zgrat | 10c72764f6d4d5b571a45cf42034cbb6eaf7c2921bec1f8b52c3540d596c3987

Analysis

max time kernel
148s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
18/02/2024, 12:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
anytoiso_setup.exe
Size 13.4MB
Sample240218-p76gbaag76
SHA256 10c72764f6d4d5b571a45cf42034cbb6eaf7c2921bec1f8b52c3540d596c3987
MD5 490128ad8c2fe36a4b3430860e61fe30
SHA1 14bd1aa15559ac295d37ba47aa4d612e256fe85b
SHA512 730dd70af95f731ed6772eeaeadc3d36a9374ea637d9c40029ceefecd0d1ef72aba61a300e025bb01129e98b3cbf9678f35285b90926ad8a9bbdf468f74994ed
SSDEEP 393216:Bveof0+px5NtgmmehrhTDbTBUJEGkbMAZ7K47:B3pxOmme//y+bhp7
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

zgrat rat

Malware Config

Signatures

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral2/memory/4712-785-0x0000000007B10000-0x0000000007BCC000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	RegAsm.exe

Executes dropped EXE 4 IoCs

pid	Process
3320	Patch.exe
1480	anytoiso_setup.exe
428	anytoiso_setup.tmp
4712	WindowsServices.exe

Loads dropped DLL 9 IoCs

pid	Process
2648	anytoiso_setup.exe
2648	anytoiso_setup.exe
4936	MsiExec.exe
3552	MsiExec.exe
3552	MsiExec.exe
3552	MsiExec.exe
3552	MsiExec.exe
3552	MsiExec.exe
2648	anytoiso_setup.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\L:	anytoiso_setup.exe
File opened (read-only)	\??\M:	anytoiso_setup.exe
File opened (read-only)	\??\V:	anytoiso_setup.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\N:	anytoiso_setup.exe
File opened (read-only)	\??\P:	anytoiso_setup.exe
File opened (read-only)	\??\Y:	anytoiso_setup.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	anytoiso_setup.exe
File opened (read-only)	\??\T:	anytoiso_setup.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\H:	anytoiso_setup.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\E:	anytoiso_setup.exe
File opened (read-only)	\??\Z:	anytoiso_setup.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\J:	anytoiso_setup.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\S:	anytoiso_setup.exe
File opened (read-only)	\??\X:	anytoiso_setup.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\U:	anytoiso_setup.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	anytoiso_setup.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	anytoiso_setup.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Q:	anytoiso_setup.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\A:	anytoiso_setup.exe
File opened (read-only)	\??\I:	anytoiso_setup.exe
File opened (read-only)	\??\R:	anytoiso_setup.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3320 set thread context of 4548	3320	Patch.exe	99
PID 4712 set thread context of 3904	4712	WindowsServices.exe	108

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\anytoiso_setup\anytoiso_setup\anytoiso_setup.exe	msiexec.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI76A7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\{337F9E87-6AFB-4E80-A7A8-51F97C9ABEC1}\anytoiso_setup.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{337F9E87-6AFB-4E80-A7A8-51F97C9ABEC1}\anytoiso_setup.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\e577668.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7803.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{337F9E87-6AFB-4E80-A7A8-51F97C9ABEC1}	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7A17.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI77E2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7734.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI77B2.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e57766c.msi	msiexec.exe
File created	C:\Windows\Installer\e577668.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2628	3904	WerFault.exe	108

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000b201ae15c8733f580000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000b201ae150000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900b201ae15000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1db201ae15000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000b201ae1500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\22\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23	msiexec.exe

Modifies registry class 24 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\78E9F733BFA608E47A8A159FC7A9EB1C\Version = "16777216"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\78E9F733BFA608E47A8A159FC7A9EB1C\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\78E9F733BFA608E47A8A159FC7A9EB1C\SourceList\PackageName = "anytoiso_setup.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\78E9F733BFA608E47A8A159FC7A9EB1C\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\78E9F733BFA608E47A8A159FC7A9EB1C\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\78E9F733BFA608E47A8A159FC7A9EB1C	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\78E9F733BFA608E47A8A159FC7A9EB1C\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\78E9F733BFA608E47A8A159FC7A9EB1C\ProductIcon = "C:\\Windows\\Installer\\{337F9E87-6AFB-4E80-A7A8-51F97C9ABEC1}\\anytoiso_setup.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\78E9F733BFA608E47A8A159FC7A9EB1C\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\78E9F733BFA608E47A8A159FC7A9EB1C\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Roaming\\anytoiso_setup\\anytoiso_setup 1.0.0\\install\\C9ABEC1\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\78E9F733BFA608E47A8A159FC7A9EB1C\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\78E9F733BFA608E47A8A159FC7A9EB1C\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\78E9F733BFA608E47A8A159FC7A9EB1C\PackageCode = "F1D24BDD7C188044BA0BD22ABCCDCFD3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\86F7AD8FEBE0A54469243B1308CECEC9	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\78E9F733BFA608E47A8A159FC7A9EB1C\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\78E9F733BFA608E47A8A159FC7A9EB1C\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\78E9F733BFA608E47A8A159FC7A9EB1C\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\78E9F733BFA608E47A8A159FC7A9EB1C	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\78E9F733BFA608E47A8A159FC7A9EB1C\ProductName = "anytoiso_setup"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\78E9F733BFA608E47A8A159FC7A9EB1C\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\86F7AD8FEBE0A54469243B1308CECEC9\78E9F733BFA608E47A8A159FC7A9EB1C	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\78E9F733BFA608E47A8A159FC7A9EB1C\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Roaming\\anytoiso_setup\\anytoiso_setup 1.0.0\\install\\C9ABEC1\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\78E9F733BFA608E47A8A159FC7A9EB1C\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\78E9F733BFA608E47A8A159FC7A9EB1C\AuthorizedLUAApp = "0"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3196	msiexec.exe
3196	msiexec.exe
4712	WindowsServices.exe
4712	WindowsServices.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	3196	msiexec.exe
Token: SeCreateTokenPrivilege	2648	anytoiso_setup.exe
Token: SeAssignPrimaryTokenPrivilege	2648	anytoiso_setup.exe
Token: SeLockMemoryPrivilege	2648	anytoiso_setup.exe
Token: SeIncreaseQuotaPrivilege	2648	anytoiso_setup.exe
Token: SeMachineAccountPrivilege	2648	anytoiso_setup.exe
Token: SeTcbPrivilege	2648	anytoiso_setup.exe
Token: SeSecurityPrivilege	2648	anytoiso_setup.exe
Token: SeTakeOwnershipPrivilege	2648	anytoiso_setup.exe
Token: SeLoadDriverPrivilege	2648	anytoiso_setup.exe
Token: SeSystemProfilePrivilege	2648	anytoiso_setup.exe
Token: SeSystemtimePrivilege	2648	anytoiso_setup.exe
Token: SeProfSingleProcessPrivilege	2648	anytoiso_setup.exe
Token: SeIncBasePriorityPrivilege	2648	anytoiso_setup.exe
Token: SeCreatePagefilePrivilege	2648	anytoiso_setup.exe
Token: SeCreatePermanentPrivilege	2648	anytoiso_setup.exe
Token: SeBackupPrivilege	2648	anytoiso_setup.exe
Token: SeRestorePrivilege	2648	anytoiso_setup.exe
Token: SeShutdownPrivilege	2648	anytoiso_setup.exe
Token: SeDebugPrivilege	2648	anytoiso_setup.exe
Token: SeAuditPrivilege	2648	anytoiso_setup.exe
Token: SeSystemEnvironmentPrivilege	2648	anytoiso_setup.exe
Token: SeChangeNotifyPrivilege	2648	anytoiso_setup.exe
Token: SeRemoteShutdownPrivilege	2648	anytoiso_setup.exe
Token: SeUndockPrivilege	2648	anytoiso_setup.exe
Token: SeSyncAgentPrivilege	2648	anytoiso_setup.exe
Token: SeEnableDelegationPrivilege	2648	anytoiso_setup.exe
Token: SeManageVolumePrivilege	2648	anytoiso_setup.exe
Token: SeImpersonatePrivilege	2648	anytoiso_setup.exe
Token: SeCreateGlobalPrivilege	2648	anytoiso_setup.exe
Token: SeCreateTokenPrivilege	2648	anytoiso_setup.exe
Token: SeAssignPrimaryTokenPrivilege	2648	anytoiso_setup.exe
Token: SeLockMemoryPrivilege	2648	anytoiso_setup.exe
Token: SeIncreaseQuotaPrivilege	2648	anytoiso_setup.exe
Token: SeMachineAccountPrivilege	2648	anytoiso_setup.exe
Token: SeTcbPrivilege	2648	anytoiso_setup.exe
Token: SeSecurityPrivilege	2648	anytoiso_setup.exe
Token: SeTakeOwnershipPrivilege	2648	anytoiso_setup.exe
Token: SeLoadDriverPrivilege	2648	anytoiso_setup.exe
Token: SeSystemProfilePrivilege	2648	anytoiso_setup.exe
Token: SeSystemtimePrivilege	2648	anytoiso_setup.exe
Token: SeProfSingleProcessPrivilege	2648	anytoiso_setup.exe
Token: SeIncBasePriorityPrivilege	2648	anytoiso_setup.exe
Token: SeCreatePagefilePrivilege	2648	anytoiso_setup.exe
Token: SeCreatePermanentPrivilege	2648	anytoiso_setup.exe
Token: SeBackupPrivilege	2648	anytoiso_setup.exe
Token: SeRestorePrivilege	2648	anytoiso_setup.exe
Token: SeShutdownPrivilege	2648	anytoiso_setup.exe
Token: SeDebugPrivilege	2648	anytoiso_setup.exe
Token: SeAuditPrivilege	2648	anytoiso_setup.exe
Token: SeSystemEnvironmentPrivilege	2648	anytoiso_setup.exe
Token: SeChangeNotifyPrivilege	2648	anytoiso_setup.exe
Token: SeRemoteShutdownPrivilege	2648	anytoiso_setup.exe
Token: SeUndockPrivilege	2648	anytoiso_setup.exe
Token: SeSyncAgentPrivilege	2648	anytoiso_setup.exe
Token: SeEnableDelegationPrivilege	2648	anytoiso_setup.exe
Token: SeManageVolumePrivilege	2648	anytoiso_setup.exe
Token: SeImpersonatePrivilege	2648	anytoiso_setup.exe
Token: SeCreateGlobalPrivilege	2648	anytoiso_setup.exe
Token: SeCreateTokenPrivilege	2648	anytoiso_setup.exe
Token: SeAssignPrimaryTokenPrivilege	2648	anytoiso_setup.exe
Token: SeLockMemoryPrivilege	2648	anytoiso_setup.exe
Token: SeIncreaseQuotaPrivilege	2648	anytoiso_setup.exe
Token: SeMachineAccountPrivilege	2648	anytoiso_setup.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2648	anytoiso_setup.exe
4836	msiexec.exe
4836	msiexec.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3196 wrote to memory of 4936	3196	msiexec.exe	86
PID 3196 wrote to memory of 4936	3196	msiexec.exe	86
PID 3196 wrote to memory of 4936	3196	msiexec.exe	86
PID 2648 wrote to memory of 4836	2648	anytoiso_setup.exe	87
PID 2648 wrote to memory of 4836	2648	anytoiso_setup.exe	87
PID 2648 wrote to memory of 4836	2648	anytoiso_setup.exe	87
PID 3196 wrote to memory of 1616	3196	msiexec.exe	94
PID 3196 wrote to memory of 1616	3196	msiexec.exe	94
PID 3196 wrote to memory of 3552	3196	msiexec.exe	96
PID 3196 wrote to memory of 3552	3196	msiexec.exe	96
PID 3196 wrote to memory of 3552	3196	msiexec.exe	96
PID 3196 wrote to memory of 3320	3196	msiexec.exe	98
PID 3196 wrote to memory of 3320	3196	msiexec.exe	98
PID 3196 wrote to memory of 3320	3196	msiexec.exe	98
PID 3320 wrote to memory of 4548	3320	Patch.exe	99
PID 3320 wrote to memory of 4548	3320	Patch.exe	99
PID 3320 wrote to memory of 4548	3320	Patch.exe	99
PID 3320 wrote to memory of 4548	3320	Patch.exe	99
PID 3320 wrote to memory of 4548	3320	Patch.exe	99
PID 3320 wrote to memory of 4548	3320	Patch.exe	99
PID 3320 wrote to memory of 4548	3320	Patch.exe	99
PID 3320 wrote to memory of 4548	3320	Patch.exe	99
PID 3196 wrote to memory of 1480	3196	msiexec.exe	102
PID 3196 wrote to memory of 1480	3196	msiexec.exe	102
PID 3196 wrote to memory of 1480	3196	msiexec.exe	102
PID 1480 wrote to memory of 428	1480	anytoiso_setup.exe	104
PID 1480 wrote to memory of 428	1480	anytoiso_setup.exe	104
PID 1480 wrote to memory of 428	1480	anytoiso_setup.exe	104
PID 4548 wrote to memory of 4712	4548	RegAsm.exe	106
PID 4548 wrote to memory of 4712	4548	RegAsm.exe	106
PID 4548 wrote to memory of 4712	4548	RegAsm.exe	106
PID 4712 wrote to memory of 932	4712	WindowsServices.exe	107
PID 4712 wrote to memory of 932	4712	WindowsServices.exe	107
PID 4712 wrote to memory of 932	4712	WindowsServices.exe	107
PID 4712 wrote to memory of 3904	4712	WindowsServices.exe	108
PID 4712 wrote to memory of 3904	4712	WindowsServices.exe	108
PID 4712 wrote to memory of 3904	4712	WindowsServices.exe	108
PID 4712 wrote to memory of 3904	4712	WindowsServices.exe	108
PID 4712 wrote to memory of 3904	4712	WindowsServices.exe	108
PID 4712 wrote to memory of 3904	4712	WindowsServices.exe	108
PID 4712 wrote to memory of 3904	4712	WindowsServices.exe	108
PID 4712 wrote to memory of 3904	4712	WindowsServices.exe	108

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\anytoiso_setup.exe
"C:\Users\Admin\AppData\Local\Temp\anytoiso_setup.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\anytoiso_setup\anytoiso_setup 1.0.0\install\C9ABEC1\anytoiso_setup.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\anytoiso_setup.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1708020579 "
  2⤵
  - Enumerates connected drives
  - Suspicious use of FindShellTrayWindow
  PID:4836

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3196
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 77293D8B408B55673A5C9FB17DDB8E9A C
  2⤵
  - Loads dropped DLL
  PID:4936
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1616
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 28D639A096E27019F7DD9FE5A34A7C6B
  2⤵
  - Loads dropped DLL
  PID:3552
- C:\Users\Admin\AppData\Local\WindowsActiveServices\Patch.exe
  "C:\Users\Admin\AppData\Local\WindowsActiveServices\Patch.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3320
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:4548
  - - C:\Users\Admin\AppData\Roaming\WindowsServices\WindowsServices.exe
      "C:\Users\Admin\AppData\Roaming\WindowsServices\WindowsServices.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4712
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        5⤵
        
        PID:932
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        5⤵
        
        PID:3904
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 572
        6⤵
        Program crash
        
        PID:2628
- C:\Program Files (x86)\anytoiso_setup\anytoiso_setup\anytoiso_setup.exe
  "C:\Program Files (x86)\anytoiso_setup\anytoiso_setup\anytoiso_setup.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1480
- - C:\Users\Admin\AppData\Local\Temp\is-1BHUO.tmp\anytoiso_setup.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-1BHUO.tmp\anytoiso_setup.tmp" /SL5="$80234,10319616,857088,C:\Program Files (x86)\anytoiso_setup\anytoiso_setup\anytoiso_setup.exe"
    3⤵
    - Executes dropped EXE
    PID:428

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3904 -ip 3904
1⤵
PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e57766b.rbs

Path C:\Config.Msi\e57766b.rbs
Size 9KB
SHA256 0152b5a68a4f51ea424032c507eeb14f849269de1b27fccdd7f018ad0abde76f
MD5 389f42fceaf602e2221562feef29c2d9
SHA1 6138cb7f918e4ce9fdefd2323fea597949747184
SHA512 ef9d8896661a9802d6edf0553b075b213f2f699a739f9631324f86aa34e9b2f0b8eb37b06f71b164a2c46dbd0f8e09526b58ca20edd076d27128c9a242850395
SSDEEP 96:eec2/9gUCD3Z3Ow18evTcmvjzUL5TCsThqvzUL5TC6jnS22ThqMHlb5fNnWktqN3:eGVL1e/jgFOIogFOv7rrNpDe/M/USv+
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI498D.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI498D.tmp
Size 378KB
SHA256 b3f5e10fb1b7352a6dbbcbb10ed605a8fda24f3f9c31f954835bd5a41eb6ea68
MD5 0981d5c068a9c33f4e8110f81ffbb92e
SHA1 badb871adf6f24aba6923b9b21b211cea2aeca77
SHA512 59cccdcde1964e61fa63078fde776eee91c462d7d3db308ada02e27e6ce584c41ad1f7970642e02ce331d805215a2cc868fb0512c01accfa70cda52e9329e1d8
SSDEEP 6144:E7C5QB3/CNG2HBOqf2BLuoZSKYfuAOkDmE09VKYHyZw:6B3WBOG2BPD6if9VNyZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

anytoiso_setup.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-1BHUO.tmp\anytoiso_setup.tmp
Size 3.1MB
SHA256 8497acc7371f8532d8a6bda75e12b24c2bb4520e95d7e71c8da14193a64a9bc9
MD5 d7907c5d4c9b358aa951a8881ff56ad2
SHA1 063e06013b4d0edb81d0d244da761301e73e99fd
SHA512 3edd164c8938eb3b8d9e24266e6ade82b4fff026d74f399a1c60e375cbaab762632f219d65885437813af688c7afbd09c6ab81845e7943da88652582fe2ebb1d
SSDEEP 49152:mWGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbG3339YcZUD:KtLutqgwh4NYxtJpkxhG9333tA
MD5 SHA1 SHA512 SSDEEP

Submit Download

WindowsServices.exe

Path C:\Users\Admin\AppData\Roaming\WindowsServices\WindowsServices.exe
Size 814KB
SHA256 bb08e330702eccd5a5cd5f69a6ab725687324b6274381e5ad5c6abc0f78d5606
MD5 5de87b373a800e9ec989dc08dfd4ded0
SHA1 a4413f658843e7b6224b14f38745f1363853ab8f
SHA512 4f8f5097d6746b40a47b6541581f12662861824563af7dc852a324b4283ff859a58387b9d93b4d7a7cdc24c146a389328ab8311483601811bd799e8ac7305931
SSDEEP 12288:otPdWsa7Rpfpe5B1tCVK7ELdaaiPFvScA+SlzKo6307kV1TLUTOp:ydWDRDe5EqEgaidSjzKX1V1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Patch.exe

Path C:\Users\Admin\AppData\Roaming\anytoiso_setup\anytoiso_setup 1.0.0\install\C9ABEC1\LocalAppDataFolder\WindowsActiveServices\Patch.exe
Size 588KB
SHA256 7b949ec5f73dff9e83d9c5e8995e025940f1ed6d3b07c27923d9321ca9a42ead
MD5 2afbb4562f46e981beae497935002d3c
SHA1 8ede8d5c5551a8b6237a3c04f77b6f374e7c3539
SHA512 112cc4a88078bfbadc86fe9e193b09307fe076be20b2080af968c8aea2d91ba691fe418444ea22b6c7e49dab9db4bb6b121f40e1aabef4219a4d62ab6fccab54
SSDEEP 12288:Fvly0YiZfGHMwK7aAbMH3150pYEqstB166O0qyFAGLHZD0a+:Fdy0YhM8CMLyYitBC0qyFNZT
MD5 SHA1 SHA512 SSDEEP

