Overview
overview
8Static
static
3severebeta.zip
windows10-2004-x64
1dependenci...h..bat
windows10-2004-x64
8dependenci...ll.bat
windows10-2004-x64
7dependenci...64.exe
windows10-2004-x64
7dependenci...86.exe
windows10-2004-x64
7dependenci...64.exe
windows10-2004-x64
7dependenci...86.exe
windows10-2004-x64
7dependenci...64.exe
windows10-2004-x64
7dependenci...86.exe
windows10-2004-x64
7dependenci...64.exe
windows10-2004-x64
7dependenci...86.exe
windows10-2004-x64
7dependenci...64.exe
windows10-2004-x64
7dependenci...86.exe
windows10-2004-x64
7dependenci...64.exe
windows10-2004-x64
7dependenci...86.exe
windows10-2004-x64
7severe.exe
windows10-2004-x64
7Analysis
-
max time kernel
87s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
16-02-2024 20:35
Static task
static1
Behavioral task
behavioral1
Sample
severebeta.zip
Resource
win10v2004-20231215-en
Behavioral task
behavioral2
Sample
dependencies/2024-1-12/auth..bat
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
dependencies/install_all.bat
Resource
win10v2004-20231215-en
Behavioral task
behavioral4
Sample
dependencies/vcredist2005_x64.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
dependencies/vcredist2005_x86.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral6
Sample
dependencies/vcredist2008_x64.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
dependencies/vcredist2008_x86.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral8
Sample
dependencies/vcredist2010_x64.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral9
Sample
dependencies/vcredist2010_x86.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral10
Sample
dependencies/vcredist2012_x64.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
dependencies/vcredist2012_x86.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral12
Sample
dependencies/vcredist2013_x64.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
dependencies/vcredist2013_x86.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral14
Sample
dependencies/vcredist2015_2017_2019_2022_x64.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
dependencies/vcredist2015_2017_2019_2022_x86.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral16
Sample
severe.exe
Resource
win10v2004-20231215-en
General
-
Target
dependencies/vcredist2005_x64.exe
-
Size
3.0MB
-
MD5
56eaf4e1237c974f6984edc93972c123
-
SHA1
ee916012783024dac67fc606457377932c826f05
-
SHA256
0551a61c85b718e1fa015b0c3e3f4c4eea0637055536c00e7969286b4fa663e0
-
SHA512
f8e15363e34db5b5445c41eea4dd80b2f682642cb8f1046f30ea4fb5f4f51b0b604f7bcb3000a35a7d3ba1d1bcc07df9b25e4533170c65640b2d137c19916736
-
SSDEEP
49152:+r67+stI6RWGTAdyvlADUrpTmcOgohwJpEM5grO3oc1OXZViFeRyDErkLUMHzkRN:AM9l8pUr9m30L5grOQXZKAsErkbQRN
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
Processes:
MsiExec.exepid process 1564 MsiExec.exe 1564 MsiExec.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
vcredist2005_x64.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" vcredist2005_x64.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc process File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe -
Drops file in Program Files directory 1 IoCs
Processes:
msiexec.exedescription ioc process File created C:\Program Files (x86)\Common Files\Microsoft Shared\VC\amd64\msdia80.dll msiexec.exe -
Drops file in Windows directory 57 IoCs
Processes:
msiexec.exedescription ioc process File created C:\Windows\WinSxS\InstallTemp\20240216203941244.0\msvcm80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240216203941557.0\8.0.50727.6195.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240216203941526.0\vcomp.dll msiexec.exe File created C:\Windows\Installer\SourceHash{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028} msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240216203941213.0\amd64_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_d6cffeda.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240216203941244.0\amd64_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_76301166.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240216203941449.0\mfc80FRA.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240216203941449.0\mfc80KOR.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240216203941557.2\8.0.50727.6195.cat msiexec.exe File created C:\Windows\Installer\e57949f.msi msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240216203941526.1 msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240216203941557.1 msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240216203941557.2 msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240216203941244.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240216203941213.0\amd64_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_d6cffeda.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240216203941338.0\mfcm80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240216203941526.0\amd64_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_7735df00.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240216203941541.0\8.0.50727.6195.policy msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240216203941557.1\8.0.50727.6195.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240216203941557.2\8.0.50727.6195.policy msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240216203941526.0 msiexec.exe File opened for modification C:\Windows\Installer\MSI9F2F.tmp msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240216203941557.0\8.0.50727.6195.policy msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240216203941449.0\mfc80ITA.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240216203941526.1\8.0.50727.6195.policy msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240216203941213.0\ATL80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240216203941449.0\amd64_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_9c659d69.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240216203941541.0\8.0.50727.6195.cat msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240216203941213.0 msiexec.exe File opened for modification C:\Windows\Installer\MSI96E1.tmp msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240216203941338.0\mfc80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240216203941449.0\mfc80DEU.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240216203941449.0\mfc80JPN.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240216203941526.0\amd64_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_7735df00.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240216203941338.0\mfc80u.dll msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240216203941244.0\amd64_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_76301166.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240216203941449.0\mfc80ENU.dll msiexec.exe File opened for modification C:\Windows\Installer\e57949f.msi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240216203941449.0\mfc80ESP.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240216203941557.1\8.0.50727.6195.policy msiexec.exe File created C:\Windows\Installer\e5794a3.msi msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240216203941541.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240216203941244.0\msvcr80.dll msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240216203941338.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240216203941526.1\8.0.50727.6195.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240216203941449.0\mfc80CHT.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240216203941449.0\amd64_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_9c659d69.manifest msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240216203941449.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240216203941338.0\amd64_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_4716846b.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240216203941244.0\msvcp80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240216203941338.0\amd64_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_4716846b.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240216203941338.0\mfcm80u.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240216203941449.0\mfc80CHS.dll msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240216203941557.0 msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
vssvc.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000083dd7964f79773090000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000083dd79640000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090083dd7964000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d83dd7964000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000083dd796400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe -
Modifies data under HKEY_USERS 3 IoCs
Processes:
msiexec.exedescription ioc process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\22\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23 msiexec.exe -
Modifies registry class 45 IoCs
Processes:
msiexec.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.ATL,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e005a00310021003d00520046007900460072005700650038004d006b0062004900640046007700550000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\PackageName = "vcredist.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\3 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\Clients = 3a0000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.CRT,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e0049004c005400540052005900320074004f005700650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFCLOC,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e00530021004900240047002e004f005f0078006800650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\2 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\5 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1af2a8da7e60d0b429d7e6453b3d0182 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\92091D8AC5E822E408118470F0E997E6\1af2a8da7e60d0b429d7e6453b3d0182 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\6 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\9 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.CRT,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e004b0039007000540041002700650026005d002900650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1af2a8da7e60d0b429d7e6453b3d0182\VC_Redist msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\Version = "134278728" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\92091D8AC5E822E408118470F0E997E6 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFC,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e0069002a0048004e00530057007d0024007e005500650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.OpenMP,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e007a0050005400310026006e0073004b0064007a00650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\Language = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\8 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\11 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\4 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFC,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e00240062003000290043004b0076003d0035002700650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\1 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\7 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.OpenMP,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e007e0078002d00360076007a0045007a007e003200650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1af2a8da7e60d0b429d7e6453b3d0182\Servicing_Key msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\ProductName = "Microsoft Visual C++ 2005 Redistributable (x64)" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\PackageCode = "C558A51006735C645AEE5A0FC6A310C9" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.ATL,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e007b004c0046003d0042004900620074004f002800650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFCLOC,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e00500054005d002700660025002b0027004b002800650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\10 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
msiexec.exepid process 1124 msiexec.exe 1124 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
msiexec.exemsiexec.exevssvc.exesrtasks.exedescription pid process Token: SeShutdownPrivilege 4152 msiexec.exe Token: SeIncreaseQuotaPrivilege 4152 msiexec.exe Token: SeSecurityPrivilege 1124 msiexec.exe Token: SeCreateTokenPrivilege 4152 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4152 msiexec.exe Token: SeLockMemoryPrivilege 4152 msiexec.exe Token: SeIncreaseQuotaPrivilege 4152 msiexec.exe Token: SeMachineAccountPrivilege 4152 msiexec.exe Token: SeTcbPrivilege 4152 msiexec.exe Token: SeSecurityPrivilege 4152 msiexec.exe Token: SeTakeOwnershipPrivilege 4152 msiexec.exe Token: SeLoadDriverPrivilege 4152 msiexec.exe Token: SeSystemProfilePrivilege 4152 msiexec.exe Token: SeSystemtimePrivilege 4152 msiexec.exe Token: SeProfSingleProcessPrivilege 4152 msiexec.exe Token: SeIncBasePriorityPrivilege 4152 msiexec.exe Token: SeCreatePagefilePrivilege 4152 msiexec.exe Token: SeCreatePermanentPrivilege 4152 msiexec.exe Token: SeBackupPrivilege 4152 msiexec.exe Token: SeRestorePrivilege 4152 msiexec.exe Token: SeShutdownPrivilege 4152 msiexec.exe Token: SeDebugPrivilege 4152 msiexec.exe Token: SeAuditPrivilege 4152 msiexec.exe Token: SeSystemEnvironmentPrivilege 4152 msiexec.exe Token: SeChangeNotifyPrivilege 4152 msiexec.exe Token: SeRemoteShutdownPrivilege 4152 msiexec.exe Token: SeUndockPrivilege 4152 msiexec.exe Token: SeSyncAgentPrivilege 4152 msiexec.exe Token: SeEnableDelegationPrivilege 4152 msiexec.exe Token: SeManageVolumePrivilege 4152 msiexec.exe Token: SeImpersonatePrivilege 4152 msiexec.exe Token: SeCreateGlobalPrivilege 4152 msiexec.exe Token: SeBackupPrivilege 1448 vssvc.exe Token: SeRestorePrivilege 1448 vssvc.exe Token: SeAuditPrivilege 1448 vssvc.exe Token: SeBackupPrivilege 1124 msiexec.exe Token: SeRestorePrivilege 1124 msiexec.exe Token: SeRestorePrivilege 1124 msiexec.exe