Analysis
- max time kernel
123s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
29/02/2024, 12:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Virus.Win32.Sality.exe
Resource
win7-20240221-en
windows7-x64
21 signatures
150 seconds
General
- Target Virus.Win32.Sality.exe
- Size 1.5MB
- Sample240229-pwf3aahb7w
- SHA256 cbe906d8ca6ea0093f4baf9e91862a10bb3c2ca93acd23e85ea7ccc65957e9be
- MD5 56c220a7640a313b73378b537964d884
- SHA1 94bc21189b9bef0e534b488f6821b5150970967d
- SHA512 5506b76936ea0119ec869e147209cbac1d4fa2c2c86f78bbfe934b2622fe96a9000d0ad46a6c8ddf0fe2b846ab4b074241bc29f66f3420402cefe4594f7d49f9
- SSDEEP 24576:dcs3MKLBDY7Ryy0fNRqTb+UO8lZN899ysIOmQuKa/57HaLtVDpEYfMonwuk4:j1LBUPoj6tv49yL2Pa9SV7414
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" Virus.Win32.Sality.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" Virus.Win32.Sality.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" Virus.Win32.Sality.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Virus.Win32.Sality.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" Virus.Win32.Sality.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" Virus.Win32.Sality.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" Virus.Win32.Sality.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" Virus.Win32.Sality.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" Virus.Win32.Sality.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" Virus.Win32.Sality.exe - Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 35 IoCs
resource yara_rule behavioral2/memory/2804-35-0x00000000025A0000-0x000000000365A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2804-40-0x00000000025A0000-0x000000000365A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2804-41-0x00000000025A0000-0x000000000365A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2804-47-0x00000000025A0000-0x000000000365A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2804-55-0x00000000025A0000-0x000000000365A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2804-61-0x00000000025A0000-0x000000000365A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2804-62-0x00000000025A0000-0x000000000365A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2804-63-0x00000000025A0000-0x000000000365A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2804-64-0x00000000025A0000-0x000000000365A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2804-66-0x00000000025A0000-0x000000000365A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2804-67-0x00000000025A0000-0x000000000365A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2804-68-0x00000000025A0000-0x000000000365A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2804-74-0x00000000025A0000-0x000000000365A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2804-75-0x00000000025A0000-0x000000000365A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2804-78-0x00000000025A0000-0x000000000365A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2804-86-0x00000000025A0000-0x000000000365A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2804-88-0x00000000025A0000-0x000000000365A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2804-89-0x00000000025A0000-0x000000000365A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2804-90-0x00000000025A0000-0x000000000365A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2804-93-0x00000000025A0000-0x000000000365A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2804-95-0x00000000025A0000-0x000000000365A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2804-101-0x00000000025A0000-0x000000000365A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2804-104-0x00000000025A0000-0x000000000365A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2804-106-0x00000000025A0000-0x000000000365A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2804-109-0x00000000025A0000-0x000000000365A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2804-110-0x00000000025A0000-0x000000000365A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2804-112-0x00000000025A0000-0x000000000365A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2804-113-0x00000000025A0000-0x000000000365A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2804-115-0x00000000025A0000-0x000000000365A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2804-117-0x00000000025A0000-0x000000000365A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2804-118-0x00000000025A0000-0x000000000365A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2804-120-0x00000000025A0000-0x000000000365A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2804-122-0x00000000025A0000-0x000000000365A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2804-131-0x00000000025A0000-0x000000000365A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2804-132-0x00000000025A0000-0x000000000365A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine - UPX dump on OEP (original entry point) 36 IoCs
resource yara_rule behavioral2/memory/2804-35-0x00000000025A0000-0x000000000365A000-memory.dmp UPX behavioral2/memory/2804-38-0x0000000001000000-0x0000000001181000-memory.dmp UPX behavioral2/memory/2804-40-0x00000000025A0000-0x000000000365A000-memory.dmp UPX behavioral2/memory/2804-41-0x00000000025A0000-0x000000000365A000-memory.dmp UPX behavioral2/memory/2804-47-0x00000000025A0000-0x000000000365A000-memory.dmp UPX behavioral2/memory/2804-55-0x00000000025A0000-0x000000000365A000-memory.dmp UPX behavioral2/memory/2804-61-0x00000000025A0000-0x000000000365A000-memory.dmp UPX behavioral2/memory/2804-62-0x00000000025A0000-0x000000000365A000-memory.dmp UPX behavioral2/memory/2804-63-0x00000000025A0000-0x000000000365A000-memory.dmp UPX behavioral2/memory/2804-64-0x00000000025A0000-0x000000000365A000-memory.dmp UPX behavioral2/memory/2804-66-0x00000000025A0000-0x000000000365A000-memory.dmp UPX behavioral2/memory/2804-67-0x00000000025A0000-0x000000000365A000-memory.dmp UPX behavioral2/memory/2804-68-0x00000000025A0000-0x000000000365A000-memory.dmp UPX behavioral2/memory/2804-74-0x00000000025A0000-0x000000000365A000-memory.dmp UPX behavioral2/memory/2804-75-0x00000000025A0000-0x000000000365A000-memory.dmp UPX behavioral2/memory/2804-78-0x00000000025A0000-0x000000000365A000-memory.dmp UPX behavioral2/memory/2804-86-0x00000000025A0000-0x000000000365A000-memory.dmp UPX behavioral2/memory/2804-88-0x00000000025A0000-0x000000000365A000-memory.dmp UPX behavioral2/memory/2804-89-0x00000000025A0000-0x000000000365A000-memory.dmp UPX behavioral2/memory/2804-90-0x00000000025A0000-0x000000000365A000-memory.dmp UPX behavioral2/memory/2804-93-0x00000000025A0000-0x000000000365A000-memory.dmp UPX behavioral2/memory/2804-95-0x00000000025A0000-0x000000000365A000-memory.dmp UPX behavioral2/memory/2804-101-0x00000000025A0000-0x000000000365A000-memory.dmp UPX behavioral2/memory/2804-104-0x00000000025A0000-0x000000000365A000-memory.dmp UPX behavioral2/memory/2804-106-0x00000000025A0000-0x000000000365A000-memory.dmp UPX behavioral2/memory/2804-109-0x00000000025A0000-0x000000000365A000-memory.dmp UPX behavioral2/memory/2804-110-0x00000000025A0000-0x000000000365A000-memory.dmp UPX behavioral2/memory/2804-112-0x00000000025A0000-0x000000000365A000-memory.dmp