mountlocker | 30050b3673c720729cd6a61803059b16dd3aa526683e7342aae0261e4c78fa83

Resubmissions

14-09-2022 11:45

220914-nwrncadhel 10

Analysis

max time kernel
96s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
14-09-2022 11:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

30050b3673c720729cd6a61803059b16dd3aa526683e7342aae0261e4c78fa83.msi
Size

112KB
MD5

ce3969ab935f0f5b1301cd70d2e59696
SHA1

e70d3341a6e2cc8ae0f140075837ceac4453b947
SHA256

30050b3673c720729cd6a61803059b16dd3aa526683e7342aae0261e4c78fa83
SHA512

20998be53a994d7adab2b71bafccec1eeb93e356965582161fa1fccea023fbf62b0145adf5e0621118f00a4ea12a71fbb5de2fdd129d92879502a5a3da019a36
SSDEEP

1536:y7WSmywADwaY6FIsr4XSZ32tcOGwpin2NI2F4cdJ0DLx0DL:y7WgpDwd6+srGi32tcOGwpin2NMcd

Score

10^/10

mountlocker ransomware

Malware Config

Extracted

Path

\??\c:\odt\RecoveryManual.html

Ransom Note

<html> <head> <title>RECOVERY MANUAL</title> </head> <body> <h1>Your ClientId:</h1> <pre> d11ebd6225c2dd096733ff8dad28b6432dcc8b7ecaa86f15abe00375993d6d58 </pre> <hr/> /!\ YOUR COMPANY' NETWORK HAS BEEN HACKED /!\ All your important documents have been encrypted and transferred to our premises! <hr/> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE WILL PERMANENTLY CORRUPT IT. DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES. However there is a solution for your problem! We can support you with your data decryption for a monetary reward. Also we will destroy your private data from our premises. And we can prove our decryption capabilities by decrypting couple of your files free of charge. Here are the next steps to get your valuable data back and get it wiped out from our premises: <a href="http://qiludmxlqqotacf62iycexcohbka4ezresf5jmwdoh7iyk3tgguzaaqd.onion/?cid=d11ebd6225c2dd096733ff8dad28b6432dcc8b7ecaa86f15abe00375993d6d58">http://qiludmxlqqotacf62iycexcohbka4ezresf5jmwdoh7iyk3tgguzaaqd.onion/?cid=d11ebd6225c2dd096733ff8dad28b6432dcc8b7ecaa86f15abe00375993d6d58</a> * Note that you need installed Tor Browser to open this kind of links. Follow the instructions to install/run Tor Browser: 1. Go to TOR Project website https://www.torproject.org using your usual browser (Chrome, Firefox, Internet Explorer or Edge) 2. Click "Download Tor Browser" and pick right version for your Operation System (this is Windows in 99.9% of cases) 3. Download and Install Tor Browser 4. After installation finished, click on "Tor Browser" link from your Desktop 5. By using Tor Browser visit <a href="http://qiludmxlqqotacf62iycexcohbka4ezresf5jmwdoh7iyk3tgguzaaqd.onion/?cid=d11ebd6225c2dd096733ff8dad28b6432dcc8b7ecaa86f15abe00375993d6d58">http://qiludmxlqqotacf62iycexcohbka4ezresf5jmwdoh7iyk3tgguzaaqd.onion/?cid=d11ebd6225c2dd096733ff8dad28b6432dcc8b7ecaa86f15abe00375993d6d58</a> 6. Copy your client id from the top of this document and paste it into Authorization window if requested 7. This will start a chat with our security experts. Please note, sometimes our team is away from keyboard, but make sure they will reply you back as soon as possible. Also, we kindly request you to contact with us as soon as possible. We will start publishing your private data to the Internet if you don't get in touch with us within next few days. </body> </html>

Signatures

Detected Mount Locker ransomware 2 IoCs

resource	yara_rule
behavioral2/files/0x0001000000022e26-134.dat	RANSOM_mountlocker
behavioral2/files/0x0001000000022e26-135.dat	RANSOM_mountlocker

MountLocker Ransomware
Ransomware family first seen in late 2020, which threatens to leak files if ransom is not paid.
ransomware mountlocker

Modifies extensions of user files 12 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File opened for modification	\??\c:\Users\Admin\Pictures\UseRename.raw.ReadManual.64BD3273	MsiExec.exe
File renamed	C:\Users\Admin\Pictures\BackupRequest.png => \??\c:\Users\Admin\Pictures\BackupRequest.png.ReadManual.64BD3273	MsiExec.exe
File opened for modification	\??\c:\Users\Admin\Pictures\BackupRequest.png.ReadManual.64BD3273	MsiExec.exe
File opened for modification	\??\c:\Users\Admin\Pictures\NewShow.raw.ReadManual.64BD3273	MsiExec.exe
File renamed	C:\Users\Admin\Pictures\PublishStop.tif => \??\c:\Users\Admin\Pictures\PublishStop.tif.ReadManual.64BD3273	MsiExec.exe
File opened for modification	\??\c:\Users\Admin\Pictures\PublishStop.tif.ReadManual.64BD3273	MsiExec.exe
File renamed	C:\Users\Admin\Pictures\SwitchImport.tif => \??\c:\Users\Admin\Pictures\SwitchImport.tif.ReadManual.64BD3273	MsiExec.exe
File opened for modification	\??\c:\Users\Admin\Pictures\SwitchImport.tif.ReadManual.64BD3273	MsiExec.exe
File renamed	C:\Users\Admin\Pictures\UseRename.raw => \??\c:\Users\Admin\Pictures\UseRename.raw.ReadManual.64BD3273	MsiExec.exe
File renamed	C:\Users\Admin\Pictures\AssertRead.raw => \??\c:\Users\Admin\Pictures\AssertRead.raw.ReadManual.64BD3273	MsiExec.exe
File opened for modification	\??\c:\Users\Admin\Pictures\AssertRead.raw.ReadManual.64BD3273	MsiExec.exe
File renamed	C:\Users\Admin\Pictures\NewShow.raw => \??\c:\Users\Admin\Pictures\NewShow.raw.ReadManual.64BD3273	MsiExec.exe

Loads dropped DLL 1 IoCs

pid	Process
1308	MsiExec.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\teyefibowo\ReadMe.txt	msiexec.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI519A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5238.tmp	msiexec.exe
File created	C:\Windows\Installer\e574ff7.msi	msiexec.exe
File created	C:\Windows\Installer\e574ff5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{792475A9-82DA-4E6B-A6E6-443B78D1084B}	msiexec.exe
File opened for modification	C:\Windows\Installer\e574ff5.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000045e03923b2b2bc3e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000045e039230000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff00000000070001000068090045e03923000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000045e0392300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000045e0392300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe

Modifies registry class 28 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\.64BD3273	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\.64BD3273\shell\Open	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A574297AD28B6E46A6E44B3871D80B4\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\7E99BE60AB9492F4EB40B1E891C24BA8	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A574297AD28B6E46A6E44B3871D80B4\SourceList\PackageName = "30050b3673c720729cd6a61803059b16dd3aa526683e7342aae0261e4c78fa83.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A574297AD28B6E46A6E44B3871D80B4\SourceList\Media\1 = ";CD-ROM #1"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\.64BD3273\shell	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A574297AD28B6E46A6E44B3871D80B4\PackageCode = "B6AA8A37A2DF03A4195563F9732E8294"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A574297AD28B6E46A6E44B3871D80B4\SourceList\Media\DiskPrompt = "zawani 3.53 Installation"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A574297AD28B6E46A6E44B3871D80B4\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\7E99BE60AB9492F4EB40B1E891C24BA8\9A574297AD28B6E46A6E44B3871D80B4	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A574297AD28B6E46A6E44B3871D80B4\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A574297AD28B6E46A6E44B3871D80B4\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A574297AD28B6E46A6E44B3871D80B4\ProductName = "zawani"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A574297AD28B6E46A6E44B3871D80B4\Version = "53805056"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A574297AD28B6E46A6E44B3871D80B4\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A574297AD28B6E46A6E44B3871D80B4\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\.64BD3273\shell\Open\command\ = "explorer.exe RecoveryManual.html"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A574297AD28B6E46A6E44B3871D80B4\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A574297AD28B6E46A6E44B3871D80B4\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A574297AD28B6E46A6E44B3871D80B4\SourceList	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\.64BD3273\shell\Open\command	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A574297AD28B6E46A6E44B3871D80B4\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A574297AD28B6E46A6E44B3871D80B4	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A574297AD28B6E46A6E44B3871D80B4\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9A574297AD28B6E46A6E44B3871D80B4	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9A574297AD28B6E46A6E44B3871D80B4\iDAAAF618FF524449BD8193E4A7C12996	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9A574297AD28B6E46A6E44B3871D80B4\DeploymentFlags = "3"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3060	msiexec.exe
3060	msiexec.exe
1308	MsiExec.exe
1308	MsiExec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4892	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4892	msiexec.exe
Token: SeSecurityPrivilege	3060	msiexec.exe
Token: SeCreateTokenPrivilege	4892	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4892	msiexec.exe
Token: SeLockMemoryPrivilege	4892	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4892	msiexec.exe
Token: SeMachineAccountPrivilege	4892	msiexec.exe
Token: SeTcbPrivilege	4892	msiexec.exe
Token: SeSecurityPrivilege	4892	msiexec.exe
Token: SeTakeOwnershipPrivilege	4892	msiexec.exe
Token: SeLoadDriverPrivilege	4892	msiexec.exe
Token: SeSystemProfilePrivilege	4892	msiexec.exe
Token: SeSystemtimePrivilege	4892	msiexec.exe
Token: SeProfSingleProcessPrivilege	4892	msiexec.exe
Token: SeIncBasePriorityPrivilege	4892	msiexec.exe
Token: SeCreatePagefilePrivilege	4892	msiexec.exe
Token: SeCreatePermanentPrivilege	4892	msiexec.exe
Token: SeBackupPrivilege	4892	msiexec.exe
Token: SeRestorePrivilege	4892	msiexec.exe
Token: SeShutdownPrivilege	4892	msiexec.exe
Token: SeDebugPrivilege	4892	msiexec.exe
Token: SeAuditPrivilege	4892	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4892	msiexec.exe
Token: SeChangeNotifyPrivilege	4892	msiexec.exe
Token: SeRemoteShutdownPrivilege	4892	msiexec.exe
Token: SeUndockPrivilege	4892	msiexec.exe
Token: SeSyncAgentPrivilege	4892	msiexec.exe
Token: SeEnableDelegationPrivilege	4892	msiexec.exe
Token: SeManageVolumePrivilege	4892	msiexec.exe
Token: SeImpersonatePrivilege	4892	msiexec.exe
Token: SeCreateGlobalPrivilege	4892	msiexec.exe
Token: SeBackupPrivilege	5068	vssvc.exe
Token: SeRestorePrivilege	5068	vssvc.exe
Token: SeAuditPrivilege	5068	vssvc.exe
Token: SeBackupPrivilege	3060	msiexec.exe
Token: SeRestorePrivilege	3060	msiexec.exe
Token: SeRestorePrivilege	3060	msiexec.exe
Token: SeTakeOwnershipPrivilege	3060	msiexec.exe
Token: SeRestorePrivilege	3060	msiexec.exe
Token: SeTakeOwnershipPrivilege	3060	msiexec.exe
Token: SeRestorePrivilege	3060	msiexec.exe
Token: SeTakeOwnershipPrivilege	3060	msiexec.exe
Token: SeDebugPrivilege	1308	MsiExec.exe
Token: SeTakeOwnershipPrivilege	1308	MsiExec.exe
Token: SeRestorePrivilege	1308	MsiExec.exe
Token: SeBackupPrivilege	4312	srtasks.exe
Token: SeRestorePrivilege	4312	srtasks.exe
Token: SeSecurityPrivilege	4312	srtasks.exe
Token: SeTakeOwnershipPrivilege	4312	srtasks.exe
Token: SeBackupPrivilege	4312	srtasks.exe
Token: SeRestorePrivilege	4312	srtasks.exe
Token: SeSecurityPrivilege	4312	srtasks.exe
Token: SeTakeOwnershipPrivilege	4312	srtasks.exe
Token: SeRestorePrivilege	3060	msiexec.exe
Token: SeTakeOwnershipPrivilege	3060	msiexec.exe
Token: SeRestorePrivilege	3060	msiexec.exe
Token: SeTakeOwnershipPrivilege	3060	msiexec.exe
Token: SeRestorePrivilege	3060	msiexec.exe
Token: SeTakeOwnershipPrivilege	3060	msiexec.exe
Token: SeRestorePrivilege	3060	msiexec.exe
Token: SeTakeOwnershipPrivilege	3060	msiexec.exe
Token: SeRestorePrivilege	3060	msiexec.exe
Token: SeTakeOwnershipPrivilege	3060	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4892	msiexec.exe
4892	msiexec.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 4312	3060	msiexec.exe	95
PID 3060 wrote to memory of 4312	3060	msiexec.exe	95
PID 3060 wrote to memory of 1308	3060	msiexec.exe	97
PID 3060 wrote to memory of 1308	3060	msiexec.exe	97
PID 3060 wrote to memory of 1308	3060	msiexec.exe	97
PID 1308 wrote to memory of 3736	1308	MsiExec.exe	100
PID 1308 wrote to memory of 3736	1308	MsiExec.exe	100
PID 1308 wrote to memory of 3736	1308	MsiExec.exe	100
PID 3736 wrote to memory of 2320	3736	cmd.exe	103
PID 3736 wrote to memory of 2320	3736	cmd.exe	103
PID 3736 wrote to memory of 2320	3736	cmd.exe	103

