Overview
overview
7Static
static
1install_all.bat
windows7-x64
7install_all.bat
windows10-2004-x64
6vcredist2005_x64.exe
windows7-x64
7vcredist2005_x64.exe
windows10-2004-x64
6vcredist2005_x86.exe
windows7-x64
7vcredist2005_x86.exe
windows10-2004-x64
6vcredist2008_x64.exe
windows7-x64
7vcredist2008_x64.exe
windows10-2004-x64
7vcredist2008_x86.exe
windows7-x64
7vcredist2008_x86.exe
windows10-2004-x64
7vcredist2010_x64.exe
windows7-x64
7vcredist2010_x64.exe
windows10-2004-x64
7vcredist2010_x86.exe
windows7-x64
7vcredist2010_x86.exe
windows10-2004-x64
7vcredist2012_x64.exe
windows7-x64
7vcredist2012_x64.exe
windows10-2004-x64
7vcredist2012_x86.exe
windows7-x64
7vcredist2012_x86.exe
windows10-2004-x64
7vcredist2013_x64.exe
windows7-x64
7vcredist2013_x64.exe
windows10-2004-x64
7vcredist2013_x86.exe
windows7-x64
7vcredist2013_x86.exe
windows10-2004-x64
7vcredist20...64.exe
windows7-x64
4vcredist20...64.exe
windows10-2004-x64
4vcredist20...86.exe
windows7-x64
4vcredist20...86.exe
windows10-2004-x64
4Analysis
-
max time kernel
122s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
27-11-2023 17:15
Static task
static1
Behavioral task
behavioral1
Sample
install_all.bat
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
install_all.bat
Resource
win10v2004-20231023-en
Behavioral task
behavioral3
Sample
vcredist2005_x64.exe
Resource
win7-20231020-en
Behavioral task
behavioral4
Sample
vcredist2005_x64.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral5
Sample
vcredist2005_x86.exe
Resource
win7-20231023-en
Behavioral task
behavioral6
Sample
vcredist2005_x86.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral7
Sample
vcredist2008_x64.exe
Resource
win7-20231020-en
Behavioral task
behavioral8
Sample
vcredist2008_x64.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral9
Sample
vcredist2008_x86.exe
Resource
win7-20231025-en
Behavioral task
behavioral10
Sample
vcredist2008_x86.exe
Resource
win10v2004-20231025-en
Behavioral task
behavioral11
Sample
vcredist2010_x64.exe
Resource
win7-20231023-en
Behavioral task
behavioral12
Sample
vcredist2010_x64.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral13
Sample
vcredist2010_x86.exe
Resource
win7-20231023-en
Behavioral task
behavioral14
Sample
vcredist2010_x86.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral15
Sample
vcredist2012_x64.exe
Resource
win7-20231020-en
Behavioral task
behavioral16
Sample
vcredist2012_x64.exe
Resource
win10v2004-20231025-en
Behavioral task
behavioral17
Sample
vcredist2012_x86.exe
Resource
win7-20231023-en
Behavioral task
behavioral18
Sample
vcredist2012_x86.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral19
Sample
vcredist2013_x64.exe
Resource
win7-20231020-en
Behavioral task
behavioral20
Sample
vcredist2013_x64.exe
Resource
win10v2004-20231025-en
Behavioral task
behavioral21
Sample
vcredist2013_x86.exe
Resource
win7-20231023-en
Behavioral task
behavioral22
Sample
vcredist2013_x86.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral23
Sample
vcredist2015_2017_2019_2022_x64.exe
Resource
win7-20231020-en
Behavioral task
behavioral24
Sample
vcredist2015_2017_2019_2022_x64.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral25
Sample
vcredist2015_2017_2019_2022_x86.exe
Resource
win7-20231023-en
Behavioral task
behavioral26
Sample
vcredist2015_2017_2019_2022_x86.exe
Resource
win10v2004-20231020-en
General
-
Target
install_all.bat
-
Size
1KB
-
MD5
eb55aae630088c91b88d2bfae4115ea0
-
SHA1
1495c69946edca474fe30c2b713aacb9f03bbf3a
-
SHA256
492ee4c16ac45a5483088583c9caa08252d3a1bb3922dbbec834d61673538f17
-
SHA512
48e4a3fa644b1859131cfec782641aaee9938c88f939ca0509df0f4120b922187753ce7cd7d912d2f90108526ba34d767baa28c9eeeb25d43fff77d38ddfd882
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
MsiExec.exepid process 1580 MsiExec.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
vcredist2005_x86.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" vcredist2005_x86.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc process File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe -
Drops file in Program Files directory 1 IoCs
Processes:
msiexec.exedescription ioc process File created C:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia80.dll msiexec.exe -
Drops file in Windows directory 50 IoCs
Processes:
