58e9f60d0b951029578cc1054668bfee2f00cfa029cfbd01ea65c7f61713a40a

Analysis

max time kernel
167s
max time network
179s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
18-01-2023 23:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AnyDeskAPP.msi
Size

1.4MB
MD5

4e4a4a4eb6a77d72af83b2bbd0698593
SHA1

dbaeba54fcae50acc36565d0f61ad73df6df7d45
SHA256

58e9f60d0b951029578cc1054668bfee2f00cfa029cfbd01ea65c7f61713a40a
SHA512

69785dadc878bd1178672a8f08590eeccd268b4fd2107ae3909e59fba03e7cfa425f690580dfcfa1f5ec3e494e5ef0b7232a16a26c8fbf734ef3887da4044ccb
SSDEEP

24576:Y+rwxLNjY3Wx0ECIgYmfLVYeBZrWAv12h2SekeUuyZD6lvs0zqa3:TrMjYMZKumZrWAWTreUuyZD6lvVz9

Score

9^/10

evasion trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

Winindiferente.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Winindiferente.exe
Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

4 1220 powershell.exe
Executes dropped EXE 1 IoCs

Processes:

Winindiferente.exe

pid process

552 Winindiferente.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Winindiferente.exe

flow	pid	process
4	1220	powershell.exe

pid	process
552	Winindiferente.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Winindiferente.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Winindiferente.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Winindiferente.exe

Loads dropped DLL 5 IoCs

Processes:

MsiExec.exepowershell.exe

pid process

308 MsiExec.exe
308 MsiExec.exe
308 MsiExec.exe
308 MsiExec.exe
1220 powershell.exe
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

Winindiferente.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Winindiferente.exe

pid	process
308	MsiExec.exe
308	MsiExec.exe
308	MsiExec.exe
308	MsiExec.exe
1220	powershell.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Winindiferente.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

Winindiferente.exe

pid process

552 Winindiferente.exe

pid	process
552	Winindiferente.exe

Drops file in Windows directory 14 IoCs

Processes:

msiexec.exeDrvInst.exe

description	ioc	process
File created	C:\Windows\Installer\6d2090.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2771.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\6d208e.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\6d208c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI23D8.tmp	msiexec.exe
File created	C:\Windows\Installer\6d208e.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\6d208c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2167.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4399.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4485.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D52E0AA1-978E-11ED-9172-7ADD0904B6AC} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Modifies data under HKEY_USERS 46 IoCs

Processes:

DrvInst.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe

Modifies registry class 20 IoCs

Processes:

msiexec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\ProductName = "AnyDesk"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\SourceList\PackageName = "AnyDeskAPP.msi"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\PackageCode = "7A53F5C34D4FDEE41A79AB069A0CCD7B"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\Version = "16777216"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B48CCF9E9411D5C40B37663A245F8B16	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B48CCF9E9411D5C40B37663A245F8B16\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\Language = "1046"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\77F933B46D1B7E843A3263A3FC358A51	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\77F933B46D1B7E843A3263A3FC358A51\B48CCF9E9411D5C40B37663A245F8B16	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B48CCF9E9411D5C40B37663A245F8B16\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

msiexec.exepowershell.exe

pid process

1460 msiexec.exe
1460 msiexec.exe
1220 powershell.exe
1220 powershell.exe
1220 powershell.exe

pid	process
1460	msiexec.exe
1460	msiexec.exe
1220	powershell.exe
1220	powershell.exe
1220	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exeDrvInst.exe

