Analysis
-
max time kernel
87s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
18-02-2024 02:05
General
-
Target
dependencies/vcredist2005_x86.exe
-
Size
2.6MB
-
MD5
ce2922f83fb4b170affce0ea448b107b
-
SHA1
b8fab0bb7f62a24ddfe77b19cd9a1451abd7b847
-
SHA256
4ee4da0fe62d5fa1b5e80c6e6d88a4a2f8b3b140c35da51053d0d7b72a381d29
-
SHA512
e94b077e054bd8992374d359f3adc4d1d78d42118d878556715d77182f7d03635850b2b2f06c012ccb7c410e2b3c124cf6508473efe150d3c51a51857ce1c6b0
-
SSDEEP
49152:rqGRIgg2SirwkF9xdtb43lyGKCafpKkiwnaDahmPzpY4FPyaza:rxxLFfY/KCCpKk9aWMzZyau
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 1 IoCs
-
Drops file in Windows directory 57 IoCs
-
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 3 IoCs
-
Modifies registry class 45 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\dependencies\vcredist2005_x86.exe"C:\Users\Admin\AppData\Local\Temp\dependencies\vcredist2005_x86.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec /i vcredist.msi2⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding CF02B1D2FC04998F921B886172CE404B2⤵
- Loads dropped DLL
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Config.Msi\e578ddb.rbsFilesize
73KB
MD54113528cc561746ab160dc955d9775af
SHA134c9a1416e65436ad027116b50ebb7b0557e72ee
SHA256a9fbe076f4cf825c5d87ab67c575f18cfa79b2869dad8d94d26a2b6d7f5483bc
SHA51243af1bd71e78e29e722277122656d72696318f672281c9d5f6525c0a44520eb0acb8cb01ee4415943191b2ed12cab4439cb1dcb5e15b985efe861d53566e3bae
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredis1.cabFilesize
247KB
MD5cc064d4b81619991de8131a86ad77681
SHA188d80d86cc20c27d7d2a872af719300bd2bb73f9
SHA256913ee5a1cae3e5a1872b3a5efaaa00c58e4beb692492b138f76967da671b0477
SHA5125aff0eb26cfc187bf58721b2b6d73357d9f1e66d1ac5340ad9ddc08b40ad0eda27a144cb3b650604637a7476c282ded83ed890de98a73ccaf0cc021da3a9eb25
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredist.msiFilesize
2.1MB
MD50ab5875cd0aa5275e68ae1d5dcfa6730
SHA1995bb3119286234a121d5c8fb9e0b9de1f041dfb
SHA256a67014434fe625db5bf3a4315b9109df4f9eed6443c4caccee242ba868a39863
SHA512e2156443fb6bf0008d5624c38c60aad69e09ace20586d24b8ae43a1fdd355ccc941c23ff19cd5a290114008d118f7ab0c720f5a0a630098243ab59a204824b39
-
C:\Windows\Installer\MSI8FAD.tmpFilesize
28KB
MD585221b3bcba8dbe4b4a46581aa49f760
SHA1746645c92594bfc739f77812d67cfd85f4b92474
SHA256f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f
SHA512060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d
-
C:\Windows\Installer\e578dd8.msiFilesize
1.1MB
MD5969068b0ba09cfb0c69ab1eb7d4298bd
SHA15fa7f479851ffab533e6ed39084cd28b10f12d22
SHA256860cc8253abdfe4d7c749706e13ce7d04f2962e8b29090398f5170e38dfe4e71
SHA5121fbfda8b40f96458174ffc1c90455aaba4b61ec0452582341f71512e648c601612a3c541b4a629217e7c7358cdba60a710558c9b7b217ba27e85bc3e71682f07
-
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2Filesize
1.6MB
MD5d3f8b72cfb247d54b9f751fb63d746ac
SHA186fb4dd5d1603732f898aad6e45da01204c2ec8f
SHA256296def949e3213b5551abaa072465e76086655b23e638b3281fc231b9528d841
SHA51260a1fb421b1153f3531bb68494c2b19b5026795fba6308e780cdfc590edb075670b4065db552b24551705b4bbf29ec17bc99e2fb1412ddc6e6d7b2a2b7d7ed10
-
\??\Volume{6479dd83-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{a694edaf-421f-4379-9201-616179f77538}_OnDiskSnapshotPropFilesize
6KB
MD522e37c3628bf2a8696c5e2fdf877cb9e
SHA1aedd2aa2cee3261735c9d99d0fa1af51c3701801
SHA25624386823152a5f00e32124c909a5c9e9c59fa08e2a5ab7a845ea58216787deca
SHA512092363df466afc869e820f3d83c8916dccde12c081599273fe8067dd5887c1dd08bc0c10f133b2280b3e0c3c29cc4758d791f891d568ec62f2a252ae7a40ba91