matanbuchus | 07f558d48bbb07e42dd21095087c126b91ec0426073fc78f3ae31a6540d3edae

Analysis

max time kernel
146s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
16/06/2022, 19:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
58EE4BED5C5B0B0DCAD9548F0D8B82B52C0090ADC3C50DEC6A2088EF243C1148.msi
Size 224KB
Sample220616-yp9wfsbdh7
SHA256 58ee4bed5c5b0b0dcad9548f0d8b82b52c0090adc3c50dec6a2088ef243c1148
MD5 d30b90bf89cfda2154df291790e573e1
SHA1 9a4a228c9f078700f17cb4fe1a430d35e4ec2590
SHA512 645adf7613d428f30fee89ce7ed96f0a915688c4b5b77115173725fbf26ac4b3dc3ec2449edc8302e7dc513882947c416732ae4588a757857ff2552c733cdede
MD5 SHA1 SHA512

Score

10^/10

matanbuchus loader

Malware Config

Signatures

Matanbuchus
A loader sold as MaaS first seen in February 2021.
loader matanbuchus

Blocklisted process makes network request 3 IoCs

flow	pid	Process
3	3292	msiexec.exe
5	3292	msiexec.exe
7	3292	msiexec.exe

Loads dropped DLL 1 IoCs

pid	Process
1216	regsvr32.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{11C75809-74E2-4828-9238-619CB9048CF3}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC856.tmp	msiexec.exe
File created	C:\Windows\Installer\e56c693.msi	msiexec.exe
File created	C:\Windows\Installer\e56c691.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e56c691.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000066bbc37791d732ea0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000066bbc3770000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff00000000070001000068090066bbc377000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000066bbc37700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000066bbc37700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4208	msiexec.exe
4208	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3292	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3292	msiexec.exe
Token: SeSecurityPrivilege	4208	msiexec.exe
Token: SeCreateTokenPrivilege	3292	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3292	msiexec.exe
Token: SeLockMemoryPrivilege	3292	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3292	msiexec.exe
Token: SeMachineAccountPrivilege	3292	msiexec.exe
Token: SeTcbPrivilege	3292	msiexec.exe
Token: SeSecurityPrivilege	3292	msiexec.exe
Token: SeTakeOwnershipPrivilege	3292	msiexec.exe
Token: SeLoadDriverPrivilege	3292	msiexec.exe
Token: SeSystemProfilePrivilege	3292	msiexec.exe
Token: SeSystemtimePrivilege	3292	msiexec.exe
Token: SeProfSingleProcessPrivilege	3292	msiexec.exe
Token: SeIncBasePriorityPrivilege	3292	msiexec.exe
Token: SeCreatePagefilePrivilege	3292	msiexec.exe
Token: SeCreatePermanentPrivilege	3292	msiexec.exe
Token: SeBackupPrivilege	3292	msiexec.exe
Token: SeRestorePrivilege	3292	msiexec.exe
Token: SeShutdownPrivilege	3292	msiexec.exe
Token: SeDebugPrivilege	3292	msiexec.exe
Token: SeAuditPrivilege	3292	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3292	msiexec.exe
Token: SeChangeNotifyPrivilege	3292	msiexec.exe
Token: SeRemoteShutdownPrivilege	3292	msiexec.exe
Token: SeUndockPrivilege	3292	msiexec.exe
Token: SeSyncAgentPrivilege	3292	msiexec.exe
Token: SeEnableDelegationPrivilege	3292	msiexec.exe
Token: SeManageVolumePrivilege	3292	msiexec.exe
Token: SeImpersonatePrivilege	3292	msiexec.exe
Token: SeCreateGlobalPrivilege	3292	msiexec.exe
Token: SeBackupPrivilege	4468	vssvc.exe
Token: SeRestorePrivilege	4468	vssvc.exe
Token: SeAuditPrivilege	4468	vssvc.exe
Token: SeBackupPrivilege	4208	msiexec.exe
Token: SeRestorePrivilege	4208	msiexec.exe
Token: SeRestorePrivilege	4208	msiexec.exe
Token: SeTakeOwnershipPrivilege	4208	msiexec.exe
Token: SeRestorePrivilege	4208	msiexec.exe
Token: SeTakeOwnershipPrivilege	4208	msiexec.exe
Token: SeRestorePrivilege	4208	msiexec.exe
Token: SeTakeOwnershipPrivilege	4208	msiexec.exe
Token: SeRestorePrivilege	4208	msiexec.exe
Token: SeTakeOwnershipPrivilege	4208	msiexec.exe
Token: SeRestorePrivilege	4208	msiexec.exe
Token: SeTakeOwnershipPrivilege	4208	msiexec.exe
Token: SeRestorePrivilege	4208	msiexec.exe
Token: SeTakeOwnershipPrivilege	4208	msiexec.exe
Token: SeRestorePrivilege	4208	msiexec.exe
Token: SeTakeOwnershipPrivilege	4208	msiexec.exe
Token: SeRestorePrivilege	4208	msiexec.exe
Token: SeTakeOwnershipPrivilege	4208	msiexec.exe
Token: SeRestorePrivilege	4208	msiexec.exe
Token: SeTakeOwnershipPrivilege	4208	msiexec.exe
Token: SeRestorePrivilege	4208	msiexec.exe
Token: SeTakeOwnershipPrivilege	4208	msiexec.exe
Token: SeRestorePrivilege	4208	msiexec.exe
Token: SeTakeOwnershipPrivilege	4208	msiexec.exe
Token: SeRestorePrivilege	4208	msiexec.exe
Token: SeTakeOwnershipPrivilege	4208	msiexec.exe
Token: SeRestorePrivilege	4208	msiexec.exe
Token: SeTakeOwnershipPrivilege	4208	msiexec.exe
Token: SeRestorePrivilege	4208	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3292	msiexec.exe
3292	msiexec.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4208 wrote to memory of 2424	4208	msiexec.exe	90
PID 4208 wrote to memory of 2424	4208	msiexec.exe	90
PID 4208 wrote to memory of 4720	4208	msiexec.exe	93
PID 4208 wrote to memory of 4720	4208	msiexec.exe	93
PID 4208 wrote to memory of 1400	4208	msiexec.exe	94
PID 4208 wrote to memory of 1400	4208	msiexec.exe	94
PID 1400 wrote to memory of 1216	1400	regsvr32.exe	95
PID 1400 wrote to memory of 1216	1400	regsvr32.exe	95
PID 1400 wrote to memory of 1216	1400	regsvr32.exe	95