UPX behavioral2/memory/2804-113-0x00000000025A0000-0x000000000365A000-memory.dmp UPX behavioral2/memory/2804-115-0x00000000025A0000-0x000000000365A000-memory.dmp UPX behavioral2/memory/2804-117-0x00000000025A0000-0x000000000365A000-memory.dmp UPX behavioral2/memory/2804-118-0x00000000025A0000-0x000000000365A000-memory.dmp UPX behavioral2/memory/2804-120-0x00000000025A0000-0x000000000365A000-memory.dmp UPX behavioral2/memory/2804-122-0x00000000025A0000-0x000000000365A000-memory.dmp UPX behavioral2/memory/2804-131-0x00000000025A0000-0x000000000365A000-memory.dmp UPX behavioral2/memory/2804-132-0x00000000025A0000-0x000000000365A000-memory.dmp UPX - Executes dropped EXE 3 IoCs
pid Process 2536 msiinst.exe 2232 MsiExec.exe 3140 MsiExec.exe - Loads dropped DLL 2 IoCs
pid Process 2232 MsiExec.exe 3140 MsiExec.exe -
resource yara_rule behavioral2/memory/2804-35-0x00000000025A0000-0x000000000365A000-memory.dmp upx behavioral2/memory/2804-40-0x00000000025A0000-0x000000000365A000-memory.dmp upx behavioral2/memory/2804-41-0x00000000025A0000-0x000000000365A000-memory.dmp upx behavioral2/memory/2804-47-0x00000000025A0000-0x000000000365A000-memory.dmp upx behavioral2/memory/2804-55-0x00000000025A0000-0x000000000365A000-memory.dmp upx behavioral2/memory/2804-61-0x00000000025A0000-0x000000000365A000-memory.dmp upx behavioral2/memory/2804-62-0x00000000025A0000-0x000000000365A000-memory.dmp upx behavioral2/memory/2804-63-0x00000000025A0000-0x000000000365A000-memory.dmp upx behavioral2/memory/2804-64-0x00000000025A0000-0x000000000365A000-memory.dmp upx behavioral2/memory/2804-66-0x00000000025A0000-0x000000000365A000-memory.dmp upx behavioral2/memory/2804-67-0x00000000025A0000-0x000000000365A000-memory.dmp upx behavioral2/memory/2804-68-0x00000000025A0000-0x000000000365A000-memory.dmp upx behavioral2/memory/2804-74-0x00000000025A0000-0x000000000365A000-memory.dmp upx behavioral2/memory/2804-75-0x00000000025A0000-0x000000000365A000-memory.dmp upx behavioral2/memory/2804-78-0x00000000025A0000-0x000000000365A000-memory.dmp upx behavioral2/memory/2804-86-0x00000000025A0000-0x000000000365A000-memory.dmp upx behavioral2/memory/2804-88-0x00000000025A0000-0x000000000365A000-memory.dmp upx behavioral2/memory/2804-89-0x00000000025A0000-0x000000000365A000-memory.dmp upx behavioral2/memory/2804-90-0x00000000025A0000-0x000000000365A000-memory.dmp upx behavioral2/memory/2804-93-0x00000000025A0000-0x000000000365A000-memory.dmp upx behavioral2/memory/2804-95-0x00000000025A0000-0x000000000365A000-memory.dmp upx behavioral2/memory/2804-101-0x00000000025A0000-0x000000000365A000-memory.dmp upx behavioral2/memory/2804-104-0x00000000025A0000-0x000000000365A000-memory.dmp upx behavioral2/memory/2804-106-0x00000000025A0000-0x000000000365A000-memory.dmp upx behavioral2/memory/2804-109-0x00000000025A0000-0x000000000365A000-memory.dmp upx behavioral2/memory/2804-110-0x00000000025A0000-0x000000000365A000-memory.dmp upx behavioral2/memory/2804-112-0x00000000025A0000-0x000000000365A000-memory.dmp upx behavioral2/memory/2804-113-0x00000000025A0000-0x000000000365A000-memory.dmp upx behavioral2/memory/2804-115-0x00000000025A0000-0x000000000365A000-memory.dmp upx behavioral2/memory/2804-117-0x00000000025A0000-0x000000000365A000-memory.dmp upx behavioral2/memory/2804-118-0x00000000025A0000-0x000000000365A000-memory.dmp upx behavioral2/memory/2804-120-0x00000000025A0000-0x000000000365A000-memory.dmp upx behavioral2/memory/2804-122-0x00000000025A0000-0x000000000365A000-memory.dmp upx behavioral2/memory/2804-131-0x00000000025A0000-0x000000000365A000-memory.dmp upx behavioral2/memory/2804-132-0x00000000025A0000-0x000000000365A000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" Virus.Win32.Sality.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" Virus.Win32.Sality.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Virus.Win32.Sality.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" Virus.Win32.Sality.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" Virus.Win32.Sality.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" Virus.Win32.Sality.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" Virus.Win32.Sality.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" Virus.Win32.Sality.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Virus.Win32.Sality.exe - Enumerates connected drives 3 TTPs 44 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: MsiExec.exe File opened (read-only) \??\T: MsiExec.exe File opened (read-only) \??\U: MsiExec.exe File opened (read-only) \??\P: Virus.Win32.Sality.exe File opened (read-only) \??\Q: Virus.Win32.Sality.exe File opened (read-only) \??\Y: Virus.Win32.Sality.exe File opened (read-only) \??\A: MsiExec.exe File opened (read-only) \??\G: MsiExec.exe File opened (read-only) \??\K: Virus.Win32.Sality.exe File opened (read-only) \??\S: Virus.Win32.Sality.exe File opened (read-only) \??\Z: Virus.Win32.Sality.exe File opened (read-only) \??\W: MsiExec.exe File opened (read-only) \??\G: Virus.Win32.Sality.exe File opened (read-only) \??\O: Virus.Win32.Sality.exe File opened (read-only) \??\R: Virus.Win32.Sality.exe File opened (read-only) \??\V: Virus.Win32.Sality.exe File opened (read-only) \??\W: Virus.Win32.Sality.exe File opened (read-only) \??\Q: MsiExec.exe File opened (read-only) \??\I: Virus.Win32.Sality.exe File opened (read-only) \??\Y: MsiExec.exe File opened (read-only) \??\E: Virus.Win32.Sality.exe File opened (read-only) \??\B: MsiExec.exe File opened (read-only) \??\J: MsiExec.exe File opened (read-only) \??\O: MsiExec.exe File opened (read-only) \??\R: MsiExec.exe File opened (read-only) \??\Z: MsiExec.exe File opened (read-only) \??\U: Virus.Win32.Sality.exe File opened (read-only) \??\E: MsiExec.exe File opened (read-only) \??\H: MsiExec.exe File opened (read-only) \??\J: Virus.Win32.Sality.exe File opened (read-only) \??\L: Virus.Win32.Sality.exe File opened (read-only) \??\M: Virus.Win32.Sality.exe File opened (read-only) \??\X: Virus.Win32.Sality.exe File opened (read-only) \??\X: MsiExec.exe File opened (read-only) \??\H: Virus.Win32.Sality.exe File opened (read-only) \??\M: MsiExec.exe File opened (read-only) \??\N: MsiExec.exe File opened (read-only) \??\P: MsiExec.exe File opened (read-only) \??\V: MsiExec.exe File opened (read-only) \??\N: Virus.Win32.Sality.exe File opened (read-only) \??\I: MsiExec.exe File opened (read-only) \??\L: MsiExec.exe File opened (read-only) \??\S: MsiExec.exe File opened (read-only) \??\T: Virus.Win32.Sality.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf Virus.Win32.Sality.exe File opened for modification F:\autorun.inf Virus.Win32.Sality.exe - Drops file in System32 directory 11 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\shfolder.dll MsiExec.exe File opened for modification C:\Windows\SysWOW64\Imagehlp.dll MsiExec.exe File opened for modification C:\Windows\SysWOW64\msiexec.exe MsiExec.exe File opened for modification C:\Windows\SysWOW64\mspatcha.dll MsiExec.exe File opened for modification C:\Windows\SysWOW64\usp10.dll MsiExec.exe File opened for modification C:\Windows\SysWOW64\msls31.dll MsiExec.exe File opened for modification C:\Windows\SysWOW64\riched20.dll MsiExec.exe File opened for modification C:\Windows\SysWOW64\msihnd.dll MsiExec.exe File opened for modification C:\Windows\SysWOW64\msi.dll MsiExec.exe File opened for modification C:\Windows\SysWOW64\msimsg.dll MsiExec.exe File opened for modification C:\Windows\SysWOW64\cabinet.dll MsiExec.exe - Drops file in Program Files directory 11 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe Virus.Win32.Sality.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe Virus.Win32.Sality.exe File opened for modification C:\Program Files\7-Zip\7zG.exe Virus.Win32.Sality.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe Virus.Win32.Sality.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe Virus.Win32.Sality.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe Virus.Win32.Sality.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe Virus.Win32.Sality.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe Virus.Win32.Sality.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe Virus.Win32.Sality.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe Virus.Win32.Sality.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe Virus.Win32.Sality.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\e576b6c Virus.Win32.Sality.exe File opened for modification C:\Windows\SYSTEM.INI Virus.Win32.Sality.exe - Modifies registry class 24 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\.msi MsiExec.exe Key created \REGISTRY\MACHINE\Software\Classes\Msi.Package\shell\Open\command MsiExec.exe Key created \REGISTRY\MACHINE\Software\Classes\Msi.Package\shell\Open MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Msi.Package\shell\Open\ = "&Install" MsiExec.exe Key created \REGISTRY\MACHINE\Software\Classes\Msi.Package\shell MsiExec.exe Key created \REGISTRY\MACHINE\Software\Classes\Msi.Package\shell\Repair MsiExec.exe Key created \REGISTRY\MACHINE\Software\Classes\Msi.Patch MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.msi\ = "Msi.Package" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Msi.Package\shell\Open\command\ = "\"C:\\Windows\\system32\\msiexec.exe\" /i \"%1\" %*" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Msi.Package\shell\ = "Open" MsiExec.exe Key created \REGISTRY\MACHINE\Software\Classes\Msi.Package\shell\Repair\command MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Msi.Package\shell\Repair\command\ = "\"C:\\Windows\\system32\\msiexec.exe\" /f \"%1\" %*" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Msi.Package\shell\Repair\ = "Re&pair" MsiExec.exe Key created \REGISTRY\MACHINE\Software\Classes\Msi.Package\shell\Uninstall\command MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Msi.Package\shell\Uninstall\command\ = "\"C:\\Windows\\system32\\msiexec.exe\" /x \"%1\" %*" MsiExec.exe Key created \REGISTRY\MACHINE\Software\Classes\Msi.Package\shell\Uninstall MsiExec.exe Key created \REGISTRY\MACHINE\Software\Classes\Msi.Patch\shell\Open\command MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Msi.Patch\shell\Open\command\ = "\"C:\\Windows\\system32\\msiexec.exe\" /p \"%1\" %*" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Msi.Package\shell\Uninstall\ = "&Uninstall" MsiExec.exe Key created \REGISTRY\MACHINE\Software\Classes\.msp MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.msp\ = "Msi.Patch" MsiExec.exe Key created \REGISTRY\MACHINE\Software\Classes\Msi.Patch\shell\Open MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Msi.Patch\ = "Open" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Msi.Patch\shell\Open\ = "&Apply Patch" MsiExec.exe - Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 2804 Virus.Win32.Sality.exe 2804 Virus.Win32.Sality.exe 2804 Virus.Win32.Sality.exe 2804 Virus.Win32.Sality.exe 2804 Virus.Win32.Sality.exe 2804 Virus.Win32.Sality.exe 2804 Virus.Win32.Sality.exe 2804 Virus.Win32.Sality.exe 2804 Virus.Win32.Sality.exe 2804 Virus.Win32.Sality.exe 2804 Virus.Win32.Sality.exe 2804 Virus.Win32.Sality.exe 2804 Virus.Win32.Sality.exe 2804 Virus.Win32.Sality.exe 2804 Virus.Win32.Sality.exe 2804 Virus.Win32.Sality.exe 2804 Virus.Win32.Sality.exe 2804 Virus.Win32.Sality.exe 2804 Virus.Win32.Sality.exe 2804 Virus.Win32.Sality.exe 2804 Virus.Win32.Sality.exe 2804 Virus.Win32.Sality.exe 2804 Virus.Win32.Sality.exe 2804 Virus.Win32.Sality.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe Token: SeDebugPrivilege 2804 Virus.Win32.Sality.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2804 wrote to memory of 2536 2804 Virus.Win32.Sality.exe 87 PID 2804 wrote to memory of 2536 2804 Virus.Win32.Sality.exe 87 PID 2804 wrote to memory of 2536 2804 Virus.Win32.Sality.exe 87 PID 2536 wrote to memory of 2232 2536 msiinst.exe 88 PID 2536 wrote to memory of 2232 2536 msiinst.exe 88 PID 2536 wrote to memory of 2232 2536 msiinst.exe 88 PID 2804 wrote to memory of 788 2804 Virus.Win32.Sality.exe 13 PID 2804 wrote to memory of 796 2804 Virus.Win32.Sality.exe 12 PID 2804 wrote to memory of 388 2804 Virus.Win32.Sality.exe 8 PID 2804 wrote to memory of 2436 2804 Virus.Win32.Sality.exe 60 PID 2804 wrote to memory of 2464 2804 Virus.Win32.Sality.exe 59 PID 2804 wrote to memory of 2556 2804 Virus.Win32.Sality.exe 56 PID 2804 wrote to memory of 3360 2804 Virus.Win32.Sality.exe 46 PID 2804 wrote to memory of 3644 2804 Virus.Win32.Sality.exe 45 PID 2804 wrote to memory of 3872 2804 Virus.Win32.Sality.exe 44 PID 2804 wrote to memory of 3968 2804 Virus.Win32.Sality.exe 43 PID 2804 wrote to memory of 4084 2804 Virus.Win32.Sality.exe 18 PID 2804 wrote to memory of 2668 2804 Virus.Win32.Sality.exe 42 PID 2804 wrote to memory of 4116 2804 Virus.Win32.Sality.exe 41 PID 2804 wrote to memory of 2156 2804 Virus.Win32.Sality.exe 39 PID 2804 wrote to memory of 4896 2804 Virus.Win32.Sality.exe 29 PID 2804 wrote to memory of 1948 2804 Virus.Win32.Sality.exe 28 PID 2804 wrote to memory of 3004 2804 Virus.Win32.Sality.exe 22 PID 2804 wrote to memory of 2788 2804 Virus.Win32.Sality.exe 21 PID 2804 wrote to memory of 3240 2804 Virus.Win32.Sality.exe 20 PID 2804 wrote to memory of 2444 2804 Virus.Win32.Sality.exe 86 PID 2804 wrote to memory of 2536 2804 Virus.Win32.Sality.exe 87 PID 2804 wrote to memory of 2536 2804 Virus.Win32.Sality.exe 87 PID 2804 wrote to memory of 2232 2804 Virus.Win32.Sality.exe 88 PID 2804 wrote to memory of 2232 2804 Virus.Win32.Sality.exe 88 PID 2804 wrote to memory of 788 2804 Virus.Win32.Sality.exe 13 PID 2804 wrote to memory of 796 2804 Virus.Win32.Sality.exe 12 PID 2804 wrote to memory of 388 2804 Virus.Win32.Sality.exe 8 PID 2804 wrote to memory of 2436 2804 Virus.Win32.Sality.exe 60 PID 2804 wrote to memory of 2464 2804 Virus.Win32.Sality.exe 59 PID 2804 wrote to memory of 2556 2804 Virus.Win32.Sality.exe 56 PID 2804 wrote to memory of 3360 2804 Virus.Win32.Sality.exe 46 PID 2804 wrote to memory of 3644 2804 Virus.Win32.Sality.exe 45 PID 2804 wrote to memory of 3872 2804 Virus.Win32.Sality.exe 44 PID 2804 wrote to memory of 3968 2804 Virus.Win32.Sality.exe 43 PID 2804 wrote to memory of 4084 2804 Virus.Win32.Sality.exe 18 PID 2804 wrote to memory of 2668 2804 Virus.Win32.Sality.exe 42 PID 2804 wrote to memory of 4116 2804 Virus.Win32.Sality.exe 41 PID 2804 wrote to memory of 2156 2804 Virus.Win32.Sality.exe 