Analysis
-
max time kernel
78s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
13-02-2022 11:37
General
-
Target
f085588cf016993e6298640bf797c1d31b61a8087a3240d517a53a5a58474987.msi
-
Size
951KB
-
MD5
e2c5416931f1c9369fb55e7adcf6364b
-
SHA1
57c960dc13b433a3fe3225b884fcbccc01c00c36
-
SHA256
f085588cf016993e6298640bf797c1d31b61a8087a3240d517a53a5a58474987
-
SHA512
96e666f61ad0e1e1c9146b31ea94622004e9dcdd082372e5ae7dada1c3aa28538d506c870502be8b381170a2d60ea470e196141de0affab232d8a106fa4ca51e
Malware Config
Signatures
-
Lampion
Lampion is a banking trojan, targeting Portuguese speaking countries.
-
Blocklisted process makes network request 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 1 IoCs
-
Loads dropped DLL 4 IoCs
-
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 1 IoCs
-
Drops file in Windows directory 21 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 32 IoCs
-
Modifies registry class 23 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\f085588cf016993e6298640bf797c1d31b61a8087a3240d517a53a5a58474987.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:32⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding FB9FFA707F4CE430F0601BA2DF87494D2⤵
- Loads dropped DLL
-
-
C:\Windows\Installer\MSI368E.tmp"C:\Windows\Installer\MSI368E.tmp" "C:\Program Files (x86)\Firefox_2020-3547\Firefox_2020-3547\658615508460043140_16.vbs"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s DsmSvc1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Firefox_2020-3547\Firefox_2020-3547\658615508460043140_16.vbs"1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exewscript.exe C:\Users\Admin\AppData\Roaming\abntufeqpnj.vbs2⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c shutdown /r /t 0 /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\shutdown.exeshutdown /r /t 0 /f4⤵
-
-
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39db855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
6726ce7753803c58bb7136216dd3378f
SHA1eb6faf34ce5a9c9a6bc5eba32cb51b88cdda3f2d
SHA2560a0bce3a1809e225be4a123e894e01a3f8eb805ebbea1bcd0172c2b104600f04
SHA512320b9c6ffedac662290482f6c73e8b8b2242bf8a359da91baa06d37c165596668157a8e89199f81c132f9434b8ad202c4ce6735f654d5e8d353104786abae9a7
-
MD5
31b3fa3be13c3eca988b6647cf274003
SHA1713779818be4a9956a02f8e16231750a9e0c3eb8
SHA256881aa5538ac02efb941f6cbef4e784f5e4a4a0c70611cc6b7e7e461f21c65f97
SHA512ba1fddaaa64e0bdc2418d615b2a34683167fc336d12109e29574c3cec51a93d16908bf155b96d0d8c4537b185caa7ee29c3eb6a84074ef366cd161b0fe8eb1bf
-
MD5
724e550c7c9a874946bcb6b51ce138c3
SHA116444fc8b1558abc51a4f2896b56012d360d7a1c
SHA256f65f61431ebd327173276a5bf8c8e30c465d15273601c67277d140632bf55575
SHA5121d3b0fc9818c77cded991846925af13351c8d964646008ef4da86c2298cfb92d3d3b6ea67956899af06cf04966d05fd3fec6b678b5b024399e9cd52842a82667
-
MD5
c39daeba173815516c180ca4361f7895
SHA1db3ae54329834baa954569a35be5b947c86dc25e
SHA256a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc
SHA512e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929
-
MD5
c39daeba173815516c180ca4361f7895
SHA1db3ae54329834baa954569a35be5b947c86dc25e
SHA256a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc
SHA512e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929
