82b8bf8acbfe4bbabe140bc8b0c7b94135983e08685e0b684853c764e89d2b7b

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
05/11/2023, 04:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.2994aec8b96490396d0ca334d32a62f0_JC.exe
Size

2.7MB
MD5

2994aec8b96490396d0ca334d32a62f0
SHA1

c48fa6469e84279b305293885d4f7be85ce4d3d8
SHA256

82b8bf8acbfe4bbabe140bc8b0c7b94135983e08685e0b684853c764e89d2b7b
SHA512

5c8e1933d520e37575f72289b8af63e8f865b8fc378ba2c9f5ab6b7090fc87243f8617ae3a4ca1f26e12161ea15c8a50437d79f1a16a68ced09670978a7a3e3a
SSDEEP

49152:jqGRIgg2SirwkF9xdtb43lyGKCafpKkiwnaDahmPzpY4FPyazI:jxxLFfY/KCCpKk9aWMzZyaU

Score

7^/10

persistence upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0008000000022d86-1.dat	acprotect
behavioral2/files/0x0008000000022d86-7.dat	acprotect

Loads dropped DLL 2 IoCs

pid	Process
2324	NEAS.2994aec8b96490396d0ca334d32a62f0_JC.exe
2128	MsiExec.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0008000000022d86-1.dat	upx
behavioral2/memory/2324-4-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/files/0x0008000000022d86-7.dat	upx
behavioral2/memory/2324-19-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/2324-26-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/2324-31-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/2324-140-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	NEAS.2994aec8b96490396d0ca334d32a62f0_JC.exe

Enumerates connected drives 3 TTPs 47 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\e:	NEAS.2994aec8b96490396d0ca334d32a62f0_JC.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	NEAS.2994aec8b96490396d0ca334d32a62f0_JC.exe
File created	\??\c:\program files\common files\system\symsrv.dll.000	NEAS.2994aec8b96490396d0ca334d32a62f0_JC.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia80.dll	msiexec.exe

Drops file in Windows directory 57 IoCs

description	ioc	Process
File created	C:\Windows\WinSxS\InstallTemp\20231105040747695.0\8.0.50727.6195.policy	msiexec.exe
File created	C:\Windows\Installer\e588306.msi	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20231105040747351.0	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20231105040747679.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231105040747351.0\mfc80FRA.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231105040747679.0\8.0.50727.6195.policy	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231105040747351.0\mfc80ENU.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231105040747351.0\mfc80KOR.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231105040747742.0\8.0.50727.6195.policy	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20231105040747601.0	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20231105040747710.0	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231105040746820.0\msvcm80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231105040747039.0\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_150c9e8b.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231105040747039.0\mfc80u.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231105040747039.0\mfc80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231105040747351.0\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_6a5bb789.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231105040747351.0\mfc80CHS.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20231105040747695.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231105040746820.0\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86.cat	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20231105040747726.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231105040746726.0\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_a4c618fa.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231105040746726.0\ATL80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231105040747039.0\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_150c9e8b.manifest	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20231105040747039.0	msiexec.exe
File opened for modification	C:\Windows\Installer\e588306.msi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231105040746820.0\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231105040747601.0\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_452bf920.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231105040747710.0\8.0.50727.6195.policy	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231105040747726.0\8.0.50727.6195.policy	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20231105040746820.0	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8865.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231105040747039.0\mfcm80u.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231105040747351.0\mfc80ESP.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20231105040746726.0	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA7F4.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231105040747351.0\mfc80JPN.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231105040747695.0\8.0.50727.6195.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231105040747351.0\mfc80ITA.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231105040747710.0\8.0.50727.6195.cat	msiexec.exe
File created	C:\Windows\Installer\SourceHash{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231105040747351.0\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_6a5bb789.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231105040747351.0\mfc80DEU.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231105040747601.0\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_452bf920.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231105040747679.0\8.0.50727.6195.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231105040747726.0\8.0.50727.6195.cat	msiexec.exe
File created	C:\Windows\Installer\e58830a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231105040747351.0\mfc80CHT.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231105040747742.0\8.0.50727.6195.cat	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231105040747039.0\mfcm80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231105040746820.0\msvcr80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231105040746820.0\msvcp80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231105040747601.0\vcomp.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20231105040747742.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231105040746726.0\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_a4c618fa.cat	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000006f5277fd0b2376700000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800006f5277fd0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809006f5277fd000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d6f5277fd000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000006f5277fd00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1A\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b	msiexec.exe

Modifies registry class 45 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\ProductName = "Microsoft Visual C++ 2005 Redistributable"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\10 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\4 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFC,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e0021004d00210026005a005a006300300025006e00650038004d006b0062004900640046007700550000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\PackageCode = "84067013B7B56744BA0F51892982BC09"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\7 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFC,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e003d0024006b00600049004e005d00490038004300650038004d006b0062004900640046007700550000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AA5D9C68C00F12943B2F6CA09FE28244	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\PackageName = "vcredist.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.OpenMP,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e0035006f00300068002c0070004d0076004e003d00650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFCLOC,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e006600720038005f006c0028006d0032004e004400650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\Language = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\Version = "134278729"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.CRT,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e005f006a0030002c0059005d007300210053006f00650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFCLOC,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e006900450024005b004d00310025002e0064002700650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.ATL,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e0036006b007d00700048004c004800240053004400650038004d006b0062004900640046007700550000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\c1c4f01781cc94c4c8fb1542c0981a2a	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\6 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.ATL,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e00700052005e007000580049006000510075006f00650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AA5D9C68C00F12943B2F6CA09FE28244\c1c4f01781cc94c4c8fb1542c0981a2a	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\8 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\11 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.OpenMP,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e00370030002d0054002400210028002a0026004e00650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\c1c4f01781cc94c4c8fb1542c0981a2a\VC_Redist	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\c1c4f01781cc94c4c8fb1542c0981a2a\Servicing_Key	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\1 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\3 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\5 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.CRT,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e0061005a004f002c0048002a004b00320060004500650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\2 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\9 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2324	NEAS.2994aec8b96490396d0ca334d32a62f0_JC.exe
2324	NEAS.2994aec8b96490396d0ca334d32a62f0_JC.exe
2324	NEAS.2994aec8b96490396d0ca334d32a62f0_JC.exe
2324	NEAS.2994aec8b96490396d0ca334d32a62f0_JC.exe
4772	msiexec.exe
4772	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2324	NEAS.2994aec8b96490396d0ca334d32a62f0_JC.exe
Token: SeShutdownPrivilege	2968	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2968	msiexec.exe
Token: SeSecurityPrivilege	4772	msiexec.exe
Token: SeCreateTokenPrivilege	2968	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2968	msiexec.exe
Token: SeLockMemoryPrivilege	2968	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2968	msiexec.exe
Token: SeMachineAccountPrivilege	2968	msiexec.exe
Token: SeTcbPrivilege	2968	msiexec.exe
Token: SeSecurityPrivilege	2968	msiexec.exe
Token: SeTakeOwnershipPrivilege	2968	msiexec.exe
Token: SeLoadDriverPrivilege	2968	msiexec.exe
Token: SeSystemProfilePrivilege	2968	msiexec.exe
Token: SeSystemtimePrivilege	2968	msiexec.exe
Token: SeProfSingleProcessPrivilege	2968	msiexec.exe
Token: SeIncBasePriorityPrivilege	2968	msiexec.exe
Token: SeCreatePagefilePrivilege	2968	msiexec.exe
Token: SeCreatePermanentPrivilege	2968	msiexec.exe
Token: SeBackupPrivilege	2968	msiexec.exe
Token: SeRestorePrivilege	2968	msiexec.exe
Token: SeShutdownPrivilege	2968	msiexec.exe
Token: SeDebugPrivilege	2968	msiexec.exe
Token: SeAuditPrivilege	2968	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2968	msiexec.exe
Token: SeChangeNotifyPrivilege	2968	msiexec.exe
Token: SeRemoteShutdownPrivilege	2968	msiexec.exe
Token: SeUndockPrivilege	2968	msiexec.exe
Token: SeSyncAgentPrivilege	2968	msiexec.exe
Token: SeEnableDelegationPrivilege	2968	msiexec.exe
Token: SeManageVolumePrivilege	2968	msiexec.exe
Token: SeImpersonatePrivilege	2968	msiexec.exe
Token: SeCreateGlobalPrivilege	2968	msiexec.exe
Token: SeBackupPrivilege	3660	vssvc.exe
Token: SeRestorePrivilege	3660	vssvc.exe
Token: SeAuditPrivilege	3660	vssvc.exe
Token: SeBackupPrivilege	4772	msiexec.exe
Token: SeRestorePrivilege	4772	msiexec.exe
Token: SeRestorePrivilege	4772	msiexec.exe
Token: SeTakeOwnershipPrivilege	4772	msiexec.exe
Token: SeRestorePrivilege	4772	msiexec.exe
Token: SeTakeOwnershipPrivilege	4772	msiexec.exe
Token: SeBackupPrivilege	3212	srtasks.exe
Token: SeRestorePrivilege	3212	srtasks.exe
Token: SeSecurityPrivilege	3212	srtasks.exe
Token: SeTakeOwnershipPrivilege	3212	srtasks.exe
Token: SeBackupPrivilege	3212	srtasks.exe
Token: SeRestorePrivilege	3212	srtasks.exe
Token: SeSecurityPrivilege	3212	srtasks.exe
Token: SeTakeOwnershipPrivilege	3212	srtasks.exe
Token: SeRestorePrivilege	4772	msiexec.exe
Token: SeTakeOwnershipPrivilege	4772	msiexec.exe
Token: SeRestorePrivilege	4772	msiexec.exe
Token: SeTakeOwnershipPrivilege	4772	msiexec.exe
Token: SeRestorePrivilege	4772	msiexec.exe
Token: SeTakeOwnershipPrivilege	4772	msiexec.exe
Token: SeRestorePrivilege	4772	msiexec.exe
Token: SeTakeOwnershipPrivilege	4772	msiexec.exe
Token: SeRestorePrivilege	4772	msiexec.exe
Token: SeTakeOwnershipPrivilege	4772	msiexec.exe
Token: SeRestorePrivilege	4772	msiexec.exe
Token: SeTakeOwnershipPrivilege	4772	msiexec.exe
Token: SeRestorePrivilege	4772	msiexec.exe
Token: SeTakeOwnershipPrivilege	4772	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2968	msiexec.exe
2968	msiexec.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 2968	2324	NEAS.2994aec8b96490396d0ca334d32a62f0_JC.exe	91
PID 2324 wrote to memory of 2968	2324	NEAS.2994aec8b96490396d0ca334d32a62f0_JC.exe	91
PID 2324 wrote to memory of 2968	2324	NEAS.2994aec8b96490396d0ca334d32a62f0_JC.exe	91
PID 4772 wrote to memory of 3212	4772	msiexec.exe	102
PID 4772 wrote to memory of 3212	4772	msiexec.exe	102
PID 4772 wrote to memory of 2128	4772	msiexec.exe	105
PID 4772 wrote to memory of 2128	4772	msiexec.exe	105
PID 4772 wrote to memory of 2128	4772	msiexec.exe	105

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\NEAS.2994aec8b96490396d0ca334d32a62f0_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.2994aec8b96490396d0ca334d32a62f0_JC.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Windows\SysWOW64\msiexec.exe
  msiexec /i vcredist.msi
  2⤵
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2968

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3212
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DD8440283E727691B87C818240BA7C45
  2⤵
  - Loads dropped DLL
  PID:2128

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e588309.rbs

Filesize
73KB

MD5
0d5d9577859fc9fdde88ac9cbfc5f3b4

SHA1
4386918ae10a6f59da32c5d456fe471fbec7c9a6

SHA256
b3e3187bc8274c015122660c94fa0577fd98bf3ba9e5ea702bbaa91786f4de16

SHA512
3d31991b374dfdb25ae70de66b7eb61c6a0074b87c9604d24710b3eb555fcb95ad4c1d1bb9d6cbee1f12e5ed395456d7ef92fe161de6b9d75caba1c63384544f

Download Submit
C:\Program Files\Common Files\System\symsrv.dll

Filesize
67KB

MD5
7574cf2c64f35161ab1292e2f532aabf

SHA1
14ba3fa927a06224dfe587014299e834def4644f

SHA256
de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085

SHA512
4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

Download Submit
C:\Program Files\Common Files\System\symsrv.dll

Filesize
67KB

MD5
7574cf2c64f35161ab1292e2f532aabf

SHA1
14ba3fa927a06224dfe587014299e834def4644f

SHA256
de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085

SHA512
4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

Download Submit
C:\Program Files\Common Files\System\symsrv.dll.000

Filesize
175B

MD5
1130c911bf5db4b8f7cf9b6f4b457623

SHA1
48e734c4bc1a8b5399bff4954e54b268bde9d54c

SHA256
eba08cc8182f379392a97f542b350ea0dbbe5e4009472f35af20e3d857eafdf1

SHA512
94e2511ef2c53494c2aff0960266491ffc0e54e75185427d1ccedae27c286992c754ca94cbb0c9ea36e3f04cd4eb7f032c551cf2d4b309f292906303f1a75fa0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredis1.cab

Filesize
247KB

MD5
cc064d4b81619991de8131a86ad77681

SHA1
88d80d86cc20c27d7d2a872af719300bd2bb73f9

SHA256
913ee5a1cae3e5a1872b3a5efaaa00c58e4beb692492b138f76967da671b0477

SHA512
5aff0eb26cfc187bf58721b2b6d73357d9f1e66d1ac5340ad9ddc08b40ad0eda27a144cb3b650604637a7476c282ded83ed890de98a73ccaf0cc021da3a9eb25

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredist.msi

Filesize
2.6MB

MD5
b20bbeb818222b657df49a9cfe4fed79

SHA1
3f6508e880b86502773a3275bc9527f046d45502

SHA256
91bdd063f6c53126737791c9eccf0b2f4cf44927831527245bc89a0be06c0cb4

SHA512
f534bc7bf1597e728940e6c3b77f864adfaa413bb1e080458326b692b0f96bddf4fbd294eeed36d7764a3578e6c8e919488bbf63b8fe2d4355ab3efd685424a4

Download Submit
C:\Windows\Installer\MSI8865.tmp

Filesize
28KB

MD5
85221b3bcba8dbe4b4a46581aa49f760

SHA1
746645c92594bfc739f77812d67cfd85f4b92474

SHA256
f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f

SHA512
060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d

Download Submit
C:\Windows\Installer\MSI8865.tmp

Filesize
28KB

MD5
85221b3bcba8dbe4b4a46581aa49f760

SHA1
746645c92594bfc739f77812d67cfd85f4b92474

SHA256
f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f

SHA512
060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d

Download Submit
C:\Windows\Installer\e588306.msi

Filesize
2.6MB

MD5
b20bbeb818222b657df49a9cfe4fed79

SHA1
3f6508e880b86502773a3275bc9527f046d45502

SHA256
91bdd063f6c53126737791c9eccf0b2f4cf44927831527245bc89a0be06c0cb4

SHA512
f534bc7bf1597e728940e6c3b77f864adfaa413bb1e080458326b692b0f96bddf4fbd294eeed36d7764a3578e6c8e919488bbf63b8fe2d4355ab3efd685424a4

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.0MB

MD5
5d716f1846993a908cc3342006ae8186

SHA1
a83198cfcb15323de0011c4460576d68bf8663ac

SHA256
5ed9c590df2ad19e33050bb26373f2026c242b2999b45ccab88c17119d2fb247

SHA512
caffde814d902b06ff979a6102e2b02ff9a59e56774c5b7225d871d0748afefc6b14fecf691bf5217547ded823e8a8a6e9fcfc622eeb43743e462410a23e840c

Download Submit
\??\Volume{fd77526f-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{a02ccae6-b6bc-43b0-9343-b60ceda11b28}_OnDiskSnapshotProp

Filesize
5KB

MD5
833d161c618713b4c0a99c58c4c7b3c0

SHA1
d6579ae9591203dcfd72934eaf5c5088e4787d40

SHA256
b8eea5fc58afa1011dbf82875c42e1202338ce83b91a3c80d7b46a2c04bd9601

SHA512
dbe895600d533e7d661020afe15dd81617db4fd5489a58ca8bd9096dab84f11355720bdddeaa8076b8f27761eaff29a6e8f75e82be27276c769925e7d2034e5d

Download Submit
memory/2324-31-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2324-6-0x0000000001000000-0x0000000001297000-memory.dmp

Filesize
2.6MB

Download
memory/2324-19-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2324-26-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2324-21-0x0000000001000000-0x0000000001297000-memory.dmp

Filesize
2.6MB

Download
memory/2324-4-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2324-140-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2324-141-0x0000000001000000-0x0000000001297000-memory.dmp

Filesize
2.6MB

Download