Overview

overview

10

Static

static

ef4930fc91...0d.msi

windows7_x64

10

ef4930fc91...0d.msi

windows10_x64

8

Analysis

  • max time kernel
    153s
  • max time network
    149s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    28-01-2022 17:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ef4930fc91c40c8bc955c9a38b5112ee0a7cb6008b13e48025ed458fae4ba20d.msi

  • Size

    3.6MB

  • MD5

    bdbb71848ccda557b6be1f1ef6f8386c

  • SHA1

    1db41ab648efdb58fafba6494b9fc89a7c15dadb

  • SHA256

    ef4930fc91c40c8bc955c9a38b5112ee0a7cb6008b13e48025ed458fae4ba20d

  • SHA512

    dc63a6536d61a463fb93954e2c309adce3308102c1b58c50b855ab99fbe4d2f7a02f9d85ef2184986f6cc70b5de1015148f0b05069a619886c34722072259688

Score
8/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • autoit_exe 4 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 2 IoCs
  • Runs ping.exe 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ef4930fc91c40c8bc955c9a38b5112ee0a7cb6008b13e48025ed458fae4ba20d.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:508
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1692
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:680
      • C:\Users\Admin\AppData\Local\Temp\Data1\storsvc.exe
        "C:\Users\Admin\AppData\Local\Temp\Data1\storsvc.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1144
        • C:\Users\Admin\AppData\Local\Temp\exit.exe
          "C:\Users\Admin\AppData\Local\Temp\exit.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:964
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c i.cmd
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:372
            • C:\Windows\SysWOW64\PING.EXE
              ping ping-test.hldns.ru -n 3 -w 6000
              5⤵
              • Runs ping.exe
              PID:2416
            • C:\Windows\SysWOW64\PING.EXE
              ping ping-test.hldns.ru -n 3 -w 6000
              5⤵
              • Runs ping.exe
              PID:4016
            • C:\Users\Admin\AppData\Local\Temp\btc.exe
              btc.exe x -p3KPnoNJ3ReME4bEU5W9APkKS5ErkR3tNRT -y
              5⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:428
              • C:\ProgramData\btc\exit.exe
                "C:\ProgramData\btc\exit.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:1004
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c i.cmd
                  7⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1396
                  • C:\Windows\SysWOW64\reg.exe
                    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "bitcoin" /t REG_SZ /d "c:\ProgramData\btc\winserv.exe"
                    8⤵
                    • Adds Run key to start application
                    PID:2112
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3484
    • \??\c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
      1⤵
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:3104

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads