formbook | 9de1892b227f07e8896b3dfa4d1f8b450bf2af962b1ec34f3075acc7a4187259

General

Target

SecuriteInfo.com.Gen.Variant.Androm.29.9877.8691.msi
Size

252KB
MD5

e329a2ae51067a9ae8a508fb7dd34ca8
SHA1

e2371038a5cac558e52297cb808ead02c2150c36
SHA256

9de1892b227f07e8896b3dfa4d1f8b450bf2af962b1ec34f3075acc7a4187259
SHA512

e76add738078a81d9465e0e9f40638dc385b9909428d684d5048ae3c6549de040012d8a2310f05e10e94cef4528d3e08490a96774dbb848003ef31f70886febc

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

C2

http://www.111bjs.com/ccr/

Decoy

abdullahlodhi.com

jevya.com

knoxvillerestaurant.com

mekarauroko7389.com

cricketspowder.net

johannchirinos.com

orangeorganical.com

libero-tt.com

lorenaegianluca.com

wintab.net

modernmillievintage.com

zgdqcyw.com

jeffabildgaardmd.com

nurulfikrimakassar.com

findyourchef.com

innovationsservicegroup.com

destek-taleplerimiz.com

whfqqco.icu

kosmetikmadeingermany.com

dieteticos.net

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1636-69-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/1404-76-0x0000000000080000-0x00000000000AE000-memory.dmp	formbook

Executes dropped EXE 2 IoCs

Processes:

MSI8EE9.tmpMSI8EE9.tmp

pid process

1736 MSI8EE9.tmp
1636 MSI8EE9.tmp
Loads dropped DLL 1 IoCs

Processes:

MSI8EE9.tmp

pid process

1736 MSI8EE9.tmp

pid	process
1736	MSI8EE9.tmp
1636	MSI8EE9.tmp

pid	process
1736	MSI8EE9.tmp

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

MSI8EE9.tmpMSI8EE9.tmpchkdsk.exe

description	pid	process	target process
PID 1736 set thread context of 1636	1736	MSI8EE9.tmp	MSI8EE9.tmp
PID 1636 set thread context of 1196	1636	MSI8EE9.tmp	Explorer.EXE
PID 1404 set thread context of 1196	1404	chkdsk.exe	Explorer.EXE

Drops file in Windows directory 10 IoCs

Processes:

msiexec.exeDrvInst.exe

description	ioc	process
File created	C:\Windows\Installer\f748b8f.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\f748b8f.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\Installer\f748b8d.msi	msiexec.exe
File created	C:\Windows\Installer\f748b8d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8E3B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8EE9.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 6 IoCs

installer

Processes:

resource	yara_rule
C:\Windows\Installer\MSI8EE9.tmp	nsis_installer_1
C:\Windows\Installer\MSI8EE9.tmp	nsis_installer_2
C:\Windows\Installer\MSI8EE9.tmp	nsis_installer_1
C:\Windows\Installer\MSI8EE9.tmp	nsis_installer_2
C:\Windows\Installer\MSI8EE9.tmp	nsis_installer_1
C:\Windows\Installer\MSI8EE9.tmp	nsis_installer_2

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

chkdsk.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	chkdsk.exe

Modifies data under HKEY_USERS 44 IoCs

Processes:

DrvInst.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

Processes:

msiexec.exeMSI8EE9.tmpchkdsk.exe

pid	process
2000	msiexec.exe
2000	msiexec.exe
1636	MSI8EE9.tmp
1636	MSI8EE9.tmp
1404	chkdsk.exe
1404	chkdsk.exe
1404	chkdsk.exe
1404	chkdsk.exe
1404	chkdsk.exe
1404	chkdsk.exe
1404	chkdsk.exe
1404	chkdsk.exe
1404	chkdsk.exe
1404	chkdsk.exe
1404	chkdsk.exe
1404	chkdsk.exe
1404	chkdsk.exe
1404	chkdsk.exe
1404	chkdsk.exe
1404	chkdsk.exe
1404	chkdsk.exe
1404	chkdsk.exe
1404	chkdsk.exe
1404	chkdsk.exe
1404	chkdsk.exe
1404	chkdsk.exe
1404	chkdsk.exe
1404	chkdsk.exe
1404	chkdsk.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1196 Explorer.EXE
Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