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
2320	attrib.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\30050b3673c720729cd6a61803059b16dd3aa526683e7342aae0261e4c78fa83.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4892

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4312
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3F9ECCCE5462BD24F49DFE2934990294
  2⤵
  - Modifies extensions of user files
  - Loads dropped DLL
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1308
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\\0E578CFE.bat" "C:\Windows\Installer\MSI5238.tmp""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3736
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -r -h "C:\Windows\Installer\MSI5238.tmp"
      4⤵
      Views/modifies file attributes
      PID:2320

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5068

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0E578CFE.bat

Filesize
65B

MD5
348cae913e496198548854f5ff2f6d1e

SHA1
a07655b9020205bd47084afd62a8bb22b48c0cdc

SHA256
c80128f51871eec3ae2057989a025ce244277c1c180498a5aaef45d5214b8506

SHA512
799796736d41d3fcb5a7c859571bb025ca2d062c4b86e078302be68c1a932ed4f78e003640df5405274364b5a9a9c0ba5e37177997683ee7ab54e5267590b611

Download Submit
C:\Windows\Installer\MSI5238.tmp

Filesize
77KB

MD5
0aacf2c41ba9b872a52055ffcaeaef15

SHA1
c09b509699aeef71f3e205d53c5f4ff71cb48570

SHA256
31630d16f4564c7a214a206a58f60b7623cd1b3abb823d10ed50aa077ca33585

SHA512
d259de51d22d72d27d5947530317661b97ba8fcc36e7a2ad4835e98bc311ef1aa5964f939660733171934f6aefa82d8b76a6f9f04137e1aeca63d592f0fb26ec

Download Submit
C:\Windows\Installer\MSI5238.tmp

Filesize
77KB

MD5
0aacf2c41ba9b872a52055ffcaeaef15

SHA1
c09b509699aeef71f3e205d53c5f4ff71cb48570

SHA256
31630d16f4564c7a214a206a58f60b7623cd1b3abb823d10ed50aa077ca33585

SHA512
d259de51d22d72d27d5947530317661b97ba8fcc36e7a2ad4835e98bc311ef1aa5964f939660733171934f6aefa82d8b76a6f9f04137e1aeca63d592f0fb26ec

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
11.8MB

MD5
b43d4014007f631dbed16817cc643e04

SHA1
909428cf19445fcf213bccf36888e281f7879f12

SHA256
71280fb979ac37e70f178e78cd76fa8f3ab6e7b590ba63fdb30ebb560a1662e2

SHA512
96432953e17219c062cc0fadc99b9982adc599c2d49f302a7075bbe7a323c2ef52e99ef9d9190745fefc9967f04fa104508f8c2dbcf3033cf38e32a12b6b99f9

Download Submit
\??\Volume{2339e045-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{158554e3-17d8-4ca2-a40c-1d056fcd61a9}_OnDiskSnapshotProp

Filesize
5KB

MD5
ac2ed9617897c481690d795bdbbf9517

SHA1
aacfe3f59bfc783ff8b7f35d449a99ca63a4c96b

SHA256
561ae405ca630f9863598c4bd6cfcb2cc2be973da75ef38c087e6ae8080e33fe

SHA512
ab47fa4aee2cebce07c1f8653c253e7061c4eee6ca8bc61f657afe68b6363be37330db45a76a93e7b563529ff8ebeb62adf033b5989466ec8e308bb436676e0e

Download Submit