Overview
overview
7Static
static
3SETUP.bat
windows7-x64
7SETUP.bat
windows10-2004-x64
6UPGRADE.bat
windows7-x64
1UPGRADE.bat
windows10-2004-x64
1postgresql...nt.msi
windows7-x64
7postgresql...nt.msi
windows10-2004-x64
7postgresql-8.3.msi
windows7-x64
7postgresql-8.3.msi
windows10-2004-x64
7vcredist_x86.exe
windows7-x64
7vcredist_x86.exe
windows10-2004-x64
7Analysis
-
max time kernel
119s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
07-11-2023 13:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SETUP.bat
Resource
win7-20231020-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
SETUP.bat
Resource
win10v2004-20231023-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
UPGRADE.bat
Resource
win7-20231023-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
UPGRADE.bat
Resource
win10v2004-20231020-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
postgresql-8.3-int.msi
Resource
win7-20231023-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral6
Sample
postgresql-8.3-int.msi
Resource
win10v2004-20231025-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral7
Sample
postgresql-8.3.msi
Resource
win7-20231020-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral8
Sample
postgresql-8.3.msi
Resource
win10v2004-20231023-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral9
Sample
vcredist_x86.exe
Resource
win7-20231023-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral10
Sample
vcredist_x86.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
vcredist_x86.exe
-
Size
2.6MB
-
MD5
1f8e9fec647700b21d45e6cda97c39b7
-
SHA1
037288ee51553f84498ae4873c357d367d1a3667
-
SHA256
9c110c0426f4e75f4384a527f0abe2232fe71f2968eb91278b16b200537d3161
-
SHA512
42f6ca3456951f3e85024444e513f424add6eda9f4807bf84c91dc8ccb623be6a8e83dc40a8b6a1bc2c6fd080f2c51b719ead1422e9d1c1079795ec70953a1ad
-
SSDEEP
49152:IJFEcHcHfnIpvSUxuB4vkjfCSfil3ObWcrJhxSkm6Fo4Ea0g/I2Pz7citcU7tmLq:S2c8gfd87CQgu9xNpW4t/Ic7csd7t0q
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2736 MsiExec.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" vcredist_x86.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia80.dll msiexec.exe -
Drops file in Windows directory 54 IoCs
description ioc Process File created C:\Windows\WinSxS\InstallTemp\20231107190552528.0\mfc80DEU.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107190552762.0\8.0.50727.762.cat msiexec.exe File opened for modification C:\Windows\Installer\MSI10D2.tmp msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107190550485.0\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107190552528.0\mfc80ENU.dll msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20231107190552747.0 msiexec.exe File opened for modification C:\Windows\Installer\MSI1AE1.tmp msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107190550485.0\ATL80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107190552045.0\mfcm80u.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107190552528.0\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107190552715.0\8.0.50727.762.policy msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\b25099274a207264182f8181add555d0 msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20231107190552528.0 msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20231107190552715.0 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\b25099274a207264182f8181add555d0\8.0.56336\ul_ATL80.dll.97F81AF1_0E47_DC99_FF1F_C8B3B9A1E18E msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107190552045.0\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107190552045.0\mfc80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107190552653.0\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6c18549a.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107190552653.0\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6c18549a.cat msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20231107190552045.0 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\b25099274a207264182f8181add555d0\8.0.56336 msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20231107190552653.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107190550485.0\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107190552528.0\mfc80CHT.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107190552528.0\mfc80ESP.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107190552528.0\mfc80FRA.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107190552528.0\mfc80JPN.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107190552653.0\vcomp.dll msiexec.exe File created C:\Windows\Installer\f770cf1.msi msiexec.exe File created C:\Windows\Installer\f770cef.ipi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107190552528.0\mfc80ITA.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107190552528.0\mfc80KOR.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107190552731.0\8.0.50727.762.policy msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107190552747.0\8.0.50727.762.cat msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20231107190550485.0 msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20231107190552762.0 msiexec.exe File created C:\Windows\Installer\f770cec.msi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107190552045.0\mfc80u.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107190552528.0\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107190552762.0\8.0.50727.762.policy msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\b25099274a207264182f8181add555d0\8.0.56336\ul_ATL80.dll.97F81AF1_0E47_DC99_FF1F_C8B3B9A1E18E msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20231107190552731.0 msiexec.exe File opened for modification C:\Windows\Installer\f770cec.msi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107190552045.0\mfcm80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107190552528.0\mfc80CHS.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107190552731.0\8.0.50727.762.cat msiexec.exe File opened for modification C:\Windows\Installer\f770cef.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107190552715.0\8.0.50727.762.cat msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File created C:\Windows\WinSxS\InstallTemp\20231107190552045.0\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231107190552747.0\8.0.50727.762.policy msiexec.exe -
Modifies data under HKEY_USERS 46 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe -
Modifies registry class 56 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\b25099274a207264182f8181add555d0\SourceList\Net msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.ATL,type="win32",version="8.0.50727.762",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 65002a0063006f004c0038003f00510056003d0078006f00420068002a006e006500390040002700560043005f005200650064006900730074003e00700052005e007000580049006000510075006f00650038004d006b0062004900640046007700550000000000 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Products\b25099274a207264182f8181add555d0 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\b25099274a207264182f8181add555d0\PackageCode = "ECF0C5769D85D534A98DCACD5B08A8A3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\b25099274a207264182f8181add555d0\SourceList\Media msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\b25099274a207264182f8181add555d0\SourceList msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFC,type="win32-policy",version="8.0.50727.762",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 65002a0063006f004c0038003f00510056003d0078006f00420068002a006e006500390040002700560043005f005200650064006900730074003e003d0024006b00600049004e005d00490038004300650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\b25099274a207264182f8181add555d0\SourceList\Media\7 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\b25099274a207264182f8181add555d0\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\b25099274a207264182f8181add555d0\SourceList\Media\2 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\b25099274a207264182f8181add555d0\VC_Redist msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\b25099274a207264182f8181add555d0\Servicing_Key msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\b25099274a207264182f8181add555d0\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\b25099274a207264182f8181add555d0\AuthorizedLUAApp = "0" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\b25099274a207264182f8181add555d0\SourceList\Net msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\b25099274a207264182f8181add555d0 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFC,type="win32",version="8.0.50727.762",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 65002a0063006f004c0038003f00510056003d0078006f00420068002a006e006500390040002700560043005f005200650064006900730074003e0021004d00210026005a005a006300300025006e00650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\b25099274a207264182f8181add555d0\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\b25099274a207264182f8181add555d0\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\b25099274a207264182f8181add555d0\SourceList\Media\8 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\b25099274a207264182f8181add555d0\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Products\b25099274a207264182f8181add555d0\SourceList\Media msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.ATL,type="win32-policy",version="8.0.50727.762",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 65002a0063006f004c0038003f00510056003d0078006f00420068002a006e006500390040002700560043005f005200650064006900730074003e0036006b007d00700048004c004800240053004400650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\b25099274a207264182f8181add555d0\SourceList\Media\6 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Features\b25099274a207264182f8181add555d0 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\b25099274a207264182f8181add555d0\Language = "0" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.CRT,type="win32-policy",version="8.0.50727.762",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 65002a0063006f004c0038003f00510056003d0078006f00420068002a006e006500390040002700560043005f005200650064006900730074003e0061005a004f002c0048002a004b00320060004500650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\b25099274a207264182f8181add555d0\SourceList\Media\11 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.OpenMP,type="win32",version="8.0.50727.762",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 65002a0063006f004c0038003f00510056003d0078006f00420068002a006e006500390040002700560043005f005200650064006900730074003e0035006f00300068002c0070004d0076004e003d00650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AA5D9C68C00F12943B2F6CA09FE28244\b25099274a207264182f8181add555d0 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Products\b25099274a207264182f8181add555d0\SourceList msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\b25099274a207264182f8181add555d0\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\b25099274a207264182f8181add555d0\SourceList\Media\4 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\b25099274a207264182f8181add555d0\AdvertiseFlags = "388" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.CRT,type="win32",version="8.0.50727.762",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 65002a0063006f004c0038003f00510056003d0078006f00420068002a006e006500390040002700560043005f005200650064006900730074003e005f006a0030002c0059005d007300210053006f00650038004d006b0062004900640046007700550000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\b25099274a207264182f8181add555d0 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\b25099274a207264182f8181add555d0\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\b25099274a207264182f8181add555d0\SourceList\Media\9 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\b25099274a207264182f8181add555d0\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\b25099274a207264182f8181add555d0\SourceList\Media msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AA5D9C68C00F12943B2F6CA09FE28244 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Win32Assemblies\Global msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\b25099274a207264182f8181add555d0\SourceList\Media\5 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AA5D9C68C00F12943B2F6CA09FE28244 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.OpenMP,type="win32-policy",version="8.0.50727.762",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 65002a0063006f004c0038003f00510056003d0078006f00420068002a006e006500390040002700560043005f005200650064006900730074003e00370030002d0054002400210028002a0026004e00650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\b25099274a207264182f8181add555d0\Version = "134274064" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\b25099274a207264182f8181add555d0\SourceList\Media\3 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFCLOC,type="win32-policy",version="8.0.50727.762",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 65002a0063006f004c0038003f00510056003d0078006f00420068002a006e006500390040002700560043005f005200650064006900730074003e006600720038005f006c0028006d0032004e004400650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\b25099274a207264182f8181add555d0\SourceList\Media\1 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\b25099274a207264182f8181add555d0 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\b25099274a207264182f8181add555d0\SourceList\PackageName = "vcredist.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\b25099274a207264182f8181add555d0 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\b25099274a207264182f8181add555d0\ProductName = "Microsoft Visual C++ 2005 Redistributable" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\b25099274a207264182f8181add555d0\SourceList\Media\10 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFCLOC,type="win32",version="8.0.50727.762",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 65002a0063006f004c0038003f00510056003d0078006f00420068002a006e006500390040002700560043005f005200650064006900730074003e006900450024005b004d00310025002e0064002700650038004d006b0062004900640046007700550000000000 msiexec.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2988 msiexec.exe 2988 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2372 msiexec.exe Token: SeIncreaseQuotaPrivilege 2372 msiexec.exe Token: SeRestorePrivilege 2988 msiexec.exe Token: SeTakeOwnershipPrivilege 2988 msiexec.exe Token: SeSecurityPrivilege 2988 msiexec.exe Token: SeCreateTokenPrivilege 2372 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2372 msiexec.exe Token: SeLockMemoryPrivilege 2372 msiexec.exe Token: SeIncreaseQuotaPrivilege 2372 msiexec.exe Token: SeMachineAccountPrivilege 2372 msiexec.exe Token: SeTcbPrivilege 2372 msiexec.exe Token: SeSecurityPrivilege 2372 msiexec.exe Token: SeTakeOwnershipPrivilege 2372 msiexec.exe Token: SeLoadDriverPrivilege 2372 msiexec.exe Token: SeSystemProfilePrivilege 2372 msiexec.exe Token: SeSystemtimePrivilege 2372 msiexec.exe Token: SeProfSingleProcessPrivilege 2372 msiexec.exe Token: SeIncBasePriorityPrivilege 2372 msiexec.exe Token: SeCreatePagefilePrivilege 2372 msiexec.exe Token: SeCreatePermanentPrivilege 2372 msiexec.exe Token: SeBackupPrivilege 2372 msiexec.exe Token: SeRestorePrivilege 2372 msiexec.exe Token: SeShutdownPrivilege 2372 msiexec.exe Token: SeDebugPrivilege 2372 msiexec.exe Token: SeAuditPrivilege 2372 msiexec.exe Token: SeSystemEnvironmentPrivilege 2372 msiexec.exe Token: SeChangeNotifyPrivilege 2372 msiexec.exe Token: SeRemoteShutdownPrivilege 2372 msiexec.exe Token: SeUndockPrivilege 2372 msiexec.exe Token: SeSyncAgentPrivilege 2372 msiexec.exe Token: SeEnableDelegationPrivilege 2372 msiexec.exe Token: SeManageVolumePrivilege 2372 msiexec.exe Token: SeImpersonatePrivilege 2372 msiexec.exe Token: SeCreateGlobalPrivilege 2372 msiexec.exe Token: SeBackupPrivilege 2644 vssvc.exe Token: SeRestorePrivilege 2644 vssvc.exe Token: SeAuditPrivilege 2644 vssvc.exe Token: SeBackupPrivilege 2988 msiexec.exe Token: SeRestorePrivilege 2988 msiexec.exe Token: SeRestorePrivilege 2868 DrvInst.exe Token: SeRestorePrivilege 2868 DrvInst.exe Token: SeRestorePrivilege 2868 DrvInst.exe Token: SeRestorePrivilege 2868 DrvInst.exe Token: SeRestorePrivilege 2868 DrvInst.exe Token: SeRestorePrivilege 2868 DrvInst.exe Token: SeRestorePrivilege 2868 DrvInst.exe Token: SeLoadDriverPrivilege 2868 DrvInst.exe Token: SeLoadDriverPrivilege 2868 DrvInst.exe Token: SeLoadDriverPrivilege 2868 DrvInst.exe Token: SeRestorePrivilege 2988 msiexec.exe Token: SeTakeOwnershipPrivilege 2988 msiexec.exe Token: SeRestorePrivilege 2988 msiexec.exe Token: SeTakeOwnershipPrivilege 2988 msiexec.exe Token: SeRestorePrivilege 2988 msiexec.exe Token: SeTakeOwnershipPrivilege 2988 msiexec.exe Token: SeRestorePrivilege 2988 msiexec.exe Token: SeTakeOwnershipPrivilege 2988 msiexec.exe Token: SeRestorePrivilege 2988 msiexec.exe Token: SeTakeOwnershipPrivilege 2988 msiexec.exe Token: SeRestorePrivilege 2988 msiexec.exe Token: SeTakeOwnershipPrivilege 2988 msiexec.exe Token: SeRestorePrivilege 2988 msiexec.exe Token: SeTakeOwnershipPrivilege 2988 msiexec.exe Token: SeRestorePrivilege 2988 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2372 msiexec.exe 2372 msiexec.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2852 wrote to memory of 2372 2852 vcredist_x86.exe 28 PID 2852 wrote to memory of 2372 2852 vcredist_x86.exe 28 PID 2852 wrote to memory of 2372 2852 vcredist_x86.exe 28 PID 2852 wrote to memory of 2372 2852 vcredist_x86.exe 28 PID 2852 wrote to memory of 2372 2852 vcredist_x86.exe 28 PID 2852 wrote to memory of 2372 2852 vcredist_x86.exe 28 PID 2852 wrote to memory of 2372 2852 vcredist_x86.exe 28 PID 2988 wrote to memory of 2736 2988 msiexec.exe 35 PID 2988 wrote to memory of 2736 2988 msiexec.exe 35 PID 2988 wrote to memory of 2736 2988 msiexec.exe 35 PID 2988 wrote to memory of 2736 2988 msiexec.exe 35 PID 2988 wrote to memory of 2736 2988 msiexec.exe 35 PID 2988 wrote to memory of 2736 2988 msiexec.exe 35 PID 2988 wrote to memory of 2736 2988 msiexec.exe 35 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\vcredist_x86.exe"C:\Users\Admin\AppData\Local\Temp\vcredist_x86.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\SysWOW64\msiexec.exemsiexec /i vcredist.msi2⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2372
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 31A7BBB77496D089C081A4B2129F810E2⤵
- Loads dropped DLL
PID:2736
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2644
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000004C8" "00000000000003E4"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2868
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
247KB
MD5aa85aa3738acfe30e197d9dfd5c3428d
SHA17f3ee53bd967265afe32b31d75b4f6c47363654a
SHA256af3560ef0c55c7e4eff2170c63e7860498b5830e405a3841f96c91601e62e108
SHA512e1bf248d6425f6ba91bf0a1f3d364321b09477af9be2f31f8bf6d92defbaddfbab8f3e6284262742378f1f87d60d06eee3b98fb081e60f9fb6f19c1797489861
-
Filesize
2.7MB
MD5dc1ab7ce3b89fc7cac369d8b246cdafe
SHA1c9a2d5a312f770189c4b65cb500905e4773c14ad
SHA256dde77dd3473d3d07c459f17cd267f96f19264f976f2fcc85b4bbbecf26487560
SHA512e554b8b36a7a853d4e6efb4e6faf2d784f41e8d26edafbb1689a944bf0a7a4b58258d820a3fada1496b8c8d295d8771fc713b29127d54a3fbc317659b7565cbe
-
Filesize
28KB
MD585221b3bcba8dbe4b4a46581aa49f760
SHA1746645c92594bfc739f77812d67cfd85f4b92474
SHA256f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f
SHA512060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d
-
Filesize
2.7MB
MD5dc1ab7ce3b89fc7cac369d8b246cdafe
SHA1c9a2d5a312f770189c4b65cb500905e4773c14ad
SHA256dde77dd3473d3d07c459f17cd267f96f19264f976f2fcc85b4bbbecf26487560
SHA512e554b8b36a7a853d4e6efb4e6faf2d784f41e8d26edafbb1689a944bf0a7a4b58258d820a3fada1496b8c8d295d8771fc713b29127d54a3fbc317659b7565cbe
-
Filesize
28KB
MD585221b3bcba8dbe4b4a46581aa49f760
SHA1746645c92594bfc739f77812d67cfd85f4b92474
SHA256f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f
SHA512060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d