modifies service 2 TTPs 147 IoCs
Processes:
vssvc.exemsiexec.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace(__?_Volume{ef8b9384-8b17-11ea-a5f6-806e6f6e6963}_)\OPEN_VOLUME_HANDLE (Leave) = 480000000000000050dbd20a9f4dd60170000000e8050000fd0300000000000000000000000000005ebbad522c271b48b2f78d3c5db9a57700000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}\PROVIDER_POSTCOMMIT (Leave) = 4800000000000000b047e80a9f4dd60170000000f0060000050400000000000000000000000000005ebbad522c271b48b2f78d3c5db9a57700000000000000000000000000000000 vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\VSS_WS_STABLE (SetCurrentState) = 480000000000000010122a089f4dd60170000000c8040000010000000100000001000000000000005ebbad522c271b48b2f78d3c5db9a57700000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\FREEZE_FRONT (Enter) = 4800000000000000b0b8f0099f4dd60170000000f0060000ec0300000100000000000000000000005ebbad522c271b48b2f78d3c5db9a57700000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\FREEZE_RM (Enter) = 4800000000000000f00b120a9f4dd60170000000f0060000ef0300000100000000000000000000005ebbad522c271b48b2f78d3c5db9a57700000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace(__?_Volume{ef8b9384-8b17-11ea-a5f6-806e6f6e6963}_)\IOCTL_RELEASE (Leave) = 4800000000000000b047e80a9f4dd60170000000e8050000ff0300000000000000000000000000005ebbad522c271b48b2f78d3c5db9a57700000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer\THAW (Leave) = 480000000000000010b4fd0a9f4dd601700000008c040000f20300000000000003000000000000005ebbad522c271b48b2f78d3c5db9a57700000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer\POSTSNAPSHOT (Enter) = 4800000000000000b0895a0b9f4dd60170000000b4020000f50300000100000004000000000000005ebbad522c271b48b2f78d3c5db9a57700000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}\PROVIDER_BEGINPREPARE (Enter) = 480000000000000010f1f0079f4dd60170000000f8060000010400000100000000000000000000005ebbad522c271b48b2f78d3c5db9a57700000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer\PREPAREBACKUP (Leave) = 4800000000000000b0b027089f4dd60170000000f8060000e90300000000000001000000000000005ebbad522c271b48b2f78d3c5db9a57700000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\FREEZE_BACK (Enter) = 4800000000000000909ffc099f4dd60170000000f0060000ed0300000100000000000000000000005ebbad522c271b48b2f78d3c5db9a57700000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace\OPEN_VOLUME_HANDLE (Enter) = 48000000000000001051520a9f4dd60170000000f0060000fd0300000100000000000000000000005ebbad522c271b48b2f78d3c5db9a57700000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace\IOCTL_FLUSH_AND_HOLD (Leave) = 480000000000000050e6e50a9f4dd60170000000f0060000fe0300000000000000000000000000005ebbad522c271b48b2f78d3c5db9a57700000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer\THAW (Leave) = 480000000000000010b4fd0a9f4dd601700000008c040000f20300000000000003000000000000005ebbad522c271b48b2f78d3c5db9a57700000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer\VSS_WS_WAITING_FOR_BACKUP_COMPLETE (SetCurrentState) = 4800000000000000b0895a0b9f4dd60170000000b4020000050000000100000004000000000000005ebbad522c271b48b2f78d3c5db9a57700000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}\PROVIDER_POSTFINALCOMMIT (Enter) = 48000000000000001001830b9f4dd60170000000f0060000070400000100000000000000000000005ebbad522c271b48b2f78d3c5db9a57700000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP\SppAddInterestingComponents (Leave) = 480000000000000030ffd1079f4dd601a802000020030000d40700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer\GETSTATE (Leave) = 4800000000000000f00349089f4dd60170000000f8060000f90300000000000001000000000000005ebbad522c271b48b2f78d3c5db9a57700000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\FREEZE_FRONT (Leave) = 4800000000000000909ffc099f4dd60170000000f0060000ec0300000000000000000000000000005ebbad522c271b48b2f78d3c5db9a57700000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\VSS_WS_WAITING_FOR_FREEZE (SetCurrentState) = 48000000000000005041c8099f4dd6017000000084040000020000000100000001000000000000005ebbad522c271b48b2f78d3c5db9a57700000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP\SppCreate (Leave) = 480000000000000010a9ea0a9f4dd601a802000020030000d00700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer\VSS_WS_WAITING_FOR_POST_SNAPSHOT (SetCurrentState) = 480000000000000010b4fd0a9f4dd601700000008c040000040000000100000003000000000000005ebbad522c271b48b2f78d3c5db9a57700000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher\GETSTATE (Leave) = 4800000000000000f00349089f4dd601a80200001c070000f90300000000000000000000000000005ebbad522c271b48b2f78d3c5db9a57700000000000000000000000000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace\IOCTL_RELEASE (Leave) = 4800000000000000b047e80a9f4dd60170000000f0060000ff0300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}\PROVIDER_PREFINALCOMMIT (Enter) = 48000000000000009039070b9f4dd60170000000f0060000060400000100000000000000000000005ebbad522c271b48b2f78d3c5db9a57700000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}\PROVIDER_PREFINALCOMMIT (Leave) = 480000000000000010e0490b9f4dd60170000000f0060000060400000000000000000000000000005ebbad522c271b48b2f78d3c5db9a57700000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\BACKUPSHUTDOWN (Enter) = 480000000000000050cd750c9f4dd60170000000b4020000fb0300000100000005000000000000005ebbad522c271b48b2f78d3c5db9a57700000000000000000000000000000000 vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag msiexec.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\PREPAREBACKUP (Leave) = 480000000000000010122a089f4dd60170000000c8040000e90300000000000001000000000000005ebbad522c271b48b2f78d3c5db9a57700000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher\GETSTATE (Enter) = 4800000000000000b0bb3a089f4dd601a80200001c070000f90300000100000000000000000000005ebbad522c271b48b2f78d3c5db9a57700000000000000000000000000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\PREPARESNAPSHOT (Leave) = 4800000000000000b0b8f0099f4dd60170000000f0060000ea0300000000000000000000000000005ebbad522c271b48b2f78d3c5db9a57700000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\FREEZE_SYSTEM (Enter) = 4800000000000000b0c3030a9f4dd60170000000f0060000ee0300000100000000000000000000005ebbad522c271b48b2f78d3c5db9a57700000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer\THAW (Enter) = 4800000000000000b052fb0a9f4dd601700000008c040000f20300000100000003000000000000005ebbad522c271b48b2f78d3c5db9a57700000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore\SrCreateRp (Enter) = 4800000000000000d00190019f4dd601a802000020030000d50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}\PROVIDER_ENDPREPARE (Leave) = 480000000000000030f174099f4dd60170000000f0060000020400000000000000000000000000005ebbad522c271b48b2f78d3c5db9a57700000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\PREPARESNAPSHOT (Leave) = 48000000000000005041c8099f4dd6017000000084040000ea0300000000000001000000000000005ebbad522c271b48b2f78d3c5db9a57700000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\POSTSNAPSHOT (Leave) = 48000000000000001001830b9f4dd60170000000f0060000f50300000000000000000000000000005ebbad522c271b48b2f78d3c5db9a57700000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\BACKUPSHUTDOWN (Leave) = 480000000000000050cd750c9f4dd60170000000f0060000fb0300000000000000000000000000005ebbad522c271b48b2f78d3c5db9a57700000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\GETSTATE (Leave) = 480000000000000090a246089f4dd60170000000f0020000f90300000000000001000000000000005ebbad522c271b48b2f78d3c5db9a57700000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer\PREPARESNAPSHOT (Leave) = 48000000000000005041c8099f4dd601700000008c040000ea0300000000000001000000000000005ebbad522c271b48b2f78d3c5db9a57700000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}\PROVIDER_PRECOMMIT (Leave) = 48000000000000001051520a9f4dd60170000000f0060000030400000000000000000000000000005ebbad522c271b48b2f78d3c5db9a57700000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore\SrCreateRp (Leave) = 480000000000000010a9ea0a9f4dd601a802000020030000d50700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer\PREPAREBACKUP (Leave) = 4800000000000000b0b027089f4dd60170000000f0020000e90300000000000001000000000000005ebbad522c271b48b2f78d3c5db9a57700000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\FREEZE (Leave) = 48000000000000001051520a9f4dd60170000000f0060000eb0300000000000000000000000000005ebbad522c271b48b2f78d3c5db9a57700000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace\OPEN_VOLUME_HANDLE (Leave) = 480000000000000050dbd20a9f4dd60170000000f0060000fd0300000000000000000000000000005ebbad522c271b48b2f78d3c5db9a57700000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer\FREEZE (Leave) = 48000000000000001051520a9f4dd601700000008c040000eb0300000000000002000000000000005ebbad522c271b48b2f78d3c5db9a57700000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace(__?_Volume{ef8b9384-8b17-11ea-a5f6-806e6f6e6963}_)\OPEN_VOLUME_HANDLE (Enter) = 48000000000000001051520a9f4dd60170000000e8050000fd0300000100000000000000000000005ebbad522c271b48b2f78d3c5db9a57700000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\IDENTIFY (Enter) = 4800000000000000702f85029f4dd6017000000058050000e80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP\SppGatherWriterMetadata (Leave) = 4800000000000000b06eb5079f4dd601a802000020030000d30700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\FREEZE_KTM (Enter) = 4800000000000000f00b120a9f4dd60170000000f0060000f00300000100000000000000000000005ebbad522c271b48b2f78d3c5db9a57700000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\VSS_WS_WAITING_FOR_POST_SNAPSHOT (SetCurrentState) = 48000000000000009039070b9f4dd60170000000b4020000040000000100000003000000000000005ebbad522c271b48b2f78d3c5db9a57700000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer\PREPARESNAPSHOT (Leave) = 48000000000000005041c8099f4dd6017000000088020000ea0300000000000001000000000000005ebbad522c271b48b2f78d3c5db9a57700000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\FREEZE (Enter) = 4800000000000000303efa099f4dd6017000000088020000eb0300000100000002000000000000005ebbad522c271b48b2f78d3c5db9a57700000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\FREEZE_SYSTEM (Leave) = 4800000000000000f00b120a9f4dd60170000000f0060000ee0300000000000000000000000000005ebbad522c271b48b2f78d3c5db9a57700000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\GETSTATE (Enter) = 4800000000000000304144089f4dd60170000000f0020000f90300000100000001000000000000005ebbad522c271b48b2f78d3c5db9a57700000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace(__?_Volume{ef8b9384-8b17-11ea-a5f6-806e6f6e6963}_)\IOCTL_FLUSH_AND_HOLD (Leave) = 480000000000000050e6e50a9f4dd60170000000e8050000fe0300000000000000000000000000005ebbad522c271b48b2f78d3c5db9a57700000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher\DOSNAPSHOT (Leave) = 4800000000000000b047e80a9f4dd601a8020000e40600000a0400000000000000000000000000005ebbad522c271b48b2f78d3c5db9a57700000000000000000000000000000000 msiexec.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\ASR Writer\IDENTIFY (Leave) = 480000000000000010d995029f4dd60170000000f8060000e80300000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer\VSS_WS_STABLE (SetCurrentState) = 4800000000000000b0b027089f4dd60170000000f0020000010000000100000001000000000000005ebbad522c271b48b2f78d3c5db9a57700000000000000000000000000000000 vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}\PROVIDER_ENDPREPARE (Enter) = 4800000000000000d0ea54089f4dd60170000000f0060000020400000100000000000000000000005ebbad522c271b48b2f78d3c5db9a57700000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\VSS_WS_WAITING_FOR_THAW (SetCurrentState) = 4800000000000000303efa099f4dd6017000000088020000030000000100000002000000000000005ebbad522c271b48b2f78d3c5db9a57700000000000000000000000000000000 vssvc.exe -
Drops file in Windows directory 7 IoCs
Processes:
msiexec.exeDrvInst.exedescription ioc process File opened for modification C:\Windows\Installer\MSID29C.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\1c8f9.msi msiexec.exe File opened for modification C:\Windows\Installer\1c8f9.msi msiexec.exe File opened for modification C:\Windows\Installer\MSICB2C.tmp msiexec.exe -
Modifies data under HKEY_USERS 44 IoCs
Processes:
DrvInst.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\24\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\24\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
msiexec.exepid process 852 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 55 IoCs
Processes:
msiexec.exemsiexec.exevssvc.exeDrvInst.exedescription pid process Token: SeShutdownPrivilege 852 msiexec.exe Token: SeIncreaseQuotaPrivilege 852 msiexec.exe Token: SeRestorePrivilege 680 msiexec.exe Token: SeTakeOwnershipPrivilege 680 msiexec.exe Token: SeSecurityPrivilege 680 msiexec.exe Token: SeCreateTokenPrivilege 852 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 852 msiexec.exe Token: SeLockMemoryPrivilege 852 msiexec.exe Token: SeIncreaseQuotaPrivilege 852 msiexec.exe Token: SeMachineAccountPrivilege 852 msiexec.exe Token: SeTcbPrivilege 852 msiexec.exe Token: SeSecurityPrivilege 852 msiexec.exe Token: SeTakeOwnershipPrivilege 852 msiexec.exe Token: SeLoadDriverPrivilege 852 msiexec.exe Token: SeSystemProfilePrivilege 852 msiexec.exe Token: SeSystemtimePrivilege 852 msiexec.exe Token: SeProfSingleProcessPrivilege 852 msiexec.exe Token: SeIncBasePriorityPrivilege 852 msiexec.exe Token: SeCreatePagefilePrivilege 852 msiexec.exe Token: SeCreatePermanentPrivilege 852 msiexec.exe Token: SeBackupPrivilege 852 msiexec.exe Token: SeRestorePrivilege 852 msiexec.exe Token: SeShutdownPrivilege 852 msiexec.exe Token: SeDebugPrivilege 852 msiexec.exe Token: SeAuditPrivilege 852 msiexec.exe Token: SeSystemEnvironmentPrivilege 852 msiexec.exe Token: SeChangeNotifyPrivilege 852 msiexec.exe Token: SeRemoteShutdownPrivilege 852 msiexec.exe Token: SeUndockPrivilege 852 msiexec.exe Token: SeSyncAgentPrivilege 852 msiexec.exe Token: SeEnableDelegationPrivilege 852 msiexec.exe Token: SeManageVolumePrivilege 852 msiexec.exe Token: SeImpersonatePrivilege 852 msiexec.exe Token: SeCreateGlobalPrivilege 852 msiexec.exe Token: SeBackupPrivilege 112 vssvc.exe Token: SeRestorePrivilege 112 vssvc.exe Token: SeAuditPrivilege 112 vssvc.exe Token: SeBackupPrivilege 680 msiexec.exe Token: SeRestorePrivilege 680 msiexec.exe Token: SeRestorePrivilege 1760 DrvInst.exe Token: SeRestorePrivilege 1760 DrvInst.exe Token: SeRestorePrivilege 1760 DrvInst.exe Token: SeRestorePrivilege 1760 DrvInst.exe Token: SeRestorePrivilege 1760 DrvInst.exe Token: SeRestorePrivilege 1760 DrvInst.exe Token: SeRestorePrivilege 1760 DrvInst.exe Token: SeLoadDriverPrivilege 1760 DrvInst.exe Token: SeLoadDriverPrivilege 1760 DrvInst.exe Token: SeLoadDriverPrivilege 1760 DrvInst.exe Token: SeRestorePrivilege 680 msiexec.exe Token: SeTakeOwnershipPrivilege 680 msiexec.exe Token: SeRestorePrivilege 680 msiexec.exe Token: SeTakeOwnershipPrivilege 680 msiexec.exe Token: SeRestorePrivilege 680 msiexec.exe Token: SeTakeOwnershipPrivilege 680 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
msiexec.exepid process 852 msiexec.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
msiexec.exedescription pid process target process PID 680 wrote to memory of 1596 680 msiexec.exe MsiExec.exe PID 680 wrote to memory of 1596 680 msiexec.exe MsiExec.exe PID 680 wrote to memory of 1596 680 msiexec.exe MsiExec.exe PID 680 wrote to memory of 1596 680 msiexec.exe MsiExec.exe PID 680 wrote to memory of 1596 680 msiexec.exe MsiExec.exe PID 680 wrote to memory of 1596 680 msiexec.exe MsiExec.exe PID 680 wrote to memory of 1596 680 msiexec.exe MsiExec.exe
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\New.Shipment.Delivery.jar.msi1⤵
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:852
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Modifies service
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding AA5ED4B78552315FDC1B812ECFE1A0712⤵
- Loads dropped DLL
PID:1596
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:112
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot12" "" "" "6d110b0a3" "0000000000000000" "00000000000005AC" "00000000000005A8"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1760