Analysis
-
max time kernel
74s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
13-02-2022 11:37
General
-
Target
cd9d625e9fe6116f5f5e938ae9f693e10529df238b4e2bbd974f6d5c41f96aa8.msi
-
Size
951KB
-
MD5
9951c45e09990f06bc3e3758062c9ade
-
SHA1
27ef845a9562b989c38dd6d2eda42d31d7c2a354
-
SHA256
cd9d625e9fe6116f5f5e938ae9f693e10529df238b4e2bbd974f6d5c41f96aa8
-
SHA512
b97185d2eeec22a2a66cd56f3ca6ee1a4e97c9e1d1ddea24c71ca4d9f7ef4f337c7a1197d08814c4a70870266230891f0798e8c924623291409edfb51b81539d
Malware Config
Signatures
-
Lampion
Lampion is a banking trojan, targeting Portuguese speaking countries.
-
Blocklisted process makes network request 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 1 IoCs
-
Loads dropped DLL 4 IoCs
-
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 1 IoCs
-
Drops file in Windows directory 21 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 32 IoCs
-
Modifies registry class 23 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\cd9d625e9fe6116f5f5e938ae9f693e10529df238b4e2bbd974f6d5c41f96aa8.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:32⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0CB29511D2C194AA7CC446ED39E78E812⤵
- Loads dropped DLL
-
-
C:\Windows\Installer\MSI155A.tmp"C:\Windows\Installer\MSI155A.tmp" "C:\Program Files (x86)\Firefox_2020-3624\Firefox_2020-3624\413824335077635404_5.vbs"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s DsmSvc1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Firefox_2020-3624\Firefox_2020-3624\413824335077635404_5.vbs"1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exewscript.exe C:\Users\Admin\AppData\Roaming\oxtrznoswbp.vbs2⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c shutdown /r /t 0 /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\shutdown.exeshutdown /r /t 0 /f4⤵
-
-
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39cc855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
eaa110d16a2f936ad5eb065eeeeb4d63
SHA1f709ea58e0f65df965d77fc8707ad0cecd57e720
SHA2560e5838c7b80a24bc9ee2149c91bc60c0eb543477ca963b373c1597f0db435350
SHA5129c724006a70f5fdbee7ba3d0e93c169f0b65854dfa87fd545ff403b79cb80208f971b31c7ed65943cd1ce64f7785cd74abe97f6fee62ef887f736893a0245584
-
MD5
31b3fa3be13c3eca988b6647cf274003
SHA1713779818be4a9956a02f8e16231750a9e0c3eb8
SHA256881aa5538ac02efb941f6cbef4e784f5e4a4a0c70611cc6b7e7e461f21c65f97
SHA512ba1fddaaa64e0bdc2418d615b2a34683167fc336d12109e29574c3cec51a93d16908bf155b96d0d8c4537b185caa7ee29c3eb6a84074ef366cd161b0fe8eb1bf
-
MD5
ee119a8d8fb152cf9e6c4abf84a72fbb
SHA1785ce7b0abb621aef388bd67f0e2ed35368eb423
SHA2564f1eeac4829f6faf85d63073231564591443c50ad0b0a327a429841e0f64dfab
SHA512e3b747a6edef792310eca38fd79297fec9b6e0aed567e7d83179a29cd8d878fb96c1392ab2f9150156ae552f614f77fa5621c602bf1d607a63b8ae86477bd3c9
-
MD5
c39daeba173815516c180ca4361f7895
SHA1db3ae54329834baa954569a35be5b947c86dc25e
SHA256a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc
SHA512e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929
-
MD5
c39daeba173815516c180ca4361f7895
SHA1db3ae54329834baa954569a35be5b947c86dc25e
SHA256a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc
SHA512e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929
