Overview
overview
7Static
static
1SETUP.bat
windows7-x64
7SETUP.bat
windows10-2004-x64
6UPGRADE.bat
windows7-x64
1UPGRADE.bat
windows10-2004-x64
1postgresql...nt.msi
windows7-x64
7postgresql...nt.msi
windows10-2004-x64
7postgresql-8.3.msi
windows7-x64
7postgresql-8.3.msi
windows10-2004-x64
7vcredist_x86.exe
windows7-x64
7vcredist_x86.exe
windows10-2004-x64
6Analysis
-
max time kernel
198s -
max time network
200s -
platform
windows10-2004_x64 -
resource
win10v2004-20231025-en -
resource tags
arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2023, 14:37
Static task
static1
Behavioral task
behavioral1
Sample
SETUP.bat
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
SETUP.bat
Resource
win10v2004-20231025-en
Behavioral task
behavioral3
Sample
UPGRADE.bat
Resource
win7-20231025-en
Behavioral task
behavioral4
Sample
UPGRADE.bat
Resource
win10v2004-20231025-en
Behavioral task
behavioral5
Sample
postgresql-8.3-int.msi
Resource
win7-20231025-en
Behavioral task
behavioral6
Sample
postgresql-8.3-int.msi
Resource
win10v2004-20231020-en
Behavioral task
behavioral7
Sample
postgresql-8.3.msi
Resource
win7-20231023-en
Behavioral task
behavioral8
Sample
postgresql-8.3.msi
Resource
win10v2004-20231020-en
Behavioral task
behavioral9
Sample
vcredist_x86.exe
Resource
win7-20231020-en
Behavioral task
behavioral10
Sample
vcredist_x86.exe
Resource
win10v2004-20231023-en
General
-
Target
SETUP.bat
-
Size
192B
-
MD5
4200cecaf0d0d6838e48b87f78c90c19
-
SHA1
9ac646870d4047e34d72ea244d003397bb4e54be
-
SHA256
1c684469f8230b75ca0c8e6d1ed39bfdbe22d7259e7c992986f9f3897bf91c05
-
SHA512
1f363479d82e6d9f1f8e068aff25043f8af44027a49c337f788ead27329e510c9e8bed755d5a7cb484be3fcfcfeb986481e82d68cc4689fd92f79c7df22169e0
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" vcredist_x86.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e177523499fd9a390000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e17752340000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900e1775234000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de1775234000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000e177523400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe -
Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeShutdownPrivilege 2760 msiexec.exe Token: SeIncreaseQuotaPrivilege 2760 msiexec.exe Token: SeSecurityPrivilege 1228 msiexec.exe Token: SeCreateTokenPrivilege 2760 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2760 msiexec.exe Token: SeLockMemoryPrivilege 2760 msiexec.exe Token: SeIncreaseQuotaPrivilege 2760 msiexec.exe Token: SeMachineAccountPrivilege 2760 msiexec.exe Token: SeTcbPrivilege 2760 msiexec.exe Token: SeSecurityPrivilege 2760 msiexec.exe Token: SeTakeOwnershipPrivilege 2760 msiexec.exe Token: SeLoadDriverPrivilege 2760 msiexec.exe Token: SeSystemProfilePrivilege 2760 msiexec.exe Token: SeSystemtimePrivilege 2760 msiexec.exe Token: SeProfSingleProcessPrivilege 2760 msiexec.exe Token: SeIncBasePriorityPrivilege 2760 msiexec.exe Token: SeCreatePagefilePrivilege 2760 msiexec.exe Token: SeCreatePermanentPrivilege 2760 msiexec.exe Token: SeBackupPrivilege 2760 msiexec.exe Token: SeRestorePrivilege 2760 msiexec.exe Token: SeShutdownPrivilege 2760 msiexec.exe Token: SeDebugPrivilege 2760 msiexec.exe Token: SeAuditPrivilege 2760 msiexec.exe Token: SeSystemEnvironmentPrivilege 2760 msiexec.exe Token: SeChangeNotifyPrivilege 2760 msiexec.exe Token: SeRemoteShutdownPrivilege 2760 msiexec.exe Token: SeUndockPrivilege 2760 msiexec.exe Token: SeSyncAgentPrivilege 2760 msiexec.exe Token: SeEnableDelegationPrivilege 2760 msiexec.exe Token: SeManageVolumePrivilege 2760 msiexec.exe Token: SeImpersonatePrivilege 2760 msiexec.exe Token: SeCreateGlobalPrivilege 2760 msiexec.exe Token: SeBackupPrivilege 3032 vssvc.exe Token: SeRestorePrivilege 3032 vssvc.exe Token: SeAuditPrivilege 3032 vssvc.exe Token: SeBackupPrivilege 1228 msiexec.exe Token: SeRestorePrivilege 1228 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2760 msiexec.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4920 wrote to memory of 4712 4920 cmd.exe 88 PID 4920 wrote to memory of 4712 4920 cmd.exe 88 PID 4920 wrote to memory of 4712 4920 cmd.exe 88 PID 4712 wrote to memory of 2760 4712 vcredist_x86.exe 91 PID 4712 wrote to memory of 2760 4712 vcredist_x86.exe 91 PID 4712 wrote to memory of 2760 4712 vcredist_x86.exe 91 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\SETUP.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\vcredist_x86.exevcredist_x86.exe /q:a /c:"msiexec /i vcredist.msi /qb!"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Windows\SysWOW64\msiexec.exemsiexec /i vcredist.msi /qb!3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2760
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1228
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3032
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD5b20bbeb818222b657df49a9cfe4fed79
SHA13f6508e880b86502773a3275bc9527f046d45502
SHA25691bdd063f6c53126737791c9eccf0b2f4cf44927831527245bc89a0be06c0cb4
SHA512f534bc7bf1597e728940e6c3b77f864adfaa413bb1e080458326b692b0f96bddf4fbd294eeed36d7764a3578e6c8e919488bbf63b8fe2d4355ab3efd685424a4