Submit Download

anytoiso_setup.exe

Path C:\Users\Admin\AppData\Roaming\anytoiso_setup\anytoiso_setup 1.0.0\install\C9ABEC1\anytoiso_setup.exe
Size 10.9MB
SHA256 ea2a607714343aa54df3501fb2e42a6bdd5e5629f18348f99a90937061a00ded
MD5 ada8e39efbe48cec5fa440576efdc834
SHA1 1c41d21660e196386f321af4a3b0fc19a9f2e09f
SHA512 b6e025564d56e87cfcb59f87ac0a6ec0d3fd389c1916b9c3e4746abed81df3342df024aa0db593256105e0a4dcb46bb29348e86e802046546317714fa0aaec80
SSDEEP 196608:ozXJVJOtGiJrmnVQPQx7uYON2JEG5vB7xnTQqIKiitFe8HLbO6YxLHx9WJKs9:yXMtRJrMyPYTcatB7Kq7z5raRx/4
MD5 SHA1 SHA512 SSDEEP

Submit Download

anytoiso_setup.msi

Path C:\Users\Admin\AppData\Roaming\anytoiso_setup\anytoiso_setup 1.0.0\install\C9ABEC1\anytoiso_setup.msi
Size 1.2MB
SHA256 6271fdb76f4e3115f65a335ce9c3f34ceb51cfc5974e38c82213e6cfa8b7f85f
MD5 3e25368d5bd27e6f2e69ace42d554794
SHA1 46db776be7abb5e6f7db9db7675e569069d62812
SHA512 f8a6a9ad567d25900da018c63c6d78191f4a30c7ed00d698bbd54cf217750734c8e881ba5deddd0e4af2cc64a114c08be89946820ee93b01123b47abc89cb3cb
SSDEEP 24576:zBVYrB3dx2if9VNa2ABYnKAabpT1bjOhG0nmVgU6oiLwducuC:zBVYrDx2iFVNa2ABYnkpxOhGkmVgU6oh
MD5 SHA1 SHA512 SSDEEP

Submit Download

decoder.dll

Path C:\Users\Admin\AppData\Roaming\anytoiso_setup\anytoiso_setup 1.0.0\install\decoder.dll
Size 202KB
SHA256 39412aacdcddc4b2b3cfeb126456edb125ce8cadb131ca5c23c031db4431c5fc
MD5 2ca6d4ed5dd15fb7934c87e857f5ebfc
SHA1 383a55cc0ab890f41b71ca67e070ac7c903adeb6
SHA512 ce11aa5bd7b0da4baf07146e8377ff0331c1d4b04aaa4408373b4dd0fe2c3f82c84b179d9a90d26cdaa02180f22276d96cf491f9ede66f5f1da6f43cc72e5ac4
SSDEEP 3072:KAks1YEbj/RY1chmT86lO2XkzjCN4d0N1crZ9RAZQH5lsuabXXikM9:nj2rAGKvdkcrZ3xsuabn5M9
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI7803.tmp

Path C:\Windows\Installer\MSI7803.tmp
Size 567KB
SHA256 52d5b228221cd5276e4ee2a038e0ce0cf494d5af9c23ac45dcbfadc3115c8cb2
MD5 5f1b243813a203c66ba735139d8ce0c7
SHA1 c60a57668d348a61e4e2f12115afb9f9024162ba
SHA512 083c6d1af44847db4b6fb90349234128141a838d1d438d5c24f5063539a8087f0814d06cfa162aeace20e162292f64c7635b4a0e81b2ca972706cfbc484adfb5
SSDEEP 12288:cYnBQYRydLAOnSoAAtBLl2m1bEM7OAU9ZimyPR10hlkgFilV3QU6oiL:cYnKAabpT1bjOhG0nmVgU6oiL
MD5 SHA1 SHA512 SSDEEP

