Overview

overview

6

Static

static

1

Setup.msi

windows10-1703-x64

6

Analysis

  • max time kernel
    339s
  • max time network
    1223s
  • platform
    windows10-1703_x64
  • resource
    win10-20230703-en
  • resource tags

    arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
  • submitted
    08-07-2023 02:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Setup.msi

  • Size

    292KB

  • MD5

    8f9b3dbeac13edd7ed6307a9ceb606a9

  • SHA1

    5bb9dad51e41c39343801bf32a983e97d38483db

  • SHA256

    393e5b0dd1d37685962cff6b2515a00c93f2bbb4359b2174e250aaabf33fd114

  • SHA512

    f752fc27630b265885ba39c3e61ee49e43f00d8df45778d051ec82a16401b17bc1d57e735f464f37580a48b10cb9011153ee0d90d2215c03881c49642ebcee98

  • SSDEEP

    6144:yA8ZnQUO9Ookjjs+nM+WEgqTrhOqgME0zG+bpGFsA:FknQUOhkjHdrxPzG+bpGWA

Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 5 IoCs
  • Drops file in Windows directory 10 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 5 IoCs
  • Modifies registry class 23 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Setup.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:3572
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2204
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:1960
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4232
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc
      1⤵
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:3240

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Config.Msi\e582a48.rbs
      Filesize

      7KB

      MD5

      19741243234e973620af1e91c2c7dc9a

      SHA1

      341a79e8d3a1b3327927104a0c638e458c960cc6

      SHA256

      3eb3f4d3a9995c01e42a3a4b281064f4bdf7c8b078bfd6535cad0f5f7bbe3506

      SHA512

      8880fd545d182dd4ebf8c820f27ae804a3513b5261a709c8dfc676e6c9347fccf4ee8f5548750c12d75d5da5ac9e912566c9f4d82d7aa05f6e8e9c84d0dda094

      Download Submit

    • C:\Windows\Installer\e582a47.msi
      Filesize

      292KB

      MD5

      8f9b3dbeac13edd7ed6307a9ceb606a9

      SHA1

      5bb9dad51e41c39343801bf32a983e97d38483db

      SHA256

      393e5b0dd1d37685962cff6b2515a00c93f2bbb4359b2174e250aaabf33fd114

      SHA512

      f752fc27630b265885ba39c3e61ee49e43f00d8df45778d051ec82a16401b17bc1d57e735f464f37580a48b10cb9011153ee0d90d2215c03881c49642ebcee98

      Download Submit

    • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
      Filesize

      25.0MB

      MD5

      2648f9aedf3c4b16e4fa1097a9f4106c

      SHA1

      26550eb7652f945e4ccfb6f73c6da74d5bf65ce4

      SHA256

      fb617672dea8b213421dade0e0310e809ab34646b5ef579789095c5cff8ca824

      SHA512

      f382ae27779b80629d5d6c4618af4b174d0f4706c3230075bfd2a5d2024ad3421abde2e9c64ac080acce33fa9a0a73c7f02806e88ba4ff4af8456d78a99cc662

      Download Submit

    • \??\Volume{9753329a-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{10b113e6-89af-44b2-be6e-d8f14566fa00}_OnDiskSnapshotProp
      Filesize

      5KB

      MD5

      1331ff8d00053867f71ee860ce8e3b26

      SHA1

      019e8d063a8f1c0da007eda469881ed382800ebe

      SHA256

      4eb0d9cd99226243a28cf999952439c3f33b538145ef7f6956754289afc74832

      SHA512

      16ff932f815c2622f54e6fb6dd6b8a1a7345b3812556196cd2cc8c85cb528b486ee1eabfb9e4cf1d2195bbeb3b146f00bcd6e1ebff8fa25851fb6688e1d143cd

      Download Submit