MSI8EE9.tmpMSI8EE9.tmpchkdsk.exe

pid process

1736 MSI8EE9.tmp
1636 MSI8EE9.tmp
1636 MSI8EE9.tmp
1636 MSI8EE9.tmp
1404 chkdsk.exe
1404 chkdsk.exe

pid	process
1196	Explorer.EXE

pid	process
1736	MSI8EE9.tmp
1636	MSI8EE9.tmp
1636	MSI8EE9.tmp
1636	MSI8EE9.tmp
1404	chkdsk.exe
1404	chkdsk.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exeDrvInst.exeMSI8EE9.tmpExplorer.EXEchkdsk.exe

description	pid	process
Token: SeShutdownPrivilege	484	msiexec.exe
Token: SeIncreaseQuotaPrivilege	484	msiexec.exe
Token: SeRestorePrivilege	2000	msiexec.exe
Token: SeTakeOwnershipPrivilege	2000	msiexec.exe
Token: SeSecurityPrivilege	2000	msiexec.exe
Token: SeCreateTokenPrivilege	484	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	484	msiexec.exe
Token: SeLockMemoryPrivilege	484	msiexec.exe
Token: SeIncreaseQuotaPrivilege	484	msiexec.exe
Token: SeMachineAccountPrivilege	484	msiexec.exe
Token: SeTcbPrivilege	484	msiexec.exe
Token: SeSecurityPrivilege	484	msiexec.exe
Token: SeTakeOwnershipPrivilege	484	msiexec.exe
Token: SeLoadDriverPrivilege	484	msiexec.exe
Token: SeSystemProfilePrivilege	484	msiexec.exe
Token: SeSystemtimePrivilege	484	msiexec.exe
Token: SeProfSingleProcessPrivilege	484	msiexec.exe
Token: SeIncBasePriorityPrivilege	484	msiexec.exe
Token: SeCreatePagefilePrivilege	484	msiexec.exe
Token: SeCreatePermanentPrivilege	484	msiexec.exe
Token: SeBackupPrivilege	484	msiexec.exe
Token: SeRestorePrivilege	484	msiexec.exe
Token: SeShutdownPrivilege	484	msiexec.exe
Token: SeDebugPrivilege	484	msiexec.exe
Token: SeAuditPrivilege	484	msiexec.exe
Token: SeSystemEnvironmentPrivilege	484	msiexec.exe
Token: SeChangeNotifyPrivilege	484	msiexec.exe
Token: SeRemoteShutdownPrivilege	484	msiexec.exe
Token: SeUndockPrivilege	484	msiexec.exe
Token: SeSyncAgentPrivilege	484	msiexec.exe
Token: SeEnableDelegationPrivilege	484	msiexec.exe
Token: SeManageVolumePrivilege	484	msiexec.exe
Token: SeImpersonatePrivilege	484	msiexec.exe
Token: SeCreateGlobalPrivilege	484	msiexec.exe
Token: SeBackupPrivilege	1796	vssvc.exe
Token: SeRestorePrivilege	1796	vssvc.exe
Token: SeAuditPrivilege	1796	vssvc.exe
Token: SeBackupPrivilege	2000	msiexec.exe
Token: SeRestorePrivilege	2000	msiexec.exe
Token: SeRestorePrivilege	956	DrvInst.exe
Token: SeRestorePrivilege	956	DrvInst.exe
Token: SeRestorePrivilege	956	DrvInst.exe
Token: SeRestorePrivilege	956	DrvInst.exe
Token: SeRestorePrivilege	956	DrvInst.exe
Token: SeRestorePrivilege	956	DrvInst.exe
Token: SeRestorePrivilege	956	DrvInst.exe
Token: SeLoadDriverPrivilege	956	DrvInst.exe
Token: SeLoadDriverPrivilege	956	DrvInst.exe
Token: SeLoadDriverPrivilege	956	DrvInst.exe
Token: SeRestorePrivilege	2000	msiexec.exe
Token: SeTakeOwnershipPrivilege	2000	msiexec.exe
Token: SeRestorePrivilege	2000	msiexec.exe
Token: SeTakeOwnershipPrivilege	2000	msiexec.exe
Token: SeRestorePrivilege	2000	msiexec.exe
Token: SeTakeOwnershipPrivilege	2000	msiexec.exe
Token: SeRestorePrivilege	2000	msiexec.exe
Token: SeTakeOwnershipPrivilege	2000	msiexec.exe
Token: SeDebugPrivilege	1636	MSI8EE9.tmp
Token: SeRestorePrivilege	2000	msiexec.exe
Token: SeTakeOwnershipPrivilege	2000	msiexec.exe
Token: SeRestorePrivilege	2000	msiexec.exe
Token: SeTakeOwnershipPrivilege	2000	msiexec.exe
Token: SeShutdownPrivilege	1196	Explorer.EXE
Token: SeDebugPrivilege	1404	chkdsk.exe

Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

msiexec.exeExplorer.EXE

pid process

484 msiexec.exe
484 msiexec.exe
1196 Explorer.EXE
1196 Explorer.EXE
1196 Explorer.EXE
1196 Explorer.EXE
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

Explorer.EXE

pid process

1196 Explorer.EXE
1196 Explorer.EXE
1196 Explorer.EXE
1196 Explorer.EXE

pid	process
484	msiexec.exe
484	msiexec.exe
1196	Explorer.EXE
1196	Explorer.EXE
1196	Explorer.EXE
1196	Explorer.EXE

pid	process
1196	Explorer.EXE
1196	Explorer.EXE
1196	Explorer.EXE
1196	Explorer.EXE

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

msiexec.exeMSI8EE9.tmpExplorer.EXEchkdsk.exe

description	pid	process	target process
PID 2000 wrote to memory of 1736	2000	msiexec.exe	MSI8EE9.tmp
PID 2000 wrote to memory of 1736	2000	msiexec.exe	MSI8EE9.tmp
PID 2000 wrote to memory of 1736	2000	msiexec.exe	MSI8EE9.tmp
PID 2000 wrote to memory of 1736	2000	msiexec.exe	MSI8EE9.tmp
PID 1736 wrote to memory of 1636	1736	MSI8EE9.tmp	MSI8EE9.tmp
PID 1736 wrote to memory of 1636	1736	MSI8EE9.tmp	MSI8EE9.tmp
PID 1736 wrote to memory of 1636	1736	MSI8EE9.tmp	MSI8EE9.tmp
PID 1736 wrote to memory of 1636	1736	MSI8EE9.tmp	MSI8EE9.tmp
PID 1736 wrote to memory of 1636	1736	MSI8EE9.tmp	MSI8EE9.tmp
PID 1196 wrote to memory of 1404	1196	Explorer.EXE	chkdsk.exe
PID 1196 wrote to memory of 1404	1196	Explorer.EXE	chkdsk.exe
PID 1196 wrote to memory of 1404	1196	Explorer.EXE	chkdsk.exe
PID 1196 wrote to memory of 1404	1196	Explorer.EXE	chkdsk.exe
PID 1404 wrote to memory of 1224	1404	chkdsk.exe	cmd.exe
PID 1404 wrote to memory of 1224	1404	chkdsk.exe	cmd.exe
PID 1404 wrote to memory of 1224	1404	chkdsk.exe	cmd.exe
PID 1404 wrote to memory of 1224	1404	chkdsk.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Windows\system32\msiexec.exe
  msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Gen.Variant.Androm.29.9877.8691.msi
  2⤵
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:484
- C:\Windows\SysWOW64\chkdsk.exe
  "C:\Windows\SysWOW64\chkdsk.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1404
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Windows\Installer\MSI8EE9.tmp"
    3⤵
    PID:1224

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\Installer\MSI8EE9.tmp
  "C:\Windows\Installer\MSI8EE9.tmp"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1736
- - C:\Windows\Installer\MSI8EE9.tmp
    "C:\Windows\Installer\MSI8EE9.tmp"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:1636

