0404c97e973706f348a4ff1f515003e42536422e75ccc149a032d166135140ac

Analysis

max time kernel
68s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 00:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9c110c0426f4e75f4384a527f0abe2232fe71f2968eb91278b16b200537d3161.exe
Size

2.6MB
MD5

1f8e9fec647700b21d45e6cda97c39b7
SHA1

037288ee51553f84498ae4873c357d367d1a3667
SHA256

9c110c0426f4e75f4384a527f0abe2232fe71f2968eb91278b16b200537d3161
SHA512

42f6ca3456951f3e85024444e513f424add6eda9f4807bf84c91dc8ccb623be6a8e83dc40a8b6a1bc2c6fd080f2c51b719ead1422e9d1c1079795ec70953a1ad
SSDEEP

49152:IJFEcHcHfnIpvSUxuB4vkjfCSfil3ObWcrJhxSkm6Fo4Ea0g/I2Pz7citcU7tmLq:S2c8gfd87CQgu9xNpW4t/Ic7csd7t0q

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	9c110c0426f4e75f4384a527f0abe2232fe71f2968eb91278b16b200537d3161.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e587105.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e587105.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000237a6c0e57fb805f0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000237a6c0e0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900237a6c0e000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d237a6c0e000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000237a6c0e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2516	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2516	msiexec.exe
Token: SeSecurityPrivilege	5060	msiexec.exe
Token: SeCreateTokenPrivilege	2516	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2516	msiexec.exe
Token: SeLockMemoryPrivilege	2516	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2516	msiexec.exe
Token: SeMachineAccountPrivilege	2516	msiexec.exe
Token: SeTcbPrivilege	2516	msiexec.exe
Token: SeSecurityPrivilege	2516	msiexec.exe
Token: SeTakeOwnershipPrivilege	2516	msiexec.exe
Token: SeLoadDriverPrivilege	2516	msiexec.exe
Token: SeSystemProfilePrivilege	2516	msiexec.exe
Token: SeSystemtimePrivilege	2516	msiexec.exe
Token: SeProfSingleProcessPrivilege	2516	msiexec.exe
Token: SeIncBasePriorityPrivilege	2516	msiexec.exe
Token: SeCreatePagefilePrivilege	2516	msiexec.exe
Token: SeCreatePermanentPrivilege	2516	msiexec.exe
Token: SeBackupPrivilege	2516	msiexec.exe
Token: SeRestorePrivilege	2516	msiexec.exe
Token: SeShutdownPrivilege	2516	msiexec.exe
Token: SeDebugPrivilege	2516	msiexec.exe
Token: SeAuditPrivilege	2516	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2516	msiexec.exe
Token: SeChangeNotifyPrivilege	2516	msiexec.exe
Token: SeRemoteShutdownPrivilege	2516	msiexec.exe
Token: SeUndockPrivilege	2516	msiexec.exe
Token: SeSyncAgentPrivilege	2516	msiexec.exe
Token: SeEnableDelegationPrivilege	2516	msiexec.exe
Token: SeManageVolumePrivilege	2516	msiexec.exe
Token: SeImpersonatePrivilege	2516	msiexec.exe
Token: SeCreateGlobalPrivilege	2516	msiexec.exe
Token: SeBackupPrivilege	4004	vssvc.exe
Token: SeRestorePrivilege	4004	vssvc.exe
Token: SeAuditPrivilege	4004	vssvc.exe
Token: SeBackupPrivilege	5060	msiexec.exe
Token: SeRestorePrivilege	5060	msiexec.exe
Token: SeRestorePrivilege	5060	msiexec.exe
Token: SeTakeOwnershipPrivilege	5060	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2516	msiexec.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 2516	4992	9c110c0426f4e75f4384a527f0abe2232fe71f2968eb91278b16b200537d3161.exe	92
PID 4992 wrote to memory of 2516	4992	9c110c0426f4e75f4384a527f0abe2232fe71f2968eb91278b16b200537d3161.exe	92
PID 4992 wrote to memory of 2516	4992	9c110c0426f4e75f4384a527f0abe2232fe71f2968eb91278b16b200537d3161.exe	92
PID 5060 wrote to memory of 3796	5060	msiexec.exe	110
PID 5060 wrote to memory of 3796	5060	msiexec.exe	110

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\9c110c0426f4e75f4384a527f0abe2232fe71f2968eb91278b16b200537d3161.exe
"C:\Users\Admin\AppData\Local\Temp\9c110c0426f4e75f4384a527f0abe2232fe71f2968eb91278b16b200537d3161.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Windows\SysWOW64\msiexec.exe
  msiexec /i vcredist.msi
  2⤵
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2516

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5060
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3796
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A71A2FF1455B05DF85C146DC225CCB9B
  2⤵
  PID:2844

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e587108.rbs

Filesize
50KB

MD5
76663e98c9f35ad5abf0c0d98e225693

SHA1
626aa14ccea7016b48de7c9ebd97230002e71c7f

SHA256
386ed5e9d0a21f1385a9297523e1b67360750b9d2172bcdbf12564f47213f639

SHA512
eb9e6d818c7a894f3187b7578d22537bfb2828f526bdc8813d36feab34578a240f2fc7f80be20a545820d6ab2cf786c7a57c04477864451a6d6ac9b99f0c6824

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredis1.cab

Filesize
247KB

MD5
aa85aa3738acfe30e197d9dfd5c3428d

SHA1
7f3ee53bd967265afe32b31d75b4f6c47363654a

SHA256
af3560ef0c55c7e4eff2170c63e7860498b5830e405a3841f96c91601e62e108

SHA512
e1bf248d6425f6ba91bf0a1f3d364321b09477af9be2f31f8bf6d92defbaddfbab8f3e6284262742378f1f87d60d06eee3b98fb081e60f9fb6f19c1797489861

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredist.msi

Filesize
2.7MB

MD5
dc1ab7ce3b89fc7cac369d8b246cdafe

SHA1
c9a2d5a312f770189c4b65cb500905e4773c14ad

SHA256
dde77dd3473d3d07c459f17cd267f96f19264f976f2fcc85b4bbbecf26487560

SHA512
e554b8b36a7a853d4e6efb4e6faf2d784f41e8d26edafbb1689a944bf0a7a4b58258d820a3fada1496b8c8d295d8771fc713b29127d54a3fbc317659b7565cbe

Download Submit
C:\Windows\Installer\MSI74ED.tmp

Filesize
28KB

MD5
85221b3bcba8dbe4b4a46581aa49f760

SHA1
746645c92594bfc739f77812d67cfd85f4b92474

SHA256
f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f

SHA512
060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d

Download Submit
C:\Windows\Installer\e587105.msi

Filesize
386KB

MD5
fa0ef92aef74d632780081f49d5f8859

SHA1
44616ca19db31eb0c3de8e15871215b503dd01e8

SHA256
64684b5e89acc441661d4373cd93575b3fb03b6f59395f3f3d17cde682f5f3bd

SHA512
56c2773e2175e9b7e54ec66202b48efeea85ae180a89346e65db5a786231bbdf93582fdd0be2a9a62120159aaefd823f1aebacbc0d14912ae2e5b64e06a55f8f

Download Submit
\??\Volume{0e6c7a23-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{bac43d80-c026-400d-be61-4905d07f498f}_OnDiskSnapshotProp

Filesize
6KB

MD5
94c17f7f5051dae415f45797a8d97e7f

SHA1
5cba150746f97c61564256ce4a6193bc55df8ae4

SHA256
afac48cfcb99a6cc59b93acedfb3e1b4e74a5ea0c0ab362203071371e472f72b

SHA512
cd6fda3c81f0c0dab6ae41ed4e839aac5fa711ed7841f1004dde58d8aeb3939dc3632e43b54fe1def4b3c08c4400edea4f510ae1b0eb1a17ee304a4bb6562bde

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads