Overview

overview

10

Static

static

8 Cores.msi

windows7_x64

6

8 Cores.msi

windows10_x64

10

8 Cores.msi

windows10-2004_x64

10

Analysis

  • max time kernel
    362s
  • max time network
    367s
  • platform
    windows10_x64
  • resource
    win10-ja-20211208
  • submitted
    16-01-2022 18:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8 Cores.msi

  • Size

    319KB

  • MD5

    6047ee1af2d30ef7db95fabb788ec9f9

  • SHA1

    2731a77f03f97aa03adcd2c7c6f4342d2fd1d515

  • SHA256

    b3f5506d672e2ea0564c52413f1f8847c569542d2cd475937c6f21a443292728

  • SHA512

    7d8de10cdf4399692da6b7e80c96d865ffc891292e1bf16adaf663f2cf087802ae61bde15057a9aa7c82d6dbd0930e623c3a4c947502c5c1129bbc66d8aa03e8

Score
10/10
persistence

Malware Config

Signatures

  • Registers COM server for autorun 1 TTPs
    persistence
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 4 IoCs
  • Drops file in Windows directory 8 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 25 IoCs
  • Modifies registry class 44 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\8 Cores.msi"
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4604
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4660
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:3532
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1200
    • \??\c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
      1⤵
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:4200
    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe
      "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe"
      1⤵
      • Modifies registry class
      PID:2828
    • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe
      "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /frequentupdate SCHEDULEDTASK displaylevel=False
      1⤵
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      • Suspicious use of SetWindowsHookEx
      PID:4448

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Privilege Escalation

    Defense Evasion

    Credential Access

    Discovery

    Query Registry

    2
    T1012

    Peripheral Device Discovery

    2
    T1120

    System Information Discovery

    2
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
      MD5

      77d1bb4f3f1cfe989a1092ca6261135d

      SHA1

      2b9253d1ee70dde25d18ffc7a9a06eee390a09b7

      SHA256

      33849441d4e3961087d35e9702b18dc36ec47a7154b4fc2fc5c6c52eea328bd2

      SHA512

      80afd2c826be3ab64171e8488d8732e18a9e3c3514c0de8a11eba45fc1845f124573626136fdb77dc0099f711144b682e993df4230f89d4c6fb0eb57e25d917e

      Download Submit
    • \??\Volume{e49a283c-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{18843a99-c587-4510-9832-278507c33b9f}_OnDiskSnapshotProp
      MD5

      49f93eeae22bb49944348df09beac046

      SHA1

      f7b3416acc3e99f6aa7fdbe6eb506d7e8421a596

      SHA256

      3100630b3108f44a07ae9d1e07384bc8e3f3e7b2992559d59a6db066d1156888

      SHA512

      087661d4487e97f458ef58cffb2bf751ff7eb2efa2537856b4f8d592a57d74bdc9378a904a735821853d291dc1d078bb5a72c769f49a6d742724325855e91d93

      Download Submit
    • memory/3532-122-0x0000000000000000-mapping.dmp
      Download
    • memory/4604-118-0x000001D793EA0000-0x000001D793EA2000-memory.dmp
      Filesize

      8KB

      Download
    • memory/4604-119-0x000001D793EA0000-0x000001D793EA2000-memory.dmp
      Filesize

      8KB

      Download
    • memory/4660-120-0x000002419D800000-0x000002419D802000-memory.dmp
      Filesize

      8KB

      Download
    • memory/4660-121-0x000002419D800000-0x000002419D802000-memory.dmp
      Filesize

      8KB

      Download