977e44df8ad7ea6f80ca14a1f817a65a38bb1660d1b776d4ad80577d9d52c2c7

General

Target

VMware-workstation-full-17.0.0-20800274.exe
Size

607.9MB
MD5

cb7adf6d87af6575f35da9974a3b46b9
SHA1

d244b21b197943b706a2c2b4ae5b82109d55fbf1
SHA256

977e44df8ad7ea6f80ca14a1f817a65a38bb1660d1b776d4ad80577d9d52c2c7
SHA512

0a0f89c70c900b7a39803d0a39d7c5eb55ab7d194dfd49dbc5a4d236761eca38be02947a638405aae18562b052d0b3c54604811aa4e510f530496b3249f673c0
SSDEEP

12582912:nRK04jaCxy21Zp8b0geTklQFdinUqd4buHT9GqryfTUDe0mhlJvYW:nRK08afJ0geAlQFdinUe4b9qe4De0mhP

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
3824	vcredist_x86.exe
4636	vcredist_x86.exe
5036	VC_redist.x86.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	vcredist_x86.exe

Loads dropped DLL 1 IoCs

pid	Process
4636	vcredist_x86.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{817e21c1-6b3a-4bc1-8c49-67e4e1887b3a} = "\"C:\\ProgramData\\Package Cache\\{817e21c1-6b3a-4bc1-8c49-67e4e1887b3a}\\VC_redist.x86.exe\" /burn.runonce"	VC_redist.x86.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	VMware-workstation-full-17.0.0-20800274.exe
File opened (read-only)	\??\U:	VMware-workstation-full-17.0.0-20800274.exe
File opened (read-only)	\??\V:	VMware-workstation-full-17.0.0-20800274.exe
File opened (read-only)	\??\H:	VMware-workstation-full-17.0.0-20800274.exe
File opened (read-only)	\??\F:	VMware-workstation-full-17.0.0-20800274.exe
File opened (read-only)	\??\K:	VMware-workstation-full-17.0.0-20800274.exe
File opened (read-only)	\??\N:	VMware-workstation-full-17.0.0-20800274.exe
File opened (read-only)	\??\S:	VMware-workstation-full-17.0.0-20800274.exe
File opened (read-only)	\??\Y:	VMware-workstation-full-17.0.0-20800274.exe
File opened (read-only)	\??\B:	VMware-workstation-full-17.0.0-20800274.exe
File opened (read-only)	\??\G:	VMware-workstation-full-17.0.0-20800274.exe
File opened (read-only)	\??\I:	VMware-workstation-full-17.0.0-20800274.exe
File opened (read-only)	\??\L:	VMware-workstation-full-17.0.0-20800274.exe
File opened (read-only)	\??\M:	VMware-workstation-full-17.0.0-20800274.exe
File opened (read-only)	\??\O:	VMware-workstation-full-17.0.0-20800274.exe
File opened (read-only)	\??\Q:	VMware-workstation-full-17.0.0-20800274.exe
File opened (read-only)	\??\W:	VMware-workstation-full-17.0.0-20800274.exe
File opened (read-only)	\??\E:	VMware-workstation-full-17.0.0-20800274.exe
File opened (read-only)	\??\J:	VMware-workstation-full-17.0.0-20800274.exe
File opened (read-only)	\??\P:	VMware-workstation-full-17.0.0-20800274.exe
File opened (read-only)	\??\R:	VMware-workstation-full-17.0.0-20800274.exe
File opened (read-only)	\??\X:	VMware-workstation-full-17.0.0-20800274.exe
File opened (read-only)	\??\Z:	VMware-workstation-full-17.0.0-20800274.exe
File opened (read-only)	\??\A:	VMware-workstation-full-17.0.0-20800274.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
636	4636	WerFault.exe	80

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000789d96067ff55f5b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000789d96060000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff000000000700010000680900789d9606000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000789d960600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000789d960600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies registry class 6 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.32,bundle\Version = "14.32.31326.0"	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.32,bundle\DisplayName = "Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.32.31326"	VC_redist.x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.32,bundle\Dependents\{817e21c1-6b3a-4bc1-8c49-67e4e1887b3a}	VC_redist.x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.32,bundle\Dependents	VC_redist.x86.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\VC,redist.x86,x86,14.32,bundle	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.32,bundle\ = "{817e21c1-6b3a-4bc1-8c49-67e4e1887b3a}"	VC_redist.x86.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeBackupPrivilege	4944	vssvc.exe
Token: SeRestorePrivilege	4944	vssvc.exe
Token: SeAuditPrivilege	4944	vssvc.exe
Token: SeBackupPrivilege	3324	srtasks.exe
Token: SeRestorePrivilege	3324	srtasks.exe
Token: SeSecurityPrivilege	3324	srtasks.exe
Token: SeTakeOwnershipPrivilege	3324	srtasks.exe
Token: SeBackupPrivilege	3324	srtasks.exe
Token: SeRestorePrivilege	3324	srtasks.exe
Token: SeSecurityPrivilege	3324	srtasks.exe
Token: SeTakeOwnershipPrivilege	3324	srtasks.exe
Token: 33	2576	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2576	AUDIODG.EXE

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 3824	1984	VMware-workstation-full-17.0.0-20800274.exe	79
PID 1984 wrote to memory of 3824	1984	VMware-workstation-full-17.0.0-20800274.exe	79
PID 1984 wrote to memory of 3824	1984	VMware-workstation-full-17.0.0-20800274.exe	79
PID 3824 wrote to memory of 4636	3824	vcredist_x86.exe	80
PID 3824 wrote to memory of 4636	3824	vcredist_x86.exe	80
PID 3824 wrote to memory of 4636	3824	vcredist_x86.exe	80
PID 4636 wrote to memory of 5036	4636	vcredist_x86.exe	81
PID 4636 wrote to memory of 5036	4636	vcredist_x86.exe	81
PID 4636 wrote to memory of 5036	4636	vcredist_x86.exe	81

C:\Users\Admin\AppData\Local\Temp\VMware-workstation-full-17.0.0-20800274.exe
"C:\Users\Admin\AppData\Local\Temp\VMware-workstation-full-17.0.0-20800274.exe"
1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Users\Admin\AppData\Local\Temp\{0E992720-1330-4AB3-8155-255F79785535}~setup\vcredist_x86.exe
  "C:\Users\Admin\AppData\Local\Temp\{0E992720-1330-4AB3-8155-255F79785535}~setup\vcredist_x86.exe" /Q /norestart
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3824
- - C:\Windows\Temp\{FDC7DAAE-414D-4FE3-803F-33C920277394}\.cr\vcredist_x86.exe
    "C:\Windows\Temp\{FDC7DAAE-414D-4FE3-803F-33C920277394}\.cr\vcredist_x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\{0E992720-1330-4AB3-8155-255F79785535}~setup\vcredist_x86.exe" -burn.filehandle.attached=540 -burn.filehandle.self=548 /Q /norestart
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:4636
  - - C:\Windows\Temp\{FF8F7C21-59A2-4D0D-B40E-87F1A2B9578D}\.be\VC_redist.x86.exe
      "C:\Windows\Temp\{FF8F7C21-59A2-4D0D-B40E-87F1A2B9578D}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{6B7BC0D0-35C7-4949-AD18-1D32CC1072A8} {F271B72D-519D-41C8-822D-E45446244DFE} 4636
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Modifies registry class
      PID:5036
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 1508
      4⤵
      Program crash
      PID:636

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4944

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4636 -ip 4636
1⤵
PID:4708

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x520 0x524
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2576

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1444

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

4

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\{0E992720-1330-4AB3-8155-255F79785535}~setup\vcredist_x86.exe

Filesize
13.1MB

MD5
4df5dde302a87e2e85351af689892fcf

SHA1
ae587be1c1ad6d58fbe73d43ce1ea0771d774ba7

SHA256
2acbfe92157c1cf1a7b524a9325824046d83dbfa3feb1cbd4dd02a42e020f77c

SHA512
d10f98f221b79b77fe92f93ac09d34c53c1e58b690dd61b6f770d892d7619b5fa38edb2c0800ce2dec715e6c2d3f46848c5a4a3b25b64967eebc05eaa0afade3

Download Submit
C:\Users\Admin\AppData\Local\Temp\{0E992720-1330-4AB3-8155-255F79785535}~setup\vcredist_x86.exe

Filesize
13.1MB

MD5
4df5dde302a87e2e85351af689892fcf

SHA1
ae587be1c1ad6d58fbe73d43ce1ea0771d774ba7

SHA256
2acbfe92157c1cf1a7b524a9325824046d83dbfa3feb1cbd4dd02a42e020f77c

SHA512
d10f98f221b79b77fe92f93ac09d34c53c1e58b690dd61b6f770d892d7619b5fa38edb2c0800ce2dec715e6c2d3f46848c5a4a3b25b64967eebc05eaa0afade3

Download Submit
C:\Windows\Temp\{FDC7DAAE-414D-4FE3-803F-33C920277394}\.cr\vcredist_x86.exe

Filesize
634KB

MD5
ff6e9c111f04dd7b06691bed6d8f0db2

SHA1
211c95ea9f7452afc1edebca6e303fba84936fa1

SHA256
05981b519a2a45407b5c8a213f04ad4caff964b2a9ae916d9269c01b45897eb1

SHA512
7beb492a3327670e19878c66a9e4b1bc45727146a14e9f79b642c94abf4d7a9ebf647428739448c447eadc6b045f0c0c750908577456520e341d4e62eff0ae0f

Download Submit
C:\Windows\Temp\{FDC7DAAE-414D-4FE3-803F-33C920277394}\.cr\vcredist_x86.exe

Filesize
634KB

MD5
ff6e9c111f04dd7b06691bed6d8f0db2

SHA1
211c95ea9f7452afc1edebca6e303fba84936fa1

SHA256
05981b519a2a45407b5c8a213f04ad4caff964b2a9ae916d9269c01b45897eb1

SHA512
7beb492a3327670e19878c66a9e4b1bc45727146a14e9f79b642c94abf4d7a9ebf647428739448c447eadc6b045f0c0c750908577456520e341d4e62eff0ae0f

Download Submit
C:\Windows\Temp\{FF8F7C21-59A2-4D0D-B40E-87F1A2B9578D}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
C:\Windows\Temp\{FF8F7C21-59A2-4D0D-B40E-87F1A2B9578D}\.be\VC_redist.x86.exe

Filesize
634KB

MD5
ff6e9c111f04dd7b06691bed6d8f0db2

SHA1
211c95ea9f7452afc1edebca6e303fba84936fa1

SHA256
05981b519a2a45407b5c8a213f04ad4caff964b2a9ae916d9269c01b45897eb1

SHA512
7beb492a3327670e19878c66a9e4b1bc45727146a14e9f79b642c94abf4d7a9ebf647428739448c447eadc6b045f0c0c750908577456520e341d4e62eff0ae0f

Download Submit
C:\Windows\Temp\{FF8F7C21-59A2-4D0D-B40E-87F1A2B9578D}\.be\VC_redist.x86.exe

Filesize
634KB

MD5
ff6e9c111f04dd7b06691bed6d8f0db2

SHA1
211c95ea9f7452afc1edebca6e303fba84936fa1

SHA256
05981b519a2a45407b5c8a213f04ad4caff964b2a9ae916d9269c01b45897eb1

SHA512
7beb492a3327670e19878c66a9e4b1bc45727146a14e9f79b642c94abf4d7a9ebf647428739448c447eadc6b045f0c0c750908577456520e341d4e62eff0ae0f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads