formbook | a7338368a74ea858b07c282d8a0bbff371f6154c9140d34d74311e0d3e1f15c0

General

Target

ghy87ck.msi
Size

240KB
MD5

9c65bfe1486bdf4451757715342f481a
SHA1

80196fcf884163d6daba116ae6ced64797ea5675
SHA256

a7338368a74ea858b07c282d8a0bbff371f6154c9140d34d74311e0d3e1f15c0
SHA512

f18d2ded359b3835d2b75f08af4ad389cc872d5efc478c06bdd4a19d980bdf8276522eb9db516387fb599985f295569dda14eace871fafbf4dc7f92610982031

Score

10^/10

formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

C2

http://www.craftsman-vail.com/cca/

Decoy

whenpigsflyhigh.com

artistiklounge.com

tinytrendstique.com

projektpartner-ag.com

charvelevh.com

easycompliances.net

zengheqiye.com

professionalmallorca.com

bonzerstudio.com

nelivo.com

yangxeric.com

aredntech.com

twincitieshousingmarket.com

allshadesunscreen.com

xiang-life.net

qmcp00011.com

lindsayeandmarkv.com

fbcsbvsbvsjbvjs.com

saveonthrivelife.com

newdpo.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1308-69-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/1716-76-0x0000000000080000-0x00000000000AE000-memory.dmp	formbook

Executes dropped EXE 2 IoCs

Processes:

MSI99D1.tmpMSI99D1.tmp

pid process

1420 MSI99D1.tmp
1308 MSI99D1.tmp
Loads dropped DLL 1 IoCs

Processes:

MSI99D1.tmp

pid process

1420 MSI99D1.tmp

pid	process
1420	MSI99D1.tmp
1308	MSI99D1.tmp

pid	process
1420	MSI99D1.tmp

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

MSI99D1.tmpMSI99D1.tmpipconfig.exe

description	pid	process	target process
PID 1420 set thread context of 1308	1420	MSI99D1.tmp	MSI99D1.tmp
PID 1308 set thread context of 1256	1308	MSI99D1.tmp	Explorer.EXE
PID 1716 set thread context of 1256	1716	ipconfig.exe	Explorer.EXE

Drops file in Windows directory 10 IoCs

Processes:

msiexec.exeDrvInst.exe

description	ioc	process
File created	C:\Windows\Installer\f749771.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9953.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI99D1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f749771.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\f74976f.msi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\f74976f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 6 IoCs

installer

Processes:

resource	yara_rule
C:\Windows\Installer\MSI99D1.tmp	nsis_installer_1
C:\Windows\Installer\MSI99D1.tmp	nsis_installer_2
C:\Windows\Installer\MSI99D1.tmp	nsis_installer_1
C:\Windows\Installer\MSI99D1.tmp	nsis_installer_2
C:\Windows\Installer\MSI99D1.tmp	nsis_installer_1
C:\Windows\Installer\MSI99D1.tmp	nsis_installer_2

Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command-Line Interface
T1059

Processes:

ipconfig.exe

pid process

1716 ipconfig.exe

pid	process
1716	ipconfig.exe

Modifies data under HKEY_USERS 44 IoCs

Processes:

DrvInst.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

Processes:

msiexec.exeMSI99D1.tmpipconfig.exe

pid	process
1172	msiexec.exe
1172	msiexec.exe
1308	MSI99D1.tmp
1308	MSI99D1.tmp
1716	ipconfig.exe
1716	ipconfig.exe
1716	ipconfig.exe
1716	ipconfig.exe
1716	ipconfig.exe
1716	ipconfig.exe
1716	ipconfig.exe
1716	ipconfig.exe
1716	ipconfig.exe
1716	ipconfig.exe
1716	ipconfig.exe
1716	ipconfig.exe
1716	ipconfig.exe
1716	ipconfig.exe
1716	ipconfig.exe
1716	ipconfig.exe
1716	ipconfig.exe
1716	ipconfig.exe
1716	ipconfig.exe
1716	ipconfig.exe
1716	ipconfig.exe
1716	ipconfig.exe
1716	ipconfig.exe
1716	ipconfig.exe
1716	ipconfig.exe
1716	ipconfig.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1256 Explorer.EXE
Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

MSI99D1.tmpMSI99D1.tmpipconfig.exe

pid process

1420 MSI99D1.tmp
1308 MSI99D1.tmp
1308 MSI99D1.tmp
1308 MSI99D1.tmp
1716 ipconfig.exe
1716 ipconfig.exe

pid	process
1256	Explorer.EXE

pid	process
1420	MSI99D1.tmp
1308	MSI99D1.tmp
1308	MSI99D1.tmp
1308	MSI99D1.tmp
1716	ipconfig.exe
1716	ipconfig.exe

Suspicious use of AdjustPrivilegeToken 63 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exeDrvInst.exeMSI99D1.tmpipconfig.exe

description	pid	process
Token: SeShutdownPrivilege	2028	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2028	msiexec.exe
Token: SeRestorePrivilege	1172	msiexec.exe
Token: SeTakeOwnershipPrivilege	1172	msiexec.exe
Token: SeSecurityPrivilege	1172	msiexec.exe
Token: SeCreateTokenPrivilege	2028	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2028	msiexec.exe
Token: SeLockMemoryPrivilege	2028	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2028	msiexec.exe
Token: SeMachineAccountPrivilege	2028	msiexec.exe
Token: SeTcbPrivilege	2028	msiexec.exe
Token: SeSecurityPrivilege	2028	msiexec.exe
Token: SeTakeOwnershipPrivilege	2028	msiexec.exe
Token: SeLoadDriverPrivilege	2028	msiexec.exe
Token: SeSystemProfilePrivilege	2028	msiexec.exe
Token: SeSystemtimePrivilege	2028	msiexec.exe
Token: SeProfSingleProcessPrivilege	2028	msiexec.exe
Token: SeIncBasePriorityPrivilege	2028	msiexec.exe
Token: SeCreatePagefilePrivilege	2028	msiexec.exe
Token: SeCreatePermanentPrivilege	2028	msiexec.exe
Token: SeBackupPrivilege	2028	msiexec.exe
Token: SeRestorePrivilege	2028	msiexec.exe
Token: SeShutdownPrivilege	2028	msiexec.exe
Token: SeDebugPrivilege	2028	msiexec.exe
Token: SeAuditPrivilege	2028	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2028	msiexec.exe
Token: SeChangeNotifyPrivilege	2028	msiexec.exe
Token: SeRemoteShutdownPrivilege	2028	msiexec.exe
Token: SeUndockPrivilege	2028	msiexec.exe
Token: SeSyncAgentPrivilege	2028	msiexec.exe
Token: SeEnableDelegationPrivilege	2028	msiexec.exe
Token: SeManageVolumePrivilege	2028	msiexec.exe
Token: SeImpersonatePrivilege	2028	msiexec.exe
Token: SeCreateGlobalPrivilege	2028	msiexec.exe
Token: SeBackupPrivilege	1888	vssvc.exe
Token: SeRestorePrivilege	1888	vssvc.exe
Token: SeAuditPrivilege	1888	vssvc.exe
Token: SeBackupPrivilege	1172	msiexec.exe
Token: SeRestorePrivilege	1172	msiexec.exe
Token: SeRestorePrivilege	1484	DrvInst.exe
Token: SeRestorePrivilege	1484	DrvInst.exe
Token: SeRestorePrivilege	1484	DrvInst.exe
Token: SeRestorePrivilege	1484	DrvInst.exe
Token: SeRestorePrivilege	1484	DrvInst.exe
Token: SeRestorePrivilege	1484	DrvInst.exe
Token: SeRestorePrivilege	1484	DrvInst.exe
Token: SeLoadDriverPrivilege	1484	DrvInst.exe
Token: SeLoadDriverPrivilege	1484	DrvInst.exe
Token: SeLoadDriverPrivilege	1484	DrvInst.exe
Token: SeRestorePrivilege	1172	msiexec.exe
Token: SeTakeOwnershipPrivilege	1172	msiexec.exe
Token: SeRestorePrivilege	1172	msiexec.exe
Token: SeTakeOwnershipPrivilege	1172	msiexec.exe
Token: SeRestorePrivilege	1172	msiexec.exe
Token: SeTakeOwnershipPrivilege	1172	msiexec.exe
Token: SeRestorePrivilege	1172	msiexec.exe
Token: SeTakeOwnershipPrivilege	1172	msiexec.exe
Token: SeRestorePrivilege	1172	msiexec.exe
Token: SeTakeOwnershipPrivilege	1172	msiexec.exe
Token: SeRestorePrivilege	1172	msiexec.exe
Token: SeTakeOwnershipPrivilege	1172	msiexec.exe
Token: SeDebugPrivilege	1308	MSI99D1.tmp
Token: SeDebugPrivilege	1716	ipconfig.exe

Suspicious use of FindShellTrayWindow 8 IoCs

Processes:

msiexec.exeExplorer.EXE

pid process

2028 msiexec.exe
2028 msiexec.exe
1256 Explorer.EXE
1256 Explorer.EXE
1256 Explorer.EXE
1256 Explorer.EXE
1256 Explorer.EXE
1256 Explorer.EXE
Suspicious use of SendNotifyMessage 6 IoCs

Processes:

Explorer.EXE

pid process

1256 Explorer.EXE
1256 Explorer.EXE
1256 Explorer.EXE
1256 Explorer.EXE
1256 Explorer.EXE
1256 Explorer.EXE

pid	process
2028	msiexec.exe
2028	msiexec.exe
1256	Explorer.EXE
1256	Explorer.EXE
1256	Explorer.EXE
1256	Explorer.EXE
1256	Explorer.EXE
1256	Explorer.EXE

pid	process
1256	Explorer.EXE
1256	Explorer.EXE
1256	Explorer.EXE
1256	Explorer.EXE
1256	Explorer.EXE
1256	Explorer.EXE

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

msiexec.exeMSI99D1.tmpExplorer.EXEipconfig.exe

description	pid	process	target process
PID 1172 wrote to memory of 1420	1172	msiexec.exe	MSI99D1.tmp
PID 1172 wrote to memory of 1420	1172	msiexec.exe	MSI99D1.tmp
PID 1172 wrote to memory of 1420	1172	msiexec.exe	MSI99D1.tmp
PID 1172 wrote to memory of 1420	1172	msiexec.exe	MSI99D1.tmp
PID 1420 wrote to memory of 1308	1420	MSI99D1.tmp	MSI99D1.tmp
PID 1420 wrote to memory of 1308	1420	MSI99D1.tmp	MSI99D1.tmp
PID 1420 wrote to memory of 1308	1420	MSI99D1.tmp	MSI99D1.tmp
PID 1420 wrote to memory of 1308	1420	MSI99D1.tmp	MSI99D1.tmp
PID 1420 wrote to memory of 1308	1420	MSI99D1.tmp	MSI99D1.tmp
PID 1256 wrote to memory of 1716	1256	Explorer.EXE	ipconfig.exe
PID 1256 wrote to memory of 1716	1256	Explorer.EXE	ipconfig.exe
PID 1256 wrote to memory of 1716	1256	Explorer.EXE	ipconfig.exe
PID 1256 wrote to memory of 1716	1256	Explorer.EXE	ipconfig.exe
PID 1716 wrote to memory of 808	1716	ipconfig.exe	cmd.exe
PID 1716 wrote to memory of 808	1716	ipconfig.exe	cmd.exe
PID 1716 wrote to memory of 808	1716	ipconfig.exe	cmd.exe
PID 1716 wrote to memory of 808	1716	ipconfig.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1256

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ghy87ck.msi
2⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2028

C:\Windows\SysWOW64\ipconfig.exe
"C:\Windows\SysWOW64\ipconfig.exe"
2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1716

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Windows\Installer\MSI99D1.tmp"
3⤵
PID:808

