Overview

overview

6

Static

static

install_vi...PC.msi

windows10-2004-x64

6

Analysis

  • max time kernel
    146s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/12/2022, 00:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    install_virtualdj_2022_B6800_PC.msi

  • Size

    182.9MB

  • MD5

    ada54e481efb876766757024bdebb06e

  • SHA1

    7bfc49b3ac1ddfded0ec358803776a4d3ac14bb5

  • SHA256

    314aff16fc8ab32267b5c80d50c5cb0216394aeb6bff7c247422c0b3fafecc2c

  • SHA512

    3cd97b85b3271de6aec5c9d815e0f0803eb12e3d59f9ad493d53bf1f5af58b0ea0e01a4253de90f59c2e12298c6e76185a67d34f05a6f012d7cdf978ecd13b89

  • SSDEEP

    3145728:1hOQOQot+LUhUsiypOsn1TVdhKAf7Kh1o+PDdCyLrfZ/VyHmkcVj1rVVe+bAhlx5:1hOeHLUhFiYT4ADa18yLrdVRrVhDe+b3

Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 7 IoCs
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 55 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\install_virtualdj_2022_B6800_PC.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2024
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1760
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4032
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:4752

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
    Filesize

    23.0MB

    MD5

    9272ad72b04f5192c1003615f91fba0d

    SHA1

    f83e250b92d928b60dcde3322e08eeed0aa8dbdb

    SHA256

    a18906b71c43ceba70f7f1867fea0c08d1fb03bc84dc60f75adbb01ff044c355

    SHA512

    9b513d1ed5df3c81166423ca9892053f3f5e16f0eeea5f69473bd059b9112112b35b17c3774c3d770f1211b33ef89a55354a17bec73c1a6c8154115dfd68b075

    Download Submit

  • \??\Volume{2fb4ccdc-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{6ae3546c-fd78-45b1-9d88-23abf888248e}_OnDiskSnapshotProp
    Filesize

    5KB

    MD5

    ec696389bbe35a4cb2062da55925ef0b

    SHA1

    e535d3d976f7951aeed378aeee88c1e55348553b

    SHA256

    44295dda8c11906a8175406fdca58373b8aa764bae205d867fa1195c92db4431

    SHA512

    a3e84d8675ce3c8930c78964780983bc5cc6840e6ae8b9f711280ceca93a97974cc59ecc148878070f9648f7b64c779180f4f926c0ebc098815cdfbf2f828016

    Download Submit