msiexec.exeDrvInst.exedescription ioc process File created C:\Windows\WinSxS\InstallTemp\20231127171729384.0\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231127171729384.0\msvcp80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231127171729977.0\mfc80DEU.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231127171729681.0\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_150c9e8b.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231127171729681.0\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_150c9e8b.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231127171730211.0\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_452bf920.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231127171730211.0\vcomp.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231127171730367.0\8.0.50727.6195.policy msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\Installer\MSIAF74.tmp msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231127171729977.0\mfc80ENU.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231127171730351.0\8.0.50727.6195.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231127171729977.0\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_6a5bb789.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231127171729977.0\mfc80JPN.dll msiexec.exe File opened for modification C:\Windows\Installer\MSI9945.tmp msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231127171729384.0\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231127171729384.0\msvcm80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231127171729681.0\mfcm80u.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231127171729103.0\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_a4c618fa.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231127171730367.0\8.0.50727.6195.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231127171729977.0\mfc80FRA.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231127171730273.0\8.0.50727.6195.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231127171730305.0\8.0.50727.6195.policy msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231127171730351.0\8.0.50727.6195.policy msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\f7694e0.msi msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\ul_ATL80.dll.97F81AF1_0E47_DC99_FF1F_C8B3B9A1E18E msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231127171729384.0\msvcr80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231127171730305.0\8.0.50727.6195.cat msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File created C:\Windows\Installer\f7694e3.ipi msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\ul_ATL80.dll.97F81AF1_0E47_DC99_FF1F_C8B3B9A1E18E msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231127171729681.0\mfc80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231127171729103.0\ATL80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231127171729977.0\mfc80ITA.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231127171729977.0\mfc80KOR.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231127171730211.0\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_452bf920.manifest msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231127171729103.0\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_a4c618fa.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231127171729681.0\mfc80u.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231127171729977.0\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_6a5bb789.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231127171729977.0\mfc80CHS.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231127171729977.0\mfc80CHT.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231127171730320.0\8.0.50727.6195.policy msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231127171730273.0\8.0.50727.6195.policy msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231127171729977.0\mfc80ESP.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231127171730320.0\8.0.50727.6195.cat msiexec.exe File opened for modification C:\Windows\Installer\f7694e0.msi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20231127171729681.0\mfcm80.dll msiexec.exe File created C:\Windows\Installer\f7694e5.msi msiexec.exe -
Modifies data under HKEY_USERS 43 IoCs
Processes:
DrvInst.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe -
Modifies registry class 45 IoCs
Processes:
msiexec.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\8 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\11 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\Clients = 3a0000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.CRT,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e005f006a0030002c0059005d007300210053006f00650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFCLOC,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e006900450024005b004d00310025002e0064002700650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AA5D9C68C00F12943B2F6CA09FE28244\c1c4f01781cc94c4c8fb1542c0981a2a msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\2 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\10 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFC,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e003d0024006b00600049004e005d00490038004300650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Net msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\7 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.ATL,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e0036006b007d00700048004c004800240053004400650038004d006b0062004900640046007700550000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\ProductName = "Microsoft Visual C++ 2005 Redistributable" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\Language = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\5 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\9 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFC,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e0021004d00210026005a005a006300300025006e00650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\PackageName = "vcredist.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\1 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.OpenMP,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e00370030002d0054002400210028002a0026004e00650038004d006b0062004900640046007700550000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\c1c4f01781cc94c4c8fb1542c0981a2a msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AA5D9C68C00F12943B2F6CA09FE28244 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\4 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.CRT,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e0061005a004f002c0048002a004b00320060004500650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFCLOC,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e006600720038005f006c0028006d0032004e004400650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\c1c4f01781cc94c4c8fb1542c0981a2a\Servicing_Key msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\Version = "134278729" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.ATL,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e00700052005e007000580049006000510075006f00650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\c1c4f01781cc94c4c8fb1542c0981a2a\VC_Redist msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\3 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.OpenMP,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e0035006f00300068002c0070004d0076004e003d00650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\PackageCode = "84067013B7B56744BA0F51892982BC09" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\6 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe -
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
Processes:
vcredist2005_x86.exepid process 2128 vcredist2005_x86.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
msiexec.exepid process 2324 msiexec.exe 2324 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
msiexec.exepid process 1060 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
msiexec.exemsiexec.exevssvc.exeDrvInst.exedescription pid process Token: SeShutdownPrivilege 1060 msiexec.exe Token: SeIncreaseQuotaPrivilege 1060 msiexec.exe Token: SeRestorePrivilege 2324 msiexec.exe Token: SeTakeOwnershipPrivilege 2324 msiexec.exe Token: SeSecurityPrivilege 2324 msiexec.exe Token: SeCreateTokenPrivilege 1060 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1060 msiexec.exe Token: SeLockMemoryPrivilege 1060 msiexec.exe Token: SeIncreaseQuotaPrivilege 1060 msiexec.exe Token: SeMachineAccountPrivilege 1060 msiexec.exe Token: SeTcbPrivilege 1060 msiexec.exe Token: SeSecurityPrivilege 1060 msiexec.exe Token: SeTakeOwnershipPrivilege 1060 msiexec.exe Token: SeLoadDriverPrivilege 1060 msiexec.exe Token: SeSystemProfilePrivilege 1060 msiexec.exe Token: SeSystemtimePrivilege 1060 msiexec.exe Token: SeProfSingleProcessPrivilege 1060 msiexec.exe Token: SeIncBasePriorityPrivilege 1060 msiexec.exe Token: SeCreatePagefilePrivilege 1060 msiexec.exe Token: SeCreatePermanentPrivilege 1060 msiexec.exe Token: SeBackupPrivilege 1060 msiexec.exe Token: SeRestorePrivilege 1060 msiexec.exe Token: SeShutdownPrivilege 1060 msiexec.exe Token: SeDebugPrivilege 1060 msiexec.exe Token: SeAuditPrivilege 1060 msiexec.exe Token: SeSystemEnvironmentPrivilege 1060 msiexec.exe Token: SeChangeNotifyPrivilege 1060 msiexec.exe Token: SeRemoteShutdownPrivilege 1060 msiexec.exe Token: SeUndockPrivilege 1060 msiexec.exe Token: SeSyncAgentPrivilege 1060 msiexec.exe Token: SeEnableDelegationPrivilege 1060 msiexec.exe Token: SeManageVolumePrivilege 1060 msiexec.exe Token: SeImpersonatePrivilege 1060 msiexec.exe Token: SeCreateGlobalPrivilege 1060 msiexec.exe Token: SeBackupPrivilege 2776 vssvc.exe Token: SeRestorePrivilege 2776 vssvc.exe Token: SeAuditPrivilege 2776 vssvc.exe Token: SeBackupPrivilege 2324 msiexec.exe Token: SeRestorePrivilege 2324 msiexec.exe Token: SeRestorePrivilege 2560 DrvInst.exe Token: SeRestorePrivilege 2560 DrvInst.exe Token: SeRestorePrivilege 2560 DrvInst.exe Token: SeRestorePrivilege 2560 DrvInst.exe Token: SeRestorePrivilege 2560 DrvInst.exe Token: SeRestorePrivilege 2560 DrvInst.exe Token: SeRestorePrivilege 2560 DrvInst.exe Token: SeLoadDriverPrivilege 2560 DrvInst.exe Token: SeLoadDriverPrivilege 2560 DrvInst.exe Token: SeLoadDriverPrivilege 2560 DrvInst.exe Token: SeRestorePrivilege 2324 msiexec.exe Token: SeTakeOwnershipPrivilege 2324 msiexec.exe Token: SeRestorePrivilege 2324 msiexec.exe Token: SeTakeOwnershipPrivilege 2324 msiexec.exe Token: SeRestorePrivilege 2324 msiexec.exe Token: SeTakeOwnershipPrivilege 2324 msiexec.exe Token: SeRestorePrivilege 2324 msiexec.exe Token: SeTakeOwnershipPrivilege 2324 msiexec.exe Token: SeRestorePrivilege 2324 msiexec.exe Token: SeTakeOwnershipPrivilege 2324 msiexec.exe Token: SeRestorePrivilege 2324 msiexec.exe Token: SeTakeOwnershipPrivilege 2324 msiexec.exe Token: SeRestorePrivilege 2324 msiexec.exe Token: SeTakeOwnershipPrivilege 2324 msiexec.exe Token: SeRestorePrivilege 2324 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
msiexec.exepid process 1060 msiexec.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
cmd.exevcredist2005_x86.exemsiexec.exedescription pid process target process PID 2124 wrote to memory of 2128 2124 cmd.exe vcredist2005_x86.exe PID 2124 wrote to memory of 2128 2124 cmd.exe vcredist2005_x86.exe PID 2124 wrote to memory of 2128 2124 cmd.exe vcredist2005_x86.exe PID 2124 wrote to memory of 2128 2124 cmd.exe vcredist2005_x86.exe PID 2124 wrote to memory of 2128 2124 cmd.exe vcredist2005_x86.exe PID 2124 wrote to memory of 2128 2124 cmd.exe vcredist2005_x86.exe PID 2124 wrote to memory of 2128 2124 cmd.exe vcredist2005_x86.exe PID 2128 wrote to memory of 1060 2128 vcredist2005_x86.exe msiexec.exe PID 2128 wrote to memory of 1060 2128 vcredist2005_x86.exe msiexec.exe PID 2128 wrote to memory of 1060 2128 vcredist2005_x86.exe msiexec.exe PID 2128 wrote to memory of 1060 2128 vcredist2005_x86.exe msiexec.exe PID 2128 wrote to memory of 1060 2128 vcredist2005_x86.exe msiexec.exe PID 2128 wrote to memory of 1060 2128 vcredist2005_x86.exe msiexec.exe PID 2128 wrote to memory of 1060 2128 vcredist2005_x86.exe msiexec.exe PID 2324 wrote to memory of 1580 2324 msiexec.exe MsiExec.exe PID 2324 wrote to memory of 1580 2324 msiexec.exe MsiExec.exe PID 2324 wrote to memory of 1580 2324 msiexec.exe MsiExec.exe PID 2324 wrote to memory of 1580 2324 msiexec.exe MsiExec.exe PID 2324 wrote to memory of 1580 2324 msiexec.exe MsiExec.exe PID 2324 wrote to memory of 1580 2324 msiexec.exe MsiExec.exe PID 2324 wrote to memory of 1580 2324 msiexec.exe MsiExec.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\install_all.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vcredist2005_x86.exevcredist2005_x86.exe /q2⤵
- Adds Run key to start application
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec /i vcredist.msi3⤵
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 2EF10524AD3412001B81B75E318E32562⤵
- Loads dropped DLL
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003D4" "000000000000057C"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5dba542c8452047b458ad03474e863211
SHA1ffec745329eb514025be093daaa0cac94e612554
SHA2562a6566ace22bd500597d1cbe96a3610f32f0d0b9d40b67bf1b1d96f9f44d0c6a
SHA512c48d084209702767b06659501be7f79890b660c41d995b3c5ca20fb09f6946cc42e170b7cf418045271a062fafbb1a9069d2427a0cf2b474a80170f3368d0f2c
-
C:\Users\Admin\AppData\Local\Temp\Cab954D.tmpFilesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredis1.cabFilesize
247KB
MD5cc064d4b81619991de8131a86ad77681
SHA188d80d86cc20c27d7d2a872af719300bd2bb73f9
SHA256913ee5a1cae3e5a1872b3a5efaaa00c58e4beb692492b138f76967da671b0477
SHA5125aff0eb26cfc187bf58721b2b6d73357d9f1e66d1ac5340ad9ddc08b40ad0eda27a144cb3b650604637a7476c282ded83ed890de98a73ccaf0cc021da3a9eb25
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredist.msiFilesize
2.6MB
MD5b20bbeb818222b657df49a9cfe4fed79
SHA13f6508e880b86502773a3275bc9527f046d45502
SHA25691bdd063f6c53126737791c9eccf0b2f4cf44927831527245bc89a0be06c0cb4
SHA512f534bc7bf1597e728940e6c3b77f864adfaa413bb1e080458326b692b0f96bddf4fbd294eeed36d7764a3578e6c8e919488bbf63b8fe2d4355ab3efd685424a4
-
C:\Windows\Installer\MSI9945.tmpFilesize
28KB
MD585221b3bcba8dbe4b4a46581aa49f760
SHA1746645c92594bfc739f77812d67cfd85f4b92474
SHA256f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f
SHA512060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d
-
C:\Windows\Installer\f7694e0.msiFilesize
2.6MB
MD5b20bbeb818222b657df49a9cfe4fed79
SHA13f6508e880b86502773a3275bc9527f046d45502
SHA25691bdd063f6c53126737791c9eccf0b2f4cf44927831527245bc89a0be06c0cb4
SHA512f534bc7bf1597e728940e6c3b77f864adfaa413bb1e080458326b692b0f96bddf4fbd294eeed36d7764a3578e6c8e919488bbf63b8fe2d4355ab3efd685424a4
-
\Windows\Installer\MSI9945.tmpFilesize
28KB
MD585221b3bcba8dbe4b4a46581aa49f760
SHA1746645c92594bfc739f77812d67cfd85f4b92474
SHA256f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f
SHA512060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d