Overview
overview
7Static
static
1COD Encout...ar.bat
windows7-x64
7COD Encout...ar.bat
windows10-2004-x64
1COD Encout...up.exe
windows7-x64
7COD Encout...up.exe
windows10-2004-x64
7COD Encout...ll.bat
windows7-x64
7COD Encout...ll.bat
windows10-2004-x64
7COD Encout...64.exe
windows7-x64
7COD Encout...64.exe
windows10-2004-x64
7COD Encout...86.exe
windows7-x64
7COD Encout...86.exe
windows10-2004-x64
7COD Encout...64.exe
windows7-x64
7COD Encout...64.exe
windows10-2004-x64
7COD Encout...86.exe
windows7-x64
7COD Encout...86.exe
windows10-2004-x64
7COD Encout...64.exe
windows7-x64
7COD Encout...64.exe
windows10-2004-x64
7COD Encout...86.exe
windows7-x64
7COD Encout...86.exe
windows10-2004-x64
7COD Encout...64.exe
windows7-x64
7COD Encout...64.exe
windows10-2004-x64
7COD Encout...86.exe
windows7-x64
7COD Encout...86.exe
windows10-2004-x64
7COD Encout...64.exe
windows7-x64
7COD Encout...64.exe
windows10-2004-x64
7COD Encout...86.exe
windows7-x64
7COD Encout...86.exe
windows10-2004-x64
7COD Encout...64.exe
windows7-x64
7COD Encout...64.exe
windows10-2004-x64
7COD Encout...86.exe
windows7-x64
7COD Encout...86.exe
windows10-2004-x64
7COD Encout...pl.exe
windows7-x64
1COD Encout...pl.exe
windows10-2004-x64
1Analysis
-
max time kernel
128s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
07-03-2024 22:29
Static task
static1
Behavioral task
behavioral1
Sample
COD Encoutered error/COD Encoutered error/Clear.bat
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
COD Encoutered error/COD Encoutered error/Clear.bat
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
COD Encoutered error/COD Encoutered error/Dx 12/dxwebsetup.exe
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
COD Encoutered error/COD Encoutered error/Dx 12/dxwebsetup.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
COD Encoutered error/COD Encoutered error/Visual Retributions!/install_all.bat
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
COD Encoutered error/COD Encoutered error/Visual Retributions!/install_all.bat
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
COD Encoutered error/COD Encoutered error/Visual Retributions!/vcredist2005_x64.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
COD Encoutered error/COD Encoutered error/Visual Retributions!/vcredist2005_x64.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
COD Encoutered error/COD Encoutered error/Visual Retributions!/vcredist2005_x86.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
COD Encoutered error/COD Encoutered error/Visual Retributions!/vcredist2005_x86.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
COD Encoutered error/COD Encoutered error/Visual Retributions!/vcredist2008_x64.exe
Resource
win7-20240215-en
Behavioral task
behavioral12
Sample
COD Encoutered error/COD Encoutered error/Visual Retributions!/vcredist2008_x64.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
COD Encoutered error/COD Encoutered error/Visual Retributions!/vcredist2008_x86.exe
Resource
win7-20240220-en
Behavioral task
behavioral14
Sample
COD Encoutered error/COD Encoutered error/Visual Retributions!/vcredist2008_x86.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
COD Encoutered error/COD Encoutered error/Visual Retributions!/vcredist2010_x64.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
COD Encoutered error/COD Encoutered error/Visual Retributions!/vcredist2010_x64.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
COD Encoutered error/COD Encoutered error/Visual Retributions!/vcredist2010_x86.exe
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
COD Encoutered error/COD Encoutered error/Visual Retributions!/vcredist2010_x86.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
COD Encoutered error/COD Encoutered error/Visual Retributions!/vcredist2012_x64.exe
Resource
win7-20231129-en
Behavioral task
behavioral20
Sample
COD Encoutered error/COD Encoutered error/Visual Retributions!/vcredist2012_x64.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
COD Encoutered error/COD Encoutered error/Visual Retributions!/vcredist2012_x86.exe
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
COD Encoutered error/COD Encoutered error/Visual Retributions!/vcredist2012_x86.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
COD Encoutered error/COD Encoutered error/Visual Retributions!/vcredist2013_x64.exe
Resource
win7-20231129-en
Behavioral task
behavioral24
Sample
COD Encoutered error/COD Encoutered error/Visual Retributions!/vcredist2013_x64.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
COD Encoutered error/COD Encoutered error/Visual Retributions!/vcredist2013_x86.exe
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
COD Encoutered error/COD Encoutered error/Visual Retributions!/vcredist2013_x86.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
COD Encoutered error/COD Encoutered error/Visual Retributions!/vcredist2015_2017_2019_x64.exe
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
COD Encoutered error/COD Encoutered error/Visual Retributions!/vcredist2015_2017_2019_x64.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
COD Encoutered error/COD Encoutered error/Visual Retributions!/vcredist2015_2017_2019_x86.exe
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
COD Encoutered error/COD Encoutered error/Visual Retributions!/vcredist2015_2017_2019_x86.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
COD Encoutered error/COD Encoutered error/dxcpl.exe
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
COD Encoutered error/COD Encoutered error/dxcpl.exe
Resource
win10v2004-20240226-en
General
-
Target
COD Encoutered error/COD Encoutered error/Visual Retributions!/vcredist2005_x64.exe
-
Size
3.0MB
-
MD5
56eaf4e1237c974f6984edc93972c123
-
SHA1
ee916012783024dac67fc606457377932c826f05
-
SHA256
0551a61c85b718e1fa015b0c3e3f4c4eea0637055536c00e7969286b4fa663e0
-
SHA512
f8e15363e34db5b5445c41eea4dd80b2f682642cb8f1046f30ea4fb5f4f51b0b604f7bcb3000a35a7d3ba1d1bcc07df9b25e4533170c65640b2d137c19916736
-
SSDEEP
49152:+r67+stI6RWGTAdyvlADUrpTmcOgohwJpEM5grO3oc1OXZViFeRyDErkLUMHzkRN:AM9l8pUr9m30L5grOQXZKAsErkbQRN
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
MsiExec.exepid process 2952 MsiExec.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
vcredist2005_x64.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" vcredist2005_x64.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc process File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: msiexec.exe -
Drops file in Program Files directory 1 IoCs
Processes:
msiexec.exedescription ioc process File created C:\Program Files (x86)\Common Files\Microsoft Shared\VC\amd64\msdia80.dll msiexec.exe -
Drops file in Windows directory 57 IoCs
Processes:
msiexec.exedescription ioc process File opened for modification C:\Windows\WinSxS\InstallTemp\20240307223127174.0 msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240307223127189.0 msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240307223127205.1 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240307223126908.0\amd64_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_76301166.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240307223127080.0\amd64_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_9c659d69.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240307223127189.1\8.0.50727.6195.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240307223127205.0\8.0.50727.6195.policy msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240307223127080.0\mfc80JPN.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240307223127174.0\amd64_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_7735df00.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240307223127174.0\vcomp.dll msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240307223126877.0 msiexec.exe File opened for modification C:\Windows\Installer\MSIA3E1.tmp msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240307223127080.0\mfc80ITA.dll msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240307223126908.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240307223126877.0\ATL80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240307223126908.0\msvcp80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240307223126986.0\mfcm80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240307223126986.0\mfcm80u.dll msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240307223127189.1 msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240307223127205.0 msiexec.exe File created C:\Windows\Installer\SourceHash{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028} msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240307223126986.0\amd64_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_4716846b.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240307223126986.0\amd64_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_4716846b.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240307223127221.0\8.0.50727.6195.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240307223126877.0\amd64_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_d6cffeda.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240307223126908.0\msvcm80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240307223127221.0\8.0.50727.6195.policy msiexec.exe File opened for modification C:\Windows\Installer\e57a057.msi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240307223127080.0\amd64_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_9c659d69.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240307223127080.0\mfc80CHT.dll msiexec.exe File opened for modification C:\Windows\Installer\MSIA895.tmp msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240307223127080.0\mfc80CHS.dll msiexec.exe File created C:\Windows\Installer\e57a05b.msi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240307223127205.1\8.0.50727.6195.cat msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240307223127221.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240307223126986.0\mfc80u.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240307223127080.0\mfc80KOR.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240307223127189.0\8.0.50727.6195.cat msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240307223127080.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240307223127080.0\mfc80ESP.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240307223127080.0\mfc80DEU.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240307223127174.0\amd64_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_7735df00.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240307223127189.1\8.0.50727.6195.policy msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240307223127080.0\mfc80FRA.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240307223127189.0\8.0.50727.6195.policy msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240307223127205.1\8.0.50727.6195.policy msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240307223126877.0\amd64_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_d6cffeda.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240307223126908.0\amd64_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_76301166.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240307223126908.0\msvcr80.dll msiexec.exe File created C:\Windows\Installer\e57a057.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240307223126986.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240307223127205.0\8.0.50727.6195.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240307223126986.0\mfc80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240307223127080.0\mfc80ENU.dll msiexec.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
vssvc.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000005cf4f6141e81f6580000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800005cf4f6140000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809005cf4f614000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d5cf4f614000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000005cf4f61400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe -
Modifies data under HKEY_USERS 3 IoCs
Processes:
msiexec.exedescription ioc process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\22\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23 msiexec.exe -
Modifies registry class 45 IoCs
Processes:
msiexec.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFC,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e00240062003000290043004b0076003d0035002700650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1af2a8da7e60d0b429d7e6453b3d0182\VC_Redist msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1af2a8da7e60d0b429d7e6453b3d0182\Servicing_Key msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\Version = "134278728" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\1 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.ATL,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e005a00310021003d00520046007900460072005700650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFC,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e0069002a0048004e00530057007d0024007e005500650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFCLOC,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e00530021004900240047002e004f005f0078006800650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFCLOC,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e00500054005d002700660025002b0027004b002800650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.OpenMP,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e007e0078002d00360076007a0045007a007e003200650038004d006b0062004900640046007700550000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\92091D8AC5E822E408118470F0E997E6 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\3 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\4 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\6 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.CRT,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e0049004c005400540052005900320074004f005700650038004d006b0062004900640046007700550000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1af2a8da7e60d0b429d7e6453b3d0182 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\ProductName = "Microsoft Visual C++ 2005 Redistributable (x64)" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\Language = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.OpenMP,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e007a0050005400310026006e0073004b0064007a00650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\7 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\Clients = 3a0000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.CRT,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e004b0039007000540041002700650026005d002900650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\PackageCode = "C558A51006735C645AEE5A0FC6A310C9" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\92091D8AC5E822E408118470F0E997E6\1af2a8da7e60d0b429d7e6453b3d0182 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\2 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\8 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\11 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.ATL,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e007b004c0046003d0042004900620074004f002800650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\PackageName = "vcredist.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\5 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\9 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\10 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
msiexec.exepid process 3096 msiexec.exe 3096 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
msiexec.exemsiexec.exevssvc.exedescription pid process Token: SeShutdownPrivilege 3192 msiexec.exe Token: SeIncreaseQuotaPrivilege 3192 msiexec.exe Token: SeSecurityPrivilege 3096 msiexec.exe Token: SeCreateTokenPrivilege 3192 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3192 msiexec.exe Token: SeLockMemoryPrivilege 3192 msiexec.exe Token: SeIncreaseQuotaPrivilege 3192 msiexec.exe Token: SeMachineAccountPrivilege 3192 msiexec.exe Token: SeTcbPrivilege 3192 msiexec.exe Token: SeSecurityPrivilege 3192 msiexec.exe Token: SeTakeOwnershipPrivilege 3192 msiexec.exe Token: SeLoadDriverPrivilege 3192 msiexec.exe Token: SeSystemProfilePrivilege 3192 msiexec.exe Token: SeSystemtimePrivilege 3192 msiexec.exe Token: SeProfSingleProcessPrivilege 3192 msiexec.exe Token: SeIncBasePriorityPrivilege 3192 msiexec.exe Token: SeCreatePagefilePrivilege 3192 msiexec.exe Token: SeCreatePermanentPrivilege 3192 msiexec.exe Token: SeBackupPrivilege 3192 msiexec.exe Token: SeRestorePrivilege 3192 msiexec.exe Token: SeShutdownPrivilege 3192 msiexec.exe Token: SeDebugPrivilege 3192 msiexec.exe Token: SeAuditPrivilege 3192 msiexec.exe Token: SeSystemEnvironmentPrivilege 3192 msiexec.exe Token: SeChangeNotifyPrivilege 3192 msiexec.exe Token: SeRemoteShutdownPrivilege 3192 msiexec.exe Token: SeUndockPrivilege 3192 msiexec.exe Token: SeSyncAgentPrivilege 3192 msiexec.exe Token: SeEnableDelegationPrivilege 3192 msiexec.exe Token: SeManageVolumePrivilege 3192 msiexec.exe Token: SeImpersonatePrivilege 3192 msiexec.exe Token: SeCreateGlobalPrivilege 3192 msiexec.exe Token: SeBackupPrivilege 4628 vssvc.exe Token: SeRestorePrivilege 4628 vssvc.exe Token: SeAuditPrivilege 4628 vssvc.exe Token: SeBackupPrivilege 3096 msiexec.exe Token: SeRestorePrivilege 3096 msiexec.exe Token: SeRestorePrivilege 3096 msiexec.exe Token: SeTakeOwnershipPrivilege 3096 msiexec.exe Token: SeRestorePrivilege 3096 msiexec.exe Token: SeTakeOwnershipPrivilege 3096 msiexec.exe Token: SeRestorePrivilege 3096 msiexec.exe Token: SeTakeOwnershipPrivilege 3096 msiexec.exe Token: SeRestorePrivilege 3096 msiexec.exe Token: SeTakeOwnershipPrivilege 3096 msiexec.exe Token: SeRestorePrivilege 3096 msiexec.exe Token: SeTakeOwnershipPrivilege 3096 msiexec.exe Token: SeRestorePrivilege 3096 msiexec.exe Token: SeTakeOwnershipPrivilege 3096 msiexec.exe Token: SeRestorePrivilege 3096 msiexec.exe Token: SeTakeOwnershipPrivilege 3096 msiexec.exe Token: SeRestorePrivilege 3096 msiexec.exe Token: SeTakeOwnershipPrivilege 3096 msiexec.exe Token: SeRestorePrivilege 3096 msiexec.exe Token: SeTakeOwnershipPrivilege 3096 msiexec.exe Token: SeRestorePrivilege 3096 msiexec.exe Token: SeTakeOwnershipPrivilege 3096 msiexec.exe Token: SeRestorePrivilege 3096 msiexec.exe Token: SeTakeOwnershipPrivilege 3096 msiexec.exe Token: SeRestorePrivilege 3096 msiexec.exe Token: SeTakeOwnershipPrivilege 3096 msiexec.exe Token: SeRestorePrivilege 3096 msiexec.exe Token: SeTakeOwnershipPrivilege 3096 msiexec.exe Token: SeRestorePrivilege 3096 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
msiexec.exepid process 3192 msiexec.exe 3192 msiexec.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
vcredist2005_x64.exemsiexec.exedescription pid process target process PID 4112 wrote to memory of 3192 4112 vcredist2005_x64.exe msiexec.exe PID 4112 wrote to memory of 3192 4112 vcredist2005_x64.exe msiexec.exe PID 4112 wrote to memory of 3192 4112 vcredist2005_x64.exe msiexec.exe PID 3096 wrote to memory of 1532 3096 msiexec.exe srtasks.exe PID 3096 wrote to memory of 1532 3096 msiexec.exe srtasks.exe PID 3096 wrote to memory of 2952 3096 msiexec.exe MsiExec.exe PID 3096 wrote to memory of 2952 3096 msiexec.exe MsiExec.exe PID 3096 wrote to memory of 2952 3096 msiexec.exe MsiExec.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\COD Encoutered error\COD Encoutered error\Visual Retributions!\vcredist2005_x64.exe"C:\Users\Admin\AppData\Local\Temp\COD Encoutered error\COD Encoutered error\Visual Retributions!\vcredist2005_x64.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec /i vcredist.msi2⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B97A20F2CD05741CD40D30C701DF3DE02⤵
- Loads dropped DLL
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Config.Msi\e57a05a.rbsFilesize
73KB
MD55a2a06b84a5469278888bbae386ca03c
SHA12bf8c67500b03d74c108d4404eb5c6ae5026d240
SHA25616d95856d1018c153dfadac3f5d6e9d776d088cbe6b9f55c50589ebdbab540ee
SHA5125a4c9cfcec2a5bd43a73d2faf3495357b79047159e00c82bd52bbac8fd48c03791d6302d4eb02728dda358f384a3b078620c146d394c1a2d0a7f0ca989232935
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredis1.cabFilesize
312KB
MD577a9bff5af149160775741e204734d47
SHA17b5126af69b5a79593f39db94180f1ff11b0e39d
SHA25620a26ed9a1edf7763a9b515522c5e29720048a482c7fbc8b7ff6bbdd27e61038
SHA512bb0440f58f07e113bddd9a0afb5aab8af6493218784fe5fa6f4032e3a37088f91b7e766dee87cec4a9ea11d425d27b3b536430de3a52222e8bca3e0247d81e3b
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredist.msiFilesize
3.0MB
MD56dbdf338a0a25cdb236d43ea3ca2395e
SHA1685b6ea61e574e628392eaac8b10aff4309f1081
SHA256200fef5d4994523a02c4daa00060db28eb289b99d47fc6c1305183101e72bdeb
SHA5126b5b31c55cf72ab92b17fb6074b3901a1e6afe0796ef9bc831e4dfb97450376d2889cd24b1cf3fce60eb3c1bcd1b31254b5cfa3ef6107974dfa0b35c233daf5a
-
C:\Windows\Installer\MSIA3E1.tmpFilesize
28KB
MD585221b3bcba8dbe4b4a46581aa49f760
SHA1746645c92594bfc739f77812d67cfd85f4b92474
SHA256f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f
SHA512060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d
-
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2Filesize
23.0MB
MD5fbe049d36ef731ba3bce90ba6d63d956
SHA155e076cb2b05511cb557c2c7d51c490d841da648
SHA25625b8e8d4acae693bd4b2af1c96dca076f0a3a740bc7d87812f0d43408c32ef15
SHA512f2fd7827398dc153aab4335810c8b66ccc4ca98a3be2d508223b03d6321d8d434224a0d8cbc00bbd2f00de793cf00461cda61f765b3005f2a494f4883251def7
-
\??\Volume{14f6f45c-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{c0529a6d-7f62-4431-8bed-8921487ff3d4}_OnDiskSnapshotPropFilesize
6KB
MD5a9cdd6ca2edd50a79fc5540ce9331c35
SHA1695dd20aa37066386bae33de566872f6adaa2b23
SHA256b9a8ccbda8dda8f7ce44e2d8ea60053f4950928f071a35334e59b52f64907317
SHA51296d253ce94f87b92ca541437cf0b2f0eece50ee0f6ba2e1154bed93504c07ea5cdbb1b753d9b6219044845f4ce48eb0449c7f9cecd792caa95a92fa07c1ef206