Analysis
-
max time kernel
253s -
max time network
51s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31-12-2023 01:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3578d2928e88860e9d3916d87e05503d79b0ef123d2a153299be551e51a4a179.exe
Resource
win7-20231215-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
3578d2928e88860e9d3916d87e05503d79b0ef123d2a153299be551e51a4a179.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
3578d2928e88860e9d3916d87e05503d79b0ef123d2a153299be551e51a4a179.exe
-
Size
4.0MB
-
MD5
2add0e3951ff067299f8a0904deb8b7e
-
SHA1
750dac5fb8c1f4e9fa0db02b8411aecb3a06bf85
-
SHA256
3578d2928e88860e9d3916d87e05503d79b0ef123d2a153299be551e51a4a179
-
SHA512
4bf6bc8e7c798a5a86386dceebd9423b6e35e1b2dc61184c80146b8e02ab1bc2f78c9b3eec76acda353029e6f6dd50ed5a38c38dc81b0356a218a964f9481f0b
-
SSDEEP
49152:Nn+95rni963PSumT0+TFiH7efPNwwlVj1wqU9nChUponnI9EYVKXGH/s7EC1g5n2:N466+6efPzclnC0VXOGk7J22
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 8 IoCs
pid Process 240 MsiExec.exe 2232 rundll32.exe 2232 rundll32.exe 2232 rundll32.exe 2232 rundll32.exe 2232 rundll32.exe 2232 rundll32.exe 2232 rundll32.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2396 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 368 3578d2928e88860e9d3916d87e05503d79b0ef123d2a153299be551e51a4a179.exe Token: SeShutdownPrivilege 2396 msiexec.exe Token: SeIncreaseQuotaPrivilege 2396 msiexec.exe Token: SeRestorePrivilege 2224 msiexec.exe Token: SeTakeOwnershipPrivilege 2224 msiexec.exe Token: SeSecurityPrivilege 2224 msiexec.exe Token: SeCreateTokenPrivilege 2396 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2396 msiexec.exe Token: SeLockMemoryPrivilege 2396 msiexec.exe Token: SeIncreaseQuotaPrivilege 2396 msiexec.exe Token: SeMachineAccountPrivilege 2396 msiexec.exe Token: SeTcbPrivilege 2396 msiexec.exe Token: SeSecurityPrivilege 2396 msiexec.exe Token: SeTakeOwnershipPrivilege 2396 msiexec.exe Token: SeLoadDriverPrivilege 2396 msiexec.exe Token: SeSystemProfilePrivilege 2396 msiexec.exe Token: SeSystemtimePrivilege 2396 msiexec.exe Token: SeProfSingleProcessPrivilege 2396 msiexec.exe Token: SeIncBasePriorityPrivilege 2396 msiexec.exe Token: SeCreatePagefilePrivilege 2396 msiexec.exe Token: SeCreatePermanentPrivilege 2396 msiexec.exe Token: SeBackupPrivilege 2396 msiexec.exe Token: SeRestorePrivilege 2396 msiexec.exe Token: SeShutdownPrivilege 2396 msiexec.exe Token: SeDebugPrivilege 2396 msiexec.exe Token: SeAuditPrivilege 2396 msiexec.exe Token: SeSystemEnvironmentPrivilege 2396 msiexec.exe Token: SeChangeNotifyPrivilege 2396 msiexec.exe Token: SeRemoteShutdownPrivilege 2396 msiexec.exe Token: SeUndockPrivilege 2396 msiexec.exe Token: SeSyncAgentPrivilege 2396 msiexec.exe Token: SeEnableDelegationPrivilege 2396 msiexec.exe Token: SeManageVolumePrivilege 2396 msiexec.exe Token: SeImpersonatePrivilege 2396 msiexec.exe Token: SeCreateGlobalPrivilege 2396 msiexec.exe Token: SeCreateTokenPrivilege 2396 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2396 msiexec.exe Token: SeLockMemoryPrivilege 2396 msiexec.exe Token: SeIncreaseQuotaPrivilege 2396 msiexec.exe Token: SeMachineAccountPrivilege 2396 msiexec.exe Token: SeTcbPrivilege 2396 msiexec.exe Token: SeSecurityPrivilege 2396 msiexec.exe Token: SeTakeOwnershipPrivilege 2396 msiexec.exe Token: SeLoadDriverPrivilege 2396 msiexec.exe Token: SeSystemProfilePrivilege 2396 msiexec.exe Token: SeSystemtimePrivilege 2396 msiexec.exe Token: SeProfSingleProcessPrivilege 2396 msiexec.exe Token: SeIncBasePriorityPrivilege 2396 msiexec.exe Token: SeCreatePagefilePrivilege 2396 msiexec.exe Token: SeCreatePermanentPrivilege 2396 msiexec.exe Token: SeBackupPrivilege 2396 msiexec.exe Token: SeRestorePrivilege 2396 msiexec.exe Token: SeShutdownPrivilege 2396 msiexec.exe Token: SeDebugPrivilege 2396 msiexec.exe Token: SeAuditPrivilege 2396 msiexec.exe Token: SeSystemEnvironmentPrivilege 2396 msiexec.exe Token: SeChangeNotifyPrivilege 2396 msiexec.exe Token: SeRemoteShutdownPrivilege 2396 msiexec.exe Token: SeUndockPrivilege 2396 msiexec.exe Token: SeSyncAgentPrivilege 2396 msiexec.exe Token: SeEnableDelegationPrivilege 2396 msiexec.exe Token: SeManageVolumePrivilege 2396 msiexec.exe Token: SeImpersonatePrivilege 2396 msiexec.exe Token: SeCreateGlobalPrivilege 2396 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2396 msiexec.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 368 wrote to memory of 2396 368 3578d2928e88860e9d3916d87e05503d79b0ef123d2a153299be551e51a4a179.exe 27 PID 368 wrote to memory of 2396 368 3578d2928e88860e9d3916d87e05503d79b0ef123d2a153299be551e51a4a179.exe 27 PID 368 wrote to memory of 2396 368 3578d2928e88860e9d3916d87e05503d79b0ef123d2a153299be551e51a4a179.exe 27 PID 368 wrote to memory of 2396 368 3578d2928e88860e9d3916d87e05503d79b0ef123d2a153299be551e51a4a179.exe 27 PID 368 wrote to memory of 2396 368 3578d2928e88860e9d3916d87e05503d79b0ef123d2a153299be551e51a4a179.exe 27 PID 368 wrote to memory of 2396 368 3578d2928e88860e9d3916d87e05503d79b0ef123d2a153299be551e51a4a179.exe 27 PID 368 wrote to memory of 2396 368 3578d2928e88860e9d3916d87e05503d79b0ef123d2a153299be551e51a4a179.exe 27 PID 2224 wrote to memory of 240 2224 msiexec.exe 29 PID 2224 wrote to memory of 240 2224 msiexec.exe 29 PID 2224 wrote to memory of 240 2224 msiexec.exe 29 PID 2224 wrote to memory of 240 2224 msiexec.exe 29 PID 2224 wrote to memory of 240 2224 msiexec.exe 29 PID 2224 wrote to memory of 240 2224 msiexec.exe 29 PID 2224 wrote to memory of 240 2224 msiexec.exe 29 PID 240 wrote to memory of 2232 240 MsiExec.exe 30 PID 240 wrote to memory of 2232 240 MsiExec.exe 30 PID 240 wrote to memory of 2232 240 MsiExec.exe 30 PID 240 wrote to memory of 2232 240 MsiExec.exe 30 PID 240 wrote to memory of 2232 240 MsiExec.exe 30 PID 240 wrote to memory of 2232 240 MsiExec.exe 30 PID 240 wrote to memory of 2232 240 MsiExec.exe 30 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3578d2928e88860e9d3916d87e05503d79b0ef123d2a153299be551e51a4a179.exe"C:\Users\Admin\AppData\Local\Temp\3578d2928e88860e9d3916d87e05503d79b0ef123d2a153299be551e51a4a179.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\setup.msi"2⤵
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2396
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A33200519FD971D47417B10FAD0AB486 C2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIF69E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259585944 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- Loads dropped DLL
PID:2232
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:2024
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003B4" "0000000000000330"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2264
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
371KB
MD5c8defc40b2f9dd0f4c64eb93a245f0d0
SHA1523e6332e22b552e3cbfe560dd24088b4f04bdda
SHA256376d0be7865a64e0d18d57462e33deb0695d9206372688a6f1ea0f14e88af06b
SHA5122207d564494d4016df5ff2312448151642a11d4ddfe8e7eed8dd1663b39a8672cb24a2db0a1e32c66dfd10a05618d63f66152f0bc28e61e562dfdc4188d50493
-
Filesize
356KB
MD51fa2f82359abd5f9be43c275334692fc
SHA188c8857b1b52afebdb25e89ae8627e132c5db70c
SHA256f8048e0190018c4794217f3576072c030fd7283bd26037b2b4de9ac6ca10ec39
SHA512c3e9dbbc4b12baca2cbec2987e8fad5357cf8a85bfac87d97aa1203cdc3dac8a8a37342ae0c5a2149121d88ef60b86cba9f9e3b3f46971027c8ba7754f6e44ff
-
Filesize
332KB
MD55fab91de88276a2adcd4bed9c7f55e60
SHA13339b302ffdeffbc44930d589ac05d775ef332fb
SHA25605b8cca6ce541e509036551f27eec5a137322bfb85fefe0cfea422a9138fc27e
SHA5129e47c8cae697475c116981da1122b6c80936550edc684e1e8cf7695045d6fd153a962ad4eaf2eaec14ab8a0ce790fa43c109b2f1adec97d78387288035082e4f
-
Filesize
172KB
MD55ef88919012e4a3d8a1e2955dc8c8d81
SHA1c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA2563e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
SHA5124544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
-
Filesize
390KB
MD55811a10f89fc24a4fffe34916944f3ba
SHA14f71a8a00c258dbb9405402be0d9bdf573c73cc3
SHA256f27cdb2beb8129bea9d9832045291abd854fc727062ed76843d2628767467c6b
SHA512a2f03c40d12a8ba6da635ee13863946b5713d065ad8eb41e6e93a429032b2450acf039ddf7fea3c674052c98a7e24cb58511e110f8f51fb2fa50f0e2a7290263
-
Filesize
312KB
MD5b1f218e4fb9b515bd9ae74fbc01996be
SHA133c08cbc8a9dbf08467dcab4bee5c3e79435d351
SHA2564591ac4eb32122a75b4977eae27ea0d86036d21c76ffc86960e829fd8ab13ceb
SHA512741035174b65bcb458fc22e274123c8464f5aa3e842e49870494a4b16f0a367e5317e099e4a389d5f289a971c9996c4590dbf6ae3b9ca9ff3b1ab942894e4d26
-
Filesize
19KB
MD558dbcfa106b3f1d529bb9d151ecb5eb2
SHA1ad0aa9cebd136952b9a2acae84c1c5a390ee6fc0
SHA2565046fdb2b88b5725c3e107339f6d5d80c11d2b6f6c9fc581c3011160e60087c5
SHA51266434aeab3795a765030b57ddaa876057dc56f5cd89d3a20abc1fec7b92cb32121ebb8152ce076fc3959fe56ff0a2909b987fc82d47074ddfc9b64e309866158