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1796

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot12" "" "" "6d110b0a3" "0000000000000000" "00000000000005A8" "000000000000005C"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:956

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Installer\MSI8EE9.tmp

MD5
d8a19f13154e81e9d526077422655453

SHA1
573e6aed1534203b36f9a8e5121c125b02e11b0f

SHA256
b525832c63ea5d05a8afde822fcb39e5fb759497e7c2c986a5673fec721ed853

SHA512
193344e672c7fb66fbd6acc2608c1d9acf360091ddf8086e5609e5a8ed511e1117fc2b7eb7cb43b56e984bf9f98f6a7648f8f1b0defc1416b2dca3c557ae39ae

Download Submit
C:\Windows\Installer\MSI8EE9.tmp

MD5
d8a19f13154e81e9d526077422655453

SHA1
573e6aed1534203b36f9a8e5121c125b02e11b0f

SHA256
b525832c63ea5d05a8afde822fcb39e5fb759497e7c2c986a5673fec721ed853

SHA512
193344e672c7fb66fbd6acc2608c1d9acf360091ddf8086e5609e5a8ed511e1117fc2b7eb7cb43b56e984bf9f98f6a7648f8f1b0defc1416b2dca3c557ae39ae

Download Submit
C:\Windows\Installer\MSI8EE9.tmp

MD5
d8a19f13154e81e9d526077422655453

SHA1
573e6aed1534203b36f9a8e5121c125b02e11b0f

SHA256
b525832c63ea5d05a8afde822fcb39e5fb759497e7c2c986a5673fec721ed853

SHA512
193344e672c7fb66fbd6acc2608c1d9acf360091ddf8086e5609e5a8ed511e1117fc2b7eb7cb43b56e984bf9f98f6a7648f8f1b0defc1416b2dca3c557ae39ae

Download Submit
\Users\Admin\AppData\Local\Temp\nss903F.tmp\3dd73lht.dll

MD5
df8beafa8d4250032a73e261c80e35e3

SHA1
3ced0abd9f02d24d79ede5052f661108b01df997

SHA256
a57717b0b91bb128761a4363d12cacd45431c7e512d5a8d307b40cf30e6a26da

SHA512
bf9fd7009e3c4919b2b230748c8f3795423b4e7e57d82d531a31682916dfb589c2df2b20320a51b532e21dec98ce597a4a80589ec5fa442417274661e1c9d1ce

Download Submit
memory/484-59-0x000007FEFB761000-0x000007FEFB763000-memory.dmp

Filesize
8KB

Download
memory/1196-79-0x0000000006050000-0x000000000614C000-memory.dmp

Filesize
1008KB

Download
memory/1196-72-0x0000000004280000-0x000000000433C000-memory.dmp

Filesize
752KB

Download
memory/1224-74-0x0000000000000000-mapping.dmp

Download
memory/1404-76-0x0000000000080000-0x00000000000AE000-memory.dmp

Filesize
184KB

Download
memory/1404-73-0x0000000000000000-mapping.dmp

Download
memory/1404-77-0x0000000002150000-0x0000000002453000-memory.dmp

Filesize
3.0MB

Download
memory/1404-75-0x00000000002C0000-0x00000000002C7000-memory.dmp

Filesize
28KB

Download
memory/1404-78-0x0000000001F20000-0x0000000001FB3000-memory.dmp

Filesize
588KB

Download
memory/1636-70-0x0000000000910000-0x0000000000C13000-memory.dmp

Filesize
3.0MB

Download
memory/1636-71-0x0000000000350000-0x0000000000364000-memory.dmp

Filesize
80KB

Download
memory/1636-67-0x000000000041EBB0-mapping.dmp

Download
memory/1636-69-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1736-66-0x0000000000380000-0x0000000000382000-memory.dmp

Filesize
8KB

Download
memory/1736-63-0x0000000075AD1000-0x0000000075AD3000-memory.dmp

Filesize
8KB

Download
memory/1736-61-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads