Analysis
- max time kernel
150s - max time network
116s - platform
windows10_x64 - resource
win10v20210410 - submitted
02/08/2021, 14:42
Static task
static1
Behavioral task
behavioral1
Sample
RASTREIO.DIG1TAL.TOZNHYVZMPWAZRMJQQUEOIVDSGAEJJ裆.msi
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
RASTREIO.DIG1TAL.TOZNHYVZMPWAZRMJQQUEOIVDSGAEJJ裆.msi
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target RASTREIO.DIG1TAL.TOZNHYVZMPWAZRMJQQUEOIVDSGAEJJ裆.msi
- Size 281KB
- Sample210802-2tp4epwetj
- SHA256 05e357b691fc3ab35a85142169e3ed5683b248d66217ff445a2060b9a68d12cb
- MD5 d0a3452dbbe093ed3c078016e1ce4f3d
- SHA1 edf904e179693f16932c74af06b2b68d8fa30f06
- SHA512 b45c04d11411ef6594d598c6aef14df3d154ce335a035ca6d82cc5cd0ed309817fbaf38ea3df5d91a2bf56024a5729e2f2fe8cc22fe8b783c13cf3700b1d7d36
- MD5 SHA1 SHA512
Score
9/10
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
- Blocklisted process makes network request 1 IoCs
flow pid Process 8 3792 MsiExec.exe - Executes dropped EXE 1 IoCs
pid Process 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe - Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe - Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZJBZIJSWYH.lnk MsiExec.exe - Loads dropped DLL 5 IoCs
pid Process 3792 MsiExec.exe 3792 MsiExec.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe -
resource yara_rule behavioral2/files/0x000100000001ab7e-165.dat themida behavioral2/files/0x000100000001ab7e-166.dat themida behavioral2/memory/680-174-0x000000006CDA0000-0x000000006F08D000-memory.dmp themida - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\software\Microsoft\Windows\CurrentVersion\Run MsiExec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\ZJBZIJSWYH = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ZJBZIJSWYH.lnk" MsiExec.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 16 ipinfo.io - Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe - Drops file in Windows directory 9 IoCs
description ioc Process File opened for modification C:\Windows\Installer\f7425fc.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI2689.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI28DC.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2A15.tmp msiexec.exe File created C:\Windows\Installer\f7425fc.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{0F58822C-DDF3-47AD-8C8C-E4795590F99A} msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Script User-Agent 3 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 8 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 17 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 19 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2088 msiexec.exe 2088 msiexec.exe 4008 powershell.exe 4008 powershell.exe 4008 powershell.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 680 BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe - Suspicious use of AdjustPrivilegeToken 47 IoCs
description pid Process Token: SeShutdownPrivilege 2204 msiexec.exe Token: SeIncreaseQuotaPrivilege 2204 msiexec.exe Token: SeSecurityPrivilege 2088 msiexec.exe Token: SeCreateTokenPrivilege 2204 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2204 msiexec.exe Token: SeLockMemoryPrivilege 2204 msiexec.exe Token: SeIncreaseQuotaPrivilege 2204 msiexec.exe Token: SeMachineAccountPrivilege 2204 msiexec.exe Token: SeTcbPrivilege 2204 msiexec.exe Token: SeSecurityPrivilege 2204 msiexec.exe Token: SeTakeOwnershipPrivilege 2204 msiexec.exe Token: SeLoadDriverPrivilege 2204 msiexec.exe Token: SeSystemProfilePrivilege 2204 msiexec.exe Token: SeSystemtimePrivilege 2204 msiexec.exe Token: SeProfSingleProcessPrivilege 2204 msiexec.exe Token: SeIncBasePriorityPrivilege 2204 msiexec.exe Token: SeCreatePagefilePrivilege 2204 msiexec.exe Token: SeCreatePermanentPrivilege 2204 msiexec.exe Token: SeBackupPrivilege 2204 msiexec.exe Token: SeRestorePrivilege 2204 msiexec.exe Token: SeShutdownPrivilege 2204 msiexec.exe Token: SeDebugPrivilege 2204 msiexec.exe Token: SeAuditPrivilege 2204 msiexec.exe Token: SeSystemEnvironmentPrivilege 2204 msiexec.exe Token: SeChangeNotifyPrivilege 2204 msiexec.exe Token: SeRemoteShutdownPrivilege 2204 msiexec.exe Token: SeUndockPrivilege 2204 msiexec.exe Token: SeSyncAgentPrivilege 2204 msiexec.exe Token: SeEnableDelegationPrivilege 2204 msiexec.exe Token: SeManageVolumePrivilege 2204 msiexec.exe Token: SeImpersonatePrivilege 2204 msiexec.exe Token: SeCreateGlobalPrivilege 2204 msiexec.exe Token: SeRestorePrivilege 2088 msiexec.exe Token: SeTakeOwnershipPrivilege 2088 msiexec.exe Token: SeRestorePrivilege 2088 msiexec.exe Token: SeTakeOwnershipPrivilege 2088 msiexec.exe Token: SeRestorePrivilege 2088 msiexec.exe Token: SeTakeOwnershipPrivilege 2088 msiexec.exe Token: SeRestorePrivilege 2088 msiexec.exe Token: SeTakeOwnershipPrivilege 2088 msiexec.exe Token: SeRestorePrivilege 2088 msiexec.exe Token: SeTakeOwnershipPrivilege 2088 msiexec.exe Token: SeRestorePrivilege 2088 msiexec.exe Token: SeTakeOwnershipPrivilege 2088 msiexec.exe Token: SeRestorePrivilege 2088 msiexec.exe Token: SeTakeOwnershipPrivilege 2088 msiexec.exe Token: SeDebugPrivilege 4008 powershell.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2204 msiexec.exe 3792 MsiExec.exe 2204 msiexec.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 3792 MsiExec.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2088 wrote to memory of 3792 2088 msiexec.exe 77 PID 2088 wrote to memory of 3792 2088 msiexec.exe 77 PID 2088 wrote to memory of 3792 2088 msiexec.exe 77 PID 3792 wrote to memory of 4008 3792 MsiExec.exe 84 PID 3792 wrote to memory of 4008 3792 MsiExec.exe 84 PID 3792 wrote to memory of 4008 3792 MsiExec.exe 84 PID 4008 wrote to memory of 680 4008 powershell.exe 86 PID 4008 wrote to memory of 680 4008 powershell.exe 86 PID 4008 wrote to memory of 680 4008 powershell.exe 86
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\RASTREIO.DIG1TAL.TOZNHYVZMPWAZRMJQQUEOIVDSGAEJJ裆.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2204
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 111CE316508928B0DEC9256A87036B7E2⤵
- Blocklisted process makes network request
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" cd\;cd 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup';Start-Sleep -s 60;Invoke-Item 'ZJBZIJSWYH.lnk'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Users\Public\Downloads\TGCJDQGFSBULAWYUTMUP\BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe"C:\Users\Public\Downloads\TGCJDQGFSBULAWYUTMUP\BTFWSMDXCZMJFCHòXTDARHGICPXCGRZõ.exe"4⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:680
-
-
-