Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1800s -
max time network
1605s -
platform
windows10-1703_x64 -
resource
win10-20240221-en -
resource tags
arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system -
submitted
19/03/2024, 16:12
Static task
static1
Behavioral task
behavioral1
Sample
9f8f58faadcda3b49e371c1ae353b30b3713652b0ad8d05b57383142757a74d0.msi
Resource
win10-20240221-en
Behavioral task
behavioral2
Sample
9f8f58faadcda3b49e371c1ae353b30b3713652b0ad8d05b57383142757a74d0.msi
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
9f8f58faadcda3b49e371c1ae353b30b3713652b0ad8d05b57383142757a74d0.msi
Resource
win11-20240221-en
General
-
Target
9f8f58faadcda3b49e371c1ae353b30b3713652b0ad8d05b57383142757a74d0.msi
-
Size
2.0MB
-
MD5
ebae9b70769458cf723022ec89b95c32
-
SHA1
3d3135b87fe274988b86f50d24bde82cc08556bf
-
SHA256
9f8f58faadcda3b49e371c1ae353b30b3713652b0ad8d05b57383142757a74d0
-
SHA512
3550c281fc8dcd8078caf6c0cef847280d6ec78216b0e018b01942e82c79499538f3a0553409e3c716edf584ff5c359ce991440bab14d4794f6ae3393788a102
-
SSDEEP
49152:J3osY5A6b4ms+4UhbrMizYiRpb2mN3rm999OhjY:hY5A6bDhbrfzYiRNdm+
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\identity_helper.cmd msiexec.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN MsiExec.exe Set value (str) \REGISTRY\USER\S-1-5-21-885525822-3215264538-2232956653-1000\Software\Microsoft\Windows\CurrentVersion\Run\K9V8X0I1 = "C:\\ProgramData\\13Wa0MoQ.2R4\\13Wa0MoQ.2R4.exe" 13Wa0MoQ.2R4.exe -
Blocklisted process makes network request 2 IoCs
flow pid Process 11 3476 MsiExec.exe 22 3476 MsiExec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 3476 MsiExec.exe -
Drops file in Windows directory 9 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSIF04D.tmp msiexec.exe File opened for modification C:\Windows\Installer\e57ecd1.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIEE2A.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{95EF7FD4-ED9D-4B37-867E-EBECFD556EFB} msiexec.exe File created C:\Windows\Installer\e57ecd1.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIED1F.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe -
Executes dropped EXE 1 IoCs
pid Process 4972 13Wa0MoQ.2R4.exe -
Loads dropped DLL 6 IoCs
pid Process 3476 MsiExec.exe 3476 MsiExec.exe 3476 MsiExec.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe -
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceDesc svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\ svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceDesc svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Capabilities svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Mfg svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4128 msiexec.exe 4128 msiexec.exe 3476 MsiExec.exe 3476 MsiExec.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe 4972 13Wa0MoQ.2R4.exe -
Suspicious use of AdjustPrivilegeToken 59 IoCs
description pid Process Token: SeShutdownPrivilege 1844 msiexec.exe Token: SeIncreaseQuotaPrivilege 1844 msiexec.exe Token: SeSecurityPrivilege 4128 msiexec.exe Token: SeCreateTokenPrivilege 1844 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1844 msiexec.exe Token: SeLockMemoryPrivilege 1844 msiexec.exe Token: SeIncreaseQuotaPrivilege 1844 msiexec.exe Token: SeMachineAccountPrivilege 1844 msiexec.exe Token: SeTcbPrivilege 1844 msiexec.exe Token: SeSecurityPrivilege 1844 msiexec.exe Token: SeTakeOwnershipPrivilege 1844 msiexec.exe Token: SeLoadDriverPrivilege 1844 msiexec.exe Token: SeSystemProfilePrivilege 1844 msiexec.exe Token: SeSystemtimePrivilege 1844 msiexec.exe Token: SeProfSingleProcessPrivilege 1844 msiexec.exe Token: SeIncBasePriorityPrivilege 1844 msiexec.exe Token: SeCreatePagefilePrivilege 1844 msiexec.exe Token: SeCreatePermanentPrivilege 1844 msiexec.exe Token: SeBackupPrivilege 1844 msiexec.exe Token: SeRestorePrivilege 1844 msiexec.exe Token: SeShutdownPrivilege 1844 msiexec.exe Token: SeDebugPrivilege 1844 msiexec.exe Token: SeAuditPrivilege 1844 msiexec.exe Token: SeSystemEnvironmentPrivilege 1844 msiexec.exe Token: SeChangeNotifyPrivilege 1844 msiexec.exe Token: SeRemoteShutdownPrivilege 1844 msiexec.exe Token: SeUndockPrivilege 1844 msiexec.exe Token: SeSyncAgentPrivilege 1844 msiexec.exe Token: SeEnableDelegationPrivilege 1844 msiexec.exe Token: SeManageVolumePrivilege 1844 msiexec.exe Token: SeImpersonatePrivilege 1844 msiexec.exe Token: SeCreateGlobalPrivilege 1844 msiexec.exe Token: SeBackupPrivilege 4156 vssvc.exe Token: SeRestorePrivilege 4156 vssvc.exe Token: SeAuditPrivilege 4156 vssvc.exe Token: SeBackupPrivilege 4128 msiexec.exe Token: SeRestorePrivilege 4128 msiexec.exe Token: SeRestorePrivilege 4128 msiexec.exe Token: SeTakeOwnershipPrivilege 4128 msiexec.exe Token: SeRestorePrivilege 4128 msiexec.exe Token: SeTakeOwnershipPrivilege 4128 msiexec.exe Token: SeRestorePrivilege 4128 msiexec.exe Token: SeTakeOwnershipPrivilege 4128 msiexec.exe Token: SeRestorePrivilege 4128 msiexec.exe Token: SeTakeOwnershipPrivilege 4128 msiexec.exe Token: SeRestorePrivilege 4128 msiexec.exe Token: SeTakeOwnershipPrivilege 4128 msiexec.exe Token: SeBackupPrivilege 4280 srtasks.exe Token: SeRestorePrivilege 4280 srtasks.exe Token: SeSecurityPrivilege 4280 srtasks.exe Token: SeTakeOwnershipPrivilege 4280 srtasks.exe Token: SeBackupPrivilege 4280 srtasks.exe Token: SeRestorePrivilege 4280 srtasks.exe Token: SeSecurityPrivilege 4280 srtasks.exe Token: SeTakeOwnershipPrivilege 4280 srtasks.exe Token: SeRestorePrivilege 4128 msiexec.exe Token: SeTakeOwnershipPrivilege 4128 msiexec.exe Token: SeRestorePrivilege 4128 msiexec.exe Token: SeTakeOwnershipPrivilege 4128 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1844 msiexec.exe 1844 msiexec.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4128 wrote to memory of 4280 4128 msiexec.exe 77 PID 4128 wrote to memory of 4280 4128 msiexec.exe 77 PID 4128 wrote to memory of 3476 4128 msiexec.exe 79 PID 4128 wrote to memory of 3476 4128 msiexec.exe 79 PID 4128 wrote to memory of 3476 4128 msiexec.exe 79 PID 3476 wrote to memory of 4972 3476 MsiExec.exe 80 PID 3476 wrote to memory of 4972 3476 MsiExec.exe 80 PID 3476 wrote to memory of 4972 3476 MsiExec.exe 80 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\9f8f58faadcda3b49e371c1ae353b30b3713652b0ad8d05b57383142757a74d0.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1844
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Drops startup file
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:4280
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C4A132E127414629DFD892DB272ED36E2⤵
- Adds Run key to start application
- Blocklisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\ProgramData\13Wa0MoQ.2R4\13Wa0MoQ.2R4.exe"C:\ProgramData\13Wa0MoQ.2R4\13Wa0MoQ.2R4.exe"3⤵
- Adds Run key to start application
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4972
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4156
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:1892
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5645ca4a748c00bbbf9a62b87432c1bf8
SHA12589b886581f6535378b0d5d6160c1fe531157b0
SHA256c402d12c61953a37869bf0934d62db23fa160c27eff59698fff21436ad4de53a
SHA512dde77b63bee91fcaf942eec73a25f5ac2feeb796224048dcf466dac5c1556572b3026d5c69e78369e5d5fc6e230ec4a94aaa4f1483d058e0f732c3d1566f00cf
-
Filesize
35KB
MD582b7adefbf7fbc0a0fd2aa1d50845812
SHA17220b3ccf363c81a875adcee16e2f3d2a3bbe864
SHA256374401e920e2173d088391889c81910c86c5112c5a7e7b5883d84a3cf12f28e0
SHA512cadaa1351d855bf721c8c2fce93cffb0c77fc25c39546aec8de3567a0d0a797b6d41617947dd294955736aad92af3b166c96871a02328e782be67905b42de651
-
Filesize
97KB
MD5a61faca7411cebd947b4f1e00dba6d08
SHA1fc1b4587990a792c32b113451197354f942b82d5
SHA256db57fbf86c8306809673be5850779b2dcda94bd8c36047840e27175cd30c257a
SHA512463e7da3b042adfcc4fc7bd5a8bf8df44375ec8adc4320dbfffeeb98e6a33c2337991d8e644eabb98c5a87a1e13a3636e9f03e4cad2b72ef23d7c0f5676bcc2b
-
Filesize
949B
MD55694649b8af1addb38df9f39581d68a2
SHA1adef9900b80817507faa0c8dc3103918e3f7a80c
SHA2567c69d49933b279430468cff75b0d3e8cc24648a425b2cb045fe87bd3074352b4
SHA5123213e14a60f37dbe009d16a111ad8b1946e71c2f77e6adcf8f9048e574108e054cf552515bc40acd8f86d870b396c3e1168b9ea893ea5ced4ca97d12dad448bd
-
Filesize
88KB
MD517f01742d17d9ffa7d8b3500978fc842
SHA12da2ff031da84ac8c2d063a964450642e849144d
SHA25670dd90f6ee01854cecf18b1b6d1dfbf30d33c5170ba07ad8b64721f0bdcc235e
SHA512c4e617cd808e48cc803343616853adf32b7f2e694b5827392219c69145a43969384d2fc67fa6fa0f5af1ca449eb4932004fbcdd394a5ba092212412b347586f0
-
Filesize
20.3MB
MD53445c1a6dd3e907eb4f72dbb30851536
SHA14c67d0e2266aaff273db1a4a95b28bd1f2af07bd
SHA2567030a9706e67aa841567c7b3e5e46641dfe5971335c04b45f2e3cc8696cb5793
SHA51273cbae6b02950432dc6923afb8ac092c00dbbdc9e3f12616025fa8a5c6526861eee18a11284fbfdee70a02017e5c294844b0c85542c0572de6fa8c0f27999036
-
Filesize
21KB
MD5474af31283e9b604e0c577d066e3151d
SHA1c12b0ac2530b6d92005b70d46af8489a964a7607
SHA2560c794c588de5ea2872dca66c8ddc79a0d048f8f231f7371e6dddff43a548cc86
SHA51221ce07772b709f3fbb23332c6db36686cc562e9e424c625b51c9f0e08201052edec14e6438d35b1c5bcc55eb22e2f5ffd453bf35bc0d00c8de7c68c2236c8462
-
Filesize
768KB
MD5c44c4f20c348689f177b8a39dc6399fb
SHA1d7fc571142da3113c4cf0d75692a72034622b17d
SHA256a4e00aea4c1a10d6d3b969314b0f691bb8e66934a5fc63edaad0121ffc62d67f
SHA512914b6b94919c780ef7b97cd95a5aff7419918b5893464f5ffd168c3e3109fa9f6bb573b67d2bc690fd6a427dfafff7bc6b2c6681afbfd9b73c408e5171ba1eec
-
Filesize
91KB
MD55c5bef05b6f3806106f8f3ce13401cc1
SHA16005fbe17f6e917ac45317552409d7a60976db14
SHA256f2f3ae8ca06f5cf320ca1d234a623bf55cf2b84c1d6dea3d85d5392e29aaf437
SHA51297933227b6002127385ace025f85a26358e47ee79c883f03180d474c15dbaf28a88492c8e53aefc0d305872edd27db0b4468da13e6f0337988f58d2ee35fd797
-
Filesize
7.1MB
MD5a9256ae34d2b801bdcc7c6608f0ee608
SHA16c2de9413a4338505c8f3cd3739aa6dc45fd4ae5
SHA25641001d38800fd1927027c2b535e4a1cf4f2c309bba5d2d0a6a29c4f120c0e007
SHA5128bb19d29e160f88a2cf2888536815105c6a9a4e326419207e26b3de29f36e26641db6c404c16d770eab881b5d5980c180c5c4f7cdbbb7b2e6a5967bfa9285a64
-
\??\Volume{d608f836-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{c2e33e28-cdad-427f-be7e-e2bf833591e2}_OnDiskSnapshotProp
Filesize5KB
MD5d0775ee078f45947bb0d2cf81b3252c9
SHA17e0540c062134e5f2b26e3176f4276bceee2731c
SHA256b808717407b9edb23ae002f078216b664f0b16e2836fde1518e41c4f34665096
SHA512d02ec5995f5f49d183d91ca77877780f9b12a21ed7113cd0c34a485c240ced970dfc265709e8b03a70b5b8e65125f85daf1cafc13ec2741fcc4a7af62fbb85c0
-
Filesize
7.7MB
MD5e317d3c2094cc17ac6756aeaaaf37628
SHA1f6b113b5e8f080052db6cc125e5ef17e7c1b572e
SHA2565306f9beed02ce55cebf0568aa0a9917353f3268e246930a50e976231c2ffa5b
SHA51292e48f8ad723d31e832dac382e453a9268c5a2a28d5ad815e23a212c32730eb3254b510ccac1eb8131a611a582dc7c8cceac631611363929d5638d51d3b3d009
-
Filesize
8.1MB
MD5fa648d6987603e9b1c20af07ac284da2
SHA10c017caa0168c19336b7c793460d6ff707cf9ebc
SHA256dfba2d8df6dc3cc91fca06c9d066fd45d869f980746b9bb727189ffa5dc7ef5b
SHA5121b1cb9ac725e7e83cf8bf41a12b62a6b3676a3d6ff5a98d9d4a96e3c152495b6e0bc65e38bd6d6c880b53f43a9f9d859dc5e56b7bfdd76e6eeb04a0e1a7c7f3f
-
Filesize
448KB
MD58ee068465887d38254b5d1f5142f83d5
SHA156e3ecfde8bdb30d98d38abbb53621b89d4f0314
SHA2560af1ed800740a057c4fbe53690195e8a6e6f1f054ec10a635614056b50a2cdf4
SHA512ecf3fd23a96521843e730ddb7de7268b7fc9d621ef96a71acd50a2ee7c7e3043ab3554c1bad0487817167e65ea54b950b57070a3526a8bf4f3390d48605e2834