ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b

Analysis

max time kernel
151s
max time network
51s
platform
windows7_x64
resource
win7-20220715-es
resource tags

arch:x64arch:x86image:win7-20220715-eslocale:es-esos:windows7-x64systemwindows
submitted
19-07-2022 15:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Size

11.0MB
MD5

88dfe0c8151c63d9ed0af236d4d64945
SHA1

36fd988674e2148cb6f9de9fd23ebefb935de164
SHA256

ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b
SHA512

60c065504e3f34b3d8424749bdd9f964bc3dc7cb46ba8a60cd898092459b4f5163ebcb71b5c621a2feb2fb0db43ef824bbe92e8f1558b864240a33ae01ecf9c0

Score

9^/10

evasion persistence themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

FileNew.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ FileNew.exe
Executes dropped EXE 1 IoCs

Processes:

FileNew.exe

pid process

1520 FileNew.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	FileNew.exe

pid	process
1520	FileNew.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

FileNew.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	FileNew.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	FileNew.exe

Drops startup file 2 IoCs

Processes:

FileNew.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.lnk	FileNew.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adminmuymjbwvfx.vbs	FileNew.exe

Loads dropped DLL 10 IoCs

Processes:

ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exeMsiExec.exeMsiExec.exeFileNew.exe

pid	process
1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
1172	MsiExec.exe
1968	MsiExec.exe
1968	MsiExec.exe
1968	MsiExec.exe
1968	MsiExec.exe
1968	MsiExec.exe
1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
1520	FileNew.exe

Themida packer 9 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\Your Company\add-in 3.1.0\install\D46D527\aspack.dll	themida
C:\Users\Admin\AppData\Roaming\Your Company\add-in\aspack.dll	themida
\Users\Admin\AppData\Roaming\Your Company\add-in\aspack.dll	themida
behavioral1/memory/1520-87-0x0000000000790000-0x00000000032D6000-memory.dmp	themida
behavioral1/memory/1520-89-0x0000000000790000-0x00000000032D6000-memory.dmp	themida
behavioral1/memory/1520-90-0x0000000000790000-0x00000000032D6000-memory.dmp	themida
behavioral1/memory/1520-91-0x0000000000790000-0x00000000032D6000-memory.dmp	themida
behavioral1/memory/1520-92-0x0000000000790000-0x00000000032D6000-memory.dmp	themida
behavioral1/memory/1520-93-0x0000000000790000-0x00000000032D6000-memory.dmp	themida

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

FileNew.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Windows\CurrentVersion\Run\FileNew.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Your Company\\add-in\\FileNew.exe"	FileNew.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

FileNew.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA FileNew.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	FileNew.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exemsiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\G:	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
File opened (read-only)	\??\I:	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
File opened (read-only)	\??\R:	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\B:	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
File opened (read-only)	\??\X:	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
File opened (read-only)	\??\Z:	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\E:	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
File opened (read-only)	\??\L:	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
File opened (read-only)	\??\P:	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\M:	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
File opened (read-only)	\??\N:	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\V:	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\F:	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\O:	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
File opened (read-only)	\??\Q:	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
File opened (read-only)	\??\U:	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
File opened (read-only)	\??\S:	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\A:	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

FileNew.exe

pid process

1520 FileNew.exe

pid	process
1520	FileNew.exe

Drops file in Windows directory 11 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Windows\Installer\6c6cb8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\6c6cb8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7C90.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7D4C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\6c6cba.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8A3D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7DAB.tmp	msiexec.exe
File created	C:\Windows\Installer\6c6cba.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI88D3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8903.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msiexec.exeFileNew.exe

pid	process
1728	msiexec.exe
1728	msiexec.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe
1520	FileNew.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exeffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe

description	pid	process
Token: SeRestorePrivilege	1728	msiexec.exe
Token: SeTakeOwnershipPrivilege	1728	msiexec.exe
Token: SeSecurityPrivilege	1728	msiexec.exe
Token: SeCreateTokenPrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeAssignPrimaryTokenPrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeLockMemoryPrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeIncreaseQuotaPrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeMachineAccountPrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeTcbPrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeSecurityPrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeTakeOwnershipPrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeLoadDriverPrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeSystemProfilePrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeSystemtimePrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeProfSingleProcessPrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeIncBasePriorityPrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeCreatePagefilePrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeCreatePermanentPrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeBackupPrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeRestorePrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeShutdownPrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeDebugPrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeAuditPrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeSystemEnvironmentPrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeChangeNotifyPrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeRemoteShutdownPrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeUndockPrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeSyncAgentPrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeEnableDelegationPrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeManageVolumePrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeImpersonatePrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeCreateGlobalPrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeCreateTokenPrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeAssignPrimaryTokenPrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeLockMemoryPrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeIncreaseQuotaPrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeMachineAccountPrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeTcbPrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeSecurityPrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeTakeOwnershipPrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeLoadDriverPrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeSystemProfilePrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeSystemtimePrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeProfSingleProcessPrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeIncBasePriorityPrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeCreatePagefilePrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeCreatePermanentPrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeBackupPrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeRestorePrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeShutdownPrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeDebugPrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeAuditPrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeSystemEnvironmentPrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeChangeNotifyPrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeRemoteShutdownPrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeUndockPrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeSyncAgentPrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeEnableDelegationPrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeManageVolumePrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeImpersonatePrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeCreateGlobalPrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeCreateTokenPrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeAssignPrimaryTokenPrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
Token: SeLockMemoryPrivilege	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exemsiexec.exe

pid process

1292 ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
856 msiexec.exe
856 msiexec.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

msiexec.exeffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe

description	pid	process	target process
PID 1728 wrote to memory of 1172	1728	msiexec.exe	MsiExec.exe
PID 1728 wrote to memory of 1172	1728	msiexec.exe	MsiExec.exe
PID 1728 wrote to memory of 1172	1728	msiexec.exe	MsiExec.exe
PID 1728 wrote to memory of 1172	1728	msiexec.exe	MsiExec.exe
PID 1728 wrote to memory of 1172	1728	msiexec.exe	MsiExec.exe
PID 1728 wrote to memory of 1172	1728	msiexec.exe	MsiExec.exe
PID 1728 wrote to memory of 1172	1728	msiexec.exe	MsiExec.exe
PID 1292 wrote to memory of 856	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe	msiexec.exe
PID 1292 wrote to memory of 856	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe	msiexec.exe
PID 1292 wrote to memory of 856	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe	msiexec.exe
PID 1292 wrote to memory of 856	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe	msiexec.exe
PID 1292 wrote to memory of 856	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe	msiexec.exe
PID 1292 wrote to memory of 856	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe	msiexec.exe
PID 1292 wrote to memory of 856	1292	ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe	msiexec.exe
PID 1728 wrote to memory of 1968	1728	msiexec.exe	MsiExec.exe
PID 1728 wrote to memory of 1968	1728	msiexec.exe	MsiExec.exe
PID 1728 wrote to memory of 1968	1728	msiexec.exe	MsiExec.exe
PID 1728 wrote to memory of 1968	1728	msiexec.exe	MsiExec.exe
PID 1728 wrote to memory of 1968	1728	msiexec.exe	MsiExec.exe
PID 1728 wrote to memory of 1968	1728	msiexec.exe	MsiExec.exe
PID 1728 wrote to memory of 1968	1728	msiexec.exe	MsiExec.exe
PID 1728 wrote to memory of 1520	1728	msiexec.exe	FileNew.exe
PID 1728 wrote to memory of 1520	1728	msiexec.exe	FileNew.exe
PID 1728 wrote to memory of 1520	1728	msiexec.exe	FileNew.exe
PID 1728 wrote to memory of 1520	1728	msiexec.exe	FileNew.exe

C:\Users\Admin\AppData\Local\Temp\ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe
"C:\Users\Admin\AppData\Local\Temp\ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1292

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Your Company\add-in 3.1.0\install\D46D527\add-in.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\ffc153b44cf9232a5256efdc907d658af451c08bd5b60657eb4dfad464639a8b.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1658245741 " AI_EUIMSI=""
2⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
PID:856

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1728

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 22ADB2F4B65EB229CEFD851785122EF1 C
2⤵
- Loads dropped DLL
PID:1172

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 340EDB74DF49A542DC579FA7DD475356
2⤵
- Loads dropped DLL
PID:1968

C:\Users\Admin\AppData\Roaming\Your Company\add-in\FileNew.exe
"C:\Users\Admin\AppData\Roaming\Your Company\add-in\FileNew.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1520

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MSI67D8.tmp
Filesize
379KB

MD5
305a50c391a94b42a68958f3f89906fb

SHA1
4110d68d71f3594f5d3bdfca91a1c759ab0105d4

SHA256
f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f

SHA512
fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7

Download Submit
C:\Users\Admin\AppData\Roaming\Your Company\add-in 3.1.0\install\D46D527\FileNew.exe
Filesize
557KB

MD5
e33bcdd61d70a1961df2c6d7f0c18351

SHA1
958ff5402b7e05be694b00bb760f124b79fe0c7d

SHA256
b1aad17f65fbdb5fb75e13a00bd3b1db6e5168f8e4419e57b13fb34dc48c4ba4

SHA512
d4bb02140173417986d559b7ab96b3388478a4494ce652ac01e6a84297f86d772408aa6591ace45e75cce589298ee3a9a7864624a25a0cbd7d1ced197bd4946b

Download Submit
C:\Users\Admin\AppData\Roaming\Your Company\add-in 3.1.0\install\D46D527\add-in.msi
Filesize
1.1MB

MD5
9ca56b1b068e1146de0b3b6914163807

SHA1
0f8d5c711e792414b3e788be0afc00a8d6025ca0

SHA256
d6fcfd7768dc960113e63a2a1f226b92859269570e93f9691819c3c8aec1d67e

SHA512
c5b5fc6b10fcb6c6f1b9fa977dd34fbd0d3210e6f69c7107ca9c645aa94947657457d8e9afb4997112676af119fa6083381c5a4009faff511809f2cd3646f69d

Download Submit
C:\Users\Admin\AppData\Roaming\Your Company\add-in 3.1.0\install\D46D527\aspack.dll
Filesize
8.1MB

MD5
6f7ba66990c3036f8cdc3880821c4ae3

SHA1
ab63d5741c652ec6cd5f58c9e76ddb3d00e5ee2b

SHA256
a74205c03943d53d6268f206754735e76be7615c5e7745b67c9118b8e3361883

SHA512
919a2b6478507ab0aaf53f31cb5e91d20ea411c508d01d35e53b1e43cb54e63cd8a180688d825f8ca9d8961be4a0dea030c9664040ccb0868288e3db3231b6a4

Download Submit
C:\Users\Admin\AppData\Roaming\Your Company\add-in\FileNew.exe
Filesize
557KB

MD5
e33bcdd61d70a1961df2c6d7f0c18351

SHA1
958ff5402b7e05be694b00bb760f124b79fe0c7d

SHA256
b1aad17f65fbdb5fb75e13a00bd3b1db6e5168f8e4419e57b13fb34dc48c4ba4

SHA512
d4bb02140173417986d559b7ab96b3388478a4494ce652ac01e6a84297f86d772408aa6591ace45e75cce589298ee3a9a7864624a25a0cbd7d1ced197bd4946b

Download Submit
C:\Users\Admin\AppData\Roaming\Your Company\add-in\FileNew.exe
Filesize
557KB

MD5
e33bcdd61d70a1961df2c6d7f0c18351

SHA1
958ff5402b7e05be694b00bb760f124b79fe0c7d

SHA256
b1aad17f65fbdb5fb75e13a00bd3b1db6e5168f8e4419e57b13fb34dc48c4ba4

SHA512
d4bb02140173417986d559b7ab96b3388478a4494ce652ac01e6a84297f86d772408aa6591ace45e75cce589298ee3a9a7864624a25a0cbd7d1ced197bd4946b

Download Submit
C:\Users\Admin\AppData\Roaming\Your Company\add-in\aspack.dll
Filesize
8.1MB

MD5
6f7ba66990c3036f8cdc3880821c4ae3

SHA1
ab63d5741c652ec6cd5f58c9e76ddb3d00e5ee2b

SHA256
a74205c03943d53d6268f206754735e76be7615c5e7745b67c9118b8e3361883

SHA512
919a2b6478507ab0aaf53f31cb5e91d20ea411c508d01d35e53b1e43cb54e63cd8a180688d825f8ca9d8961be4a0dea030c9664040ccb0868288e3db3231b6a4

Download Submit
C:\Windows\Installer\MSI7C90.tmp
Filesize
379KB

MD5
305a50c391a94b42a68958f3f89906fb

SHA1
4110d68d71f3594f5d3bdfca91a1c759ab0105d4

SHA256
f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f

SHA512
fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7

Download Submit
C:\Windows\Installer\MSI7D4C.tmp
Filesize
379KB

MD5
305a50c391a94b42a68958f3f89906fb

SHA1
4110d68d71f3594f5d3bdfca91a1c759ab0105d4

SHA256
f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f

SHA512
fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7

Download Submit
C:\Windows\Installer\MSI7DAB.tmp
Filesize
379KB

MD5
305a50c391a94b42a68958f3f89906fb

SHA1
4110d68d71f3594f5d3bdfca91a1c759ab0105d4

SHA256
f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f

SHA512
fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7

Download Submit
C:\Windows\Installer\MSI8903.tmp
Filesize
537KB

MD5
d7ec04b009302b83da506b9c63ca775c

SHA1
6fa9ea09b71531754b4cd05814a91032229834c0

SHA256
00c0e19c05f6df1a34cc3593680a6ab43874d6cd62a8046a7add91997cfabcd4

SHA512
171c465fe6f89b9e60da97896990d0b68ef595c3f70ee89b44fcf411352da22a457c41f7b853157f1faa500513419e504696775eefabe520f835ce9be5f4081c

Download Submit
C:\Windows\Installer\MSI8A3D.tmp
Filesize
537KB

MD5
d7ec04b009302b83da506b9c63ca775c

SHA1
6fa9ea09b71531754b4cd05814a91032229834c0

SHA256
00c0e19c05f6df1a34cc3593680a6ab43874d6cd62a8046a7add91997cfabcd4

SHA512
171c465fe6f89b9e60da97896990d0b68ef595c3f70ee89b44fcf411352da22a457c41f7b853157f1faa500513419e504696775eefabe520f835ce9be5f4081c

Download Submit
\Users\Admin\AppData\Local\Temp\MSI67D8.tmp
Filesize
379KB

MD5
305a50c391a94b42a68958f3f89906fb

SHA1
4110d68d71f3594f5d3bdfca91a1c759ab0105d4

SHA256
f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f

SHA512
fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7

Download Submit
\Users\Admin\AppData\Roaming\Your Company\add-in 3.1.0\install\decoder.dll
Filesize
182KB

MD5
52415e1c96d5578c1a6114214426d5c1

SHA1
82f1c6f5edd920b002f4f75ae94ddb9b179fd5a9

SHA256
de54cf4cdede3f772967e2e9613d2584fc5143f30d3dd97e8791fc3f89b0d34f

SHA512
d5e7b037c7b52cddbe8148386dce085d5b372668f08154c66d4b8c3cb4200dc753d930590c50d676d34b6de2ca0d05e7b1aa7f528d087b00fa754a877af708a6

Download Submit
\Users\Admin\AppData\Roaming\Your Company\add-in 3.1.0\install\decoder.dll
Filesize
182KB

MD5
52415e1c96d5578c1a6114214426d5c1

SHA1
82f1c6f5edd920b002f4f75ae94ddb9b179fd5a9

SHA256
de54cf4cdede3f772967e2e9613d2584fc5143f30d3dd97e8791fc3f89b0d34f

SHA512
d5e7b037c7b52cddbe8148386dce085d5b372668f08154c66d4b8c3cb4200dc753d930590c50d676d34b6de2ca0d05e7b1aa7f528d087b00fa754a877af708a6

Download Submit
\Users\Admin\AppData\Roaming\Your Company\add-in 3.1.0\install\decoder.dll
Filesize
182KB

MD5
52415e1c96d5578c1a6114214426d5c1

SHA1
82f1c6f5edd920b002f4f75ae94ddb9b179fd5a9

SHA256
de54cf4cdede3f772967e2e9613d2584fc5143f30d3dd97e8791fc3f89b0d34f

SHA512
d5e7b037c7b52cddbe8148386dce085d5b372668f08154c66d4b8c3cb4200dc753d930590c50d676d34b6de2ca0d05e7b1aa7f528d087b00fa754a877af708a6

Download Submit
\Users\Admin\AppData\Roaming\Your Company\add-in\aspack.dll
Filesize
8.1MB

MD5
6f7ba66990c3036f8cdc3880821c4ae3

SHA1
ab63d5741c652ec6cd5f58c9e76ddb3d00e5ee2b

SHA256
a74205c03943d53d6268f206754735e76be7615c5e7745b67c9118b8e3361883

SHA512
919a2b6478507ab0aaf53f31cb5e91d20ea411c508d01d35e53b1e43cb54e63cd8a180688d825f8ca9d8961be4a0dea030c9664040ccb0868288e3db3231b6a4

Download Submit
\Windows\Installer\MSI7C90.tmp
Filesize
379KB

MD5
305a50c391a94b42a68958f3f89906fb

SHA1
4110d68d71f3594f5d3bdfca91a1c759ab0105d4

SHA256
f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f

SHA512
fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7

Download Submit
\Windows\Installer\MSI7D4C.tmp
Filesize
379KB

MD5
305a50c391a94b42a68958f3f89906fb

SHA1
4110d68d71f3594f5d3bdfca91a1c759ab0105d4

SHA256
f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f

SHA512
fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7

Download Submit
\Windows\Installer\MSI7DAB.tmp
Filesize
379KB

MD5
305a50c391a94b42a68958f3f89906fb

SHA1
4110d68d71f3594f5d3bdfca91a1c759ab0105d4

SHA256
f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f

SHA512
fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7

Download Submit
\Windows\Installer\MSI8903.tmp
Filesize
537KB

MD5
d7ec04b009302b83da506b9c63ca775c

SHA1
6fa9ea09b71531754b4cd05814a91032229834c0

SHA256
00c0e19c05f6df1a34cc3593680a6ab43874d6cd62a8046a7add91997cfabcd4

SHA512
171c465fe6f89b9e60da97896990d0b68ef595c3f70ee89b44fcf411352da22a457c41f7b853157f1faa500513419e504696775eefabe520f835ce9be5f4081c

Download Submit
\Windows\Installer\MSI8A3D.tmp
Filesize
537KB

MD5
d7ec04b009302b83da506b9c63ca775c

SHA1
6fa9ea09b71531754b4cd05814a91032229834c0

SHA256
00c0e19c05f6df1a34cc3593680a6ab43874d6cd62a8046a7add91997cfabcd4

SHA512
171c465fe6f89b9e60da97896990d0b68ef595c3f70ee89b44fcf411352da22a457c41f7b853157f1faa500513419e504696775eefabe520f835ce9be5f4081c

Download Submit
memory/856-63-0x0000000000000000-mapping.dmp

Download
memory/1172-59-0x0000000000000000-mapping.dmp

Download
memory/1292-54-0x0000000075691000-0x0000000075693000-memory.dmp

Filesize
8KB

Download
memory/1292-55-0x0000000073A61000-0x0000000073A63000-memory.dmp

Filesize
8KB

Download
memory/1520-81-0x0000000000000000-mapping.dmp

Download
memory/1520-87-0x0000000000790000-0x00000000032D6000-memory.dmp

Filesize
43.3MB

Download
memory/1520-88-0x0000000076FD0000-0x0000000077150000-memory.dmp

Filesize
1.5MB

Download
memory/1520-89-0x0000000000790000-0x00000000032D6000-memory.dmp

Filesize
43.3MB

Download
memory/1520-90-0x0000000000790000-0x00000000032D6000-memory.dmp

Filesize
43.3MB

Download
memory/1520-91-0x0000000000790000-0x00000000032D6000-memory.dmp

Filesize
43.3MB

Download
memory/1520-92-0x0000000000790000-0x00000000032D6000-memory.dmp

Filesize
43.3MB

Download
memory/1520-93-0x0000000000790000-0x00000000032D6000-memory.dmp

Filesize
43.3MB

Download
memory/1728-58-0x000007FEFB671000-0x000007FEFB673000-memory.dmp

Filesize
8KB

Download
memory/1968-66-0x0000000000000000-mapping.dmp

Download