Analysis
-
max time kernel
150s -
max time network
110s -
platform
windows7_x64 -
resource
win7v200722 -
submitted
01-08-2020 19:38
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Java.Ratty.2.17626.28919.msi
Resource
win7v200722
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Java.Ratty.2.17626.28919.msi
Resource
win10v200722
General
-
Target
SecuriteInfo.com.Java.Ratty.2.17626.28919.msi
-
Size
384KB
-
MD5
65a137d42ab4a2e88af0c517dea6550f
-
SHA1
d605514c0d1cef5cdbd1c7bde54b23c07a58fd17
-
SHA256
67905416ed17dc324c87f1d7a9bde197b2f651f2334f2eef554447675b7dd0c0
-
SHA512
798720589871b0a2cd4b505356ed02e9270707bbdd2aa162216455f6f215f77a2e451e5fd9e59d5aa0ef3d7816743c58536d81a7413d6548e558ad575336c5e8
Malware Config
Signatures
-
Drops file in Windows directory 12 IoCs
Processes:
msiexec.exeDrvInst.exedescription ioc process File created C:\Windows\Installer\25762.msi msiexec.exe File opened for modification C:\Windows\Installer\25762.msi msiexec.exe File created C:\Windows\Installer\25763.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}\ARPIcon msiexec.exe File opened for modification C:\Windows\Installer\25763.ipi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\MSI5F50.tmp msiexec.exe File created C:\Windows\Installer\25765.msi msiexec.exe File created C:\Windows\Installer\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}\ARPIcon msiexec.exe -
Enumerates connected drives 3 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 87 IoCs
Processes:
msiexec.exemsiexec.exevssvc.exeDrvInst.exedescription pid process Token: SeShutdownPrivilege 1408 msiexec.exe Token: SeIncreaseQuotaPrivilege 1408 msiexec.exe Token: SeRestorePrivilege 112 msiexec.exe Token: SeTakeOwnershipPrivilege 112 msiexec.exe Token: SeSecurityPrivilege 112 msiexec.exe Token: SeCreateTokenPrivilege 1408 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1408 msiexec.exe Token: SeLockMemoryPrivilege 1408 msiexec.exe Token: SeIncreaseQuotaPrivilege 1408 msiexec.exe Token: SeMachineAccountPrivilege 1408 msiexec.exe Token: SeTcbPrivilege 1408 msiexec.exe Token: SeSecurityPrivilege 1408 msiexec.exe Token: SeTakeOwnershipPrivilege 1408 msiexec.exe Token: SeLoadDriverPrivilege 1408 msiexec.exe Token: SeSystemProfilePrivilege 1408 msiexec.exe Token: SeSystemtimePrivilege 1408 msiexec.exe Token: SeProfSingleProcessPrivilege 1408 msiexec.exe Token: SeIncBasePriorityPrivilege 1408 msiexec.exe Token: SeCreatePagefilePrivilege 1408 msiexec.exe Token: SeCreatePermanentPrivilege 1408 msiexec.exe Token: SeBackupPrivilege 1408 msiexec.exe Token: SeRestorePrivilege 1408 msiexec.exe Token: SeShutdownPrivilege 1408 msiexec.exe Token: SeDebugPrivilege 1408 msiexec.exe Token: SeAuditPrivilege 1408 msiexec.exe Token: SeSystemEnvironmentPrivilege 1408 msiexec.exe Token: SeChangeNotifyPrivilege 1408 msiexec.exe Token: SeRemoteShutdownPrivilege 1408 msiexec.exe Token: SeUndockPrivilege 1408 msiexec.exe Token: SeSyncAgentPrivilege 1408 msiexec.exe Token: SeEnableDelegationPrivilege 1408 msiexec.exe Token: SeManageVolumePrivilege 1408 msiexec.exe Token: SeImpersonatePrivilege 1408 msiexec.exe Token: SeCreateGlobalPrivilege 1408 msiexec.exe Token: SeBackupPrivilege 1292 vssvc.exe Token: SeRestorePrivilege 1292 vssvc.exe Token: SeAuditPrivilege 1292 vssvc.exe Token: SeBackupPrivilege 112 msiexec.exe Token: SeRestorePrivilege 112 msiexec.exe Token: SeRestorePrivilege 1940 DrvInst.exe Token: SeRestorePrivilege 1940 DrvInst.exe Token: SeRestorePrivilege 1940 DrvInst.exe Token: SeRestorePrivilege 1940 DrvInst.exe Token: SeRestorePrivilege 1940 DrvInst.exe Token: SeRestorePrivilege 1940 DrvInst.exe Token: SeRestorePrivilege 1940 DrvInst.exe Token: SeLoadDriverPrivilege 1940 DrvInst.exe Token: SeLoadDriverPrivilege 1940 DrvInst.exe Token: SeLoadDriverPrivilege 1940 DrvInst.exe Token: SeRestorePrivilege 112 msiexec.exe Token: SeTakeOwnershipPrivilege 112 msiexec.exe Token: SeRestorePrivilege 112 msiexec.exe Token: SeTakeOwnershipPrivilege 112 msiexec.exe Token: SeRestorePrivilege 112 msiexec.exe Token: SeTakeOwnershipPrivilege 112 msiexec.exe Token: SeRestorePrivilege 112 msiexec.exe Token: SeTakeOwnershipPrivilege 112 msiexec.exe Token: SeRestorePrivilege 112 msiexec.exe Token: SeTakeOwnershipPrivilege 112 msiexec.exe Token: SeRestorePrivilege 112 msiexec.exe Token: SeTakeOwnershipPrivilege 112 msiexec.exe Token: SeRestorePrivilege 112 msiexec.exe Token: SeTakeOwnershipPrivilege 112 msiexec.exe Token: SeRestorePrivilege 112 msiexec.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
msiexec.exepid process 112 msiexec.exe 112 msiexec.exe -
Modifies registry class 24 IoCs
Processes:
msiexec.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7314F9862C648A4DB8BE2A5B47BE100\SourceList\PackageName = "SecuriteInfo.com.Java.Ratty.2.17626.28919.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7314F9862C648A4DB8BE2A5B47BE100\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7314F9862C648A4DB8BE2A5B47BE100\SourceList\Media\DiskPrompt = "Microsoft's Silverlight Installation [1]" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7314F9862C648A4DB8BE2A5B47BE100 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7314F9862C648A4DB8BE2A5B47BE100\ProductIcon = "C:\\Windows\\Installer\\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}\\ARPIcon" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7314F9862C648A4DB8BE2A5B47BE100\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4AE2841C3D7016247914C7DE6E8A2CA5 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7314F9862C648A4DB8BE2A5B47BE100\AuthorizedLUAApp = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7314F9862C648A4DB8BE2A5B47BE100\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D7314F9862C648A4DB8BE2A5B47BE100\Complete msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7314F9862C648A4DB8BE2A5B47BE100\PackageCode = "5EF367904E352BF479B5B53AD6115D55" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7314F9862C648A4DB8BE2A5B47BE100\Version = "16777216" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7314F9862C648A4DB8BE2A5B47BE100\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7314F9862C648A4DB8BE2A5B47BE100\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7314F9862C648A4DB8BE2A5B47BE100\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7314F9862C648A4DB8BE2A5B47BE100\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7314F9862C648A4DB8BE2A5B47BE100\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7314F9862C648A4DB8BE2A5B47BE100\SourceList\Media\1 = ";1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7314F9862C648A4DB8BE2A5B47BE100\SourceList msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7314F9862C648A4DB8BE2A5B47BE100\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D7314F9862C648A4DB8BE2A5B47BE100 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7314F9862C648A4DB8BE2A5B47BE100\ProductName = "Microsoft Silverlight" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7314F9862C648A4DB8BE2A5B47BE100\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4AE2841C3D7016247914C7DE6E8A2CA5\D7314F9862C648A4DB8BE2A5B47BE100 msiexec.exe -
Modifies service 2 TTPs 147 IoCs
Processes:
msiexec.exevssvc.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP\SppGatherWriterMetadata (Leave) = 480000000000000010e6dad74d68d6017000000074050000d30700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace(__?_Volume{af35dda4-cc48-11ea-b356-806e6f6e6963}_)\OPEN_VOLUME_HANDLE (Enter) = 4800000000000000703636db4d68d6010c050000fc040000fd03000001000000000000000000000016b07d56b7c1bf4dbbee88e2f5c8e9e200000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer\GETSTATE (Enter) = 4800000000000000506548d84d68d6010c050000d4060000f903000001000000010000000000000016b07d56b7c1bf4dbbee88e2f5c8e9e200000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}\PROVIDER_COMMIT (Enter) = 4800000000000000b0b5a3db4d68d6010c050000500400000404000001000000000000000000000016b07d56b7c1bf4dbbee88e2f5c8e9e200000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}\PROVIDER_PRECOMMIT (Leave) = 4800000000000000703636db4d68d6010c050000380600000304000000000000000000000000000016b07d56b7c1bf4dbbee88e2f5c8e9e200000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace\IOCTL_RELEASE (Enter) = 4800000000000000b0b5a3db4d68d6010c05000038060000ff0300000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}\PROVIDER_POSTCOMMIT (Leave) = 4800000000000000b0b5a3db4d68d6010c050000380600000504000000000000000000000000000016b07d56b7c1bf4dbbee88e2f5c8e9e200000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\POSTSNAPSHOT (Enter) = 4800000000000000f04a37dc4d68d6010c050000c4070000f503000001000000040000000000000016b07d56b7c1bf4dbbee88e2f5c8e9e200000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher\DOSNAPSHOT (Leave) = 48000000000000001017a6db4d68d601700000009c0700000a04000000000000000000000000000016b07d56b7c1bf4dbbee88e2f5c8e9e200000000000000000000000000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\FREEZE (Enter) = 4800000000000000b00573da4d68d6010c050000c8070000eb03000001000000020000000000000016b07d56b7c1bf4dbbee88e2f5c8e9e200000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\THAW_KTM (Leave) = 4800000000000000b0b5a3db4d68d6010c05000038060000f403000000000000000000000000000016b07d56b7c1bf4dbbee88e2f5c8e9e200000000000000000000000000000000 vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore msiexec.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore\SrCreateRp (Enter) = 480000000000000010ca15c84d68d6017000000074050000d50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer\IDENTIFY (Enter) = 4800000000000000509b87cc4d68d6010c0500000c070000e80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher\IDENTIFY (Leave) = 4800000000000000509dbcd14d68d6017000000048070000e803000000000000000000000000000016b07d56b7c1bf4dbbee88e2f5c8e9e200000000000000000000000000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}\PROVIDER_BEGINPREPARE (Leave) = 4800000000000000d0c918d84d68d6010c050000d40600000104000000000000000000000000000016b07d56b7c1bf4dbbee88e2f5c8e9e200000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher\GETSTATE (Leave) = 4800000000000000b0c64ad84d68d6017000000074070000f903000000000000000000000000000016b07d56b7c1bf4dbbee88e2f5c8e9e200000000000000000000000000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer\VSS_WS_WAITING_FOR_BACKUP_COMPLETE (SetCurrentState) = 4800000000000000f04a37dc4d68d6010c050000c80700000500000001000000040000000000000016b07d56b7c1bf4dbbee88e2f5c8e9e200000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\POSTSNAPSHOT (Leave) = 480000000000000030ebdddc4d68d6010c050000c4070000f503000000000000040000000000000016b07d56b7c1bf4dbbee88e2f5c8e9e200000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP\SppAddInterestingComponents (Enter) = 480000000000000010e6dad74d68d6017000000074050000d40700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}\PROVIDER_ENDPREPARE (Enter) = 480000000000000090ad56d84d68d6010c050000380600000204000001000000000000000000000016b07d56b7c1bf4dbbee88e2f5c8e9e200000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}\PROVIDER_COMMIT (Leave) = 4800000000000000b0b5a3db4d68d6010c050000500400000404000000000000000000000000000016b07d56b7c1bf4dbbee88e2f5c8e9e200000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer\THAW (Enter) = 4800000000000000b0c0b6db4d68d6010c050000cc070000f203000001000000030000000000000016b07d56b7c1bf4dbbee88e2f5c8e9e200000000000000000000000000000000 vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag msiexec.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer\VSS_WS_STABLE (SetCurrentState) = 4800000000000000d0d42bd84d68d6010c0500005c0400000100000001000000010000000000000016b07d56b7c1bf4dbbee88e2f5c8e9e200000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher\PREPAREBACKUP (Leave) = 480000000000000090a243d84d68d601700000000c060000e903000000000000000000000000000016b07d56b7c1bf4dbbee88e2f5c8e9e200000000000000000000000000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\FREEZE_FRONT (Leave) = 480000000000000070c877da4d68d6010c05000038060000ec03000000000000000000000000000016b07d56b7c1bf4dbbee88e2f5c8e9e200000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\FREEZE_SYSTEM (Enter) = 480000000000000050af83da4d68d6010c05000038060000ee03000001000000000000000000000016b07d56b7c1bf4dbbee88e2f5c8e9e200000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace\IOCTL_RELEASE (Leave) = 4800000000000000b0b5a3db4d68d6010c05000038060000ff0300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer\PREPAREBACKUP (Leave) = 4800000000000000d0d42bd84d68d6010c050000d4060000e903000000000000010000000000000016b07d56b7c1bf4dbbee88e2f5c8e9e200000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer\THAW (Leave) = 4800000000000000b0c0b6db4d68d6010c050000cc070000f203000000000000030000000000000016b07d56b7c1bf4dbbee88e2f5c8e9e200000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer\PREPAREBACKUP (Enter) = 4800000000000000b0b024d84d68d6010c0500005c040000e903000001000000010000000000000016b07d56b7c1bf4dbbee88e2f5c8e9e200000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer\BKGND_FREEZE_THREAD (Enter) = 4800000000000000d0348dda4d68d6010c050000b4070000fc03000001000000030000000000000016b07d56b7c1bf4dbbee88e2f5c8e9e200000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer\FREEZE (Enter) = 4800000000000000b03cd2da4d68d6010c050000d0070000eb03000001000000020000000000000016b07d56b7c1bf4dbbee88e2f5c8e9e200000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace\IOCTL_FLUSH_AND_HOLD (Enter) = 4800000000000000f0e78bdb4d68d6010c05000038060000fe03000001000000000000000000000016b07d56b7c1bf4dbbee88e2f5c8e9e200000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer\BKGND_FREEZE_THREAD (Enter) = 4800000000000000703636db4d68d6010c050000a0020000fc03000001000000030000000000000016b07d56b7c1bf4dbbee88e2f5c8e9e200000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}\PROVIDER_POSTCOMMIT (Enter) = 4800000000000000b0b5a3db4d68d6010c050000380600000504000001000000000000000000000016b07d56b7c1bf4dbbee88e2f5c8e9e200000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\THAW (Leave) = 48000000000000003046c0db4d68d6010c05000038060000f203000000000000000000000000000016b07d56b7c1bf4dbbee88e2f5c8e9e200000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer\POSTSNAPSHOT (Leave) = 480000000000000050ac39dc4d68d6010c050000d0070000f503000000000000040000000000000016b07d56b7c1bf4dbbee88e2f5c8e9e200000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer\BACKUPSHUTDOWN (Enter) = 480000000000000050301edd4d68d6010c050000c8070000fb03000001000000050000000000000016b07d56b7c1bf4dbbee88e2f5c8e9e200000000000000000000000000000000 vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer\IDENTIFY (Leave) = 480000000000000070caa1cc4d68d6010c0500005c040000e80300000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer\GETSTATE (Enter) = 4800000000000000506548d84d68d6010c0500005c040000f903000001000000010000000000000016b07d56b7c1bf4dbbee88e2f5c8e9e200000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\PREPARESNAPSHOT (Enter) = 480000000000000030490ada4d68d6010c05000038060000ea03000001000000000000000000000016b07d56b7c1bf4dbbee88e2f5c8e9e200000000000000000000000000000000 vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher msiexec.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssvcPublisher vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher\IDENTIFY (Enter) = 4800000000000000306c6dcc4d68d6017000000048070000e803000001000000000000000000000016b07d56b7c1bf4dbbee88e2f5c8e9e200000000000000000000000000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer\IDENTIFY (Leave) = 4800000000000000d02ba4cc4d68d6010c0500000c070000e80300000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher\PREPAREBACKUP (Enter) = 4800000000000000d0c918d84d68d601700000000c060000e903000001000000000000000000000016b07d56b7c1bf4dbbee88e2f5c8e9e200000000000000000000000000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher\GETSTATE (Enter) = 480000000000000090a243d84d68d6017000000074070000f903000001000000000000000000000016b07d56b7c1bf4dbbee88e2f5c8e9e200000000000000000000000000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\FREEZE_BACK (Leave) = 480000000000000050af83da4d68d6010c05000038060000ed03000000000000000000000000000016b07d56b7c1bf4dbbee88e2f5c8e9e200000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace(__?_Volume{af35dda4-cc48-11ea-b356-806e6f6e6963}_)\IOCTL_RELEASE (Leave) = 4800000000000000b0b5a3db4d68d6010c050000fc040000ff03000000000000000000000000000016b07d56b7c1bf4dbbee88e2f5c8e9e200000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}\PROVIDER_PREFINALCOMMIT (Leave) = 4800000000000000f03f24dc4d68d6010c050000380600000604000000000000000000000000000016b07d56b7c1bf4dbbee88e2f5c8e9e200000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\BACKUPSHUTDOWN (Enter) = 4800000000000000b0860ddd4d68d6010c05000038060000fb03000001000000000000000000000016b07d56b7c1bf4dbbee88e2f5c8e9e200000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer\BACKUPSHUTDOWN (Leave) = 480000000000000050301edd4d68d6010c050000c8070000fb03000000000000050000000000000016b07d56b7c1bf4dbbee88e2f5c8e9e200000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP\SppCreate (Enter) = 480000000000000010ca15c84d68d6017000000074050000d00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 msiexec.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP\SppGatherWriterMetadata (Enter) = 480000000000000090c25ccc4d68d6017000000074050000d30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\BKGND_FREEZE_THREAD (Enter) = 4800000000000000b00573da4d68d6010c050000c0070000fc03000001000000030000000000000016b07d56b7c1bf4dbbee88e2f5c8e9e200000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer\VSS_WS_WAITING_FOR_THAW (SetCurrentState) = 4800000000000000d0348dda4d68d6010c050000c80700000300000001000000020000000000000016b07d56b7c1bf4dbbee88e2f5c8e9e200000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\ASR Writer\IDENTIFY (Leave) = 480000000000000090eea8cc4d68d6010c050000d4060000e80300000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\PREPAREBACKUP (Leave) = 4800000000000000707329d84d68d6010c0500000c070000e903000000000000010000000000000016b07d56b7c1bf4dbbee88e2f5c8e9e200000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer\PREPARESNAPSHOT (Leave) = 4800000000000000508e4ada4d68d6010c050000cc070000ea03000000000000010000000000000016b07d56b7c1bf4dbbee88e2f5c8e9e200000000000000000000000000000000 vssvc.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
msiexec.exepid process 1408 msiexec.exe 1408 msiexec.exe -
Modifies data under HKEY_USERS 47 IoCs
Processes:
DrvInst.exemsiexec.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\24 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\24\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\24\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\24\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25 msiexec.exe
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Java.Ratty.2.17626.28919.msi1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Modifies registry class
- Modifies service
- Modifies data under HKEY_USERS
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
- Modifies service
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot12" "" "" "6d110b0a3" "0000000000000000" "00000000000005A8" "000000000000059C"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
-
memory/112-14-0x0000000000B20000-0x0000000000B24000-memory.dmpFilesize
16KB
-
memory/112-11-0x0000000000450000-0x0000000000452000-memory.dmpFilesize
8KB
-
memory/112-12-0x0000000001070000-0x0000000001074000-memory.dmpFilesize
16KB
-
memory/112-13-0x0000000000B20000-0x0000000000B24000-memory.dmpFilesize
16KB
-
memory/112-15-0x0000000000B20000-0x0000000000B24000-memory.dmpFilesize
16KB
-
memory/112-29-0x0000000004880000-0x0000000004884000-memory.dmpFilesize
16KB
-
memory/112-31-0x0000000004880000-0x0000000004884000-memory.dmpFilesize
16KB
-
memory/1408-3-0x00000000041C0000-0x00000000041C4000-memory.dmpFilesize
16KB
-
memory/1408-4-0x0000000004340000-0x0000000004344000-memory.dmpFilesize
16KB
-
memory/1408-6-0x0000000004340000-0x0000000004344000-memory.dmpFilesize
16KB
-
memory/1408-1-0x0000000004070000-0x0000000004074000-memory.dmpFilesize
16KB
-
memory/1408-0-0x0000000003280000-0x0000000003284000-memory.dmpFilesize
16KB
-
memory/1408-32-0x0000000002180000-0x0000000002184000-memory.dmpFilesize
16KB