Overview
overview
7Static
static
1vc-redist_...64.exe
windows7-x64
7vc-redist_...64.exe
windows10-2004-x64
6vc-redist_...64.exe
windows7-x64
7vc-redist_...64.exe
windows10-2004-x64
7vc-redist_...64.exe
windows7-x64
7vc-redist_...64.exe
windows10-2004-x64
7vc-redist_...64.exe
windows7-x64
7vc-redist_...64.exe
windows10-2004-x64
7vc-redist_...64.exe
windows7-x64
7vc-redist_...64.exe
windows10-2004-x64
7vc-redist_...64.exe
windows7-x64
4vc-redist_...64.exe
windows10-2004-x64
4Analysis
-
max time kernel
169s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
07-11-2023 13:45
Static task
static1
Behavioral task
behavioral1
Sample
vc-redist_2005-x64.exe
Resource
win7-20231020-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
vc-redist_2005-x64.exe
Resource
win10v2004-20231020-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
vc-redist_2008-x64.exe
Resource
win7-20231020-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
vc-redist_2008-x64.exe
Resource
win10v2004-20231020-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
vc-redist_2010-x64.exe
Resource
win7-20231025-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral6
Sample
vc-redist_2010-x64.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral7
Sample
vc-redist_2012-x64.exe
Resource
win7-20231025-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
vc-redist_2012-x64.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
vc-redist_2013-x64.exe
Resource
win7-20231020-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
vc-redist_2013-x64.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
vc-redist_2015-2022-x64.exe
Resource
win7-20231020-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral12
Sample
vc-redist_2015-2022-x64.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
vc-redist_2005-x64.exe
-
Size
3.0MB
-
MD5
e231fbcce2c2cb16dcc299d36c734df3
-
SHA1
f4d74643a0e117ea80b2c7ebcd908a6dd26aa9ea
-
SHA256
4487570bd86e2e1aac29db2a1d0a91eb63361fcaac570808eb327cd4e0e2240d
-
SHA512
4a3d27791f72d6feb38e55fe06b8a08f99bac315415d11e32cb6895cdd6f7145d46d070cd94ac879c4b87ff2a025b3781e662b32848ff2dbdd350cb46fe9177a
-
SSDEEP
49152:or67+stI6RWGTAdyvlADUrpTmcOgohwJpEM5grO3oc1OXZViFeRyDErkLUMHzkRT:eM9l8pUr9m30L5grOQXZKAsErkbQRT
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 1652 MsiExec.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" vc-redist_2005-x64.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\B: msiexec.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\Microsoft Shared\VC\amd64\msdia80.dll msiexec.exe -
Drops file in Windows directory 48 IoCs
description ioc Process File created C:\Windows\WinSxS\InstallTemp\20231107152021753.0\8.0.50727.6195.policy msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107152021784.0\8.0.50727.6195.cat msiexec.exe File opened for modification C:\Windows\Installer\MSI15B.tmp msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107152003345.0\msvcm80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107152017946.0\mfcm80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107152021051.0\amd64_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_9c659d69.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107152021051.0\mfc80FRA.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107152021862.0\8.0.50727.6195.cat msiexec.exe File created C:\Windows\Installer\f78ecf3.msi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107152003345.0\msvcr80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107152017946.0\amd64_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_4716846b.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107152021051.0\amd64_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_9c659d69.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107152017946.0\mfc80u.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107152021051.0\mfc80ESP.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107152021051.0\mfc80JPN.dll msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File created C:\Windows\Installer\f78ecee.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107152003345.0\amd64_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_76301166.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107152017946.0\amd64_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_4716846b.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107152021051.0\mfc80KOR.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107152021051.0\mfc80ITA.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107152021799.0\8.0.50727.6195.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107152021831.0\8.0.50727.6195.policy msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107152021831.0\8.0.50727.6195.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107152017946.0\mfc80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107152017946.0\mfcm80u.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107152021051.0\mfc80CHS.dll msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\f78ecee.msi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107152021690.0\amd64_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_7735df00.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107152003345.0\amd64_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_76301166.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107152003345.0\msvcp80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107152021051.0\mfc80ENU.