Overview

overview

8

Static

static

1

si.msi

windows10-1703-x64

8

si.msi

windows10-2004-x64

8

Analysis

  • max time kernel
    590s
  • max time network
    598s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    07/03/2023, 16:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    si.msi

  • Size

    588KB

  • MD5

    262b3a8d59585a9840bcf39c0b98a84a

  • SHA1

    3bbccf28a4b75f2ff0505684799f14a8f72969e9

  • SHA256

    93ff5d50aeb9242c733dd80f411eeafc0fe72c3eb37327ba85a5626edc4c545c

  • SHA512

    1f826b0113b0a1cd785cc311e37bcc6b87634bf5fef72554bef8289c0ae2ac525e063eaf475fb27b2925a1dd52b963da8187d6717dd81c2988aed5ebc2a2ad43

  • SSDEEP

    3072:dPaJvTKlkihKyOeGNbb4crPpxBvlHOp2rrFc:dCBW5UyonOp2rrF

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 17 IoCs
  • Executes dropped EXE 1 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 2 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\si.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2076
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2568
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:3088
      • C:\Windows\system32\wscript.exe
        "wscript.exe" "sdv.vbs"
        2⤵
          PID:4808
        • C:\Windows\system32\wscript.exe
          "wscript.exe" "app.js"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:5052
          • C:\ProgramData\Zap\snap.exe
            "C:\ProgramData\Zap\snap.exe" /capture /convert=gs.jpg
            3⤵
            • Executes dropped EXE
            PID:4280
          • C:\Windows\System32\wbem\WMIC.exe
            "C:\Windows\System32\wbem\WMIC.exe" product where name='Tum' call uninstall /nointeractive
            3⤵
              PID:4264
          • C:\Windows\system32\wscript.exe
            "wscript.exe" "index.js"
            2⤵
            • Blocklisted process makes network request
            PID:5064
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3672
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc
          1⤵
          • Checks SCSI registry key(s)
          • Modifies data under HKEY_USERS
          PID:4656

        Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Config.Msi\e5790f6.rbs
                Filesize

                9KB

                MD5

                32322bfd24a9a442f6207d700cc1e1a9

                SHA1

                11c5ae28c3dbc91528bd2f9637045f0bbda72c0b

                SHA256

                9620909be33acee15290bf308c25c069edd88840c4d6caa38e0c45ad66fba7f2

                SHA512

                98d0246c1f02411c5a3c947c013080feadf4682fc8d187c72724764d7ebc632451eedd967c9fa7dc162b94ded9528cfb773742e01144a114911ca43a89ef7ffd

                Download Submit

              • C:\Config.Msi\e5790f9.rbs
                Filesize

                9KB

                MD5

                94ea3c356a1595952f4bca2fb6ca3299

                SHA1

                d752fdd103ab25dc445115c39d4c8e63bf8ef6d5

                SHA256

                d98387c3117cbd614cbb76b3c9a6d78e518840316f179cec863692c0dd4f1414

                SHA512

                9f4091bb6b2b111d6e2871d3744f57f01406b64a6b871b5667a3b7469f91d4258fb0c93d943634b4bbf4a0666feb4725ded292d0b59e842bd40b021266dd5922

                Download Submit

              • C:\Config.Msi\e5790fc.rbs
                Filesize

                10KB

                MD5

                9c57f045ab54f6f8b314378ffe3043a9

                SHA1

                4a51df0ab115097ec82010246f71c7d2b90a0714

                SHA256

                da052995653c509d13e2f6783c4a989548bf969b44d6f618751ccdd0aa13840f

                SHA512

                4c9bfad4f2d885a360f1c86dde09877b7f44b796678e08b114c786c0e8c0af0d2f2465eedbfba5ac118feaa4cc0cf2b5a003f386530e160315f32539c79fdeea

                Download Submit

              • C:\ProgramData\Zap\app.js
                Filesize

                200B

                MD5

                e2e694f471846e4004b30b673f217296

                SHA1

                3daa94a97871bae495e4cb925b591287b2c89505

                SHA256

                aec5bf19e72ed577b0a02cffeb4f5cc713ab4478267ce348cf337b508f2fcade

                SHA512

                6b314219ef82d85640187888442c5c52e8d7bf808a22522ac7768e7e1ca5d47a5d18fdad341fe78ea2b481295ae0c8479491a2290b4e6763aba552b7b3e1e68f

                Download Submit

              • C:\ProgramData\Zap\gs.jpg
                Filesize

                72KB

                MD5

                f8448e27a2d0f871217ac250cb23a716

                SHA1

                07c46522a258be1abdcfc9d9cecc71c512883f6b

                SHA256

                b6a118a5e369b044b2ba196fbe24479851ee948a999ad3fd61e94daaeb91993a

                SHA512

                8408d1b450b4de41de81d7596a00c767bb842c0e4a68e8b226c14fb2aee9f9940764f32f43e9f054ee4680c411fc7298da3a6a7d5ed0a2fdf0bf707da4123827

                Download Submit

              • C:\ProgramData\Zap\index.js
                Filesize

                1KB

                MD5

                8760674032a81254fdea5b8d15f92fe8

                SHA1

                471995c2a451ee06e25298541a2f9acef0976d41

                SHA256

                ea9ea1c7b055a3ecab327bdb74a7bc7bb0ba077828f6d219882316575baf928f

                SHA512

                c179936e17e21c8528e2e650fd8c439d06ea388854696b229b53419813100c61f0acac3ef8ce7c05c195443eeb5d63b870a63d02195fac1be1c73ab8c65f730c

                Download Submit

              • C:\ProgramData\Zap\snap.exe
                Filesize

                1.9MB

                MD5

                b103655d23aab7ff124de7ea4fbc2361

                SHA1

                904bf233b9070af245f4dbcae11828615ef8715b

                SHA256

                6e53a93fc2968d90891db6059bac49e975c09546e19a54f1f93fb01a21318fdc

                SHA512

                fda0e3855522039d3b56e15b169b4c634672ca181ced78a479b6723c22ce889308db55aa1ea58fa8cb01ed1657fddc52a2c45d904c6eb5b852a171bcba310a52

                Download Submit

              • C:\ProgramData\Zap\snap.exe
                Filesize

                1.9MB

                MD5

                b103655d23aab7ff124de7ea4fbc2361

                SHA1

                904bf233b9070af245f4dbcae11828615ef8715b

                SHA256

                6e53a93fc2968d90891db6059bac49e975c09546e19a54f1f93fb01a21318fdc

                SHA512

                fda0e3855522039d3b56e15b169b4c634672ca181ced78a479b6723c22ce889308db55aa1ea58fa8cb01ed1657fddc52a2c45d904c6eb5b852a171bcba310a52

                Download Submit

              • C:\ProgramData\buas\sdv.vbs
                Filesize

                16KB

                MD5

                1ac262835ce10823fd6f7d7296e6fef1

                SHA1

                aedaac50010e8c708bb70cb38893697e565fbf89

                SHA256

                f1b4376472f23de643052e1552d8fdac0a4ba56aa342696b7d510b62f24c4e15

                SHA512

                e0177744a682f8913f74da6a428bd16487ff473548f740d99bd6098308136a81f40cea2603950658621db714622845c1ace95ff5851bc6ff325e51ad3f7776e5

                Download Submit

              • C:\Windows\Installer\e5790f5.msi
                Filesize

                588KB

                MD5

                262b3a8d59585a9840bcf39c0b98a84a

                SHA1

                3bbccf28a4b75f2ff0505684799f14a8f72969e9

                SHA256

                93ff5d50aeb9242c733dd80f411eeafc0fe72c3eb37327ba85a5626edc4c545c

                SHA512

                1f826b0113b0a1cd785cc311e37bcc6b87634bf5fef72554bef8289c0ae2ac525e063eaf475fb27b2925a1dd52b963da8187d6717dd81c2988aed5ebc2a2ad43

                Download Submit

              • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                Filesize

                25.0MB

                MD5

                d9f2dd2b99db0e19d550d865760a3406

                SHA1

                7de5bcd2c3b14e41796413e384a8ea754bf62a49

                SHA256

                95c4cb251fb4cdf1a50a12abb55be876c6822be007084a45bcf2a05bdd0c0764

                SHA512

                2b39b74305956263940f8125411b82435bdf2d89ebff95f9323a5def6760f0d402b38b13f9166984305fdd67d2d2cbef1a83799d5bdaefd824672f1429438ae3

                Download Submit

              • \??\Volume{b2c2c2d8-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{ff3c7db7-08a0-4f02-87bf-2b448e3f3c99}_OnDiskSnapshotProp
                Filesize

                5KB

                MD5

                830ff71b38f446577008025aaaf38a95

                SHA1

                b22b812cf3333ee09658b39166ed6370f6b15619

                SHA256

                4c02cb14a1342f300b8dbdf6ceb0ce5410d69e92725780258d64ffb71799ca73

                SHA512

                33500b5fa88d72fd477046f0c7ff3eecc8ea3275808872975f13eb15c2d9490c825a54da97750e64b5546ca0c08a382126fc6f2d7c2fcad1e3b22c19819b7e49

                Download Submit