Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
24-01-2024 17:01
General
-
Target
msi1217YD.msi
-
Size
112.2MB
-
MD5
73de0e9331c6fa90bc0b78d1fd8371e7
-
SHA1
df579476fbcb6b0848b73fcf52c7879461d838a8
-
SHA256
b0a480c9a1e292b18a55b8d79bc3efccdb2936510226b0f313d14df8ac67627f
-
SHA512
57e985d3044e2597cf5c22207694c95268aff713c3d80a70332e54607a3fe8ec07a451593c65a55cb2c4228c830fab9d3be86141222784834b845b7738014e73
-
SSDEEP
3145728:4B4swQOP2kt4/iUOsdQidkLgvEtRxGH2/ril:4BxOhS/iUZ7dNE1GW/ril
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 5 IoCs
-
Loads dropped DLL 9 IoCs
-
VMProtect packed file 10 IoCs
Detects executables packed with VMProtect commercial packer.
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Windows directory 16 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies Internet Explorer settings 1 TTPs 64 IoCs
-
Modifies data under HKEY_USERS 3 IoCs
-
Modifies registry class 25 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 9 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
-
Suspicious use of SetWindowsHookEx 9 IoCs
-
Suspicious use of WriteProcessMemory 41 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\msi1217YD.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A91AB6D6049D6297932EAD87F372F74D C2⤵
- Loads dropped DLL
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 3316A1D3E4FA3C22E00EC97A84D9B2782⤵
- Loads dropped DLL
-
-
C:\Windows\Installer\MSIA74F.tmp"C:\Windows\Installer\MSIA74F.tmp" /EnforcedRunAsAdmin /RunAsAdmin "C:\Users\Admin\AppData\Roaming\YOUDAO\217.bat"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ""C:\Users\Admin\AppData\Roaming\YOUDAO\217.bat" "3⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\YOUDAO\WinRAR.exeC:\Users\Admin\AppData\Roaming\YOUDAO\WinRAR.exe x -p7758523s -ibck 1.zip tiak.exe4⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\YOUDAO\3.vbs"4⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c del %cd%\66.bat5⤵
-
-
C:\Users\Admin\AppData\Roaming\YOUDAO\tiak.exe"C:\Users\Admin\AppData\Roaming\YOUDAO\tiak.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\tkhkel\help360.exeC:\tkhkel\help360.exe6⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\windows\Runn\Yloux.exe"C:\windows\Runn\Yloux.exe"7⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://sms-activate.ru/cn/getNumber6⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3940 CREDAT:17410 /prefetch:27⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 5 &del "C:\Users\Admin\AppData\Roaming\YOUDAO\tiak.exe"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 57⤵
- Runs ping.exe
-
-
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x344 0x3d01⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
300KB
MD5fb4de747a88d0b1fa4d0c413741dbded
SHA1c1c013c5de8d8aa3f4f390834d8cf4c4915ac57d
SHA2567f774f0fc4207a5c58ca9cf56b0a73075d6043178f4d97ab93ae6a398195c4ba
SHA512743b8596ec43f08b9d489a83531af78d52e3cf81e070b9a6cafbc1171198b7e151e9894ec8e586e6b1a4333b12a571c38bb57e4fa92df4684989bd91d3ac89ef
-
Filesize
471B
MD56c9b222cd1e44e41ad93ba8d2fcb6512
SHA1b00df12a3bb2efd842f545c288b4bc948fc0de8f
SHA2564d9577e0b9cdb6fd342f66ed39177a482fa460da255f954dcd6a32b88385727d
SHA512809faeef601ca22eba46491747fc7dbb4ce292aaff753ec0041cd85121fbf914f78a23bed0882ce89712a0ebdc52d3aaedad71e9e98e194c62289577c82f5507
-
Filesize
404B
MD586a76405020a548c7776072fea7ffa2e
SHA1bfe85468c8d2ae9d5747b7e9014ef74b85c27bc3
SHA25601ce71cb8a9a20aa75c506f5f78b3658c27da3ff4fd254ec492c89d89667f849
SHA512e3109e29298cb9700f54c3a02a8356c25bbe7447548d02e69d42320338fe653ef54903884e0a85d87c47b4b7a921baa53ed9e495066fadc215533b7c7e158247
-
Filesize
267B
MD527a23a23109662c91cc3d63426b6bcf0
SHA14500a19ee0246ab6757d02a8870ee29a2caa265c
SHA2565d5150d46a2e2dd2a61835e37eb3463cf8d1f1de332d3fa17c937ed2bc0e97cd
SHA512e25a938e390d7e6712b9f1a2faf23bc2f4d532a4aa807953109943f9c68e7013ef5b89833c96b4abd513d61babfa1a0720a56b7193231205b196c6f624c8d1a7
-
Filesize
681B
MD5210a39e83fea22b0fcbc3b957fef02ad
SHA1c67c0a29de9519f9818f84f1d0f11f947a5bf02d
SHA2568b4f6d0623e7a38646be3e7746f35f670539dc189498d141ef3b335d06648cda
SHA5125babef2d03958d628e87a3a833156e4a077fe34ecd6adf262d7ffc4ca040789c48c408ba5285cd3609c40da4e46b8f25d552a69c1fcf20eb02c8b3df9197c2e8
-
Filesize
2KB
MD53051763a18f15ddda594ba963ee63d3f
SHA1aa8c626791a2971015a76980e056092333f83151
SHA25604010176ff33e117fad48e73dc4b10bd80badd2d1a9b4a23c07bdbcc337dceb2
SHA51230835883bdf1bc856d991664c6e167bf01a458fc6c5a3957d1cb9ab40482a3a302687b706477eecdd832623bcc8cdbd88a999e32325b5637fc3850fb60e76d63
-
Filesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
Filesize
832B
MD537f1e6aecb4256a594415a19e130b6f2
SHA19b996919e2381c9805d52ad84ef40b0d97294f3c
SHA256d9c7ad04dee9670e18f1062f440d50abad7687bfdaeb346eed22241c81ced578
SHA51269984985d56bac443d87048ca5daa94a013da56096ea7cf13de7ea167a006d10c9a04b25e74bca60a560a40db13e2087056fa42a09057b0ca48e12b8951cba5f
-
Filesize
51KB
MD5575b5480531da4d14e7453e2016fe0bc
SHA1e5c5f3134fe29e60b591c87ea85951f0aea36ee1
SHA256de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
SHA512174e48f4fb2a7e7a0be1e16564f9ed2d0bbcc8b4af18cb89ad49cf42b1c3894c8f8e29ce673bc5d9bc8552f88d1d47294ee0e216402566a3f446f04aca24857a
-
Filesize
624B
MD549fd14489af959c08d1f0cc073788fd6
SHA1f5a22605926a80dab3114f170e069a3d97a72ff3
SHA25629c11b104967a9b054c179230a8faa99033044ff106a0b49acbbc604e53a4e3d
SHA512a313b8a913caa79d30002eddc491cf66297d7011ac6f3376129cb97bd581fc832848eab2fd336a37949f5813732fdb229935a3907875ac077e39b86162f0f831
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
557KB
MD5db7612f0fd6408d664185cfc81bef0cb
SHA119a6334ec00365b4f4e57d387ed885b32aa7c9aa
SHA256e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240
SHA51225e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9
-
Filesize
1.3MB
MD5b759d283d1e318ac76757be8787585ef
SHA1b0b18c0ea22a823d2ee32ad702a6f615304b1955
SHA25694a5ed168fe2adea5e57ef7edd72b3137b74da62d527b467a9a3f3785040b5a7
SHA512273d651d6db2e8f90d55fcf1c98f8d32a52c0fc5e8b16c6008f01b7a092e6c44457502c3250c3fb25134efd3e60214d4b311c059edcd98c7b02e3a012a3d2b88
-
Filesize
91B
MD5cb242c95a12c2107f242a0f1620216e1
SHA1899cf47f75e292d4a3696b23df68e19b090c0218
SHA256429376ad0492dd8b4e03dc113888cbce866b5e9b6c3e72c82c6ee3fc006f6e6f
SHA51242d56db973fa3c9f7c414d4a9f4bffe28e089ad542556ae054a0b15f264c4060d3777064461920a0fd864a57bea715f71daf5c858f6c66d960587ade3b457e4c
-
Filesize
439B
MD5ff1eac510e2fb9c00a39ee817826be7b
SHA136485d145164c922d8c4ff92fa879bdba1a9ad5e
SHA256e96ecf797d784b8bab8d70a264f1fd6ca6b679a477af4bf6887f6635f8d42bcd
SHA512d44f4cc8445371636c9a728817a4d8321220968ff70955c3dec0a7521b1741972aa92a1190a1e0b4d08770ef0e806a84226836d8ca0ff20d21355a96cc214d2f
-
Filesize
1.4MB
MD5833ee6c5e8470e6854bed0348bbf8600
SHA1ba69f4184273952bc6231b6252129c2f2e150272
SHA256aebeda4a23149ee31782de62c3f8af89a85f2438d7eb3ea2dbfcdbc41e3fdaac
SHA512ade97e3348aa70a7c4b9b10ba97d106e24f08ada5f16789f439e05f5eb95e58cd84d24526a0e963466a1bfca0c2fcd874a0db24b430b502cc553c9368f20c9ff
-
Filesize
1.2MB
MD542e3ebd0f79da4cd7b464c2f034e6102
SHA1aa954817d34d516a7b72449a80f90698f6449371
SHA256fe9ba273060ebd8d19b253466bc029c452c6e5189b1cb126cfb002e0cad409b9
SHA512322d1613d94b45846b16cda0fd8f14ff438231915b495ed70ea469ed2e455928c120b807ed114be7302d38b4c1807e8590e6c5a3081deef829409d2a1aa0443f
-
Filesize
1.4MB
MD5d370fb110dbfa214821fbe64a3a4f293
SHA1e246be2fe719044c6e0f6087228e47e633d86656
SHA2567ff1e34f072af0a47b35f51e2a6ae96bec0c8843f2a64d0e8a9d47d1a9a0932b
SHA512903b01ab627ea4770562b90e14ec9b6a916921dad94e510642bdb6c324bb7ca12826faef0feae3ac87d4b628c4656f2e5f7ee743165574a9bbbe79329a89f34a
-
Filesize
409KB
MD5f7e1ad874fba884ceabfdb0f8edf74bb
SHA1dcd89a248a6e3d85bb3f7eae624a41cef9704654
SHA256bbce37f9e20f5bc59ab45dc49c985d115b13bb214561ddb874118fd91fb52ce8
SHA5125e59de04305aff37703e928a594b9114fb728e3285c09aae7706339d9f9ee77652271de5899738e8410d13224838efb3e30f5ab4e149c21458d3c971010dd209
-
Filesize
222KB
MD5cc65ec74a8d179bd83070679cc7779d1
SHA12878caed0d9af0fc08b3e0060427802a60710544
SHA2567ba6d6a43e173d500e7f155c3cb08c93a2bf8c578503bb8f6746bff7c4ac8f1e
SHA5127e7a7ce6c742697c0413911b97ca04a259f0ee3e6c61161c3c18d7f7ceb0a528d0a31f6fd3b7643790ae3eb8fcf3794bde966a6a9686c3c24957d6ec893ff263
-
Filesize
360KB
MD531a53ed65fb85e263a4df3f2c14c6acd
SHA16cfe843aa773536aa367ac28f7ea178dedabd629
SHA256fb639a750be5dc0aebca629cd509503d7b16874803908a05f6afa6be4cc83fe9
SHA5120179f931fdd544dadd05d42b033dbd8d4c75a90b245d259336bd34401c5d5571982a8fdb2cd11a622d6084ac453421ada47e83eacc7cf3bcbcd55223caa1ac0e
-
Filesize
316KB
MD5986a856134e8a25c6c89db5900c3ee1d
SHA12ccf8d319fa6366d7fd1c6c0c123ca164f1bded1
SHA256e43967a82cebc8e24545290e9abcdf2d40bf771ba43748d6f47cf68fd7e3fcd3
SHA512b08fce1a0eed02dfddbcd5d95db2b22cf1f1fae3e0f29ae4c797372f7c866e2002de784114b0b2fb0e79a6e254c84330552051695875795c0243624f8d1d5fcc
-
Filesize
126KB
MD510cfb325cca3a1f89e465e9f42aab06f
SHA1c9ccc603060ed690d9e20c03cf4ffb4946b1fbff
SHA256a3d93b29524a9d136fb9d713661a2d463360f57194068ff0c713f7e99f334d75
SHA512bf7a7ec71da9d490ea622488a3dd1e800b5dcdd903b7ddc663f93e537b5393329c258332f0f412fd65d0a5973edd6aa0208522bd5ab54ad54082d119c7425d4a
-
Filesize
75KB
MD5f974852383efa2d205757c68ae54ae9a
SHA1458d590a7cd2263754e852c908b1f382767376db
SHA256eabf19a26e07fbb9154ccb5a2702fbe12e61cfa2bc55f288ab9587b3d2da9932
SHA5125002c4138ec209406de908afed9922d01a25cdaf1b46474fb4fdad2dbe09f948a9654a39557922231a5c375c473f237c13070abdeca359a6091e96b980738620
-
Filesize
176KB
MD53d7d682f44b0b12b5518d3e9c6c11d2a
SHA123869cb52e797c0f5c64364af8c78c49c71b9c27
SHA256702eb45ead6494f36944f5d16e5aef30de138c6d16fdf92eedd098fb59fa5347
SHA5126295f519308b8ccd4ce6cea1058340dc25fdba5414a44c8c952437dc2cdea42b783e476ded8c855d0423895c1e8d0667eda817d956322d78ceeb5e10139af550
-
Filesize
352KB
MD517783da96bb57020095ae6f995a9c99e
SHA190eba8ed395e2d3ac01acf23253a58a2cc976b11
SHA25689a40fa5507b919fa1eb59af75d08790e5604bb0cdfe33fa02eee3ae0be9113f
SHA512a0716e0f1e6100a2ab9b840f876a6b9c01338a7ba361bf33d1fd699891e661d0c26a6183ea8f7e488c8377db352950e1f54eb46042961ad20fc6360aa7e7a1c5
-
Filesize
132KB
MD565457d5a622ae4e7e1038fef020366ce
SHA173236fd948b2f26fdefa1d5d808f974bf2d1b6d1
SHA25690647bb378de0be49e118b6f3a4dfce15da8a978aaad36c77817a3acac41765b
SHA512267f38f497f6576c31e5ecf0cccc1e34afe55e8526cd08aeaf110008635b7b4c8ae629cc1270a471aed3eea9ed20e767c10f587310ed41e9b4f3c8af1a0fc7aa
-
Filesize
6KB
MD541f09068a92a2e921df49a6c96c67238
SHA193d9107a5462cc19e655ab7376a6c1731391d5a0
SHA25661336a194b35070224883e3a0c4912eda0366823e945a8c4c62d0849ebcab397
SHA51245c0724f7f05a20c6c668dfd51fe5bfce0f1b2b9877387cf6a69d573e926f2bd5e0eb1b1df28c798e8704737b1957af7c07a3fe24331db04c95e55e3df831d6b
-
Filesize
272KB
-
Filesize
180KB
-
Filesize
272KB
-
Filesize
204KB
-
Filesize
272KB
-
Filesize
204KB
-
Filesize
272KB
-
Filesize
272KB
-
Filesize
1.6MB
-
Filesize
248KB
-
Filesize
272KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
272KB
-
Filesize
19.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
19.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
19.9MB
-
Filesize
4KB
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
4KB
-
Filesize
8.6MB