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\58EE4BED5C5B0B0DCAD9548F0D8B82B52C0090ADC3C50DEC6A2088EF243C1148.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3292

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4208
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2424
- C:\Windows\system32\wscript.exe
  wscript.exe C:\Users\Admin\AppData\Local\AdobeFontPack\notify.vbs
  2⤵
  PID:4720
- C:\Windows\system32\regsvr32.exe
  regsvr32.exe -n -i:"Install" C:\Users\Admin\AppData\Local\AdobeFontPack\main.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1400
- - C:\Windows\SysWOW64\regsvr32.exe
    -n -i:"Install" C:\Users\Admin\AppData\Local\AdobeFontPack\main.dll
    3⤵
    - Loads dropped DLL
    PID:1216

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4468

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8EC9B1D0ABBD7F98B401D425828828CE_A7327B44A69527A27956DB1216E5F535

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_A7327B44A69527A27956DB1216E5F535
Size 727B
SHA256 8b4f7f9bfba7694bba0f73951f1a50e64d3cea560b18c9bb63366abfc0d0cd0a
MD5 7928c3688d855f9c7c83bb0533fdc463
SHA1 d8bd219cd2b4b5d92b9f33ad8f5d4f7469f78755
SHA512 b6df399bdfa2a122dac8206b770faf9fc2af136bff614eaa43b7f134a4a0716165c87e984305471f56b07338faba078386a4efccd4df06375ada74c79303ec82
MD5 SHA1 SHA512

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 d32d6c2ddd4165ff710d503cd874aa96a7c45a74d08b98eb6ba6e1f8ce86bc18
MD5 dbd0ea3109b08b1c543287c52f386fa2
SHA1 f062abf3894c0a5dddb21b19782466db11ead513
SHA512 f2a56b17c9562fe6fa4e8f91a7aca9f1c29053ea0fe26be109b6e0ba99bac756dc4e2d27b2c7c98e60008c8e4ff4c87ff063f4f4272dfb59436f56de14fb3555
MD5 SHA1 SHA512

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_A7327B44A69527A27956DB1216E5F535

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_A7327B44A69527A27956DB1216E5F535
Size 404B
SHA256 0053909d1658b30dd16a2e714dce519a77a2afc63cdeecd2d8d4c9ff4d581156
MD5 56b9b8f0e5bd6ac60939cea84c7de179
SHA1 8fd647d0d5d08faa39cc8897c46878207ce7f51c
SHA512 411e3a268d9c1428d58e3b21efcf20ef09b071855a25b8786066dbf00602a3ee193bd4ecca67b0fabe597f866477d6c080831ddf504292fd02885ce25153b7ee
MD5 SHA1 SHA512

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 442B
SHA256 dacdd1a95847d42b0111fa080a8893bd84d88b5bd38860b9ac18cee58e2612b7
MD5 a1a5ae892204dd802655e2681a3db93b
SHA1 4312fa315ff3c643207a6d33cdb15f9fae390e4b
SHA512 7c7cf2507499f6723d995b548c89d77e2a1fd842d8637a7d509050e9025631dd5776dd1cb5662671bd111d07c00077a23eb4d3f718849a8761ede31c2d9cde3c
MD5 SHA1 SHA512

Submit Download

main.dll

Path C:\Users\Admin\AppData\Local\AdobeFontPack\main.dll
Size 401KB
SHA256 88f50d29a83bfbe6a6c2c490a22e54cd79718f60a4ea574017d491d78ae28c4b
MD5 ab26edfebc42dea6681c8a23b964ad59
SHA1 72d820702dfbb3716722f08c4ddfa446fbd1a161
SHA512 406a31427270148b33dd2eb50f1f87088728e9cd68d6ac9cc168e59a949b341487925fef85643c2231f139fca4e10c0b7215e3ba41bd8fdf505c09fed0360d2a
SSDEEP 6144:ItugFAmTHh/rONOBHtnee6fIhO1MMwWPzRRTuxeLaRRZMuspQ1fg345:CtWmTBpHtee6IcUWbHI/RRZMud
MD5 SHA1 SHA512 SSDEEP

Submit Download

main.dll

Path C:\Users\Admin\AppData\Local\AdobeFontPack\main.dll
Size 401KB
SHA256 88f50d29a83bfbe6a6c2c490a22e54cd79718f60a4ea574017d491d78ae28c4b
MD5 ab26edfebc42dea6681c8a23b964ad59
SHA1 72d820702dfbb3716722f08c4ddfa446fbd1a161
SHA512 406a31427270148b33dd2eb50f1f87088728e9cd68d6ac9cc168e59a949b341487925fef85643c2231f139fca4e10c0b7215e3ba41bd8fdf505c09fed0360d2a
SSDEEP 6144:ItugFAmTHh/rONOBHtnee6fIhO1MMwWPzRRTuxeLaRRZMuspQ1fg345:CtWmTBpHtee6IcUWbHI/RRZMud
MD5 SHA1 SHA512 SSDEEP

Submit Download

notify.vbs

Path C:\Users\Admin\AppData\Local\AdobeFontPack\notify.vbs
Size 68B
SHA256 0a7e8fd68575db5f84c18b9a26e4058323d1357e2a29a5b12278e4bfa6939489
MD5 0308aa2c8dab8a69de41f5d16679bb9b
SHA1 c6827bf44a433ff086e787653361859d6f6e2fb3
SHA512 1a1ca92e3c8d52c8b5adbb3117a88d8a2a8c33eaf2f7b0d620fe006653f57f4ba0b803884616594ca31e13a1b0b59ddae52cecf044621ec44371084dac6beb72
MD5 SHA1 SHA512

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 23.0MB
SHA256 37683df736fac4ee96ed2d22f3f216ef2402c70a33f6a092a73d294c492f6a50
MD5 124d895d39f60caabe760a320ce89977
SHA1 e95fdceee914a369821053f96261f4e50bcaf511
SHA512 f182de3a6e706b5d7451ff0b57d3998015768849c8a7d072ecad36dd73993655ec213e73c588b6a63e7118bd76f34ed9d5be9d554d273a072d377d8793b676ad
SSDEEP 24576:rjdmOnIgdoO/vvTLAtGuelbbWBkti5gjSBwd0W0gNN6rBouWojpr7v68P:d
MD5 SHA1 SHA512 SSDEEP

Submit Download

{c3efac0f-fa94-442d-ae3a-e94e6f894072}_OnDiskSnapshotProp

Path \??\Volume{77c3bb66-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{c3efac0f-fa94-442d-ae3a-e94e6f894072}_OnDiskSnapshotProp
Size 5KB
SHA256 9577b56e6fb543380d9a28633f5a10d82fce61b9dd572d5a0852f8adf2668f86
MD5 40d0d8986302ee77cc5ddf0bc0a59552
SHA1 3dbaafc2f0c386cda7f20df4bcc944da55e9f512
SHA512 afb27800a423512b6d657eaae4687cd835eb068fa158a54d529f3edf7a6cd5bd67e1e19b4be4be57a87280c911f396d8bbbaac708f1fe73aae67cd86ab5302d0
SSDEEP 96:FLqnDcC8tJlh3wDD84LTHzbOHXOHBlBRQn8Sa9XE56tRSVQEJN:snvUlmb++CzJN
MD5 SHA1 SHA512 SSDEEP

Submit Download