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107152021690.0\amd64_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_7735df00.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107152021753.0\8.0.50727.6195.cat msiexec.exe File opened for modification C:\Windows\Installer\MSIF6FE.tmp msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107152000381.0\amd64_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_d6cffeda.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107152000381.0\ATL80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107152021784.0\8.0.50727.6195.policy msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107152021862.0\8.0.50727.6195.policy msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107152021051.0\mfc80CHT.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107152021051.0\mfc80DEU.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107152021690.0\vcomp.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107152021799.0\8.0.50727.6195.policy msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File created C:\Windows\Installer\f78ecf1.ipi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107152000381.0\amd64_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_d6cffeda.cat msiexec.exe -
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe -
Modifies registry class 45 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\4 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\PackageCode = "C558A51006735C645AEE5A0FC6A310C9" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\2 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\5 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\11 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1af2a8da7e60d0b429d7e6453b3d0182\Servicing_Key msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\Version = "134278728" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\92091D8AC5E822E408118470F0E997E6\1af2a8da7e60d0b429d7e6453b3d0182 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\AdvertiseFlags = "388" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.CRT,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e0049004c005400540052005900320074004f005700650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.ATL,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e007b004c0046003d0042004900620074004f002800650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\Assignment = "1" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.CRT,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e004b0039007000540041002700650026005d002900650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\ProductName = "Microsoft Visual C++ 2005 Redistributable (x64)" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\7 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\6 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFCLOC,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e00530021004900240047002e004f005f0078006800650038004d006b0062004900640046007700550000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1af2a8da7e60d0b429d7e6453b3d0182 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\92091D8AC5E822E408118470F0E997E6 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\8 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\Language = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\3 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFCLOC,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e00500054005d002700660025002b0027004b002800650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.OpenMP,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e007e0078002d00360076007a0045007a007e003200650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\PackageName = "vcredist.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\9 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFC,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e0069002a0048004e00530057007d0024007e005500650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.OpenMP,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e007a0050005400310026006e0073004b0064007a00650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\10 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\1 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.ATL,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e005a00310021003d00520046007900460072005700650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFC,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e00240062003000290043004b0076003d0035002700650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1af2a8da7e60d0b429d7e6453b3d0182\VC_Redist msiexec.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2812 msiexec.exe 2812 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2804 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2804 msiexec.exe Token: SeIncreaseQuotaPrivilege 2804 msiexec.exe Token: SeRestorePrivilege 2812 msiexec.exe Token: SeTakeOwnershipPrivilege 2812 msiexec.exe Token: SeSecurityPrivilege 2812 msiexec.exe Token: SeCreateTokenPrivilege 2804 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2804 msiexec.exe Token: SeLockMemoryPrivilege 2804 msiexec.exe Token: SeIncreaseQuotaPrivilege 2804 msiexec.exe Token: SeMachineAccountPrivilege 2804 msiexec.exe Token: SeTcbPrivilege 2804 msiexec.exe Token: SeSecurityPrivilege 2804 msiexec.exe Token: SeTakeOwnershipPrivilege 2804 msiexec.exe Token: SeLoadDriverPrivilege 2804 msiexec.exe Token: SeSystemProfilePrivilege 2804 msiexec.exe Token: SeSystemtimePrivilege 2804 msiexec.exe Token: SeProfSingleProcessPrivilege 2804 msiexec.exe Token: SeIncBasePriorityPrivilege 2804 msiexec.exe Token: SeCreatePagefilePrivilege 2804 msiexec.exe Token: SeCreatePermanentPrivilege 2804 msiexec.exe Token: SeBackupPrivilege 2804 msiexec.exe Token: SeRestorePrivilege 2804 msiexec.exe Token: SeShutdownPrivilege 2804 msiexec.exe Token: SeDebugPrivilege 2804 msiexec.exe Token: SeAuditPrivilege 2804 msiexec.exe Token: SeSystemEnvironmentPrivilege 2804 msiexec.exe Token: SeChangeNotifyPrivilege 2804 msiexec.exe Token: SeRemoteShutdownPrivilege 2804 msiexec.exe Token: SeUndockPrivilege 2804 msiexec.exe Token: SeSyncAgentPrivilege 2804 msiexec.exe Token: SeEnableDelegationPrivilege 2804 msiexec.exe Token: SeManageVolumePrivilege 2804 msiexec.exe Token: SeImpersonatePrivilege 2804 msiexec.exe Token: SeCreateGlobalPrivilege 2804 msiexec.exe Token: SeBackupPrivilege 2748 vssvc.exe Token: SeRestorePrivilege 2748 vssvc.exe Token: SeAuditPrivilege 2748 vssvc.exe Token: SeBackupPrivilege 2812 msiexec.exe Token: SeRestorePrivilege 2812 msiexec.exe Token: SeRestorePrivilege 1916 DrvInst.exe Token: SeRestorePrivilege 1916 DrvInst.exe Token: SeRestorePrivilege 1916 DrvInst.exe Token: SeRestorePrivilege 1916 DrvInst.exe Token: SeRestorePrivilege 1916 DrvInst.exe Token: SeRestorePrivilege 1916 DrvInst.exe Token: SeRestorePrivilege 1916 DrvInst.exe Token: SeLoadDriverPrivilege 1916 DrvInst.exe Token: SeLoadDriverPrivilege 1916 DrvInst.exe Token: SeLoadDriverPrivilege 1916 DrvInst.exe Token: SeRestorePrivilege 2812 msiexec.exe Token: SeTakeOwnershipPrivilege 2812 msiexec.exe Token: SeRestorePrivilege 2812 msiexec.exe Token: SeTakeOwnershipPrivilege 2812 msiexec.exe Token: SeRestorePrivilege 2812 msiexec.exe Token: SeTakeOwnershipPrivilege 2812 msiexec.exe Token: SeRestorePrivilege 2812 msiexec.exe Token: SeTakeOwnershipPrivilege 2812 msiexec.exe Token: SeRestorePrivilege 2812 msiexec.exe Token: SeTakeOwnershipPrivilege 2812 msiexec.exe Token: SeRestorePrivilege 2812 msiexec.exe Token: SeTakeOwnershipPrivilege 2812 msiexec.exe Token: SeRestorePrivilege 2812 msiexec.exe Token: SeTakeOwnershipPrivilege 2812 msiexec.exe Token: SeRestorePrivilege 2812 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2804 msiexec.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2028 wrote to memory of 2804 2028 vc-redist_2005-x64.exe 29 PID 2028 wrote to memory of 2804 2028 vc-redist_2005-x64.exe 29 PID 2028 wrote to memory of 2804 2028 vc-redist_2005-x64.exe 29 PID 2028 wrote to memory of 2804 2028 vc-redist_2005-x64.exe 29 PID 2028 wrote to memory of 2804 2028 vc-redist_2005-x64.exe 29 PID 2028 wrote to memory of 2804 2028 vc-redist_2005-x64.exe 29 PID 2028 wrote to memory of 2804 2028 vc-redist_2005-x64.exe 29 PID 2812 wrote to memory of 1652 2812 msiexec.exe 34 PID 2812 wrote to memory of 1652 2812 msiexec.exe 34 PID 2812 wrote to memory of 1652 2812 msiexec.exe 34 PID 2812 wrote to memory of 1652 2812 msiexec.exe 34 PID 2812 wrote to memory of 1652 2812 msiexec.exe 34 PID 2812 wrote to memory of 1652 2812 msiexec.exe 34 PID 2812 wrote to memory of 1652 2812 msiexec.exe 34 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\vc-redist_2005-x64.exe"C:\Users\Admin\AppData\Local\Temp\vc-redist_2005-x64.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\SysWOW64\msiexec.exemsiexec /i vcredist.msi2⤵
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2804
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5676FC815174DFC0C918A729D7382A492⤵
- Loads dropped DLL
PID:1652
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2748
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000060" "00000000000004A8"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1916
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5595340007682425449a903b86d8faa85
SHA1a2b0f451849dc3163aeb1da6f7fba8c08bb24834
SHA256b6bb3349051212aae01b9bf9eaa4b46115fadf0323d0aa4163b6bb710264148c
SHA512f028cb020597088d55db7d724355884ecb1f533931e01edf491552e4b32a178a9b964f763a435add053e4e87666211bd5d5f006b4f90bca21199ed321d5a9f3e
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
Filesize
312KB
MD577a9bff5af149160775741e204734d47
SHA17b5126af69b5a79593f39db94180f1ff11b0e39d
SHA25620a26ed9a1edf7763a9b515522c5e29720048a482c7fbc8b7ff6bbdd27e61038
SHA512bb0440f58f07e113bddd9a0afb5aab8af6493218784fe5fa6f4032e3a37088f91b7e766dee87cec4a9ea11d425d27b3b536430de3a52222e8bca3e0247d81e3b
-
Filesize
3.0MB
MD56dbdf338a0a25cdb236d43ea3ca2395e
SHA1685b6ea61e574e628392eaac8b10aff4309f1081
SHA256200fef5d4994523a02c4daa00060db28eb289b99d47fc6c1305183101e72bdeb
SHA5126b5b31c55cf72ab92b17fb6074b3901a1e6afe0796ef9bc831e4dfb97450376d2889cd24b1cf3fce60eb3c1bcd1b31254b5cfa3ef6107974dfa0b35c233daf5a
-
Filesize
28KB
MD585221b3bcba8dbe4b4a46581aa49f760
SHA1746645c92594bfc739f77812d67cfd85f4b92474
SHA256f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f
SHA512060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d
-
Filesize
3.0MB
MD56dbdf338a0a25cdb236d43ea3ca2395e
SHA1685b6ea61e574e628392eaac8b10aff4309f1081
SHA256200fef5d4994523a02c4daa00060db28eb289b99d47fc6c1305183101e72bdeb
SHA5126b5b31c55cf72ab92b17fb6074b3901a1e6afe0796ef9bc831e4dfb97450376d2889cd24b1cf3fce60eb3c1bcd1b31254b5cfa3ef6107974dfa0b35c233daf5a
-
Filesize
28KB
MD585221b3bcba8dbe4b4a46581aa49f760
SHA1746645c92594bfc739f77812d67cfd85f4b92474
SHA256f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f
SHA512060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d