39 PID 2804 wrote to memory of 4896 2804 Virus.Win32.Sality.exe 29 PID 2804 wrote to memory of 1948 2804 Virus.Win32.Sality.exe 28 PID 2804 wrote to memory of 3004 2804 Virus.Win32.Sality.exe 22 PID 2804 wrote to memory of 2788 2804 Virus.Win32.Sality.exe 21 PID 2804 wrote to memory of 3240 2804 Virus.Win32.Sality.exe 20 PID 2804 wrote to memory of 2444 2804 Virus.Win32.Sality.exe 86 PID 2804 wrote to memory of 2496 2804 Virus.Win32.Sality.exe 89 PID 2804 wrote to memory of 3152 2804 Virus.Win32.Sality.exe 90 PID 2536 wrote to memory of 3140 2536 msiinst.exe 91 PID 2536 wrote to memory of 3140 2536 msiinst.exe 91 PID 2536 wrote to memory of 3140 2536 msiinst.exe 91 PID 2804 wrote to memory of 788 2804 Virus.Win32.Sality.exe 13 PID 2804 wrote to memory of 796 2804 Virus.Win32.Sality.exe 12 PID 2804 wrote to memory of 388 2804 Virus.Win32.Sality.exe 8 PID 2804 wrote to memory of 2436 2804 Virus.Win32.Sality.exe 60 PID 2804 wrote to memory of 2464 2804 Virus.Win32.Sality.exe 59 PID 2804 wrote to memory of 2556 2804 Virus.Win32.Sality.exe 56 PID 2804 wrote to memory of 3360 2804 Virus.Win32.Sality.exe 46 PID 2804 wrote to memory of 3644 2804 Virus.Win32.Sality.exe 45 PID 2804 wrote to memory of 3872 2804 Virus.Win32.Sality.exe 44 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Virus.Win32.Sality.exe
Processes
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:388
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:796
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:788
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4084
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca1⤵PID:3240
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:2788
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:3004
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1948
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4896
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2156
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4116
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2668
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3968
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3872
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3644
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\Virus.Win32.Sality.exe"C:\Users\Admin\AppData\Local\Temp\Virus.Win32.Sality.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\msiinst.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\msiinst.exe /i instmsi.msi /qb+3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MsiExec.exeMsiExec.exe /regserver4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2232
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MsiExec.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\msiinst.exe /i instmsi.msi /qb+4⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Modifies registry class
PID:3140
-
-
-
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2556
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2464
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2436
-
C:\Windows\system32\BackgroundTaskHost.exe"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider1⤵PID:2444
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2496
-
C:\Windows\System32\wuapihost.exeC:\Windows\System32\wuapihost.exe -Embedding1⤵PID:3152
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵PID:3756
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Msi.dll
- Size 1.7MB
- SHA256 2c6efaf4b4e92f85f2ade55c38e7912031a6a844e562c05aa8de2f11a1cef9ec
- MD5 35c0cf9fd27f1cadcb3172fa4b049085
- SHA1 be256c42730835c681ba8d93eb758c72de43c618