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1172

C:\Windows\Installer\MSI99D1.tmp
"C:\Windows\Installer\MSI99D1.tmp"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1420

C:\Windows\Installer\MSI99D1.tmp
"C:\Windows\Installer\MSI99D1.tmp"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1308

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1888

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot12" "" "" "6d110b0a3" "0000000000000000" "00000000000003CC" "00000000000005B8"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1484

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

3

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Installer\MSI99D1.tmp
MD5
78df6987b12a77a4d38c4d08665ebe18

SHA1
639595a07bd375349f8371e577252087ffe37247

SHA256
b6e96276c116a1100b52ca6fcb369e22b4faa30bbfd48df68942fae3feffb15e

SHA512
1dea3c04f5bc59171e58ed0a0215b953d38ddb34b9d652735d268b5fce391e65fb45048f69a3da528d20cc06fb9ec1976420f8a842ecd551b24067c637d07d05

Download Submit
C:\Windows\Installer\MSI99D1.tmp
MD5
78df6987b12a77a4d38c4d08665ebe18

SHA1
639595a07bd375349f8371e577252087ffe37247

SHA256
b6e96276c116a1100b52ca6fcb369e22b4faa30bbfd48df68942fae3feffb15e

SHA512
1dea3c04f5bc59171e58ed0a0215b953d38ddb34b9d652735d268b5fce391e65fb45048f69a3da528d20cc06fb9ec1976420f8a842ecd551b24067c637d07d05

Download Submit
C:\Windows\Installer\MSI99D1.tmp
MD5
78df6987b12a77a4d38c4d08665ebe18

SHA1
639595a07bd375349f8371e577252087ffe37247

SHA256
b6e96276c116a1100b52ca6fcb369e22b4faa30bbfd48df68942fae3feffb15e

SHA512
1dea3c04f5bc59171e58ed0a0215b953d38ddb34b9d652735d268b5fce391e65fb45048f69a3da528d20cc06fb9ec1976420f8a842ecd551b24067c637d07d05

Download Submit
\Users\Admin\AppData\Local\Temp\kiyeu.dll
MD5
2ba17e14d1ab840f5ca03ee92996928e

SHA1
eb6be7539a81e28c1a20a82316694ff0d36c25cb

SHA256
db10c9636a7d7aec652d7aea8ab16143793b6a1da1c41f8486babc271e9be69d

SHA512
e12ba3e4e1bc3125fa452408be9d7c56aae497799b1986b93106d473979c795fd47a960f14756070580e045286bc197a1d35787adf796b648b39f68b33501627

Download Submit
memory/808-78-0x0000000000000000-mapping.dmp

Download
memory/1256-72-0x0000000005150000-0x000000000528A000-memory.dmp

Filesize
1.2MB

Download
memory/1256-80-0x0000000007030000-0x0000000007163000-memory.dmp

Filesize
1.2MB

Download
memory/1308-69-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1308-71-0x00000000002D0000-0x00000000002E4000-memory.dmp

Filesize
80KB

Download
memory/1308-70-0x00000000006E0000-0x00000000009E3000-memory.dmp

Filesize
3.0MB

Download
memory/1308-67-0x000000000041EB70-mapping.dmp

Download
memory/1420-64-0x00000000765F1000-0x00000000765F3000-memory.dmp

Filesize
8KB

Download
memory/1420-62-0x0000000000000000-mapping.dmp

Download
memory/1716-73-0x0000000000000000-mapping.dmp

Download
memory/1716-76-0x0000000000080000-0x00000000000AE000-memory.dmp

Filesize
184KB

Download
memory/1716-77-0x00000000020F0000-0x00000000023F3000-memory.dmp

Filesize
3.0MB

Download
memory/1716-75-0x00000000006F0000-0x00000000006FA000-memory.dmp

Filesize
40KB

Download
memory/1716-79-0x0000000001F10000-0x0000000001FA3000-memory.dmp

Filesize
588KB

Download
memory/2028-60-0x000007FEFC411000-0x000007FEFC413000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads