Overview
overview
7Static
static
30_Katz-Pit...01.pdf
windows7-x64
10_Katz-Pit...01.pdf
windows10-2004-x64
1LoiocpServeur.js
windows7-x64
1LoiocpServeur.js
windows10-2004-x64
1LoiocpServ...OCP.js
windows7-x64
1LoiocpServ...OCP.js
windows10-2004-x64
12_Sioc_350.exe
windows7-x64
62_Sioc_350.exe
windows10-2004-x64
6KaTZe_04-01.js
windows7-x64
1KaTZe_04-01.js
windows10-2004-x64
1Gauge Composer.msi
windows7-x64
6Gauge Composer.msi
windows10-2004-x64
6setup.exe
windows7-x64
6setup.exe
windows10-2004-x64
65_KaTZ-Pit...up.exe
windows7-x64
75_KaTZ-Pit...up.exe
windows10-2004-x64
7Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
07/11/2023, 14:08
Behavioral task
behavioral1
Sample
0_Katz-Pit Manuel_v401.pdf
Resource
win7-20231023-en
windows7-x64
Behavioral task
behavioral2
Sample
0_Katz-Pit Manuel_v401.pdf
Resource
win10v2004-20231023-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
LoiocpServeur.js
Resource
win7-20231020-en
windows7-x64
Behavioral task
behavioral4
Sample
LoiocpServeur.js
Resource
win10v2004-20231020-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
LoiocpServeur_LOCAL-IOCP.js
Resource
win7-20231020-en
windows7-x64
Behavioral task
behavioral6
Sample
LoiocpServeur_LOCAL-IOCP.js
Resource
win10v2004-20231023-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
2_Sioc_350.exe
Resource
win7-20231020-en
windows7-x64
Behavioral task
behavioral8
Sample
2_Sioc_350.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
KaTZe_04-01.js
Resource
win7-20231023-en
windows7-x64
Behavioral task
behavioral10
Sample
KaTZe_04-01.js
Resource
win10v2004-20231025-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Gauge Composer.msi
Resource
win7-20231020-en
windows7-x64
Behavioral task
behavioral12
Sample
Gauge Composer.msi
Resource
win10v2004-20231025-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
setup.exe
Resource
win7-20231025-en
windows7-x64
Behavioral task
behavioral14
Sample
setup.exe
Resource
win10v2004-20231020-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
5_KaTZ-Pit_401b_Setup.exe
Resource
win7-20231023-en
windows7-x64
Behavioral task
behavioral16
Sample
5_KaTZ-Pit_401b_Setup.exe
Resource
win10v2004-20231020-en
windows10-2004-x64
General
-
Target
2_Sioc_350.exe
-
Size
7.4MB
-
MD5
f9a7573bad667a5f0521c2498b2d0c17
-
SHA1
b671598cd1d0057d460016ce9d1e4d71e6240c3a
-
SHA256
26219da11c8229fcad8461fd70b78ebe28d2c8a29d0cefcbbb9d599696b144ff
-
SHA512
c78687acd0b1f43c5cfed429af068631983b180596e8f46abb19ccafd08a43069ac3a5cc6f607ecbbc6974dbb6ef9b10e225014c7131a2552eb51ed36eeee545
-
SSDEEP
196608:W3pA1oMuWr45hrr2imVf72apRkHSxTijgbTCIjLwmKf:5eJWGhrr297x/pe0TpnwD
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: MSIEXEC.EXE File opened (read-only) \??\L: MSIEXEC.EXE File opened (read-only) \??\P: MSIEXEC.EXE File opened (read-only) \??\T: MSIEXEC.EXE File opened (read-only) \??\Y: MSIEXEC.EXE File opened (read-only) \??\X: MSIEXEC.EXE File opened (read-only) \??\E: MSIEXEC.EXE File opened (read-only) \??\J: MSIEXEC.EXE File opened (read-only) \??\N: MSIEXEC.EXE File opened (read-only) \??\R: MSIEXEC.EXE File opened (read-only) \??\U: MSIEXEC.EXE File opened (read-only) \??\W: MSIEXEC.EXE File opened (read-only) \??\V: MSIEXEC.EXE File opened (read-only) \??\A: MSIEXEC.EXE File opened (read-only) \??\B: MSIEXEC.EXE File opened (read-only) \??\G: MSIEXEC.EXE File opened (read-only) \??\M: MSIEXEC.EXE File opened (read-only) \??\Q: MSIEXEC.EXE File opened (read-only) \??\S: MSIEXEC.EXE File opened (read-only) \??\H: MSIEXEC.EXE File opened (read-only) \??\K: MSIEXEC.EXE File opened (read-only) \??\O: MSIEXEC.EXE File opened (read-only) \??\Z: MSIEXEC.EXE -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Downloaded Installations\{BE004AB4-31FF-4B23-903C-853D04C9F6B9}\Opencockpits SIOC software.msi 2_Sioc_350.exe File opened for modification C:\Windows\Downloaded Installations\{BE004AB4-31FF-4B23-903C-853D04C9F6B9}\Opencockpits SIOC software.msi 2_Sioc_350.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2724 MSIEXEC.EXE -