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 23.0MB
SHA256 2efb0e07e8e408ef8fcdb0f0aa3e97ab6e46b29cc575ba30b76cc78c8d73f84b
MD5 ca676841baba72cbc2a9e361948856bc
SHA1 42c4090bb3afd21c2c46208b0771210783ae1e30
SHA512 5f618f99b3a8532881c4e0da7eccf0c399e76c1e3e44c06fd37951931803212bc711e9346cab94f3ab1a628b24ea5a83286a73a968174ef611438d4c0096db09
SSDEEP 24576:Rjdmqn++doO/vvTLLsG+fFLbHRXsGYtTjBAN03VgMdqrQJ+m4TIqa/7cl:D
MD5 SHA1 SHA512 SSDEEP

Submit Download

{a8bd5088-dc66-4ae2-9042-0dedaaaba65f}_OnDiskSnapshotProp

Path \??\Volume{15ae01b2-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{a8bd5088-dc66-4ae2-9042-0dedaaaba65f}_OnDiskSnapshotProp
Size 6KB
SHA256 1cab5cb61c7d21ac340d140cbd9e0d06b9c7a5ba631c308edfac6091496b85ea
MD5 1fdf5e904d7005a9bff7c8835c6f3a80
SHA1 e38fb1145e830bfd5a5bb64a70a98527c8cdd5c6
SHA512 772802382249648b78dff825395fcc57059367ef31ae3a40217fad2eb1a16d3ad3b3153964ad45a2e49c554a1619d03ac9677196159589bc7fa48dc5e6dee6c2
SSDEEP 96:Fr0fYWuGYFpDD84LTHzbOHXOHBlBRQJ8Sc9XE56tOSVQpu:J0wBb++sVm
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/428-758-0x00000000024E0000-0x00000000024E1000-memory.dmp

Download

memory/428-782-0x00000000024E0000-0x00000000024E1000-memory.dmp

Download

memory/1480-780-0x0000000000400000-0x00000000004DE000-memory.dmp

Download

memory/1480-751-0x0000000000400000-0x00000000004DE000-memory.dmp

Download

memory/3320-90-0x0000000005B20000-0x0000000005BAF000-memory.dmp

Download

memory/3320-727-0x0000000005BF0000-0x0000000005C12000-memory.dmp

Download

memory/3320-88-0x0000000005B20000-0x0000000005BAF000-memory.dmp

Download

memory/3320-84-0x0000000005B20000-0x0000000005BAF000-memory.dmp

Download

memory/3320-92-0x0000000005B20000-0x0000000005BAF000-memory.dmp

Download

memory/3320-94-0x0000000005B20000-0x0000000005BAF000-memory.dmp

Download

memory/3320-96-0x0000000005B20000-0x0000000005BAF000-memory.dmp

Download

memory/3320-98-0x0000000005B20000-0x0000000005BAF000-memory.dmp

Download

memory/3320-100-0x0000000005B20000-0x0000000005BAF000-memory.dmp

Download

memory/3320-102-0x0000000005B20000-0x0000000005BAF000-memory.dmp

Download

memory/3320-104-0x0000000005B20000-0x0000000005BAF000-memory.dmp

Download

memory/3320-106-0x0000000005B20000-0x0000000005BAF000-memory.dmp

Download

memory/3320-108-0x0000000005B20000-0x0000000005BAF000-memory.dmp

Download

memory/3320-110-0x0000000005B20000-0x0000000005BAF000-memory.dmp

Download

memory/3320-112-0x0000000005B20000-0x0000000005BAF000-memory.dmp

Download

memory/3320-114-0x0000000005B20000-0x0000000005BAF000-memory.dmp

Download

memory/3320-116-0x0000000005B20000-0x0000000005BAF000-memory.dmp

Download

memory/3320-118-0x0000000005B20000-0x0000000005BAF000-memory.dmp

Download

memory/3320-120-0x0000000005B20000-0x0000000005BAF000-memory.dmp

Download

memory/3320-122-0x0000000005B20000-0x0000000005BAF000-memory.dmp

Download

memory/3320-124-0x0000000005B20000-0x0000000005BAF000-memory.dmp

Download

memory/3320-126-0x0000000005B20000-0x0000000005BAF000-memory.dmp

Download

memory/3320-128-0x0000000005B20000-0x0000000005BAF000-memory.dmp

Download

memory/3320-130-0x0000000005B20000-0x0000000005BAF000-memory.dmp

Download

memory/3320-132-0x0000000005B20000-0x0000000005BAF000-memory.dmp

Download

memory/3320-134-0x0000000005B20000-0x0000000005BAF000-memory.dmp

Download

memory/3320-136-0x0000000005B20000-0x0000000005BAF000-memory.dmp

Download

memory/3320-725-0x0000000005CA0000-0x0000000005CB0000-memory.dmp

Download

memory/3320-726-0x0000000005D20000-0x0000000005DB2000-memory.dmp

Download

memory/3320-86-0x0000000005B20000-0x0000000005BAF000-memory.dmp

Download

memory/3320-728-0x0000000005DB0000-0x0000000006104000-memory.dmp

Download

memory/3320-729-0x0000000035F80000-0x0000000035FE6000-memory.dmp

Download

memory/3320-730-0x0000000036410000-0x00000000364A2000-memory.dmp

Download

memory/3320-731-0x0000000036A60000-0x0000000037004000-memory.dmp

Download

memory/3320-734-0x0000000072000000-0x00000000727B0000-memory.dmp

Download

memory/3320-71-0x0000000072000000-0x00000000727B0000-memory.dmp

Download

memory/3320-70-0x0000000000080000-0x0000000000118000-memory.dmp

Download

memory/3320-72-0x0000000005B20000-0x0000000005BB6000-memory.dmp

Download

memory/3320-82-0x0000000005B20000-0x0000000005BAF000-memory.dmp

Download

memory/3320-80-0x0000000005B20000-0x0000000005BAF000-memory.dmp

Download

memory/3320-78-0x0000000005B20000-0x0000000005BAF000-memory.dmp

Download

memory/3320-76-0x0000000005B20000-0x0000000005BAF000-memory.dmp

Download

memory/3320-73-0x0000000005B20000-0x0000000005BAF000-memory.dmp

Download

memory/3320-74-0x0000000005B20000-0x0000000005BAF000-memory.dmp

Download

memory/4548-735-0x0000000072000000-0x00000000727B0000-memory.dmp

Download

memory/4548-765-0x0000000072000000-0x00000000727B0000-memory.dmp

Download

memory/4548-740-0x0000000005760000-0x00000000057FC000-memory.dmp

Download

memory/4548-1887-0x0000000072000000-0x00000000727B0000-memory.dmp

Download

memory/4548-736-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/4548-1648-0x00000000058C0000-0x00000000058D0000-memory.dmp

Download

memory/4548-760-0x00000000058C0000-0x00000000058D0000-memory.dmp

Download

memory/4712-784-0x0000000005100000-0x000000000510A000-memory.dmp

Download

memory/4712-783-0x00000000052C0000-0x00000000052D0000-memory.dmp

Download

memory/4712-785-0x0000000007B10000-0x0000000007BCC000-memory.dmp

Download

memory/4712-781-0x0000000072000000-0x00000000727B0000-memory.dmp

Download

memory/4712-1863-0x0000000005450000-0x0000000005451000-memory.dmp

Download

memory/4712-1864-0x00000000055C0000-0x00000000055F6000-memory.dmp

Download

memory/4712-1865-0x0000000007BD0000-0x0000000007C1C000-memory.dmp

Download

memory/4712-1870-0x0000000072000000-0x00000000727B0000-memory.dmp

Download

memory/4712-779-0x0000000000770000-0x0000000000842000-memory.dmp

Download