Token: SeTakeOwnershipPrivilege 1124 msiexec.exe Token: SeRestorePrivilege 1124 msiexec.exe Token: SeTakeOwnershipPrivilege 1124 msiexec.exe Token: SeBackupPrivilege 1280 srtasks.exe Token: SeRestorePrivilege 1280 srtasks.exe Token: SeSecurityPrivilege 1280 srtasks.exe Token: SeTakeOwnershipPrivilege 1280 srtasks.exe Token: SeBackupPrivilege 1280 srtasks.exe Token: SeRestorePrivilege 1280 srtasks.exe Token: SeSecurityPrivilege 1280 srtasks.exe Token: SeTakeOwnershipPrivilege 1280 srtasks.exe Token: SeRestorePrivilege 1124 msiexec.exe Token: SeTakeOwnershipPrivilege 1124 msiexec.exe Token: SeRestorePrivilege 1124 msiexec.exe Token: SeTakeOwnershipPrivilege 1124 msiexec.exe Token: SeRestorePrivilege 1124 msiexec.exe Token: SeTakeOwnershipPrivilege 1124 msiexec.exe Token: SeRestorePrivilege 1124 msiexec.exe Token: SeTakeOwnershipPrivilege 1124 msiexec.exe Token: SeRestorePrivilege 1124 msiexec.exe Token: SeTakeOwnershipPrivilege 1124 msiexec.exe Token: SeRestorePrivilege 1124 msiexec.exe Token: SeTakeOwnershipPrivilege 1124 msiexec.exe Token: SeRestorePrivilege 1124 msiexec.exe Token: SeTakeOwnershipPrivilege 1124 msiexec.exe Token: SeRestorePrivilege 1124 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
msiexec.exepid process 4152 msiexec.exe 4152 msiexec.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
vcredist2005_x64.exemsiexec.exedescription pid process target process PID 4412 wrote to memory of 4152 4412 vcredist2005_x64.exe msiexec.exe PID 4412 wrote to memory of 4152 4412 vcredist2005_x64.exe msiexec.exe PID 4412 wrote to memory of 4152 4412 vcredist2005_x64.exe msiexec.exe PID 1124 wrote to memory of 1280 1124 msiexec.exe srtasks.exe PID 1124 wrote to memory of 1280 1124 msiexec.exe srtasks.exe PID 1124 wrote to memory of 1564 1124 msiexec.exe MsiExec.exe PID 1124 wrote to memory of 1564 1124 msiexec.exe MsiExec.exe PID 1124 wrote to memory of 1564 1124 msiexec.exe MsiExec.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\dependencies\vcredist2005_x64.exe"C:\Users\Admin\AppData\Local\Temp\dependencies\vcredist2005_x64.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec /i vcredist.msi2⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 07ED4B0468DFEA7179DBCE770B93F5CC2⤵
- Loads dropped DLL
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Config.Msi\e5794a2.rbsFilesize
73KB
MD5ef5d1c7d958d5865b15aa601a150a91c
SHA1fc4eb004a3ced0ed48eda3b36e3cc5f489591a51
SHA256fff47ede9c4981215a02ca5123ff9a9811c4f32790e989343874b49462e6f51f
SHA512a4f29477ccde8f61acf8df3459d9ded3cbda8ebe96a544b8b84c00f9e5f07d853b6739de83d2426b00a01dce455c9c049828ddd2ca16935729a1b72020ac8d6f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredis1.cabFilesize
312KB
MD577a9bff5af149160775741e204734d47
SHA17b5126af69b5a79593f39db94180f1ff11b0e39d
SHA25620a26ed9a1edf7763a9b515522c5e29720048a482c7fbc8b7ff6bbdd27e61038
SHA512bb0440f58f07e113bddd9a0afb5aab8af6493218784fe5fa6f4032e3a37088f91b7e766dee87cec4a9ea11d425d27b3b536430de3a52222e8bca3e0247d81e3b
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredist.msiFilesize
157KB
MD53a5d00dfd182c47147d21090fae4fe7d
SHA11b445d7aa880742260151554664172f4529cc9c9
SHA2562d81937958b8246a0ab30c755f5e77af8cb9cab7b4528b6757dbf49a68b683cd
SHA5126695dc2166e4cf41e19974d17fafa6ae68d3e9cee44e3a57f6b5c508da33ebab7858429635e2d26e48614b5376d7283d8945f0737981b28cb521f5ee107e9793
-
C:\Windows\Installer\MSI96E1.tmpFilesize
28KB
MD585221b3bcba8dbe4b4a46581aa49f760
SHA1746645c92594bfc739f77812d67cfd85f4b92474
SHA256f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f
SHA512060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d
-
C:\Windows\Installer\e57949f.msiFilesize
3.0MB
MD56dbdf338a0a25cdb236d43ea3ca2395e
SHA1685b6ea61e574e628392eaac8b10aff4309f1081
SHA256200fef5d4994523a02c4daa00060db28eb289b99d47fc6c1305183101e72bdeb
SHA5126b5b31c55cf72ab92b17fb6074b3901a1e6afe0796ef9bc831e4dfb97450376d2889cd24b1cf3fce60eb3c1bcd1b31254b5cfa3ef6107974dfa0b35c233daf5a
-
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2Filesize
23.0MB
MD5c7f9d0a2d64ebdfe00ff79d66ed46fa0
SHA1741006db0f665828263b65aab848448c88e9b589
SHA2562fc30e5e0bc464c3fb614a9eda06ffe18eed1f3956280614610430e512657838
SHA512c3ae5af859fee2b117fa6543d207fee729a45ee2e5c272286dca60f1d8fa24f71dc63bc69a5ee33a4834c435de491c845c4eaf92cd00948446ced2cdbcfef53e
-
\??\Volume{6479dd83-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{279b0078-427f-41cb-8b7e-9ef387900b8f}_OnDiskSnapshotPropFilesize
6KB
MD5a7a62fe77e32c6ae7a3c202113a7f155
SHA11cd49aa349a76bb60fd0c87ae0af8162938a56fb
SHA2566fb0d9b76dda8d18751e24bb696f73187e3b5b55587b9e43c8112da3228e2a8d
SHA512680b37647cc4ce21eb7bb6030358d6a3c22b44127d386f8e5fb303fc7186d9a41b60da5c756cce4b1203be85525e15b79863cbbf0799f474442503709f90428d