-
MD5
c39daeba173815516c180ca4361f7895
SHA1db3ae54329834baa954569a35be5b947c86dc25e
SHA256a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc
SHA512e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929
-
MD5
c39daeba173815516c180ca4361f7895
SHA1db3ae54329834baa954569a35be5b947c86dc25e
SHA256a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc
SHA512e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929
-
MD5
c39daeba173815516c180ca4361f7895
SHA1db3ae54329834baa954569a35be5b947c86dc25e
SHA256a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc
SHA512e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929
-
MD5
c39daeba173815516c180ca4361f7895
SHA1db3ae54329834baa954569a35be5b947c86dc25e
SHA256a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc
SHA512e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929
-
MD5
c39daeba173815516c180ca4361f7895
SHA1db3ae54329834baa954569a35be5b947c86dc25e
SHA256a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc
SHA512e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929
-
MD5
c39daeba173815516c180ca4361f7895
SHA1db3ae54329834baa954569a35be5b947c86dc25e
SHA256a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc
SHA512e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929
-
MD5
867b627b008d149f15e8df90d2648d41
SHA1543fc2763f98378c5777f0dc1f11f54ee3a71733
SHA25651d309734f25d009714a0e4d428ffee3f42bfaa3eaf21da68369405f3a0a8233
SHA5129c3beb4c8c5319f1f584c49fa66b1ee704b6ecb56184af0024a4e363979466c2933a99fa0662532b0ac8ca22536b1717de8214cd828094bbc38f9d8bb3d2da44
-
MD5
bff4ebaee03ef104ed34a48ea4e1ce0d
SHA1f9d2e090c188d0fd2d7c6632bd14ae28c0ddf0d8
SHA2564b7640afb67328194f7a111f42e81f6565cff022e72fef96ee2bd7d5f658f047
SHA5123341ffb04fa1c966a57d8422ab286afa072589b1239a846d23a06d5797b4fc09089f66643f92356925a61520428a953800fa34eb8b2663c0ee2ac9bb40d640b8
-
MD5
d11652347b2c3c5a6f5dc924a6e3e06c
SHA141ffdabff4e0e3b8be7945916a9b89e91704f432
SHA25697f3eec695a86f9d285d1ee2c7b2d821104edf69320c6565d3dc973e4b1b5b8f
SHA512023108d1e13e2cc8d9bdd815d3d422b3fb11c46e9d3d12f0c35047b8b478467d1810934a4448ee8db856ab7c1c7ba8fc7e0229c3b7fee5579f140c6dcbfa5b79
-
MD5
f35ed659b81455a2a36fc7b7ac30150b
SHA1ae34f60afb7ba243b01b5586253a5c9cef870065
SHA2569ad4105382cbee131153ef1c22452245f7848df10795af7a8d08acecba09f298
SHA512b9e2b976891a7707a4584184473f33534a384a4b72f873026eaa040a9908e05476efcf13fb6be1b995b09a6f7d947b14d636e7513da170be1e56ad4220504fd8
-
MD5
dede237c29ef31056bdd8ee742a87de0
SHA12b2bac17a326715b70c03f0623b42d9a515093a9
SHA25612aa8318c82ddcd4b09d9cec171e652f54b325707de272695cb2eec85a3580ca
SHA5121a524a5daf8af862c8bc5b6c43ac5e3908551f87baf42e7ccd9d0479feb8ca9af324616484f275792715a1ae85a78ab4ddfdfcba9a7b405c3869bf018911c805
-
MD5
6030d65b7608a031ff00577456ef7186
SHA144c36e76dcfab3929f17ab65c110013ddd117719
SHA25623f419cdf2159d2de1308be7345c70ad86c6a3e1c1f7e64969ff19dbd6e353d5
SHA51243f02801e52d9217b513785acf5b2652ade1582f0631f555c4b84423f3dd397974b59118b0a7482552486776dc871bd2c58469020746a77747e2f92a13c00be2
-
Filesize
16KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
16KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
16KB
-
Filesize
16KB
-
Filesize
4KB
-
Filesize
16KB
-
Filesize
4KB
-
Filesize
16KB
-
Filesize
4KB