Suspicious use of AdjustPrivilegeToken 34 IoCs
description pid Process Token: SeShutdownPrivilege 2724 MSIEXEC.EXE Token: SeIncreaseQuotaPrivilege 2724 MSIEXEC.EXE Token: SeRestorePrivilege 2872 msiexec.exe Token: SeTakeOwnershipPrivilege 2872 msiexec.exe Token: SeSecurityPrivilege 2872 msiexec.exe Token: SeCreateTokenPrivilege 2724 MSIEXEC.EXE Token: SeAssignPrimaryTokenPrivilege 2724 MSIEXEC.EXE Token: SeLockMemoryPrivilege 2724 MSIEXEC.EXE Token: SeIncreaseQuotaPrivilege 2724 MSIEXEC.EXE Token: SeMachineAccountPrivilege 2724 MSIEXEC.EXE Token: SeTcbPrivilege 2724 MSIEXEC.EXE Token: SeSecurityPrivilege 2724 MSIEXEC.EXE Token: SeTakeOwnershipPrivilege 2724 MSIEXEC.EXE Token: SeLoadDriverPrivilege 2724 MSIEXEC.EXE Token: SeSystemProfilePrivilege 2724 MSIEXEC.EXE Token: SeSystemtimePrivilege 2724 MSIEXEC.EXE Token: SeProfSingleProcessPrivilege 2724 MSIEXEC.EXE Token: SeIncBasePriorityPrivilege 2724 MSIEXEC.EXE Token: SeCreatePagefilePrivilege 2724 MSIEXEC.EXE Token: SeCreatePermanentPrivilege 2724 MSIEXEC.EXE Token: SeBackupPrivilege 2724 MSIEXEC.EXE Token: SeRestorePrivilege 2724 MSIEXEC.EXE Token: SeShutdownPrivilege 2724 MSIEXEC.EXE Token: SeDebugPrivilege 2724 MSIEXEC.EXE Token: SeAuditPrivilege 2724 MSIEXEC.EXE Token: SeSystemEnvironmentPrivilege 2724 MSIEXEC.EXE Token: SeChangeNotifyPrivilege 2724 MSIEXEC.EXE Token: SeRemoteShutdownPrivilege 2724 MSIEXEC.EXE Token: SeUndockPrivilege 2724 MSIEXEC.EXE Token: SeSyncAgentPrivilege 2724 MSIEXEC.EXE Token: SeEnableDelegationPrivilege 2724 MSIEXEC.EXE Token: SeManageVolumePrivilege 2724 MSIEXEC.EXE Token: SeImpersonatePrivilege 2724 MSIEXEC.EXE Token: SeCreateGlobalPrivilege 2724 MSIEXEC.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2724 MSIEXEC.EXE -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2192 wrote to memory of 2724 2192 2_Sioc_350.exe 28 PID 2192 wrote to memory of 2724 2192 2_Sioc_350.exe 28 PID 2192 wrote to memory of 2724 2192 2_Sioc_350.exe 28 PID 2192 wrote to memory of 2724 2192 2_Sioc_350.exe 28 PID 2192 wrote to memory of 2724 2192 2_Sioc_350.exe 28 PID 2192 wrote to memory of 2724 2192 2_Sioc_350.exe 28 PID 2192 wrote to memory of 2724 2192 2_Sioc_350.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2_Sioc_350.exe"C:\Users\Admin\AppData\Local\Temp\2_Sioc_350.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Windows\SysWOW64\MSIEXEC.EXEMSIEXEC.EXE /i "C:\Windows\Downloaded Installations\{BE004AB4-31FF-4B23-903C-853D04C9F6B9}\Opencockpits SIOC software.msi" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp"2⤵
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2724
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2872
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD547b8151455bc54356bd8eab2d9656dff
SHA1077fce613856628b7144db497c38283d733ff0d1
SHA256ddc0262ecaf411329b7d6b0510696e934f7f15887a9b81084ef3b1d07c7f3824
SHA512fe78e017c856e5de346b781b745fbef32eb265bfe9d33c0d543f412fbc60261535ffb355cd3f52a15f17e235273f386c40d474ef8d40f404dffeb1fbfb610b6b
-
Filesize
3.8MB
MD5e1e182867b27e689cd20f8c97605b68b
SHA1ab57cde4316f9718ff8808038cb51287a5520562
SHA256b4b39b107ce9561ce8f8a13c8b096f30e7387d9b9bda5553ba529409ac385bb5
SHA512f398d071439e2283a24ac9ee40d0959c1feb5a2b2a98d92ef8cb0d6434a44fe3e4afb76cd35f2bbc35ccbf0ce2cbbb6b24727493e977ad15774aa7d9a4d80a0b
-
Filesize
1KB
MD577a2588b989660360180e4e6685523e9
SHA1fdcbc4dd53eb8254f9e7eaa265b2855c52628071
SHA2567807bf9faa712df244469410adf33fc089f30de143d45e0094a53e7e4a1e36ca
SHA5125e8364cde209dd19674283116af29afd8d505186060b86dd79c401286a1b8c836eaa7b7121e9bdaad409bd0a5922e705184cfa877264292a28f2a48d0de07ee9
-
C:\Windows\Downloaded Installations\{BE004AB4-31FF-4B23-903C-853D04C9F6B9}\Opencockpits SIOC software.msi
Filesize3.8MB
MD5e1e182867b27e689cd20f8c97605b68b
SHA1ab57cde4316f9718ff8808038cb51287a5520562
SHA256b4b39b107ce9561ce8f8a13c8b096f30e7387d9b9bda5553ba529409ac385bb5
SHA512f398d071439e2283a24ac9ee40d0959c1feb5a2b2a98d92ef8cb0d6434a44fe3e4afb76cd35f2bbc35ccbf0ce2cbbb6b24727493e977ad15774aa7d9a4d80a0b