Analysis
-
max time kernel
603s -
max time network
608s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
submitted
13-03-2024 13:29
Static task
static1
Behavioral task
behavioral1
Sample
cisa.msi
Resource
win7-20240220-en
windows7-x64
10 signatures
600 seconds
Behavioral task
behavioral2
Sample
cisa.msi
Resource
win10v2004-20240226-en
windows10-2004-x64
12 signatures
600 seconds
General
-
Target
cisa.msi
-
Size
1.5MB
-
MD5
c4e8f3e02fd50a4051f11048f1355726
-
SHA1
c82bf39c9f4797f346447aecc1070fb8c892010f
-
SHA256
3a950d7e6736f17c3df90844c76d934dc66c17ec76841a4ad58de07af7955f0f
-
SHA512
e44d8330c4ffdae01614ed5d11c2f112cff9b39bae793242f983d039e1404d371a2697a77fa65b740e43548ab1b203607a6d82b05ff3df741be02bd99a136592
-
SSDEEP
24576:QjGxLNvYLSMvZCFlp8zBQSc0ZoCvqKwx0ECIgYmfLVYeBZr7A0r7Jh3OnJ3qXIoj:QjivYpW8zBQSc0ZnSKeZKumZr7A+D3O2
Malware Config
Extracted
Family
latrodectus
C2
https://aytobusesre.com/live/
https://scifimond.com/live/
Signatures
-
Latrodectus family
-
Latrodectus loader
Latrodectus is a loader written in C++.
-
Detect larodectus Loader variant 2 4 IoCs
resource yara_rule behavioral2/memory/3712-47-0x00000272C7980000-0x00000272C7994000-memory.dmp family_latrodectus_v2 behavioral2/memory/3712-51-0x00000272C7980000-0x00000272C7994000-memory.dmp family_latrodectus_v2 behavioral2/memory/2504-63-0x000002BFBCE20000-0x000002BFBCE34000-memory.dmp family_latrodectus_v2 behavioral2/memory/2504-62-0x000002BFBCE20000-0x000002BFBCE34000-memory.dmp family_latrodectus_v2 -
Blocklisted process makes network request 64 IoCs
flow pid Process 95 2504 rundll32.exe 97 2504 rundll32.exe 98 2504 rundll32.exe 99 2504 rundll32.exe 100 2504 rundll32.exe 103 2504 rundll32.exe 104 2504 rundll32.exe 105 2504 rundll32.exe 106 2504 rundll32.exe 107 2504 rundll32.exe 108 2504 rundll32.exe 109 2504 rundll32.exe 110 2504 rundll32.exe 111 2504 rundll32.exe 112 2504 rundll32.exe 113 2504 rundll32.exe 114 2504 rundll32.exe 115 2504 rundll32.exe 116 2504 rundll32.exe 117 2504 rundll32.exe 118 2504 rundll32.exe 119 2504 rundll32.exe 120 2504 rundll32.exe 121 2504 rundll32.exe 122 2504 rundll32.exe 123 2504 rundll32.exe 124 2504 rundll32.exe 125 2504 rundll32.exe 126 2504 rundll32.exe 127 2504 rundll32.exe 128 2504 rundll32.exe 129 2504 rundll32.exe 130 2504 rundll32.exe 131 2504 rundll32.exe 132 2504 rundll32.exe 133 2504 rundll32.exe 134 2504 rundll32.exe 135 2504 rundll32.exe 136 2504 rundll32.exe 137 2504 rundll32.exe 138 2504 rundll32.exe 139 2504 rundll32.exe 140 2504 rundll32.exe 141 2504 rundll32.exe 142 2504 rundll32.exe 143 2504 rundll32.exe 144 2504 rundll32.exe 145 2504 rundll32.exe 146 2504 rundll32.exe 147 2504 rundll32.exe 148 2504 rundll32.exe 149 2504 rundll32.exe 150 2504 rundll32.exe 151 2504 rundll32.exe 152 2504 rundll32.exe 153 2504 rundll32.exe 154 2504 rundll32.exe 155 2504 rundll32.exe 156 2504 rundll32.exe 157 2504 rundll32.exe 158 2504 rundll32.exe 159 2504 rundll32.exe 160 2504 rundll32.exe 161 2504 rundll32.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\S: msiexec.exe -
Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSIEB4D.tmp msiexec.exe File opened for modification C:\Windows\Installer\e57e7a1.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIE86C.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIEACF.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{A38F5F69-A209-49ED-8CCE-91613AA34EAF} msiexec.exe File created C:\Windows\Installer\e57e7a1.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIE938.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe -
Executes dropped EXE 1 IoCs
pid Process 2960 MSIEB4D.tmp -
Loads dropped DLL 10 IoCs
pid Process 3236 MsiExec.exe 3236 MsiExec.exe 3236 MsiExec.exe 3236 MsiExec.exe 3236 MsiExec.exe 3236 MsiExec.exe 2308 MsiExec.exe 2308 MsiExec.exe 3712 rundll32.exe 2504 rundll32.exe -
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4036 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSIEB4D.tmp -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000c2cf76efb8a5767e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000c2cf76ef0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900c2cf76ef000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dc2cf76ef000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000c2cf76ef00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 3596 msiexec.exe 3596 msiexec.exe 2960 MSIEB4D.tmp 2960 MSIEB4D.tmp 3712 rundll32.exe 3712 rundll32.exe 3712 rundll32.exe 3712 rundll32.exe 2504 rundll32.exe 2504 rundll32.exe 2504 rundll32.exe 2504 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4036 msiexec.exe Token: SeIncreaseQuotaPrivilege 4036 msiexec.exe Token: SeSecurityPrivilege 3596 msiexec.exe Token: SeCreateTokenPrivilege 4036 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4036 msiexec.exe Token: SeLockMemoryPrivilege 4036 msiexec.exe Token: SeIncreaseQuotaPrivilege 4036 msiexec.exe Token: SeMachineAccountPrivilege 4036 msiexec.exe Token: SeTcbPrivilege 4036 msiexec.exe Token: SeSecurityPrivilege 4036 msiexec.exe Token: SeTakeOwnershipPrivilege 4036 msiexec.exe Token: SeLoadDriverPrivilege 4036 msiexec.exe Token: SeSystemProfilePrivilege 4036 msiexec.exe Token: SeSystemtimePrivilege 4036 msiexec.exe Token: SeProfSingleProcessPrivilege 4036 msiexec.exe Token: SeIncBasePriorityPrivilege 4036 msiexec.exe Token: SeCreatePagefilePrivilege 4036 msiexec.exe Token: SeCreatePermanentPrivilege 4036 msiexec.exe Token: SeBackupPrivilege 4036 msiexec.exe Token: SeRestorePrivilege 4036 msiexec.exe Token: SeShutdownPrivilege 4036 msiexec.exe Token: SeDebugPrivilege 4036 msiexec.exe Token: SeAuditPrivilege 4036 msiexec.exe Token: SeSystemEnvironmentPrivilege 4036 msiexec.exe Token: SeChangeNotifyPrivilege 4036 msiexec.exe Token: SeRemoteShutdownPrivilege 4036 msiexec.exe Token: SeUndockPrivilege 4036 msiexec.exe Token: SeSyncAgentPrivilege 4036 msiexec.exe Token: SeEnableDelegationPrivilege 4036 msiexec.exe Token: SeManageVolumePrivilege 4036 msiexec.exe Token: SeImpersonatePrivilege 4036 msiexec.exe Token: SeCreateGlobalPrivilege 4036 msiexec.exe Token: SeCreateTokenPrivilege 4036 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4036 msiexec.exe Token: SeLockMemoryPrivilege 4036 msiexec.exe Token: SeIncreaseQuotaPrivilege 4036 msiexec.exe Token: SeMachineAccountPrivilege 4036 msiexec.exe Token: SeTcbPrivilege 4036 msiexec.exe Token: SeSecurityPrivilege 4036 msiexec.exe Token: SeTakeOwnershipPrivilege 4036 msiexec.exe Token: SeLoadDriverPrivilege 4036 msiexec.exe Token: SeSystemProfilePrivilege 4036 msiexec.exe Token: SeSystemtimePrivilege 4036 msiexec.exe Token: SeProfSingleProcessPrivilege 4036 msiexec.exe Token: SeIncBasePriorityPrivilege 4036 msiexec.exe Token: SeCreatePagefilePrivilege 4036 msiexec.exe Token: SeCreatePermanentPrivilege 4036 msiexec.exe Token: SeBackupPrivilege 4036 msiexec.exe Token: SeRestorePrivilege 4036 msiexec.exe Token: SeShutdownPrivilege 4036 msiexec.exe Token: SeDebugPrivilege 4036 msiexec.exe Token: SeAuditPrivilege 4036 msiexec.exe Token: SeSystemEnvironmentPrivilege 4036 msiexec.exe Token: SeChangeNotifyPrivilege 4036 msiexec.exe Token: SeRemoteShutdownPrivilege 4036 msiexec.exe Token: SeUndockPrivilege 4036 msiexec.exe Token: SeSyncAgentPrivilege 4036 msiexec.exe Token: SeEnableDelegationPrivilege 4036 msiexec.exe Token: SeManageVolumePrivilege 4036 msiexec.exe Token: SeImpersonatePrivilege 4036 msiexec.exe Token: SeCreateGlobalPrivilege 4036 msiexec.exe Token: SeCreateTokenPrivilege 4036 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4036 msiexec.exe Token: SeLockMemoryPrivilege 4036 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4036 msiexec.exe 4036 msiexec.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 3596 wrote to memory of 3236 3596 msiexec.exe 90 PID 3596 wrote to memory of 3236 3596 msiexec.exe 90 PID 3596 wrote to memory of 3236 3596 msiexec.exe 90 PID 3596 wrote to memory of 2200 3596 msiexec.exe 106 PID 3596 wrote to memory of 2200 3596 msiexec.exe 106 PID 3596 wrote to memory of 2308 3596 msiexec.exe 108 PID 3596 wrote to memory of 2308 3596 msiexec.exe 108 PID 3596 wrote to memory of 2308 3596 msiexec.exe 108 PID 3596 wrote to memory of 2960 3596 msiexec.exe 109 PID 3596 wrote to memory of 2960 3596 msiexec.exe 109 PID 3596 wrote to memory of 2960 3596 msiexec.exe 109 PID 3712 wrote to memory of 2504 3712 rundll32.exe 112 PID 3712 wrote to memory of 2504 3712 rundll32.exe 112 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\cisa.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4036
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 413A3B742E9A270D9B43DE5BB47F59D3 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3236
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:2200
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F7BC351B191C100EAF078E699352BB702⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2308
-
-
C:\Windows\Installer\MSIEB4D.tmp"C:\Windows\Installer\MSIEB4D.tmp" C:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\stat\falcon.dll, vgml2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2960
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:4296
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\stat\falcon.dll, vgml1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Windows\System32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Roaming\Custom_update\Update_dcb32c2b.dll", vgml2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2504
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5e4060af4c78842f00f3ae1d75e3e3e13
SHA176e6db890145b9a486a3fb070e7619acff80ebf4
SHA2567f0d2d8dc103867e94f5814af7f37e49ed95007eec2ea194b1c1a36d457064c3
SHA512cd4197b9169659875d8a780e1a994751254f397a5da40f4deafdd95f221ef242dcc8b743599e06e99301703432e1bd412b8ace7124af70c64effe6a144784953
-
Filesize
436KB
MD5475d20c0ea477a35660e3f67ecf0a1df
SHA167340739f51e1134ae8f0ffc5ae9dd710e8e3a08
SHA256426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
SHA51299525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
-
Filesize
694KB
MD5da8ae8e1de522b20a462239c6893613e
SHA17f65ef885815d81d220f9f42877ff0d696b0134c
SHA256aee22a35cbdac3f16c3ed742c0b1bfe9739a13469cf43b36fb2c63565111028c
SHA512d2dca9ba9272a0bdfa88f7520545e21a1f4d18dcacec36b072369cee8e28ba635a0214b47caef74b6f7fcd06e120d898da997e71c8955c72510972c66d2a855d
-
Filesize
389KB
MD5b9545ed17695a32face8c3408a6a3553
SHA1f6c31c9cd832ae2aebcd88e7b2fa6803ae93fc83
SHA2561e0e63b446eecf6c9781c7d1cae1f46a3bb31654a70612f71f31538fb4f4729a
SHA512f6d6dc40dcba5ff091452d7cc257427dcb7ce2a21816b4fec2ee249e63246b64667f5c4095220623533243103876433ef8c12c9b612c0e95fdfffe41d1504e04
-
Filesize
23.7MB
MD542aaaedbe47a7f51ef5548ae7c608458
SHA1fe1e48ae4864024be5b36bfd2e0dd5119b588bb1
SHA256d2cc1e136c2970ddb7140f9f752fb50b92c9866154129c9077faa9ac9feee858
SHA512ca72bdee3503aa09cdf081108ba1e97ce5121e8326f0cd7b6050a196721684dea76081ca5709f0e79575c8b67b3af55f4759abca0831ee1486062127dea45552
-
\??\Volume{ef76cfc2-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{a9c704b2-9250-4cc2-b670-d4a48eb96b71}_OnDiskSnapshotProp
Filesize6KB
MD5be20d70e6f92758c5616e9168e1917d5
SHA108a72b8321aaa8c44283d227da1589ff2b1c148d
SHA25635cff5876829f6f9186b1c1ac20757526653e22b3094720bdeaef6cfa2b7eda0
SHA5128f22dc9667002d6da328d78010241f22b8c0001be26c347c739cbe28845e5f4c2fee317644b727129f899737ef7ba8d6c74237ac168dae8ab3dfe28ddfeb087e