description	pid	process
Token: SeShutdownPrivilege	2020	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2020	msiexec.exe
Token: SeRestorePrivilege	1460	msiexec.exe
Token: SeTakeOwnershipPrivilege	1460	msiexec.exe
Token: SeSecurityPrivilege	1460	msiexec.exe
Token: SeCreateTokenPrivilege	2020	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2020	msiexec.exe
Token: SeLockMemoryPrivilege	2020	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2020	msiexec.exe
Token: SeMachineAccountPrivilege	2020	msiexec.exe
Token: SeTcbPrivilege	2020	msiexec.exe
Token: SeSecurityPrivilege	2020	msiexec.exe
Token: SeTakeOwnershipPrivilege	2020	msiexec.exe
Token: SeLoadDriverPrivilege	2020	msiexec.exe
Token: SeSystemProfilePrivilege	2020	msiexec.exe
Token: SeSystemtimePrivilege	2020	msiexec.exe
Token: SeProfSingleProcessPrivilege	2020	msiexec.exe
Token: SeIncBasePriorityPrivilege	2020	msiexec.exe
Token: SeCreatePagefilePrivilege	2020	msiexec.exe
Token: SeCreatePermanentPrivilege	2020	msiexec.exe
Token: SeBackupPrivilege	2020	msiexec.exe
Token: SeRestorePrivilege	2020	msiexec.exe
Token: SeShutdownPrivilege	2020	msiexec.exe
Token: SeDebugPrivilege	2020	msiexec.exe
Token: SeAuditPrivilege	2020	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2020	msiexec.exe
Token: SeChangeNotifyPrivilege	2020	msiexec.exe
Token: SeRemoteShutdownPrivilege	2020	msiexec.exe
Token: SeUndockPrivilege	2020	msiexec.exe
Token: SeSyncAgentPrivilege	2020	msiexec.exe
Token: SeEnableDelegationPrivilege	2020	msiexec.exe
Token: SeManageVolumePrivilege	2020	msiexec.exe
Token: SeImpersonatePrivilege	2020	msiexec.exe
Token: SeCreateGlobalPrivilege	2020	msiexec.exe
Token: SeBackupPrivilege	852	vssvc.exe
Token: SeRestorePrivilege	852	vssvc.exe
Token: SeAuditPrivilege	852	vssvc.exe
Token: SeBackupPrivilege	1460	msiexec.exe
Token: SeRestorePrivilege	1460	msiexec.exe
Token: SeRestorePrivilege	1732	DrvInst.exe
Token: SeRestorePrivilege	1732	DrvInst.exe
Token: SeRestorePrivilege	1732	DrvInst.exe
Token: SeRestorePrivilege	1732	DrvInst.exe
Token: SeRestorePrivilege	1732	DrvInst.exe
Token: SeRestorePrivilege	1732	DrvInst.exe
Token: SeRestorePrivilege	1732	DrvInst.exe
Token: SeLoadDriverPrivilege	1732	DrvInst.exe
Token: SeLoadDriverPrivilege	1732	DrvInst.exe
Token: SeLoadDriverPrivilege	1732	DrvInst.exe
Token: SeRestorePrivilege	1460	msiexec.exe
Token: SeTakeOwnershipPrivilege	1460	msiexec.exe
Token: SeRestorePrivilege	1460	msiexec.exe
Token: SeTakeOwnershipPrivilege	1460	msiexec.exe
Token: SeRestorePrivilege	1460	msiexec.exe
Token: SeTakeOwnershipPrivilege	1460	msiexec.exe
Token: SeRestorePrivilege	1460	msiexec.exe
Token: SeTakeOwnershipPrivilege	1460	msiexec.exe
Token: SeRestorePrivilege	1460	msiexec.exe
Token: SeTakeOwnershipPrivilege	1460	msiexec.exe
Token: SeRestorePrivilege	1460	msiexec.exe
Token: SeTakeOwnershipPrivilege	1460	msiexec.exe
Token: SeRestorePrivilege	1460	msiexec.exe
Token: SeTakeOwnershipPrivilege	1460	msiexec.exe
Token: SeRestorePrivilege	1460	msiexec.exe

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

msiexec.exepowershell.exeiexplore.exe

pid process

2020 msiexec.exe
1220 powershell.exe
1220 powershell.exe
580 iexplore.exe
2020 msiexec.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

580 iexplore.exe
580 iexplore.exe
1372 IEXPLORE.EXE
1372 IEXPLORE.EXE

pid	process
2020	msiexec.exe
1220	powershell.exe
1220	powershell.exe
580	iexplore.exe
2020	msiexec.exe

pid	process
580	iexplore.exe
580	iexplore.exe
1372	IEXPLORE.EXE
1372	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

msiexec.exeMsiExec.exepowershell.exeiexplore.exe

description	pid	process	target process
PID 1460 wrote to memory of 308	1460	msiexec.exe	MsiExec.exe
PID 1460 wrote to memory of 308	1460	msiexec.exe	MsiExec.exe
PID 1460 wrote to memory of 308	1460	msiexec.exe	MsiExec.exe
PID 1460 wrote to memory of 308	1460	msiexec.exe	MsiExec.exe
PID 1460 wrote to memory of 308	1460	msiexec.exe	MsiExec.exe
PID 1460 wrote to memory of 308	1460	msiexec.exe	MsiExec.exe
PID 1460 wrote to memory of 308	1460	msiexec.exe	MsiExec.exe
PID 308 wrote to memory of 1220	308	MsiExec.exe	powershell.exe
PID 308 wrote to memory of 1220	308	MsiExec.exe	powershell.exe
PID 308 wrote to memory of 1220	308	MsiExec.exe	powershell.exe
PID 308 wrote to memory of 1220	308	MsiExec.exe	powershell.exe
PID 1220 wrote to memory of 552	1220	powershell.exe	Winindiferente.exe
PID 1220 wrote to memory of 552	1220	powershell.exe	Winindiferente.exe
PID 1220 wrote to memory of 552	1220	powershell.exe	Winindiferente.exe
PID 1220 wrote to memory of 552	1220	powershell.exe	Winindiferente.exe
PID 580 wrote to memory of 1372	580	iexplore.exe	IEXPLORE.EXE
PID 580 wrote to memory of 1372	580	iexplore.exe	IEXPLORE.EXE
PID 580 wrote to memory of 1372	580	iexplore.exe	IEXPLORE.EXE
PID 580 wrote to memory of 1372	580	iexplore.exe	IEXPLORE.EXE

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\AnyDeskAPP.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2020

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1BE9FC6ED0E82700AA85DFD9BA46A456
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:308
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss452F.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msi450D.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scr450E.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scr450F.txt" -propSep " :<->: " -testPrefix "_testValue."
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1220
  - - C:\discrição\oriundo\Winindiferente.exe
      "C:\discrição\oriundo\Winindiferente.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Executes dropped EXE
      Checks BIOS information in registry
      Checks whether UAC is enabled
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:552

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:852

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000004A4" "0000000000000064"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1732

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:580
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:580 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1372

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\pss452F.ps1

Filesize
5KB

MD5
fc1bb6c87fd1f08b534e52546561c53c

SHA1
db402c5c1025cf8d3e79df7b868fd186243aa9d1

SHA256
a04750ed5f05b82b90f6b8ea3748ba246af969757a5a4b74a0e25b186add520b

SHA512
5495f4ac3c8f42394a82540449526bb8ddd91adf0a1a852a9e1f2d32a63858b966648b4099d9947d8ac68ee43824dacda24c337c5b97733905e36c4921280e86

Download Submit
C:\Users\Admin\AppData\Local\Temp\scr450E.ps1

Filesize
17KB

MD5
7c5b73168b207a9c580eb62dd1588fef

SHA1
cdd8f39b7a12aa0b3c62a3c0c19572976d0444dc

SHA256
6d6b711685d829f27fcfe579853e43d993bf6e935085161d0dbee6abb43f60d5

SHA512
7ea9836bc57698341d18154e1b76ea6d1ee67b68504c2076b7125374c63298a9bf3580b4d2c2936ab19d0831940bb927171b6ad5a46fb87caf7f43b2b82696f9

Download Submit
C:\Windows\Installer\MSI2167.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSI23D8.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSI2771.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSI4485.tmp

Filesize
574KB

MD5
7b7d9e2c9b8236e7155f2f97254cb40e

SHA1
99621fc9d14511428d62d91c31865fb2c4625663

SHA256
df58faba241328b9645dcb5dec387ec5edd56e2d878384a4783f2c0a66f85897

SHA512
fbaa1560f03255f73be3e846959e4b7cbb1c24165d014ed01245639add6cc463975e5558567ab5704e18c9078a8a071c9e38dc1e499ba6e3dc507d4275b4a228

Download Submit
C:\discrição\oriundo\Winindiferente.exe

Filesize
5.5MB

MD5
caa7805c7dc283359293bae074cb85ec

SHA1
f21c4880fbf40b8f03ed8954263106d814ac014d

SHA256
e24fbdd85caccbf63428e12d5e0afb7529c6c22469ed7414e80d5a6b9c02ac23

SHA512
206a54b956f7bed6f63a2f08b9ec6b9bec32fb628356e2b6189edea814e403bee385ce46420ca5a4d41e33d6306376c7c605f3645c5c3b85a0f0980d4ba5e8f1

Download Submit
C:\discrição\oriundo\Winindiferente.exe

Filesize
5.5MB

MD5
caa7805c7dc283359293bae074cb85ec

SHA1
f21c4880fbf40b8f03ed8954263106d814ac014d

SHA256
e24fbdd85caccbf63428e12d5e0afb7529c6c22469ed7414e80d5a6b9c02ac23

SHA512
206a54b956f7bed6f63a2f08b9ec6b9bec32fb628356e2b6189edea814e403bee385ce46420ca5a4d41e33d6306376c7c605f3645c5c3b85a0f0980d4ba5e8f1

Download Submit
C:\discrição\oriundo\vending

Filesize
89.4MB

MD5
3c6ef07082ae5cd1cdbb4c272f1da202

SHA1
4bbc70f293110dae93746e8a1fe7c5a47d1f33ec

SHA256
2bd1e88bcdd6377d1fa2a8f12b1ffec9c1a73e4aeea4a9eea31c359880a17b4c

SHA512
432d6c249b4b000c5cdf9600f8ca3f7771e55d41152abbc398b70a5b8cc5bd3d867a7febbd7b4d07186a519b04a7f552aa25712c099b16ebdb4575a751c73ee9

Download Submit
\Windows\Installer\MSI2167.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
\Windows\Installer\MSI23D8.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
\Windows\Installer\MSI2771.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
\Windows\Installer\MSI4485.tmp

Filesize
574KB

MD5
7b7d9e2c9b8236e7155f2f97254cb40e

SHA1
99621fc9d14511428d62d91c31865fb2c4625663

SHA256
df58faba241328b9645dcb5dec387ec5edd56e2d878384a4783f2c0a66f85897

SHA512
fbaa1560f03255f73be3e846959e4b7cbb1c24165d014ed01245639add6cc463975e5558567ab5704e18c9078a8a071c9e38dc1e499ba6e3dc507d4275b4a228

Download Submit
\discrição\oriundo\Winindiferente.exe

Filesize
5.5MB

MD5
caa7805c7dc283359293bae074cb85ec

SHA1
f21c4880fbf40b8f03ed8954263106d814ac014d

SHA256
e24fbdd85caccbf63428e12d5e0afb7529c6c22469ed7414e80d5a6b9c02ac23

SHA512
206a54b956f7bed6f63a2f08b9ec6b9bec32fb628356e2b6189edea814e403bee385ce46420ca5a4d41e33d6306376c7c605f3645c5c3b85a0f0980d4ba5e8f1

Download Submit
memory/308-57-0x0000000076181000-0x0000000076183000-memory.dmp

Filesize
8KB

Download
memory/308-56-0x0000000000000000-mapping.dmp

Download
memory/552-77-0x0000000000030000-0x0000000001190000-memory.dmp

Filesize
17.4MB

Download
memory/552-82-0x0000000000030000-0x0000000001190000-memory.dmp

Filesize
17.4MB

Download
memory/552-73-0x0000000000000000-mapping.dmp

Download
memory/552-76-0x0000000000030000-0x0000000001190000-memory.dmp

Filesize
17.4MB

Download
memory/552-98-0x0000000009DF0000-0x000000000F766000-memory.dmp

Filesize
89.5MB

Download
memory/552-78-0x0000000000030000-0x0000000001190000-memory.dmp

Filesize
17.4MB

Download
memory/552-79-0x0000000077DE0000-0x0000000077F60000-memory.dmp

Filesize
1.5MB

Download
memory/552-80-0x0000000000030000-0x0000000001190000-memory.dmp

Filesize
17.4MB

Download
memory/552-81-0x0000000000030000-0x0000000001190000-memory.dmp

Filesize
17.4MB

Download
memory/552-94-0x00000000015C0000-0x0000000001639000-memory.dmp

Filesize
484KB

Download
memory/552-83-0x0000000000030000-0x0000000001190000-memory.dmp

Filesize
17.4MB

Download
memory/552-97-0x00000000042F0000-0x0000000004321000-memory.dmp

Filesize
196KB

Download
memory/552-85-0x00000000012F0000-0x00000000012FD000-memory.dmp

Filesize
52KB

Download
memory/552-86-0x000000000F770000-0x000000000F900000-memory.dmp

Filesize
1.6MB

Download
memory/552-87-0x0000000077DE0000-0x0000000077F60000-memory.dmp

Filesize
1.5MB

Download
memory/552-88-0x000000000F900000-0x000000000FAC3000-memory.dmp

Filesize
1.8MB

Download
memory/552-96-0x000000000FF20000-0x0000000010050000-memory.dmp

Filesize
1.2MB

Download
memory/552-91-0x0000000001380000-0x000000000139C000-memory.dmp

Filesize
112KB

Download
memory/552-93-0x0000000009DF0000-0x000000000F766000-memory.dmp

Filesize
89.5MB

Download
memory/552-92-0x00000000038B0000-0x0000000003947000-memory.dmp

Filesize
604KB

Download
memory/1220-70-0x0000000072CC0000-0x00000000741E8000-memory.dmp

Filesize
21.2MB

Download
memory/1220-66-0x0000000000000000-mapping.dmp

Download
memory/1220-71-0x0000000072CC0000-0x00000000741E8000-memory.dmp

Filesize
21.2MB

Download
memory/2020-54-0x000007FEFC621000-0x000007FEFC623000-memory.dmp

Filesize
8KB

Download