matanbuchus | face46e6593206867da39e47001f134a00385898a36b8142a21ad54954682666

Analysis

max time kernel
155s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
17/06/2022, 07:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SCAN-016063.pdf.msi
Size 224KB
Sample220617-h535vaddf9
SHA256 face46e6593206867da39e47001f134a00385898a36b8142a21ad54954682666
MD5 ff82937564ff59eb6207f079cdc8e43d
SHA1 7cfe0a71c4a2508a1af80e640ec8b1b034edb604
SHA512 4c4c2f59ef157de6570bf16daff958d9ccdafd8ba6cf3f946cabaa413c085c05242b2499552e789f0f0bc9e1cbf0b74ec6327340d29c80a694aeddf444788ee1
MD5 SHA1 SHA512

Score

10^/10

matanbuchus loader

Malware Config

Signatures

Matanbuchus
A loader sold as MaaS first seen in February 2021.
loader matanbuchus

Blocklisted process makes network request 3 IoCs

flow	pid	Process
4	2996	msiexec.exe
6	2996	msiexec.exe
8	2996	msiexec.exe

Loads dropped DLL 1 IoCs

pid	Process
4588	regsvr32.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e56ec4b.msi	msiexec.exe
File created	C:\Windows\Installer\e56ec49.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e56ec49.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D20C245F-321F-453F-8139-C938C6F031A3}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEDB0.tmp	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e111c2ed168134740000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e111c2ed0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff000000000700010000680900e111c2ed000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000e111c2ed00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000e111c2ed00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1408	msiexec.exe
1408	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2996	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2996	msiexec.exe
Token: SeSecurityPrivilege	1408	msiexec.exe
Token: SeCreateTokenPrivilege	2996	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2996	msiexec.exe
Token: SeLockMemoryPrivilege	2996	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2996	msiexec.exe
Token: SeMachineAccountPrivilege	2996	msiexec.exe
Token: SeTcbPrivilege	2996	msiexec.exe
Token: SeSecurityPrivilege	2996	msiexec.exe
Token: SeTakeOwnershipPrivilege	2996	msiexec.exe
Token: SeLoadDriverPrivilege	2996	msiexec.exe
Token: SeSystemProfilePrivilege	2996	msiexec.exe
Token: SeSystemtimePrivilege	2996	msiexec.exe
Token: SeProfSingleProcessPrivilege	2996	msiexec.exe
Token: SeIncBasePriorityPrivilege	2996	msiexec.exe
Token: SeCreatePagefilePrivilege	2996	msiexec.exe
Token: SeCreatePermanentPrivilege	2996	msiexec.exe
Token: SeBackupPrivilege	2996	msiexec.exe
Token: SeRestorePrivilege	2996	msiexec.exe
Token: SeShutdownPrivilege	2996	msiexec.exe
Token: SeDebugPrivilege	2996	msiexec.exe
Token: SeAuditPrivilege	2996	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2996	msiexec.exe
Token: SeChangeNotifyPrivilege	2996	msiexec.exe
Token: SeRemoteShutdownPrivilege	2996	msiexec.exe
Token: SeUndockPrivilege	2996	msiexec.exe
Token: SeSyncAgentPrivilege	2996	msiexec.exe
Token: SeEnableDelegationPrivilege	2996	msiexec.exe
Token: SeManageVolumePrivilege	2996	msiexec.exe
Token: SeImpersonatePrivilege	2996	msiexec.exe
Token: SeCreateGlobalPrivilege	2996	msiexec.exe
Token: SeBackupPrivilege	1652	vssvc.exe
Token: SeRestorePrivilege	1652	vssvc.exe
Token: SeAuditPrivilege	1652	vssvc.exe
Token: SeBackupPrivilege	1408	msiexec.exe
Token: SeRestorePrivilege	1408	msiexec.exe
Token: SeRestorePrivilege	1408	msiexec.exe
Token: SeTakeOwnershipPrivilege	1408	msiexec.exe
Token: SeRestorePrivilege	1408	msiexec.exe
Token: SeTakeOwnershipPrivilege	1408	msiexec.exe
Token: SeRestorePrivilege	1408	msiexec.exe
Token: SeTakeOwnershipPrivilege	1408	msiexec.exe
Token: SeRestorePrivilege	1408	msiexec.exe
Token: SeTakeOwnershipPrivilege	1408	msiexec.exe
Token: SeRestorePrivilege	1408	msiexec.exe
Token: SeTakeOwnershipPrivilege	1408	msiexec.exe
Token: SeRestorePrivilege	1408	msiexec.exe
Token: SeTakeOwnershipPrivilege	1408	msiexec.exe
Token: SeRestorePrivilege	1408	msiexec.exe
Token: SeTakeOwnershipPrivilege	1408	msiexec.exe
Token: SeRestorePrivilege	1408	msiexec.exe
Token: SeTakeOwnershipPrivilege	1408	msiexec.exe
Token: SeRestorePrivilege	1408	msiexec.exe
Token: SeTakeOwnershipPrivilege	1408	msiexec.exe
Token: SeRestorePrivilege	1408	msiexec.exe
Token: SeTakeOwnershipPrivilege	1408	msiexec.exe
Token: SeRestorePrivilege	1408	msiexec.exe
Token: SeTakeOwnershipPrivilege	1408	msiexec.exe
Token: SeRestorePrivilege	1408	msiexec.exe
Token: SeTakeOwnershipPrivilege	1408	msiexec.exe
Token: SeRestorePrivilege	1408	msiexec.exe
Token: SeTakeOwnershipPrivilege	1408	msiexec.exe
Token: SeRestorePrivilege	1408	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2996	msiexec.exe
2996	msiexec.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 3560	1408	msiexec.exe	92
PID 1408 wrote to memory of 3560	1408	msiexec.exe	92
PID 1408 wrote to memory of 968	1408	msiexec.exe	94
PID 1408 wrote to memory of 968	1408	msiexec.exe	94
PID 1408 wrote to memory of 3528	1408	msiexec.exe	95
PID 1408 wrote to memory of 3528	1408	msiexec.exe	95
PID 968 wrote to memory of 4588	968	regsvr32.exe	96
PID 968 wrote to memory of 4588	968	regsvr32.exe	96
PID 968 wrote to memory of 4588	968	regsvr32.exe	96

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\SCAN-016063.pdf.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2996

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3560
- C:\Windows\system32\regsvr32.exe
  regsvr32.exe -n -i:"Install" C:\Users\Admin\AppData\Local\AdobeFontPack\main.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:968
- - C:\Windows\SysWOW64\regsvr32.exe
    -n -i:"Install" C:\Users\Admin\AppData\Local\AdobeFontPack\main.dll
    3⤵
    - Loads dropped DLL
    PID:4588
- C:\Windows\system32\wscript.exe
  wscript.exe C:\Users\Admin\AppData\Local\AdobeFontPack\notify.vbs
  2⤵
  PID:3528

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1652

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8EC9B1D0ABBD7F98B401D425828828CE_A7327B44A69527A27956DB1216E5F535

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_A7327B44A69527A27956DB1216E5F535
Size 727B
SHA256 8b4f7f9bfba7694bba0f73951f1a50e64d3cea560b18c9bb63366abfc0d0cd0a
MD5 7928c3688d855f9c7c83bb0533fdc463
SHA1 d8bd219cd2b4b5d92b9f33ad8f5d4f7469f78755
SHA512 b6df399bdfa2a122dac8206b770faf9fc2af136bff614eaa43b7f134a4a0716165c87e984305471f56b07338faba078386a4efccd4df06375ada74c79303ec82
MD5 SHA1 SHA512

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 d32d6c2ddd4165ff710d503cd874aa96a7c45a74d08b98eb6ba6e1f8ce86bc18
MD5 dbd0ea3109b08b1c543287c52f386fa2
SHA1 f062abf3894c0a5dddb21b19782466db11ead513
SHA512 f2a56b17c9562fe6fa4e8f91a7aca9f1c29053ea0fe26be109b6e0ba99bac756dc4e2d27b2c7c98e60008c8e4ff4c87ff063f4f4272dfb59436f56de14fb3555
MD5 SHA1 SHA512

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_A7327B44A69527A27956DB1216E5F535

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_A7327B44A69527A27956DB1216E5F535
Size 434B
SHA256 2910331a1f60fa5205407ca8dc9191cdf98a9f93a820a29ba992581c68109261
MD5 c8bbd7330249824da2efcf41ce87bc63
SHA1 951af2d7a960cf2d1bb6696e3aed293fdc7f70b1
SHA512 c64680dcd01a6aecfcef363fec48b6e5f9f03ef63b0ada84ac5a47874e88fd42749dc6b6708dec9d6f6def43a272f91e96c26896de440e802f81b3fa79e3da9f
MD5 SHA1 SHA512

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 f416f1cb1052bc115aca9e5eb1bb0f343df8c289d0ca511a16a5f77c3d371fb5
MD5 277873874cf9cb7dd4692856644838fb
SHA1 091ed643ac2444eb74d6499fc5492245d0f0ba73
SHA512 a1dcac806cf8872eee81c1ae4f90e86927ed9901700f232e568bc2c5d153c4c6854eb32ff0d00004eb6dcd0f8a1b56350701947aeb4e597bcb25e3c2c8e402d7
MD5 SHA1 SHA512

Submit Download

main.dll

Path C:\Users\Admin\AppData\Local\AdobeFontPack\main.dll
Size 401KB
SHA256 14debc481aa0a26d3a0bdeed0e56b3ae9e301220f2606aae624d57a9d0617d6f
MD5 8cb8cf84ab20159702e6803cd6ce364a
SHA1 05103f90540f3e8a9599e9f1ab6a11c791aec393
SHA512 9d9cb037b9c79f88fb89a9757f6c27848d7cc7c448594faf58cedb12925756206106235a2dd44142157e19e2c17535fa942156322768e62579aab55e6a6f64da
SSDEEP 6144:KtugFAmTHh/rONOBHtnee6fIhO1MMwWPzRRTuxeLaRRZMuspQ1fg3o5:stWmTBpHtee6IcUWbHI/RRZMut
MD5 SHA1 SHA512 SSDEEP

Submit Download

main.dll

Path C:\Users\Admin\AppData\Local\AdobeFontPack\main.dll
Size 401KB
SHA256 14debc481aa0a26d3a0bdeed0e56b3ae9e301220f2606aae624d57a9d0617d6f
MD5 8cb8cf84ab20159702e6803cd6ce364a
SHA1 05103f90540f3e8a9599e9f1ab6a11c791aec393
SHA512 9d9cb037b9c79f88fb89a9757f6c27848d7cc7c448594faf58cedb12925756206106235a2dd44142157e19e2c17535fa942156322768e62579aab55e6a6f64da
SSDEEP 6144:KtugFAmTHh/rONOBHtnee6fIhO1MMwWPzRRTuxeLaRRZMuspQ1fg3o5:stWmTBpHtee6IcUWbHI/RRZMut
MD5 SHA1 SHA512 SSDEEP

Submit Download

notify.vbs

Path C:\Users\Admin\AppData\Local\AdobeFontPack\notify.vbs
Size 68B
SHA256 0a7e8fd68575db5f84c18b9a26e4058323d1357e2a29a5b12278e4bfa6939489
MD5 0308aa2c8dab8a69de41f5d16679bb9b
SHA1 c6827bf44a433ff086e787653361859d6f6e2fb3
SHA512 1a1ca92e3c8d52c8b5adbb3117a88d8a2a8c33eaf2f7b0d620fe006653f57f4ba0b803884616594ca31e13a1b0b59ddae52cecf044621ec44371084dac6beb72
MD5 SHA1 SHA512

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 23.0MB
SHA256 06edfdc290dbe31328207a1d97b21ec904ca490115cc87f7d66f0f49d1292623
MD5 65059402c26eba042774956bb02d7b14
SHA1 6a644043de7670bb6ea1be28689c8d7d5a8cf332
SHA512 1e7212c52ed5c2ca4a60333a70a398535fb0ba719d3839578b6c365f2e8343524bc80c845c2a30e6b13bac5d191c954870263773772247a22f5f8cca1326a132
SSDEEP 24576:/jdmOnI8doO/vvTLU5mOKl7bCBEZWtgjGBQ9UiAAZt6r1cO2Ijd/vPO8P:B
MD5 SHA1 SHA512 SSDEEP

Submit Download

{beddc012-afaa-4887-a688-96cd0b60b882}_OnDiskSnapshotProp

Path \??\Volume{edc211e1-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{beddc012-afaa-4887-a688-96cd0b60b882}_OnDiskSnapshotProp
Size 5KB
SHA256 fe8477621103e28e7c1e05fb8ec33f9ebd2a5581f32a64acbfc77f6b2cdc6907
MD5 6777b11e8369b361751ba925846412c2
SHA1 0c98fd825e34d842302ae982b6f0198a9d296416
SHA512 0871f800a6a9a0ceba684116f1d924cec14d3146577a6d5fbf01135b2ae30c98c05de3d16bc92667434f80dfc8d4324b276d327e0e5d4a0afb007d7d0a9f8069
SSDEEP 96:FnnDcC8hVRLlh3KDD84LTHzbOHXOHBlBRQn8Sa9XE56tRSVQEJN:xnvORLlsb++CzJN
MD5 SHA1 SHA512 SSDEEP

Submit Download