Analysis
-
max time kernel
107s -
max time network
93s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
09-11-2020 20:15
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Java.Ratty.2.16669.26428.msi
Resource
win7v20201028
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Java.Ratty.2.16669.26428.msi
Resource
win10v20201028
General
-
Target
SecuriteInfo.com.Java.Ratty.2.16669.26428.msi
-
Size
382KB
-
MD5
aa3ff63ab96d65c389f21ccd788f3f3d
-
SHA1
a8c88243d07e4293a543ab0ab98618c793e7f3db
-
SHA256
cae5dae2e0d582b80b5029fc3c89f8497badeccf6750d8dceefa47029fae3b0f
-
SHA512
9082dd93744e3ba338cd138736f6c186fefe4914fa57218b33cbd67b027ece64e1070d2cc1c72e2e5742d8e5d666193c137661897765596660d4fb1761584437
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc process File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe -
Modifies service 2 TTPs 149 IoCs
Processes:
vssvc.exemsiexec.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\BACKUPSHUTDOWN (Enter) = 4800000000000000504f27b771b7d60194050000c8070000fb03000001000000050000000000000003c6a0e83ac3b4489124408662a9c24800000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore\SrCreateRp (Leave) = 4800000000000000307326b471b7d601d406000060020000d507000001000000000000000a0100810000000000000000000000000000000000000000000000000000000000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer\PREPAREBACKUP (Enter) = 480000000000000050ad53b471b7d60194050000ec020000e903000001000000010000000000000003c6a0e83ac3b4489124408662a9c24800000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer\VSS_WS_WAITING_FOR_BACKUP_COMPLETE (SetCurrentState) = 4800000000000000701b96b671b7d60194050000c80700000500000001000000040000000000000003c6a0e83ac3b4489124408662a9c24800000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}\PROVIDER_PRECOMMIT (Leave) = 48000000000000003070dcb571b7d601940500006c0600000304000000000000000000000000000003c6a0e83ac3b4489124408662a9c24800000000000000000000000000000000 vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore msiexec.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Lovelace(__?_Volume{495fd7e4-1989-11eb-abf9-806e6f6e6963}_) vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer\GETSTATE (Enter) = 480000000000000070d15ab471b7d6019405000068020000f903000001000000010000000000000003c6a0e83ac3b4489124408662a9c24800000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}\PROVIDER_PRECOMMIT (Enter) = 48000000000000003070dcb571b7d601940500006c0600000304000001000000000000000000000003c6a0e83ac3b4489124408662a9c24800000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore\SrCreateRp (Leave) = 480000000000000050b51cb671b7d601d406000060020000d50700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}\PROVIDER_POSTFINALCOMMIT (Enter) = 4800000000000000d087abb671b7d601940500006c0600000704000001000000000000000000000003c6a0e83ac3b4489124408662a9c24800000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\BKGND_FREEZE_THREAD (Enter) = 480000000000000070818bb571b7d60194050000c0070000fc03000001000000030000000000000003c6a0e83ac3b4489124408662a9c24800000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace\OPEN_VOLUME_HANDLE (Enter) = 48000000000000003070dcb571b7d601940500006c060000fd03000001000000000000000000000003c6a0e83ac3b4489124408662a9c24800000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}\PROVIDER_POSTCOMMIT (Leave) = 4800000000000000f0531ab671b7d601940500006c0600000504000000000000000000000000000003c6a0e83ac3b4489124408662a9c24800000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer\IDENTIFY (Enter) = 480000000000000090c915b471b7d6019405000068020000e80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\ASR Writer\IDENTIFY (Enter) = 480000000000000090df3bb471b7d60194050000ec020000e80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}\PROVIDER_BEGINPREPARE (Leave) = 4800000000000000d0274ab471b7d60194050000680200000104000000000000000000000000000003c6a0e83ac3b4489124408662a9c24800000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\THAW (Enter) = 4800000000000000f0531ab671b7d601940500006c060000f203000001000000000000000000000003c6a0e83ac3b4489124408662a9c24800000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}\PROVIDER_POSTFINALCOMMIT (Leave) = 4800000000000000705d08b771b7d601940500006c0600000704000000000000000000000000000003c6a0e83ac3b4489124408662a9c24800000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP\SppGatherWriterMetadata (Enter) = 4800000000000000b0e209b471b7d601d406000060020000d30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace\IOCTL_RELEASE (Leave) = 4800000000000000f0531ab671b7d601940500006c060000ff0300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}\PROVIDER_POSTCOMMIT (Enter) = 4800000000000000f0531ab671b7d601940500006c0600000504000001000000000000000000000003c6a0e83ac3b4489124408662a9c24800000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer\BKGND_FREEZE_THREAD (Enter) = 4800000000000000b0c999b571b7d60194050000b4070000fc03000001000000030000000000000003c6a0e83ac3b4489124408662a9c24800000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\IDENTIFY (Leave) = 4800000000000000508c1ab471b7d6019405000060050000e80300000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\PREPAREBACKUP (Leave) = 4800000000000000b00e56b471b7d6019405000030010000e903000000000000010000000000000003c6a0e83ac3b4489124408662a9c24800000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\FREEZE_FRONT (Enter) = 4800000000000000f0fb81b571b7d601940500006c060000ec03000001000000000000000000000003c6a0e83ac3b4489124408662a9c24800000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\ASR Writer\IDENTIFY (Leave) = 480000000000000070b021b471b7d6019405000030010000e80300000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer\VSS_WS_WAITING_FOR_BACKUP_COMPLETE (SetCurrentState) = 4800000000000000d07c98b671b7d60194050000bc0700000500000001000000040000000000000003c6a0e83ac3b4489124408662a9c24800000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\POSTSNAPSHOT (Leave) = 4800000000000000d087abb671b7d60194050000f8070000f503000000000000040000000000000003c6a0e83ac3b4489124408662a9c24800000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\PREPARESNAPSHOT (Enter) = 4800000000000000b0a860b571b7d60194050000bc070000ea03000001000000010000000000000003c6a0e83ac3b4489124408662a9c24800000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\FREEZE (Enter) = 4800000000000000f0fb81b571b7d601940500006c060000eb03000001000000000000000000000003c6a0e83ac3b4489124408662a9c24800000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\FREEZE_KTM (Leave) = 4800000000000000b0c999b571b7d601940500006c060000f003000000000000000000000000000003c6a0e83ac3b4489124408662a9c24800000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace\IOCTL_RELEASE (Enter) = 4800000000000000f0531ab671b7d601940500006c060000ff0300000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer\IDENTIFY (Enter) = 4800000000000000f0403eb471b7d6019405000068020000e80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer\VSS_WS_STABLE (SetCurrentState) = 4800000000000000b00e56b471b7d60194050000ec0200000100000001000000010000000000000003c6a0e83ac3b4489124408662a9c24800000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer\BKGND_FREEZE_THREAD (Leave) = 480000000000000090fd2ab671b7d6019405000050060000fc03000000000000030000000000000003c6a0e83ac3b4489124408662a9c24800000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\BKGND_FREEZE_THREAD (Leave) = 480000000000000090fd2ab671b7d60194050000c0070000fc03000000000000030000000000000003c6a0e83ac3b4489124408662a9c24800000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\VSS_WS_WAITING_FOR_BACKUP_COMPLETE (SetCurrentState) = 4800000000000000d087abb671b7d60194050000f80700000500000001000000040000000000000003c6a0e83ac3b4489124408662a9c24800000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher\IDENTIFY (Leave) = 480000000000000070b021b471b7d601d4060000d4030000e80300000000000000000000000204000379713f99e4d1428bb87c6989481bcd00000000000000000000000000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\FREEZE_SYSTEM (Enter) = 480000000000000090a592b571b7d601940500006c060000ee03000001000000000000000000000003c6a0e83ac3b4489124408662a9c24800000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\FREEZE (Leave) = 48000000000000003070dcb571b7d601940500006c060000eb03000000000000000000000000000003c6a0e83ac3b4489124408662a9c24800000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\IDENTIFY (Enter) = 480000000000000090c915b471b7d6019405000060050000e80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\THAW (Leave) = 480000000000000090fd2ab671b7d601940500006c060000f203000000000000000000000000000003c6a0e83ac3b4489124408662a9c24800000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\BACKUPSHUTDOWN (Leave) = 4800000000000000b0b029b771b7d601940500006c060000fb03000000000000000000000000000003c6a0e83ac3b4489124408662a9c24800000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\POSTSNAPSHOT (Enter) = 480000000000000050ec7bb671b7d601940500006c060000f503000001000000000000000000000003c6a0e83ac3b4489124408662a9c24800000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer\IDENTIFY (Leave) = 4800000000000000f0403eb471b7d6019405000060050000e80300000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\FREEZE_RM (Leave) = 48000000000000003070dcb571b7d601940500006c060000ef03000000000000000000000000000003c6a0e83ac3b4489124408662a9c24800000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace\IOCTL_FLUSH_AND_HOLD (Leave) = 4800000000000000f0531ab671b7d601940500006c060000fe03000000000000000000000000000003c6a0e83ac3b4489124408662a9c24800000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer\VSS_WS_WAITING_FOR_FREEZE (SetCurrentState) = 4800000000000000f0fb81b571b7d60194050000f80700000200000001000000010000000000000003c6a0e83ac3b4489124408662a9c24800000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\FREEZE_KTM (Enter) = 4800000000000000b0c999b571b7d601940500006c060000f003000001000000000000000000000003c6a0e83ac3b4489124408662a9c24800000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\THAW_KTM (Leave) = 4800000000000000f0531ab671b7d601940500006c060000f403000000000000000000000000000003c6a0e83ac3b4489124408662a9c24800000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace(__?_Volume{495fd7e4-1989-11eb-abf9-806e6f6e6963}_)\IOCTL_FLUSH_AND_HOLD (Enter) = 4800000000000000106d0eb671b7d6019405000054060000fe03000001000000000000000000000003c6a0e83ac3b4489124408662a9c24800000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\THAW_KTM (Enter) = 4800000000000000f0531ab671b7d601940500006c060000f403000001000000000000000000000003c6a0e83ac3b4489124408662a9c24800000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer\THAW (Leave) = 480000000000000090fd2ab671b7d60194050000f8070000f203000000000000030000000000000003c6a0e83ac3b4489124408662a9c24800000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer\GETSTATE (Leave) = 4800000000000000d0325db471b7d6019405000068020000f903000000000000010000000000000003c6a0e83ac3b4489124408662a9c24800000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer\VSS_WS_WAITING_FOR_THAW (SetCurrentState) = 4800000000000000b0c999b571b7d60194050000f80700000300000001000000020000000000000003c6a0e83ac3b4489124408662a9c24800000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\FREEZE_SYSTEM (Leave) = 4800000000000000b0c999b571b7d601940500006c060000ee03000000000000000000000000000003c6a0e83ac3b4489124408662a9c24800000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher\IDENTIFY (Enter) = 480000000000000070a50eb471b7d601d4060000d4030000e80300000100000000000000000000000379713f99e4d1428bb87c6989481bcd00000000000000000000000000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer\IDENTIFY (Leave) = 4800000000000000f0403eb471b7d6019405000068020000e80300000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer\PREPAREBACKUP (Enter) = 4800000000000000f04b51b471b7d6019405000068020000e903000001000000010000000000000003c6a0e83ac3b4489124408662a9c24800000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\FREEZE (Enter) = 4800000000000000102089b571b7d60194050000bc070000eb03000001000000020000000000000003c6a0e83ac3b4489124408662a9c24800000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer\FREEZE (Leave) = 4800000000000000b0c999b571b7d60194050000f8070000eb03000000000000020000000000000003c6a0e83ac3b4489124408662a9c24800000000000000000000000000000000 vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP msiexec.exe -
Drops file in Windows directory 8 IoCs
Processes:
msiexec.exeDrvInst.exedescription ioc process File opened for modification C:\Windows\Installer\MSI2ACA.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\f7428a6.msi msiexec.exe File opened for modification C:\Windows\Installer\f7428a6.msi msiexec.exe File created C:\Windows\Installer\f7428a8.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe -
Modifies data under HKEY_USERS 44 IoCs
Processes:
DrvInst.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
msiexec.exepid process 1748 msiexec.exe 1748 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
msiexec.exepid process 784 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 57 IoCs
Processes:
msiexec.exemsiexec.exevssvc.exeDrvInst.exedescription pid process Token: SeShutdownPrivilege 784 msiexec.exe Token: SeIncreaseQuotaPrivilege 784 msiexec.exe Token: SeRestorePrivilege 1748 msiexec.exe Token: SeTakeOwnershipPrivilege 1748 msiexec.exe Token: SeSecurityPrivilege 1748 msiexec.exe Token: SeCreateTokenPrivilege 784 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 784 msiexec.exe Token: SeLockMemoryPrivilege 784 msiexec.exe Token: SeIncreaseQuotaPrivilege 784 msiexec.exe Token: SeMachineAccountPrivilege 784 msiexec.exe Token: SeTcbPrivilege 784 msiexec.exe Token: SeSecurityPrivilege 784 msiexec.exe Token: SeTakeOwnershipPrivilege 784 msiexec.exe Token: SeLoadDriverPrivilege 784 msiexec.exe Token: SeSystemProfilePrivilege 784 msiexec.exe Token: SeSystemtimePrivilege 784 msiexec.exe Token: SeProfSingleProcessPrivilege 784 msiexec.exe Token: SeIncBasePriorityPrivilege 784 msiexec.exe Token: SeCreatePagefilePrivilege 784 msiexec.exe Token: SeCreatePermanentPrivilege 784 msiexec.exe Token: SeBackupPrivilege 784 msiexec.exe Token: SeRestorePrivilege 784 msiexec.exe Token: SeShutdownPrivilege 784 msiexec.exe Token: SeDebugPrivilege 784 msiexec.exe Token: SeAuditPrivilege 784 msiexec.exe Token: SeSystemEnvironmentPrivilege 784 msiexec.exe Token: SeChangeNotifyPrivilege 784 msiexec.exe Token: SeRemoteShutdownPrivilege 784 msiexec.exe Token: SeUndockPrivilege 784 msiexec.exe Token: SeSyncAgentPrivilege 784 msiexec.exe Token: SeEnableDelegationPrivilege 784 msiexec.exe Token: SeManageVolumePrivilege 784 msiexec.exe Token: SeImpersonatePrivilege 784 msiexec.exe Token: SeCreateGlobalPrivilege 784 msiexec.exe Token: SeBackupPrivilege 1428 vssvc.exe Token: SeRestorePrivilege 1428 vssvc.exe Token: SeAuditPrivilege 1428 vssvc.exe Token: SeBackupPrivilege 1748 msiexec.exe Token: SeRestorePrivilege 1748 msiexec.exe Token: SeRestorePrivilege 884 DrvInst.exe Token: SeRestorePrivilege 884 DrvInst.exe Token: SeRestorePrivilege 884 DrvInst.exe Token: SeRestorePrivilege 884 DrvInst.exe Token: SeRestorePrivilege 884 DrvInst.exe Token: SeRestorePrivilege 884 DrvInst.exe Token: SeRestorePrivilege 884 DrvInst.exe Token: SeLoadDriverPrivilege 884 DrvInst.exe Token: SeLoadDriverPrivilege 884 DrvInst.exe Token: SeLoadDriverPrivilege 884 DrvInst.exe Token: SeRestorePrivilege 1748 msiexec.exe Token: SeTakeOwnershipPrivilege 1748 msiexec.exe Token: SeRestorePrivilege 1748 msiexec.exe Token: SeTakeOwnershipPrivilege 1748 msiexec.exe Token: SeRestorePrivilege 1748 msiexec.exe Token: SeTakeOwnershipPrivilege 1748 msiexec.exe Token: SeRestorePrivilege 1748 msiexec.exe Token: SeTakeOwnershipPrivilege 1748 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
msiexec.exepid process 784 msiexec.exe
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Java.Ratty.2.16669.26428.msi1⤵
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:784
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Modifies service
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1748
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:1428
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot12" "" "" "6d110b0a3" "0000000000000000" "00000000000005A8" "00000000000003B8"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:884
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD59059bbcaec8405563e1ed187344ecf73
SHA17a69f8be92075cadb18dc2278b9fa5a60a0f93dd
SHA25616b10c2a58b35ac463be8a03f5502ed14328824bed0ba2d75b564e334cfd8b28
SHA512c0439a8f97d16861a0b66ce70b2932d217c334ee64ddf9bbcfc32311f90a48ea834f6ca5910887669168f888071d19618730dbe49ad614d0833d73ca922f5c31