-
MD5
867b627b008d149f15e8df90d2648d41
SHA1543fc2763f98378c5777f0dc1f11f54ee3a71733
SHA25651d309734f25d009714a0e4d428ffee3f42bfaa3eaf21da68369405f3a0a8233
SHA5129c3beb4c8c5319f1f584c49fa66b1ee704b6ecb56184af0024a4e363979466c2933a99fa0662532b0ac8ca22536b1717de8214cd828094bbc38f9d8bb3d2da44
-
MD5
c39daeba173815516c180ca4361f7895
SHA1db3ae54329834baa954569a35be5b947c86dc25e
SHA256a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc
SHA512e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929
-
MD5
c39daeba173815516c180ca4361f7895
SHA1db3ae54329834baa954569a35be5b947c86dc25e
SHA256a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc
SHA512e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929
-
MD5
c39daeba173815516c180ca4361f7895
SHA1db3ae54329834baa954569a35be5b947c86dc25e
SHA256a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc
SHA512e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929
-
MD5
c39daeba173815516c180ca4361f7895
SHA1db3ae54329834baa954569a35be5b947c86dc25e
SHA256a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc
SHA512e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929
-
MD5
c39daeba173815516c180ca4361f7895
SHA1db3ae54329834baa954569a35be5b947c86dc25e
SHA256a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc
SHA512e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929
-
MD5
c39daeba173815516c180ca4361f7895
SHA1db3ae54329834baa954569a35be5b947c86dc25e
SHA256a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc
SHA512e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929
-
MD5
12074a6152fdc3d5d88a59da275ed09f
SHA10f0b5cad804da2b5729677feb2671cc656544ce7
SHA25650756860b2da5344fb166d37e272e4dd687668f6f27426364d640a56032be056
SHA5122b7e5c401ec7f4f67c6f1d2d1645b0281f84f5e4208d9567d1137d681e449e97c82cd49ea6192e1b199933736fc889a560e27aef51646b9609a9ea8a68b60265
-
MD5
8f93e3d3e26a783814969d6b7c8b7f19
SHA1bfba595e92041a6228363557051e89a5b7c9ce52
SHA256bf30b30ee18292bb244450eae0683b08a292dd2bec3fe04daaba5297a1e682fc
SHA512f84e41597737111de173783ef748ed273486d1a8c06aa21ecf3eea7726c104e13543312d33ddf12509924878d28828ec4bc68b5a4b5eb034c237f89b3a61b3d7
-
MD5
57ea1f0ab02e77365030a078928c3d4e
SHA10787258f8b28faeef2bfdfe71d0e26a6a153fd58
SHA2567af1fc293a3b0c0141f0460a540a7f4b7a18c8cf5f5f90a9edc674fc4d0b7cf0
SHA512de12c32640fdb21ffb49b5a74cb4da23de98373ba98d292996c96517f5ec0031f2719ab0109771c090c16548e8371e78c341201fd72e0c68235833ffd449d003
-
MD5
7601cfcb38376bbf5bc97051192b318f
SHA1ce6d7fd12294bc50f26d6085aa7cbfccbcaa4dbb
SHA256c0ed2e8fe959c8f97bff84017244e93752531d9e602d2e3dd5b905117f345159
SHA51221054b034292c4edab5ef908caa2a4ce4608225735773d2f2f0cd9629c67356bbf20bfb482d8b1aba96888ec4a82ddf46fdfbe241beaafe2bdaad0c9c234d402
-
MD5
280d69d5ac94f4fbd94dd8485079f206
SHA177e43fe4a7c5851ff902de3f1fd7ff202571551d
SHA25653674298bd36d26611f1d5b9dd7fa82f3fb1b5025a6251494ac322aa1a0dbb13
SHA5122fc6ba2c26f6f5a967e65327511d6a2ea706ebe0d8b85d0325d4271d634da75e575ea67bcdbdc848006f99d2d4fbfdacf7d1ddaf34eccc2da02145f8bd698a21
-
Filesize
16KB
-
Filesize
64KB
-
Filesize
16KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
16KB
-
Filesize
4KB
-
Filesize
16KB
-
Filesize
16KB
-
Filesize
16KB