06fb5f8b5c42c35d87a1031cc7d25c630c6cf4380460307a5e027e61d1d33b02

Analysis

max time kernel
151s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2023 20:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Pizza.Tower.v1.0.311/_Redist/_Redist/vcredist2005_x64.exe
Size

3.1MB
MD5

abde5e0a22a46434bd0df652a63fff44
SHA1

c5088da4be3f72b4af2f3156893bf1d2b1f6f6ec
SHA256

b1cbcde3791e0b1c6df3def43d8c05035c60fe2f6a2d8ba091abb4509fb43ef1
SHA512

4ebd8971dea1efb9a72fee071694da7c9d8c797b3564cec7e0044d24b01a13009013f4a43719b7e223214a6c43d50d56790751b9e91cd324d40809bf0d605d9f
SSDEEP

49152:RVgGXsOTkzq69oXxerpduZ6xJftGEkU0oEBL/txTroHENHTpPE6fIr6VAVP04PLJ:R7XFcDehoLtXEBv11TqZl04P5PqE

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

VCREDI~2.EXE

pid process

1916 VCREDI~2.EXE
Loads dropped DLL 2 IoCs

Processes:

MsiExec.exe

pid process

808 MsiExec.exe
808 MsiExec.exe

pid	process
1916	VCREDI~2.EXE

pid	process
808	MsiExec.exe
808	MsiExec.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

VCREDI~2.EXEvcredist2005_x64.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	VCREDI~2.EXE
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	vcredist2005_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	vcredist2005_x64.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	VCREDI~2.EXE

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe

Drops file in Program Files directory 1 IoCs

Processes:

msiexec.exe

description ioc process

File created C:\Program Files (x86)\Common Files\Microsoft Shared\VC\amd64\msdia80.dll msiexec.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VC\amd64\msdia80.dll	msiexec.exe

Drops file in Windows directory 57 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSI854D.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526203338941.0\mfc80ENU.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526203338285.0\amd64_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_79404cdd.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526203338941.0\mfc80KOR.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526203339161.0\8.0.50727.4053.cat	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20230526203338410.0	msiexec.exe
File created	C:\Windows\Installer\e5776d6.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526203339161.0\8.0.50727.4053.policy	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526203339253.0\8.0.50727.4053.policy	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20230526203339097.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526203338628.0\mfcm80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526203338941.0\mfc80ESP.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526203338941.0\amd64_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_3ed5eb6c.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526203338941.0\mfc80JPN.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526203338628.0\amd64_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e986d26e.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526203338941.0\amd64_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_3ed5eb6c.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526203339097.0\vcomp.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526203339238.0\8.0.50727.4053.policy	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20230526203339161.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526203338410.0\msvcr80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526203338410.0\msvcp80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526203338410.0\amd64_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_18a05f69.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526203338410.0\msvcm80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526203339113.0\8.0.50727.4053.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526203339191.0\8.0.50727.4053.policy	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526203338410.0\amd64_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_18a05f69.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526203339253.0\8.0.50727.4053.cat	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20230526203339191.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526203338941.0\mfc80ITA.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526203339097.0\amd64_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_19a62d03.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526203338941.0\mfc80FRA.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526203339097.0\amd64_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_19a62d03.manifest	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526203338941.0\mfc80CHS.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9183.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526203339113.0\8.0.50727.4053.policy	msiexec.exe
File created	C:\Windows\Installer\e5776d9.msi	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20230526203338285.0	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20230526203338941.0	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526203338628.0\mfc80u.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526203339238.0\8.0.50727.4053.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526203338941.0\mfc80CHT.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526203339191.0\8.0.50727.4053.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526203338628.0\mfcm80u.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20230526203339238.0	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20230526203339253.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526203338628.0\amd64_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e986d26e.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526203338628.0\mfc80.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\e5776d6.msi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526203338941.0\mfc80DEU.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20230526203338628.0	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20230526203339113.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526203338285.0\amd64_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_79404cdd.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230526203338285.0\ATL80.dll	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssvc.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000a8dca56a4fb650f70000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000a8dca56a0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff000000000700010000680900a8dca56a000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000a8dca56a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000a8dca56a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe

Modifies data under HKEY_USERS 3 IoCs

Processes:

msiexec.exe

description	ioc	process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe

Modifies registry class 45 IoCs

Processes:

msiexec.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFCLOC,type="win32-policy",version="8.0.50727.4053",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 75003d007a007e004a0056003f004400410040005a007d003800620068004f003d007d0034007a00560043005f005200650064006900730074003e00500054005d002700660025002b0027004b002800650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9eab5ec6ac3d99b498a1d16c1c815acf\Servicing_Key	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media\10 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\92091D8AC5E822E408118470F0E997E6\9eab5ec6ac3d99b498a1d16c1c815acf	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media\6 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.CRT,type="win32-policy",version="8.0.50727.4053",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 75003d007a007e004a0056003f004400410040005a007d003800620068004f003d007d0034007a00560043005f005200650064006900730074003e004b0039007000540041002700650026005d002900650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFC,type="win32-policy",version="8.0.50727.4053",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 75003d007a007e004a0056003f004400410040005a007d003800620068004f003d007d0034007a00560043005f005200650064006900730074003e00240062003000290043004b0076003d0035002700650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\PackageCode = "83DB259064B8669479679DCD441743AC"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\Version = "134276920"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media\9 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFCLOC,type="win32",version="8.0.50727.4053",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 75003d007a007e004a0056003f004400410040005a007d003800620068004f003d007d0034007a00560043005f005200650064006900730074003e00530021004900240047002e004f005f0078006800650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\PackageName = "vcredist.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media\1 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\Clients = 3a0000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.ATL,type="win32",version="8.0.50727.4053",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 75003d007a007e004a0056003f004400410040005a007d003800620068004f003d007d0034007a00560043005f005200650064006900730074003e005a00310021003d00520046007900460072005700650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.CRT,type="win32",version="8.0.50727.4053",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 75003d007a007e004a0056003f004400410040005a007d003800620068004f003d007d0034007a00560043005f005200650064006900730074003e0049004c005400540052005900320074004f005700650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFC,type="win32",version="8.0.50727.4053",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 75003d007a007e004a0056003f004400410040005a007d003800620068004f003d007d0034007a00560043005f005200650064006900730074003e0069002a0048004e00530057007d0024007e005500650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.ATL,type="win32-policy",version="8.0.50727.4053",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 75003d007a007e004a0056003f004400410040005a007d003800620068004f003d007d0034007a00560043005f005200650064006900730074003e007b004c0046003d0042004900620074004f002800650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\ProductName = "Microsoft Visual C++ 2005 Redistributable (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media\2 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media\4 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.OpenMP,type="win32",version="8.0.50727.4053",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 75003d007a007e004a0056003f004400410040005a007d003800620068004f003d007d0034007a00560043005f005200650064006900730074003e007a0050005400310026006e0073004b0064007a00650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.OpenMP,type="win32-policy",version="8.0.50727.4053",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 75003d007a007e004a0056003f004400410040005a007d003800620068004f003d007d0034007a00560043005f005200650064006900730074003e007e0078002d00360076007a0045007a007e003200650038004d006b0062004900640046007700550000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9eab5ec6ac3d99b498a1d16c1c815acf	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\92091D8AC5E822E408118470F0E997E6	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media\8 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media\5 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media\7 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9eab5ec6ac3d99b498a1d16c1c815acf\VC_Redist	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\Language = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media\3 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media\11 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

msiexec.exe

pid process

4428 msiexec.exe
4428 msiexec.exe

pid	process
4428	msiexec.exe
4428	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exesrtasks.exe

description	pid	process
Token: SeShutdownPrivilege	1016	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1016	msiexec.exe
Token: SeSecurityPrivilege	4428	msiexec.exe
Token: SeCreateTokenPrivilege	1016	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1016	msiexec.exe
Token: SeLockMemoryPrivilege	1016	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1016	msiexec.exe
Token: SeMachineAccountPrivilege	1016	msiexec.exe
Token: SeTcbPrivilege	1016	msiexec.exe
Token: SeSecurityPrivilege	1016	msiexec.exe
Token: SeTakeOwnershipPrivilege	1016	msiexec.exe
Token: SeLoadDriverPrivilege	1016	msiexec.exe
Token: SeSystemProfilePrivilege	1016	msiexec.exe
Token: SeSystemtimePrivilege	1016	msiexec.exe
Token: SeProfSingleProcessPrivilege	1016	msiexec.exe
Token: SeIncBasePriorityPrivilege	1016	msiexec.exe
Token: SeCreatePagefilePrivilege	1016	msiexec.exe
Token: SeCreatePermanentPrivilege	1016	msiexec.exe
Token: SeBackupPrivilege	1016	msiexec.exe
Token: SeRestorePrivilege	1016	msiexec.exe
Token: SeShutdownPrivilege	1016	msiexec.exe
Token: SeDebugPrivilege	1016	msiexec.exe
Token: SeAuditPrivilege	1016	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1016	msiexec.exe
Token: SeChangeNotifyPrivilege	1016	msiexec.exe
Token: SeRemoteShutdownPrivilege	1016	msiexec.exe
Token: SeUndockPrivilege	1016	msiexec.exe
Token: SeSyncAgentPrivilege	1016	msiexec.exe
Token: SeEnableDelegationPrivilege	1016	msiexec.exe
Token: SeManageVolumePrivilege	1016	msiexec.exe
Token: SeImpersonatePrivilege	1016	msiexec.exe
Token: SeCreateGlobalPrivilege	1016	msiexec.exe
Token: SeBackupPrivilege	4016	vssvc.exe
Token: SeRestorePrivilege	4016	vssvc.exe
Token: SeAuditPrivilege	4016	vssvc.exe
Token: SeBackupPrivilege	4428	msiexec.exe
Token: SeRestorePrivilege	4428	msiexec.exe
Token: SeRestorePrivilege	4428	msiexec.exe
Token: SeTakeOwnershipPrivilege	4428	msiexec.exe
Token: SeBackupPrivilege	2620	srtasks.exe
Token: SeRestorePrivilege	2620	srtasks.exe
Token: SeSecurityPrivilege	2620	srtasks.exe
Token: SeTakeOwnershipPrivilege	2620	srtasks.exe
Token: SeBackupPrivilege	2620	srtasks.exe
Token: SeRestorePrivilege	2620	srtasks.exe
Token: SeSecurityPrivilege	2620	srtasks.exe
Token: SeTakeOwnershipPrivilege	2620	srtasks.exe
Token: SeRestorePrivilege	4428	msiexec.exe
Token: SeTakeOwnershipPrivilege	4428	msiexec.exe
Token: SeRestorePrivilege	4428	msiexec.exe
Token: SeTakeOwnershipPrivilege	4428	msiexec.exe
Token: SeRestorePrivilege	4428	msiexec.exe
Token: SeTakeOwnershipPrivilege	4428	msiexec.exe
Token: SeRestorePrivilege	4428	msiexec.exe
Token: SeTakeOwnershipPrivilege	4428	msiexec.exe
Token: SeRestorePrivilege	4428	msiexec.exe
Token: SeTakeOwnershipPrivilege	4428	msiexec.exe
Token: SeRestorePrivilege	4428	msiexec.exe
Token: SeTakeOwnershipPrivilege	4428	msiexec.exe
Token: SeRestorePrivilege	4428	msiexec.exe
Token: SeTakeOwnershipPrivilege	4428	msiexec.exe
Token: SeRestorePrivilege	4428	msiexec.exe
Token: SeTakeOwnershipPrivilege	4428	msiexec.exe
Token: SeRestorePrivilege	4428	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

1016 msiexec.exe
1016 msiexec.exe

pid	process
1016	msiexec.exe
1016	msiexec.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

vcredist2005_x64.exeVCREDI~2.EXEmsiexec.exe

description	pid	process	target process
PID 1456 wrote to memory of 1916	1456	vcredist2005_x64.exe	VCREDI~2.EXE
PID 1456 wrote to memory of 1916	1456	vcredist2005_x64.exe	VCREDI~2.EXE
PID 1456 wrote to memory of 1916	1456	vcredist2005_x64.exe	VCREDI~2.EXE
PID 1916 wrote to memory of 1016	1916	VCREDI~2.EXE	msiexec.exe
PID 1916 wrote to memory of 1016	1916	VCREDI~2.EXE	msiexec.exe
PID 1916 wrote to memory of 1016	1916	VCREDI~2.EXE	msiexec.exe
PID 4428 wrote to memory of 2620	4428	msiexec.exe	srtasks.exe
PID 4428 wrote to memory of 2620	4428	msiexec.exe	srtasks.exe
PID 4428 wrote to memory of 808	4428	msiexec.exe	MsiExec.exe
PID 4428 wrote to memory of 808	4428	msiexec.exe	MsiExec.exe
PID 4428 wrote to memory of 808	4428	msiexec.exe	MsiExec.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Pizza.Tower.v1.0.311\_Redist\_Redist\vcredist2005_x64.exe
"C:\Users\Admin\AppData\Local\Temp\Pizza.Tower.v1.0.311\_Redist\_Redist\vcredist2005_x64.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1456

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~2.EXE
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~2.EXE
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1916

C:\Windows\SysWOW64\msiexec.exe
msiexec /i vcredist.msi
3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1016

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4428

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2620

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 3D9C3B8998D3AA9AEF494F0394D77AF1
2⤵
- Loads dropped DLL
PID:808

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4016

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5776d8.rbs
Filesize
65KB

MD5
e2fb6ba098e7c2a18cf3fcfed32a140b

SHA1
21c41b1bbf3fd62ef9da28eb81a2e3962c83e535

SHA256
cae3d6392eaa4346516775180cf394bcebe6eb2cdd7348b7e93be0fcb27b046c

SHA512
9a1de3cb3c483d1ddf86ae78a664080814eceaf4b5eeedbb45cfeb1733601c87916bf86531f032849c6772fbac5a15b810ccfc24095d32c9345811fb94948308

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~2.EXE
Filesize
3.0MB

MD5
5734983a4cb513efbcccc357641c4d7c

SHA1
5650512cd0c8ae451032a795a4e881c9cdc50776

SHA256
bfc68a9e609ee8a850c21be8c459b99f09e34309b8113e43b12be7a27f0b445a

SHA512
93da04b2f7a3f64dca8c2c5b4c62be1ba867e46424130af19f9f88e668fd6ee10db354ed3921605df936a1248be51fe8e8612f9542b01de3e0ef54be3356f2a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~2.EXE
Filesize
3.0MB

MD5
5734983a4cb513efbcccc357641c4d7c

SHA1
5650512cd0c8ae451032a795a4e881c9cdc50776

SHA256
bfc68a9e609ee8a850c21be8c459b99f09e34309b8113e43b12be7a27f0b445a

SHA512
93da04b2f7a3f64dca8c2c5b4c62be1ba867e46424130af19f9f88e668fd6ee10db354ed3921605df936a1248be51fe8e8612f9542b01de3e0ef54be3356f2a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vcredis1.cab
Filesize
312KB

MD5
0aa0da68a91e9133715d9cde2a180ffb

SHA1
892e941bed49b3404dad2aa33cd36b708e1443a9

SHA256
64570910e03c337d4e1f8ab1b9fb8e4dc46fdccb93857a1e9c73b296c6850fe0

SHA512
247dc48b39844fcfbfd46ef8eb1c72375b183f2d54361f5fe857d3a1b7275145cd0a9be8f287e037b46912a496a39a8855c20a63a8c663b60fc620b0b35e2313

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vcredist.msi
Filesize
3.0MB

MD5
391dddd564a9e8a20576fe05e5e1f25b

SHA1
84f17830075abea6e6a369dee6b93ac16a71f025

SHA256
a9a8dac04e3b38c2f8d33ee7cf6d658fa4ea089bbf9f4014eb61b9d5de7dc6a2

SHA512
10358d52620178296c9033b257db960d3bf9b1219fa5b6f02f1173234686930616da708c5ac051b0c0c8892b3b66164093fc64698de43e56cf3b6f1d875e418f

Download Submit
C:\Windows\Installer\MSI854D.tmp
Filesize
28KB

MD5
85221b3bcba8dbe4b4a46581aa49f760

SHA1
746645c92594bfc739f77812d67cfd85f4b92474

SHA256
f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f

SHA512
060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d

Download Submit
C:\Windows\Installer\MSI854D.tmp
Filesize
28KB

MD5
85221b3bcba8dbe4b4a46581aa49f760

SHA1
746645c92594bfc739f77812d67cfd85f4b92474

SHA256
f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f

SHA512
060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d

Download Submit
C:\Windows\Installer\MSI854D.tmp
Filesize
28KB

MD5
85221b3bcba8dbe4b4a46581aa49f760

SHA1
746645c92594bfc739f77812d67cfd85f4b92474

SHA256
f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f

SHA512
060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d

Download Submit
C:\Windows\Installer\e5776d6.msi
Filesize
3.0MB

MD5
391dddd564a9e8a20576fe05e5e1f25b

SHA1
84f17830075abea6e6a369dee6b93ac16a71f025

SHA256
a9a8dac04e3b38c2f8d33ee7cf6d658fa4ea089bbf9f4014eb61b9d5de7dc6a2

SHA512
10358d52620178296c9033b257db960d3bf9b1219fa5b6f02f1173234686930616da708c5ac051b0c0c8892b3b66164093fc64698de43e56cf3b6f1d875e418f

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Filesize
11.8MB

MD5
fb87380974810e6007f9ed4933223a1d

SHA1
c617a75af4dad4cc225e523b3ec0cb20f331abfe

SHA256
a745fc33809d5bd214cb9189a88580241fb6dd4cca3525b066ee68f258870556

SHA512
e929e4a77985aef17a4793906d2af20e8f9970d9d88a4957caa4c0b4568172195b6faebc76f14246f88426d1537cebbab118a832383e82d99bdc3ee67e975d82

Download Submit
\??\Volume{6aa5dca8-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{3e68e183-dd6b-4a27-ad93-81bd42e940e1}_OnDiskSnapshotProp
Filesize
5KB

MD5
648c77d489ee8b1ad075fee10f9d7651

SHA1
aeebe8962cb190208d653fcb8d793cfd94e7ed8d

SHA256
e2291647b1157932d235ae2e9133cdd0a06457c6fb467e6532f6761de736b4e8

SHA512
a90193252599075216679d88b7037e42d585900f170418472e825eaa7e266c2a42949a8bf996cbc8aba583ef6c5be9f6c9be0c14506858ede08c526457c62c8d

Download Submit