693ff5db0a085db5094bb96cd4c0ce1d1d3fdc2fbf6b92c32836f3e61a089e7a

Analysis

max time kernel
122s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
submitted
13-02-2024 03:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

693ff5db0a085db5094bb96cd4c0ce1d1d3fdc2fbf6b92c32836f3e61a089e7a.msi
Size

5.8MB
MD5

9c02a9298b97fcfc5a75fbedf08002bd
SHA1

2d3bc2856c015914f2856331a0315298f3c34b0c
SHA256

693ff5db0a085db5094bb96cd4c0ce1d1d3fdc2fbf6b92c32836f3e61a089e7a
SHA512

fafe5dddb610068cb1044c803a6d681d1739904d8e0c4b2b0fc05bcd55cf9344f69e77c8627ae73713f759117d81a78855ff937ee8650b47ab18d37cb9ca34bc
SSDEEP

49152:ppUP3UhtSTK+0THkWsN8SDYdvH5eoQDWhbHHhZgWEF94FJy5jvrgFdbBUleY82cp:pp6nFDkEWoyvy5jvcdbBUkYC+XCFmpC

Score

7^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1564	ICACLS.EXE

Blocklisted process makes network request 3 IoCs

flow	pid	Process
2	4688	msiexec.exe
4	4688	msiexec.exe
8	4688	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe

Command and Scripting Interpreter: AutoIT 1 TTPs 1 IoCs

Using AutoIT for possible automate script.

execution

AutoHotKey & AutoIT

T1059.010

pid	Process
1668	Autoit3.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4688	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000003462af5746133e160000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800003462af570000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809003462af57000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d3462af57000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000003462af5700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4688	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4688	msiexec.exe
Token: SeSecurityPrivilege	648	msiexec.exe
Token: SeCreateTokenPrivilege	4688	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4688	msiexec.exe
Token: SeLockMemoryPrivilege	4688	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4688	msiexec.exe
Token: SeMachineAccountPrivilege	4688	msiexec.exe
Token: SeTcbPrivilege	4688	msiexec.exe
Token: SeSecurityPrivilege	4688	msiexec.exe
Token: SeTakeOwnershipPrivilege	4688	msiexec.exe
Token: SeLoadDriverPrivilege	4688	msiexec.exe
Token: SeSystemProfilePrivilege	4688	msiexec.exe
Token: SeSystemtimePrivilege	4688	msiexec.exe
Token: SeProfSingleProcessPrivilege	4688	msiexec.exe
Token: SeIncBasePriorityPrivilege	4688	msiexec.exe
Token: SeCreatePagefilePrivilege	4688	msiexec.exe
Token: SeCreatePermanentPrivilege	4688	msiexec.exe
Token: SeBackupPrivilege	4688	msiexec.exe
Token: SeRestorePrivilege	4688	msiexec.exe
Token: SeShutdownPrivilege	4688	msiexec.exe
Token: SeDebugPrivilege	4688	msiexec.exe
Token: SeAuditPrivilege	4688	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4688	msiexec.exe
Token: SeChangeNotifyPrivilege	4688	msiexec.exe
Token: SeRemoteShutdownPrivilege	4688	msiexec.exe
Token: SeUndockPrivilege	4688	msiexec.exe
Token: SeSyncAgentPrivilege	4688	msiexec.exe
Token: SeEnableDelegationPrivilege	4688	msiexec.exe
Token: SeManageVolumePrivilege	4688	msiexec.exe
Token: SeImpersonatePrivilege	4688	msiexec.exe
Token: SeCreateGlobalPrivilege	4688	msiexec.exe
Token: SeBackupPrivilege	2432	vssvc.exe
Token: SeRestorePrivilege	2432	vssvc.exe
Token: SeAuditPrivilege	2432	vssvc.exe
Token: SeBackupPrivilege	648	msiexec.exe
Token: SeRestorePrivilege	648	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4688	msiexec.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\693ff5db0a085db5094bb96cd4c0ce1d1d3fdc2fbf6b92c32836f3e61a089e7a.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4688

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:648
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:5036
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F5B57C516F4E949612F5C023D8EA0644
  2⤵
  PID:2520
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-0cd1ff89-8427-447b-b5c1-15fcf2c7d432\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
    3⤵
    - Modifies file permissions
    PID:1564
- - C:\Windows\SysWOW64\EXPAND.EXE
    "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
    3⤵
    PID:2660
- - C:\Users\Admin\AppData\Local\Temp\MW-0cd1ff89-8427-447b-b5c1-15fcf2c7d432\files\iTunesHelper.exe
    "C:\Users\Admin\AppData\Local\Temp\MW-0cd1ff89-8427-447b-b5c1-15fcf2c7d432\files\iTunesHelper.exe"
    3⤵
    PID:4600
  - - \??\c:\temp\Autoit3.exe
      "c:\temp\Autoit3.exe" c:\temp\script.a3x
      4⤵
      Command and Scripting Interpreter: AutoIT
      PID:1668

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AutoHotKey & AutoIT

T1059.010

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

File and Directory Permissions Modification

T1222

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_A55A1F98A2E2349B736808E9897028A5

Filesize
1KB

MD5
d8122b7238b377214a0a699eb8d9a2ea

SHA1
25284d30ae60e1f98c87b1e079f12546710c95e2

SHA256
595ee0bb73832a27c34b4e0c67dd3395fc54ec7e4f982f14e8557711940543a8

SHA512
3faf35e0154045d78ae97ec4aff589e8182143c99625ee5ca26071c188afa19809c428c9df3cdca03ca0c2a59d41ff8fc500116184923a622a2bed92657cf1d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Filesize
1KB

MD5
cacbd2c04f02598b6a3cc2f663186c89

SHA1
a6b73ab848745a233b5d10897a78f6ad44cb48c1

SHA256
625ae74d2775d7a8c29876ad17760e72674e8e94576b8ba2a34cf9c14cac0b6d

SHA512
ccefec6f936f918487ad3a721c4d962172ac1f428b2d42a657c7523b05247937aff5953caba5f4e6c6b2a0db4fc077c637ddbb4d1b347492d2c8a5d298d2ca6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_A55A1F98A2E2349B736808E9897028A5

Filesize
540B

MD5
29988c350f2958ee7d79f9e1b979fff9

SHA1
1b7288e73dd3cf82097bd415ffa47d0fd0ec22b9

SHA256
aa2bacbebcd2f57f39bb448cc071f78d78c05d1f2e6142ad414ad2a4b59c494d

SHA512
2ff0c357de8563d3fa7aea8dfadc24394be6e95d32ff683e5af402fcc0912471901f564e72203942cbeeb0632c40734851764c610bb63866378cd5b983d55cc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Filesize
536B

MD5
663867c6fb248d5f6fc4d24baa7543d4

SHA1
faaf95c16364bb252254d0b0cdfa88db8c208b33

SHA256
d4bbe64632597fac4f7fad51566fb656031c75bf8ffb1fecccfc43bceeafee46

SHA512
dadc71cf8f8cea687a682d68fa96a611095c78e84d318328ea7f3e2bc0caaaf5af888359608a441e29f6ed7597d6282c2bad0fb1879365d11bf600fd3ea89c4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-0cd1ff89-8427-447b-b5c1-15fcf2c7d432\files.cab

Filesize
1.6MB

MD5
b7b37ad9203aef1bf5866c0e58978058

SHA1
f8c5ee753f529300f6fda178c3c4b059644d0973

SHA256
943a4c687f83b1a05be5bbf3356e972a912d573ced3abd9aaf3bee525fdef064

SHA512
738251b1534acdedea241bbf15289dda10d2da176df0261a867fce46d06deb6e3f74a7cf4565505d4f6847ae03ce8e93496d21dca87a31f716b892e585882bbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-0cd1ff89-8427-447b-b5c1-15fcf2c7d432\files\CoreFoundation.dll

Filesize
967KB

MD5
2f83f85f5d61f7c269b863489bf0e60d

SHA1
3eb455568caa55da9e9cf54d1334407001415f6e

SHA256
c3248dfcc52750612232a585acdbf117307d139d6a8da5662da84a4dcbc4b473

SHA512
7a1def33034b8fa46f0dbdffc365d42032f7dfd707e43b6d11fdd54be78ba0bbd2bb4bbcf284ff9754c98a386d2bb059fa9feee8c4fad90fd30296120c4dd299

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-0cd1ff89-8427-447b-b5c1-15fcf2c7d432\files\CoreFoundation.dll

Filesize
1.1MB

MD5
1a4e182a187afed65955dbf4837d9a08

SHA1
53a20362be792f517ce771416f69923d3b06cb24

SHA256
70aef3d9fc2f91979480318bee3af0f62adcce753128ff87787bf642bcae6230

SHA512
1f8cb7c15b89c333e377c9cb9538c21ce93b5b3f6356e6b79c8d63d2bbb02623aad62c9f9f87727924a9b4c31096036e3ce18a5703992816280c449cafe0c4a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-0cd1ff89-8427-447b-b5c1-15fcf2c7d432\files\iTunesHelper.exe

Filesize
358KB

MD5
ed6a1c72a75dee15a6fa75873cd64975

SHA1
67a15ca72e3156f8be6c46391e184087e47f4a0d

SHA256
0d8878cca08903777888b3681f90e4a07c7aef7d9600a67dfa985844d4bf5eda

SHA512
256c2ebfeb42c2d3340d8bb423ef0ae48d5fb9fe5ca09c363595f51a03007482b67a777e4cae7a8194f69bc3a3fbcdb9abb5c9f92097925272431bb9d50f5c03

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-0cd1ff89-8427-447b-b5c1-15fcf2c7d432\files\sqlite3.dll

Filesize
940KB

MD5
2f94d27415049c0a776d792d26c0fa48

SHA1
397054af57b44685a52f011e1fb6197868f4fe0d

SHA256
ef74c3a86b0d8e749d2666ab779117c3952a10c425b79691c0fe915f32fe90b0

SHA512
132d1f7d34893b7d50149341216df38c0448a21e6096b984434c345e139530211e573542dae1f1412c48ace2125a22a84d1440147fde1a17c853dbf989dcefac

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-0cd1ff89-8427-447b-b5c1-15fcf2c7d432\msiwrapper.ini

Filesize
1KB

MD5
de22791ffd7378991fcb3b423fcc491a

SHA1
17d7934ce8d7afa1f91ad41f6741217c11052ef0

SHA256
592703901ac536752ec0b88df1c744d27f349b89cb406ecb45c42472db0d30d9

SHA512
bfa6dceec99043161f78fa9e5c995c6d23df32b04b7d4593378b3fe04c3c6c5a963c17539bc0cbcfbb9370f959b5268f11b364523dc672b088d21bbb869c3da5

Download Submit
C:\Windows\Installer\MSIF43A.tmp

Filesize
208KB

MD5
d82b3fb861129c5d71f0cd2874f97216

SHA1
f3fe341d79224126e950d2691d574d147102b18d

SHA256
107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c

SHA512
244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

Download Submit
C:\temp\Autoit3.exe

Filesize
655KB

MD5
73fed646f74df40ba458972a80b28e68

SHA1
cafbcf8f2fdda7faef5847bc076786ef54ea9db5

SHA256
8f77ec3a314a5281143b4fff5ea5ecf103f1be7f5a9151d310a5cd0f369e280e

SHA512
b9e8ea8fe83b675a36dd774efe5cd41979f9bef60d3aecf26f3123a6630a7b4fe361ee2787d935e2019a9645238cdbc9aca1234fe0833ea0c4010f7059b6c441

Download Submit
\??\c:\temp\Autoit3.exe

Filesize
628KB

MD5
cacecd799e9421d28570178c019349d3

SHA1
c6842216ea231fe5523e0229b2ffa89762cbac74

SHA256
1310ced3e2565ebe664cd44a6b3c8f840d14086b2cb53e5011d01a99dedf39b1

SHA512
833b90f72c6043d7bf4ae022825e3699430c18c7994e8b10f34b10fdcfece2bb1afc927f52c03aeab31eea7ba6ac3bf991aa2f8c792a7e2dd9e69930416c5543

Download Submit
\??\c:\temp\script.a3x

Filesize
473KB

MD5
33ca8bc4ac593027fd3e83ba44be54fc

SHA1
07e2e129a5b0a694d38ac29bc21f74eda100519f

SHA256
2296f929340976c680d199ce8e47bd7136d9f4c1f7abc9df79843e094f894236

SHA512
05f6f03e69a7d31686f422e422d61161bde45173a6453fdf0392a7a084c9bd69c7c0ed11eb7a37281481eea14497e95c51dfaded21e2ff943fee3f371592db61

Download Submit
memory/4600-97-0x0000019A93200000-0x0000019A933A0000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads