Analysis
- max time kernel
68s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
31/12/2023, 00:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9c110c0426f4e75f4384a527f0abe2232fe71f2968eb91278b16b200537d3161.exe
Resource
win7-20231215-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
9c110c0426f4e75f4384a527f0abe2232fe71f2968eb91278b16b200537d3161.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 9c110c0426f4e75f4384a527f0abe2232fe71f2968eb91278b16b200537d3161.exe
- Size 2.6MB
- Sample231231-a3333abbc4
- SHA256 9c110c0426f4e75f4384a527f0abe2232fe71f2968eb91278b16b200537d3161
- MD5 1f8e9fec647700b21d45e6cda97c39b7
- SHA1 037288ee51553f84498ae4873c357d367d1a3667
- SHA512 42f6ca3456951f3e85024444e513f424add6eda9f4807bf84c91dc8ccb623be6a8e83dc40a8b6a1bc2c6fd080f2c51b719ead1422e9d1c1079795ec70953a1ad
- SSDEEP 49152:IJFEcHcHfnIpvSUxuB4vkjfCSfil3ObWcrJhxSkm6Fo4Ea0g/I2Pz7citcU7tmLq:S2c8gfd87CQgu9xNpW4t/Ic7csd7t0q
- MD5 SHA1 SHA512 SSDEEP
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 9c110c0426f4e75f4384a527f0abe2232fe71f2968eb91278b16b200537d3161.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\Installer\e587105.msi msiexec.exe File opened for modification C:\Windows\Installer\e587105.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000237a6c0e57fb805f0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000237a6c0e0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900237a6c0e000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d237a6c0e000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000237a6c0e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious use of AdjustPrivilegeToken 39 IoCs
description pid Process Token: SeShutdownPrivilege 2516 msiexec.exe Token: SeIncreaseQuotaPrivilege 2516 msiexec.exe Token: SeSecurityPrivilege 5060 msiexec.exe Token: SeCreateTokenPrivilege 2516 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2516 msiexec.exe Token: SeLockMemoryPrivilege 2516 msiexec.exe Token: SeIncreaseQuotaPrivilege 2516 msiexec.exe Token: SeMachineAccountPrivilege 2516 msiexec.exe Token: SeTcbPrivilege 2516 msiexec.exe Token: SeSecurityPrivilege 2516 msiexec.exe Token: SeTakeOwnershipPrivilege 2516 msiexec.exe Token: SeLoadDriverPrivilege 2516 msiexec.exe Token: SeSystemProfilePrivilege 2516 msiexec.exe Token: SeSystemtimePrivilege 2516 msiexec.exe Token: SeProfSingleProcessPrivilege 2516 msiexec.exe Token: SeIncBasePriorityPrivilege 2516 msiexec.exe Token: SeCreatePagefilePrivilege 2516 msiexec.exe Token: SeCreatePermanentPrivilege 2516 msiexec.exe Token: SeBackupPrivilege 2516 msiexec.exe Token: SeRestorePrivilege 2516 msiexec.exe Token: SeShutdownPrivilege 2516 msiexec.exe Token: SeDebugPrivilege 2516 msiexec.exe Token: SeAuditPrivilege 2516 msiexec.exe Token: SeSystemEnvironmentPrivilege 2516 msiexec.exe Token: SeChangeNotifyPrivilege 2516 msiexec.exe Token: SeRemoteShutdownPrivilege 2516 msiexec.exe Token: SeUndockPrivilege 2516 msiexec.exe Token: SeSyncAgentPrivilege 2516 msiexec.exe Token: SeEnableDelegationPrivilege 2516 msiexec.exe Token: SeManageVolumePrivilege 2516 msiexec.exe Token: SeImpersonatePrivilege 2516 msiexec.exe Token: SeCreateGlobalPrivilege 2516 msiexec.exe Token: SeBackupPrivilege 4004 vssvc.exe Token: SeRestorePrivilege 4004 vssvc.exe Token: SeAuditPrivilege 4004 vssvc.exe Token: SeBackupPrivilege 5060 msiexec.exe Token: SeRestorePrivilege 5060 msiexec.exe Token: SeRestorePrivilege 5060 msiexec.exe Token: SeTakeOwnershipPrivilege 5060 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2516 msiexec.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4992 wrote to memory of 2516 4992 9c110c0426f4e75f4384a527f0abe2232fe71f2968eb91278b16b200537d3161.exe 92 PID 4992 wrote to memory of 2516 4992 9c110c0426f4e75f4384a527f0abe2232fe71f2968eb91278b16b200537d3161.exe 92 PID 4992 wrote to memory of 2516 4992 9c110c0426f4e75f4384a527f0abe2232fe71f2968eb91278b16b200537d3161.exe 92 PID 5060 wrote to memory of 3796 5060 msiexec.exe 110 PID 5060 wrote to memory of 3796 5060 msiexec.exe 110 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\9c110c0426f4e75f4384a527f0abe2232fe71f2968eb91278b16b200537d3161.exe"C:\Users\Admin\AppData\Local\Temp\9c110c0426f4e75f4384a527f0abe2232fe71f2968eb91278b16b200537d3161.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Windows\SysWOW64\msiexec.exemsiexec /i vcredist.msi2⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2516
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:3796
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A71A2FF1455B05DF85C146DC225CCB9B2⤵PID:2844
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4004
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e587108.rbs
- Size 50KB
- SHA256 386ed5e9d0a21f1385a9297523e1b67360750b9d2172bcdbf12564f47213f639
- MD5 76663e98c9f35ad5abf0c0d98e225693
- SHA1 626aa14ccea7016b48de7c9ebd97230002e71c7f
- SHA512 eb9e6d818c7a894f3187b7578d22537bfb2828f526bdc8813d36feab34578a240f2fc7f80be20a545820d6ab2cf786c7a57c04477864451a6d6ac9b99f0c6824
- SSDEEP 384:cjFjy/+BGhwcFSrbez01T6OoNEcaNF0e6epRja92l+2mLMrLeBSBFgFiX/uR53Xq:cRj0uGhhSLcaNF09wRja92l+2me3uwP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredis1.cab
- Size 247KB
- SHA256 af3560ef0c55c7e4eff2170c63e7860498b5830e405a3841f96c91601e62e108
- MD5 aa85aa3738acfe30e197d9dfd5c3428d
- SHA1 7f3ee53bd967265afe32b31d75b4f6c47363654a
- SHA512 e1bf248d6425f6ba91bf0a1f3d364321b09477af9be2f31f8bf6d92defbaddfbab8f3e6284262742378f1f87d60d06eee3b98fb081e60f9fb6f19c1797489861
- SSDEEP 6144:jZZNW4mlCRYT6pbIuwDU7+Q3JgE/sJYQu0xf0Gg/uvw3Ls:jjNQrThU7le3YafI/uMLs
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredist.msi
- Size 2.7MB
- SHA256 dde77dd3473d3d07c459f17cd267f96f19264f976f2fcc85b4bbbecf26487560
- MD5 dc1ab7ce3b89fc7cac369d8b246cdafe
- SHA1 c9a2d5a312f770189c4b65cb500905e4773c14ad
- SHA512 e554b8b36a7a853d4e6efb4e6faf2d784f41e8d26edafbb1689a944bf0a7a4b58258d820a3fada1496b8c8d295d8771fc713b29127d54a3fbc317659b7565cbe
- SSDEEP 49152:88iG59xjcLHWNTpMYeJscoTpqlLrditJ35bForUCfSwcJoJB/I4GzJCKG:N9tSA8418LZ6hyf8qz/IjJO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI74ED.tmp
- Size 28KB
- SHA256 f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f
- MD5 85221b3bcba8dbe4b4a46581aa49f760
- SHA1 746645c92594bfc739f77812d67cfd85f4b92474
- SHA512 060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d
- SSDEEP 192:XOdG/6G4nnykxsdYZ+mrv2ySzLUHypLGgjuXFw5acHKBNtHjhuHWrkA9uBP1WWzT:P6GuZBrvkzAHyxxHKBdaA2dWWzm0ZH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\e587105.msi
- Size 386KB
- SHA256 64684b5e89acc441661d4373cd93575b3fb03b6f59395f3f3d17cde682f5f3bd
- MD5 fa0ef92aef74d632780081f49d5f8859
- SHA1 44616ca19db31eb0c3de8e15871215b503dd01e8
- SHA512 56c2773e2175e9b7e54ec66202b48efeea85ae180a89346e65db5a786231bbdf93582fdd0be2a9a62120159aaefd823f1aebacbc0d14912ae2e5b64e06a55f8f
- SSDEEP 3072:tZXyQcPEiGlclhZePu6vxYwtC4VAhb0ANCPRyaPhjkQJPBhnf0amZad6Z4paQGGe:TXIPEiGQYP9xm4VAhbV/jn5Afh2lpX
- MD5 SHA1 SHA512 SSDEEP
- Path \??\Volume{0e6c7a23-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{bac43d80-c026-400d-be61-4905d07f498f}_OnDiskSnapshotProp
- Size 6KB
- SHA256 afac48cfcb99a6cc59b93acedfb3e1b4e74a5ea0c0ab362203071371e472f72b
- MD5 94c17f7f5051dae415f45797a8d97e7f
- SHA1 5cba150746f97c61564256ce4a6193bc55df8ae4
- SHA512 cd6fda3c81f0c0dab6ae41ed4e839aac5fa711ed7841f1004dde58d8aeb3939dc3632e43b54fe1def4b3c08c4400edea4f510ae1b0eb1a17ee304a4bb6562bde
- SSDEEP 96:FjgNTv9gJLYFpDD84LTHzbOHXOHBlBRQJ8Sc9XE56tOSVQEJ:lgplb++sVe
- MD5 SHA1 SHA512 SSDEEP