59e1edf4d82fae4978e97512b0331b7eb21dd4b838b850ba46794d9c7a2c0983

General

Target

3CXDesktopApp-18.12.416.msi
Size

97.8MB
MD5

0eeb1c0133eb4d571178b2d9d14ce3e9
SHA1

bfecb8ce89a312d2ef4afc64a63847ae11c6f69e
SHA256

59e1edf4d82fae4978e97512b0331b7eb21dd4b838b850ba46794d9c7a2c0983
SHA512

85923f35da3638c9aefa152a0a6b7e8f2b8ec6aa6791b4d4a758c8899d04be25fb480253a9fbf27d9c108c6635347af2705d97d962faea497a6649f8b63ec2fc
SSDEEP

3145728:Ujlq80AfkRGgGGo4yrtD1PQLzth2TBcMa8uGj2A:8lqmijypD1YPthSkS

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 5 IoCs

Processes:

msiexec.exe

flow pid process

15 1164 msiexec.exe
17 1164 msiexec.exe
21 1164 msiexec.exe
23 1164 msiexec.exe
25 1164 msiexec.exe

flow	pid	process
15	1164	msiexec.exe
17	1164	msiexec.exe
21	1164	msiexec.exe
23	1164	msiexec.exe
25	1164	msiexec.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssvc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000206f4107d723b55a0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000206f41070000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff000000000700010000680900206f4107000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000206f410700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000206f410700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exe

description	pid	process
Token: SeShutdownPrivilege	1164	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1164	msiexec.exe
Token: SeSecurityPrivilege	4552	msiexec.exe
Token: SeCreateTokenPrivilege	1164	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1164	msiexec.exe
Token: SeLockMemoryPrivilege	1164	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1164	msiexec.exe
Token: SeMachineAccountPrivilege	1164	msiexec.exe
Token: SeTcbPrivilege	1164	msiexec.exe
Token: SeSecurityPrivilege	1164	msiexec.exe
Token: SeTakeOwnershipPrivilege	1164	msiexec.exe
Token: SeLoadDriverPrivilege	1164	msiexec.exe
Token: SeSystemProfilePrivilege	1164	msiexec.exe
Token: SeSystemtimePrivilege	1164	msiexec.exe
Token: SeProfSingleProcessPrivilege	1164	msiexec.exe
Token: SeIncBasePriorityPrivilege	1164	msiexec.exe
Token: SeCreatePagefilePrivilege	1164	msiexec.exe
Token: SeCreatePermanentPrivilege	1164	msiexec.exe
Token: SeBackupPrivilege	1164	msiexec.exe
Token: SeRestorePrivilege	1164	msiexec.exe
Token: SeShutdownPrivilege	1164	msiexec.exe
Token: SeDebugPrivilege	1164	msiexec.exe
Token: SeAuditPrivilege	1164	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1164	msiexec.exe
Token: SeChangeNotifyPrivilege	1164	msiexec.exe
Token: SeRemoteShutdownPrivilege	1164	msiexec.exe
Token: SeUndockPrivilege	1164	msiexec.exe
Token: SeSyncAgentPrivilege	1164	msiexec.exe
Token: SeEnableDelegationPrivilege	1164	msiexec.exe
Token: SeManageVolumePrivilege	1164	msiexec.exe
Token: SeImpersonatePrivilege	1164	msiexec.exe
Token: SeCreateGlobalPrivilege	1164	msiexec.exe
Token: SeBackupPrivilege	4476	vssvc.exe
Token: SeRestorePrivilege	4476	vssvc.exe
Token: SeAuditPrivilege	4476	vssvc.exe
Token: SeBackupPrivilege	4552	msiexec.exe
Token: SeRestorePrivilege	4552	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

msiexec.exe

pid process

1164 msiexec.exe
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

pid	process
1164	msiexec.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\3CXDesktopApp-18.12.416.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1164