e3b3fe8bf91cbd4295f5d90496102c0db14d7ec1b536658ff83b7db1f4b0b228

Resubmissions

26-12-2023 08:41

231226-klnl6abhh2 10

19-11-2023 21:36

231119-1fyg6sbh52 10

Analysis

max time kernel
123s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
19-11-2023 21:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1c532f2594.msi
Size

8.5MB
MD5

fbf5d7b4c5f0e86a95b4fcd5c5ccc534
SHA1

51588315ff4ae36412c337361ea65f84810938d8
SHA256

6da198925581418863170f05b832cd1584b923278d0730d779a30ec96513111d
SHA512

3ef2d34071fc10bed59dbe60df3789524f62b89284cc011f1ab0a790196f9010ef6fa41d809947f52668918aa72c90c17211d6be82707b0f8099df548fb40588
SSDEEP

196608:0eS5hV9/S6WXbfXlTrn7HZ5AQX3AveLukj1w9OtaQCK0Ex7FVJi0:0dhVs6WXjX9HZ5AQX32WDb0ExZV8

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssvc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000064ad0c2742b1dab0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000064ad0c20000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900064ad0c2000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d064ad0c2000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000064ad0c200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exe

description	pid	process
Token: SeShutdownPrivilege	5092	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5092	msiexec.exe
Token: SeSecurityPrivilege	1764	msiexec.exe
Token: SeCreateTokenPrivilege	5092	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5092	msiexec.exe
Token: SeLockMemoryPrivilege	5092	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5092	msiexec.exe
Token: SeMachineAccountPrivilege	5092	msiexec.exe
Token: SeTcbPrivilege	5092	msiexec.exe
Token: SeSecurityPrivilege	5092	msiexec.exe
Token: SeTakeOwnershipPrivilege	5092	msiexec.exe
Token: SeLoadDriverPrivilege	5092	msiexec.exe
Token: SeSystemProfilePrivilege	5092	msiexec.exe
Token: SeSystemtimePrivilege	5092	msiexec.exe
Token: SeProfSingleProcessPrivilege	5092	msiexec.exe
Token: SeIncBasePriorityPrivilege	5092	msiexec.exe
Token: SeCreatePagefilePrivilege	5092	msiexec.exe
Token: SeCreatePermanentPrivilege	5092	msiexec.exe
Token: SeBackupPrivilege	5092	msiexec.exe
Token: SeRestorePrivilege	5092	msiexec.exe
Token: SeShutdownPrivilege	5092	msiexec.exe
Token: SeDebugPrivilege	5092	msiexec.exe
Token: SeAuditPrivilege	5092	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5092	msiexec.exe
Token: SeChangeNotifyPrivilege	5092	msiexec.exe
Token: SeRemoteShutdownPrivilege	5092	msiexec.exe
Token: SeUndockPrivilege	5092	msiexec.exe
Token: SeSyncAgentPrivilege	5092	msiexec.exe
Token: SeEnableDelegationPrivilege	5092	msiexec.exe
Token: SeManageVolumePrivilege	5092	msiexec.exe
Token: SeImpersonatePrivilege	5092	msiexec.exe
Token: SeCreateGlobalPrivilege	5092	msiexec.exe
Token: SeBackupPrivilege	4192	vssvc.exe
Token: SeRestorePrivilege	4192	vssvc.exe
Token: SeAuditPrivilege	4192	vssvc.exe
Token: SeBackupPrivilege	1764	msiexec.exe
Token: SeRestorePrivilege	1764	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

msiexec.exe

pid process

5092 msiexec.exe
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

pid	process
5092	msiexec.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\1c532f2594.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5092

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1764

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
2⤵
PID:2356

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4192

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads