Overview
overview
7Static
static
1SETUP.bat
windows7-x64
7SETUP.bat
windows10-2004-x64
6UPGRADE.bat
windows7-x64
1UPGRADE.bat
windows10-2004-x64
1postgresql...nt.msi
windows7-x64
7postgresql...nt.msi
windows10-2004-x64
7postgresql-8.3.msi
windows7-x64
7postgresql-8.3.msi
windows10-2004-x64
7vcredist_x86.exe
windows7-x64
7vcredist_x86.exe
windows10-2004-x64
6Analysis
-
max time kernel
269s -
max time network
304s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
07-11-2023 14:37
Static task
static1
Behavioral task
behavioral1
Sample
SETUP.bat
Resource
win7-20231023-en
windows7-x64
Behavioral task
behavioral2
Sample
SETUP.bat
Resource
win10v2004-20231025-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
UPGRADE.bat
Resource
win7-20231025-en
windows7-x64
Behavioral task
behavioral4
Sample
UPGRADE.bat
Resource
win10v2004-20231025-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
postgresql-8.3-int.msi
Resource
win7-20231025-en
windows7-x64
Behavioral task
behavioral6
Sample
postgresql-8.3-int.msi
Resource
win10v2004-20231020-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
postgresql-8.3.msi
Resource
win7-20231023-en
windows7-x64
Behavioral task
behavioral8
Sample
postgresql-8.3.msi
Resource
win10v2004-20231020-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
vcredist_x86.exe
Resource
win7-20231020-en
windows7-x64
Behavioral task
behavioral10
Sample
vcredist_x86.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
General
-
Target
vcredist_x86.exe
-
Size
2.6MB
-
MD5
f5926134a66309d9d2b14416ff707891
-
SHA1
84f65b93f99dca65f47638b4eb851c32fefc6939
-
SHA256
9f46c94aed0854314d6162fdc8162964bd3efd646d078caafb03fdbbefc41f0d
-
SHA512
52fc37019e59a330c3ff66d2978b66c36caf2dbb7d6ee76b20af738cd27304be0255f7c63b999ab354e3bf6adcce81d96172c239df6f0122e4ea3c77e15fe151
-
SSDEEP
49152:QwIRpt0/YCbD3WyByiH1ThVZwiqVcwmscYVjaV6tmPS2wy1CZDkYEHvP:pII97yO1TNwif+UVQiJwah
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" vcredist_x86.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e909c866916b25070000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e909c8660000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900e909c866000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de909c866000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000e909c86600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe -
Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeShutdownPrivilege 3724 msiexec.exe Token: SeIncreaseQuotaPrivilege 3724 msiexec.exe Token: SeSecurityPrivilege 3212 msiexec.exe Token: SeCreateTokenPrivilege 3724 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3724 msiexec.exe Token: SeLockMemoryPrivilege 3724 msiexec.exe Token: SeIncreaseQuotaPrivilege 3724 msiexec.exe Token: SeMachineAccountPrivilege 3724 msiexec.exe Token: SeTcbPrivilege 3724 msiexec.exe Token: SeSecurityPrivilege 3724 msiexec.exe Token: SeTakeOwnershipPrivilege 3724 msiexec.exe Token: SeLoadDriverPrivilege 3724 msiexec.exe Token: SeSystemProfilePrivilege 3724 msiexec.exe Token: SeSystemtimePrivilege 3724 msiexec.exe Token: SeProfSingleProcessPrivilege 3724 msiexec.exe Token: SeIncBasePriorityPrivilege 3724 msiexec.exe Token: SeCreatePagefilePrivilege 3724 msiexec.exe Token: SeCreatePermanentPrivilege 3724 msiexec.exe Token: SeBackupPrivilege 3724 msiexec.exe Token: SeRestorePrivilege 3724 msiexec.exe Token: SeShutdownPrivilege 3724 msiexec.exe Token: SeDebugPrivilege 3724 msiexec.exe Token: SeAuditPrivilege 3724 msiexec.exe Token: SeSystemEnvironmentPrivilege 3724 msiexec.exe Token: SeChangeNotifyPrivilege 3724 msiexec.exe Token: SeRemoteShutdownPrivilege 3724 msiexec.exe Token: SeUndockPrivilege 3724 msiexec.exe Token: SeSyncAgentPrivilege 3724 msiexec.exe Token: SeEnableDelegationPrivilege 3724 msiexec.exe Token: SeManageVolumePrivilege 3724 msiexec.exe Token: SeImpersonatePrivilege 3724 msiexec.exe Token: SeCreateGlobalPrivilege 3724 msiexec.exe Token: SeBackupPrivilege 1320 vssvc.exe Token: SeRestorePrivilege 1320 vssvc.exe Token: SeAuditPrivilege 1320 vssvc.exe Token: SeBackupPrivilege 3212 msiexec.exe Token: SeRestorePrivilege 3212 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3724 msiexec.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5064 wrote to memory of 3724 5064 vcredist_x86.exe 90 PID 5064 wrote to memory of 3724 5064 vcredist_x86.exe 90 PID 5064 wrote to memory of 3724 5064 vcredist_x86.exe 90 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\vcredist_x86.exe"C:\Users\Admin\AppData\Local\Temp\vcredist_x86.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Windows\SysWOW64\msiexec.exemsiexec /i vcredist.msi2⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3724
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3212
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1320
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD5b20bbeb818222b657df49a9cfe4fed79
SHA13f6508e880b86502773a3275bc9527f046d45502
SHA25691bdd063f6c53126737791c9eccf0b2f4cf44927831527245bc89a0be06c0cb4
SHA512f534bc7bf1597e728940e6c3b77f864adfaa413bb1e080458326b692b0f96bddf4fbd294eeed36d7764a3578e6c8e919488bbf63b8fe2d4355ab3efd685424a4