- SHA512 af6ae0f4919c6ca729cefb4bed3a90990fdde54f8bf6f15975dc6f497b069826ac24bedf8fce83765559a71687f2031fdbd7497f2a24b6054e28e21082bf7d44
- SSDEEP 49152:3ECFWXfDEAyG1eLtQHoauHfWVwLo2ZeWNZ7LnjSfvb771u5nE9/WV4lrw7zAqv4f:39FWXfDEAyG1eLtQHoauHfWVwLo2ZeWu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MsiMsg.dll
- Size 679KB
- SHA256 706cc97d4aca7dee485d8de6d5f5e286a513bf11bca11fbf321430de760c7801
- MD5 528846710b84cf29b3fbae8b5a12e028
- SHA1 417e88f96cdb9effefb5ec8be020c36367674e40
- SHA512 8174b1413b4db9e9347e114d1402aa34a80fcc616cc5c68273f2a36b4b4da21745d4956bf9808bd9516bd0489b8defabcfe0da1f3a82f651d7db495636660353
- SSDEEP 12288:hCcTu7kEN1a974esvuWdBcsOhmj9jPhufB1oNxq6/XmYOWez:hovuWdAhmj9jPhufBaOYOWez
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\instmsi.msi
- Size 680KB
- SHA256 34e6013cd82abd7f5fc1879c3f27b10899bdf3833bf93cbb81d3eb72c3c62be3
- MD5 637320b4d6a81f21edb5f45abd1d02fa
- SHA1 ea0b4081bcccbf797c32172fafa5bd732b61acec
- SHA512 662dff4d02ce4feac27cd378728428943a5b7fad30b71a2ffd9f38517b835c05bf48fc4bc59a24ce86a657b2eaf5ce00939ede1e2badbf39c3bb20d4d0d7df39
- SSDEEP 12288:9nV7Nf1H2cpRQTr4QDmh0iFvQRcGgqTqkPNJB1olxEIDnBqzEq6UoWfZcCMV96nh:9nV7NOm+iFvQRcGgqTqkPNJB1olxEIDs
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\msi.dll
- Size 1024KB
- SHA256 6834ba85daccc386fdac43f7635bad28057576545d836b4669bb095ea9b287c0
- MD5 f76b0b443beb812f51662683476b92ca
- SHA1 92da36246c5bb081689136243784324276c4dd33
- SHA512 c34896e9b2140da53a770f182985d4c5984ec496b00a8245137ad7b8c6d1caa80e0d15101711dceff013bc3a5e4891abbc5fa2110e09e0b1c3fa1300a7a3aaaa
- SSDEEP 24576:gkteoMH3dt9fKrVzFWzTfDEAyG1eLtJ6Hoau3XfWVwLo2ZeWNZ7Lnj2bfvs0771q:3ECFWXfDEAyG1eLtQHoauHfWVwLo2ZeS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\msi.dll
- Size 704KB
- SHA256 f40e8adf4ce70fb6d2887c6c8bb9fe129ecd4e797564fecd4c2a9641996783ef
- MD5 e39135242f93c1ae0c48f31247877072
- SHA1 7207720f909b19ce3a11034734d9ba256112eac6
- SHA512 9db8f222b1823442f614ae9d330c7aa6b2204fd685ccbd4bfd23580ea2c82fb1cb85030333ca7475e80a04f2115753c2adbe4f2d03087c4e6ac1c4377cc47c01
- SSDEEP 12288:gowQteLLgMH3dt9MWR2/r5vTzFWzTfDEAyG1eLtyI6Hoau3XfWVwLo2ZeWNZ7LnT:gkteoMH3dt9fKrVzFWzTfDEAyG1eLtJd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\msiexec.exe
- Size 46KB
- SHA256 b896a92bfd15a51e3c44e5a9131af437605376357abe44e28d101d35779b58d0
- MD5 4dd11f4fd21897f4629cb6e68b8d8b5b
- SHA1 60df48206ad37cfacdd91d88d5614a78d7d843d6
- SHA512 bfab354421b494fb0ccc3369e25b335d92c74973fd2393df1a1b8e56c547c88e6abf8364e559ff7ca998a13adddf5114638333d3cd0108cf12cee54702dc8d2f
- SSDEEP 768:tvJqSxsARyxun1ZLXC/ZCQlEufNkquUTFi0feMS24XJjpB:tvJqEExy1VX6ZNlfSVUT80f4jr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\msiinst.exe
- Size 6KB
- SHA256 4bae6fb6d6d4907d259959315f35e74c183f594e6f8145353377eb55162fb004
- MD5 7499489b7d11eee16eff127a764a8f28
- SHA1 341d4e290537932cdeb2f3321f99d18a778220d0
- SHA512 e8fdfc6abdc5e6bc26d467eafa71060cb06e4320b79e9ba8f8328c78aa58f5f42389d729b1e5d95454d67958f51d7361aac261e48498a2aeb1f31cb0e6a0caec
- SSDEEP 96:K0mpp9WMSB0coiwkJasL9HAROLmqLzCdfj3goxIO72n+s/bYLvLdkDCaqc:K3ppgMA0uDL9gsfK3gH+sUW2/c
- MD5 SHA1 SHA512 SSDEEP
- Path C:\qkaxe.pif
- Size 97KB
- SHA256 c601736ad7c906fbfb3b45c2ce89fe06059c16bd033c40cf1b13c05dbef6e240
- MD5 49b78a98fa9fddeb955336fa6d98fc56
- SHA1 d65783e334dd2904e95b14b37dbc62ed129ccc45
- SHA512 23ba3e8cfb14e9094bf5ef362e4eafde29d0370d48ab5afc06e0c722331edd679f35b4f7eae496d1a3b04e0c384cba2d6bc1dc75d19a4199cadf301199396adf
- SSDEEP 1536:H9u0uG59xCoVVfpcslbUP90A8Yib/KzS4dZn7wR+16wwwmWtQMoFs:du0J51VfTgP9H6b/Ku4dJwww3Wtr
- MD5 SHA1 SHA512 SSDEEP