Analysis
-
max time kernel
56s -
max time network
62s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
-
submitted
29-09-2022 12:29
General
-
Target
Suricata-6.0.6-1-64bit.msi
-
Size
22.6MB
-
MD5
8b9258c77ca6bebff5a0cbf116c02129
-
SHA1
750ecdf0c3d3b63ae0f5d3f753731345e59caedc
-
SHA256
ce545bb7539dd09990bc9cf9d8a78492124d6a132f9d86d0b5fa60c0ae4186b2
-
SHA512
cd1a0847d70497c4abe2a7d538d0b13461806250340158677c9f5de9258ef99ec625c5366a853a05d8809dcb7c1dd616c2cdcb249a25fb20bfcd995198f69219
-
SSDEEP
393216:Zv+Pjv1e3OWSr1hE0UElR69nfSbkC5ZUnD8+2QZpmRuqzQbtitLPEjTJ1YkfFnJt:ZAsOWn+6UhZM8+Bm4qzQpUbKT6
Malware Config
Signatures
-
Blocklisted process makes network request 4 IoCs
-
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 43 IoCs
-
Drops file in Windows directory 8 IoCs
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Suricata-6.0.6-1-64bit.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_E6095CD2AECC9011BCD0D7B421356B17Filesize
2KB
MD59b6aa6b016605338fb3cd2008b29ba2f
SHA1d25f576eb5ff15f96689fc7895cef0381ba2a765
SHA2568be33bfe5ed298c9b38c4c38d3995465d303b8c987d6744b4c41857872471d72
SHA512bb2a63d9332033b31940368876d30096786b5c487716693e89ed188f9c0676eb23b3440b4f7bca4c35cb51774e21df7bd2c4e8b136e2ea8bb5d3b145c78e595b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711EFilesize
1KB
MD5edcd4c783b2b2c906602519bd8f697f4
SHA1fc56fded4065d6960c6507cac4264dfd2b038004
SHA256367e0ac4e24f1d1530de05a6abf81d6b572c0546b5aa134c246fa1514582fd90
SHA512cb23a82c06211121e39ed0dbec5928b1a85aca7c25f2c060d609350e3a94bf82e9159a2a4d5e67295fc29bac22c95d525ea2461a0000d24c6c4cb630520f68d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D7833C286363AD25C70511661A83D581_5A754446CB863DF3C298CB4E94FD802EFilesize
510B
MD5b19ef5487c354b415d4ebaf3d57908fb
SHA1997e76d19fb386dac3d16aeab96cabdb9a07952f
SHA256dfb737aafdf4d1fd4484cf6c83cf72a242d15650e792258de22c16df5dc453fa
SHA5127fb06d23e0063c2c658ddb0cd5c50518b93e814c50839da5f4adb4e26b628be677402ebcd9e25576df2a927f233dbb1a244398f4683421d2fa3044dae85aa9d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_E6095CD2AECC9011BCD0D7B421356B17Filesize
488B
MD5fecf3280d167d121a01a14366f78ecaf
SHA142b6c854c83785d963363979548c4300e3e3d86e
SHA25666a833499fd8b511f34e57132b56569f19cea05b232db2114cedf451ca360284
SHA512176bef0c156597bae311f365f0f01bd9a81131902891ec7c381f8d97c76021eb2ce6c9abacb46bf21c40917e2dbe140f80155e1a258773599abda05f5158c6a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711EFilesize
482B
MD5709d1868321ce261266e12fe2146f64e
SHA1451811cee2f22990b06859ae9e9baf6b32ea2203
SHA256ee17bd1d176697a731e47bc9e32316c0d807e1df369ce6e510ebfb4ce0e7dab7
SHA512bb18bb9e28b1fd2ec856f92578cd389c937343d9e8b02d16afbce6d20cd038dc982a00dbd2ea52d91cbfa6f88de5c3ddd3072b862c279415aa518a698f48c79b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D7833C286363AD25C70511661A83D581_5A754446CB863DF3C298CB4E94FD802EFilesize
484B
MD5c17bb901a82aa34fec37eb4631532e82
SHA1884673cf6ccf013f405a372019f36c34f185fe93
SHA256f4c8851be8446cdd66653d78075b83983f0f10eccd35961c9119e725c4fda492
SHA51270010d85b72e0c982ed2d3bc2453859e38bf8481e53f6883777ca8e6260f8f0605bc2c59541ab04f4d450511b62f188a4a6a9df5ceb25a26569393ed05bb1398
-
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2Filesize
22.8MB
MD57fc58ecf66e05cb17b240624b4212719
SHA18ed0ca8d5b2e75be764e4940edef5d8237f511e6
SHA256408685b55cd639a8eeb4edb8c69b1149ebd4013c3b1f3b4ec6a78ad9f502d3ff
SHA5129d57f575528e7c884278e37917b6ac066d44f1258808e3cca00636f417044ef325388a3168b1a3ff73536363dcfee3a45338e01b772aac0036a9d8013b0408f0
-
\??\Volume{420c8c0f-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{5263609f-bf81-4904-b4dc-9266ea906c88}_OnDiskSnapshotPropFilesize
5KB
MD56cf993ce226a07361a730146bee5ef07
SHA16b093200f70d69cbf6221b8a6dfb65379e1b5356
SHA25645d463fc7b55ac5ccf9bd166500e2bc5e312970c4c750aa25d32b6cddfd7a72c
SHA51257f767755caf2669ccdf126579820cd6d8f3f64ff1128bdf07c28abbb9b41daeab59cc7efd456b43a5795c71410ec09e8997a1252383e7c2c3e35845fa4b69bd
-
memory/1104-119-0x0000000000000000-mapping.dmp