Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02-04-2024 10:36
Static task
static1
Behavioral task
behavioral1
Sample
93a98b919aec23411ae62dba8d0d22f939da45dec19db2b4e7293124d8f1507f.msi
Resource
win7-20240221-en
windows7-x64
14 signatures
150 seconds
General
-
Target
93a98b919aec23411ae62dba8d0d22f939da45dec19db2b4e7293124d8f1507f.msi
-
Size
1.9MB
-
MD5
82b8bd90e500fb0bf878d6f430c5abec
-
SHA1
f004c09428f2f18a145212a9e55eef3615858f9c
-
SHA256
93a98b919aec23411ae62dba8d0d22f939da45dec19db2b4e7293124d8f1507f
-
SHA512
82b2e997bf5bc0d08ab8dd921aef3e8d620a61c26f86b6f481845ad694d7b97f65dfa42e1c18b83f0f827cad9df69a409b75d96793e5bd7124c26bc7cb07f881
-
SSDEEP
49152:Ksjitd+vszAlozTy4g5r8+5eNBABxGNvXreD68f:rihTyfcXreO8f
Malware Config
Extracted
Family
qakbot
Botnet
tchk06
Campaign
1702463600
C2
45.138.74.191:443
65.108.218.24:443
Attributes
-
camp_date
2023-12-13 10:33:20 +0000 UTC
Signatures
-
Detect Qakbot Payload 12 IoCs
Processes:
resource yara_rule behavioral1/memory/3056-320-0x00000000002C0000-0x00000000002EF000-memory.dmp family_qakbot_v5 behavioral1/memory/3056-325-0x0000000180000000-0x000000018002E000-memory.dmp family_qakbot_v5 behavioral1/memory/3056-322-0x0000000000290000-0x00000000002BD000-memory.dmp family_qakbot_v5 behavioral1/memory/3056-326-0x0000000180000000-0x000000018002E000-memory.dmp family_qakbot_v5 behavioral1/memory/2692-328-0x0000000000060000-0x000000000008E000-memory.dmp family_qakbot_v5 behavioral1/memory/2692-335-0x0000000000060000-0x000000000008E000-memory.dmp family_qakbot_v5 behavioral1/memory/3056-336-0x0000000180000000-0x000000018002E000-memory.dmp family_qakbot_v5 behavioral1/memory/2692-352-0x0000000000060000-0x000000000008E000-memory.dmp family_qakbot_v5 behavioral1/memory/2692-353-0x0000000000060000-0x000000000008E000-memory.dmp family_qakbot_v5 behavioral1/memory/2692-355-0x0000000000060000-0x000000000008E000-memory.dmp family_qakbot_v5 behavioral1/memory/2692-354-0x0000000000060000-0x000000000008E000-memory.dmp family_qakbot_v5 behavioral1/memory/2692-356-0x0000000000060000-0x000000000008E000-memory.dmp family_qakbot_v5 -
Blocklisted process makes network request 3 IoCs
Processes:
msiexec.exemsiexec.exeflow pid Process 3 2368 msiexec.exe 5 2368 msiexec.exe 6 1776 msiexec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe -
Drops file in Windows directory 12 IoCs
Processes:
msiexec.exeDrvInst.exedescription ioc Process File created C:\Windows\Installer\f76535f.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI5918.tmp msiexec.exe File opened for modification C:\Windows\Installer\f76535f.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI5D8F.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\Installer\MSI56B6.tmp msiexec.exe File created C:\Windows\Installer\f76535e.msi msiexec.exe File opened for modification C:\Windows\Installer\f76535e.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI5A05.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe -
Executes dropped EXE 1 IoCs
Processes:
MSI5D8F.tmppid Process 2492 MSI5D8F.tmp -
Loads dropped DLL 11 IoCs
Processes:
MsiExec.exeMsiExec.exerundll32.exepid Process 324 MsiExec.exe 324 MsiExec.exe 324 MsiExec.exe 324 MsiExec.exe 324 MsiExec.exe 2848 MsiExec.exe 2848 MsiExec.exe 3056 rundll32.exe 3056 rundll32.exe 3056 rundll32.exe 3056 rundll32.exe -
Modifies data under HKEY_USERS 43 IoCs
Processes:
DrvInst.exedescription ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe -
Modifies registry class 12 IoCs
Processes:
wermgr.exedescription ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\uhuawxpbz\b94311f8 = c7112b7e224958bc2b35362d0a4b0fecb3b16a09bf8147ed8b192b507b504de600f7d9a1cd35092aa293b00d8dab39ded2b4d0ebfec74dc602daece4037e4e48ba5d42438a6fe5c01b7678c0b8c9279ae3 wermgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\uhuawxpbz\75e91166 = 6481cf9f5249cad06e434e2d56e51438074ec587fbe484368f10b2a6d3d65e4841bba4cae5738a7d630b0de468bfab2bb1e8748e61258c6f100f720dd8db639eadca94790a7d7317bf4063633e36d678ed wermgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\uhuawxpbz\23c159ae = 25e6c68d667963a1e86a3e9b14a120b85052e29128f7604657b3206ed7c0ef701ff3bf98c829d9cf3dbc74d47ee61b049f4f6d282978f99ca256da891302be8147ccf30503d8e6f33b357d6cb96bbd0f1d92a4edd007962e69aa38a4ac17be086689a51596e2bc0b111b57f699d6edba1d474e657912191994d7ed2842c3dc174e wermgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\uhuawxpbz\22460429 = e47d623366cb588d1405633eb3fa33a29008ed9a7de49eeed233b1027793da0ee322ebfa49f0f5356b3e3e378b3a84cdcac6eebbe419b43e568e397264c5e7f31cd49bd47e0375d2a3c31c320973a5f894 wermgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\uhuawxpbz\746e4ce1 = 86d010670f56f5779b45b4463636d6001ac110fe2253070d121c027eeb72df74f422b6ca4ff5eb4c957a7d9fc726bec4611f021bc9314bc7fb46042ef74dc49b040aa7788ed10602ba2b740cabc2dd1183f2a57b728222e93b26168c3c0f28045ecbccf7d35b56053f757448fe2519ecce6f5ec136ce9c9e062683a429d6b619a0fdf4cb39599d53e1bcde644ff2cb16777a4df0cb67830e8027dd78d085a4b35607f63403ed49182032ba37f0cfa338bc wermgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\uhuawxpbz\6aa60a4d = 05d7525da13e3c87a0f072182e3f76a6e03e3566b1093344db45c66ab427bc45f98690f5b547489cb96130a9490ef234173fc47727ee71fadec3b5034a29f6bbf219d8fea5ef8f4266c629f8aea7112cade2a2537901c5e72266ceb9a6641e5edc wermgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\uhuawxpbz\b2014566 = 47c6f792a11b13425ee400ecf641d34aa1ac2022179232882d26d3ff875cf24d1d3e8958eeaeb3e2f58bb8f6f5e4b7d41f5c13078bfd221bc77072818f4f4d4becaba281cf05b93ff21b6a4879ddd5b682b4e95f1769d4b1f5ad1212fc2ab8d5cd3a7b08782dc2787e412457e5689488db4ea5b962a8fdbd051b7d03eaa45ca8a0 wermgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\uhuawxpbz\1d5f6ff8 = e751eb9ea8598b209a288acc1f93b7ee7a3f4515945b2db09dae76af145408d4821f24a8287d0488f330f7c50188f9aafd9f84ee606a56a16f81e3db0f2d219ffabc82367875b199508f70d4916b8e2f3f8487321dd7186fd0568fd1bf9d0832d1 wermgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\uhuawxpbz\22460429 = e5f5b309533eedc1a07bd440183ce9ece598ef57ac2da0603a7c8dcf007608116c2a61345054a0e636fe19d756a6588c07016b9dce444479f0c510123a09c8db2865404c667175414f956412b0958caeba0fc572814a6d267561b8ddcd994157359521f356277ce2ba4d19c03bfdde97e4 wermgr.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\uhuawxpbz wermgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\uhuawxpbz\a60c0ad3 = e54fee9a2a453ef6483bea3a2b0d93cd104b4c9118f11040ee0ea7c13543913c0241e507b970aa13fc9aa047bbf142155026428788ec459608c1421e65a4813187b9be4e69e90d9e662dffaa38cad19e5fdd68a06a93fe908bcd024f1f5ff75793 wermgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\uhuawxpbz\b8c44c7f = e53adc9a181720ace026092b1db52b1bd910b67b50fd0555e8c4168404c7f1d543ed52433a7de1c1fafb16ebb61017c89d67c776754d3a67069842f31aa9b60b58 wermgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
msiexec.exeMSI5D8F.tmprundll32.exewermgr.exepid Process 1776 msiexec.exe 1776 msiexec.exe 2492 MSI5D8F.tmp 3056 rundll32.exe 2692 wermgr.exe 2692 wermgr.exe 2692 wermgr.exe 2692 wermgr.exe 2692 wermgr.exe 2692 wermgr.exe 2692 wermgr.exe 2692 wermgr.exe 2692 wermgr.exe 2692 wermgr.exe 2692 wermgr.exe 2692 wermgr.exe 2692 wermgr.exe 2692 wermgr.exe 2692 wermgr.exe 2692 wermgr.exe 2692 wermgr.exe 2692 wermgr.exe 2692 wermgr.exe 2692 wermgr.exe 2692 wermgr.exe 2692 wermgr.exe 2692 wermgr.exe 2692 wermgr.exe 2692 wermgr.exe 2692 wermgr.exe 2692 wermgr.exe 2692 wermgr.exe 2692 wermgr.exe 2692 wermgr.exe 2692 wermgr.exe 2692 wermgr.exe 2692 wermgr.exe 2692 wermgr.exe 2692 wermgr.exe 2692 wermgr.exe 2692 wermgr.exe 2692 wermgr.exe 2692 wermgr.exe 2692 wermgr.exe 2692 wermgr.exe 2692 wermgr.exe 2692 wermgr.exe 2692 wermgr.exe 2692 wermgr.exe 2692 wermgr.exe 2692 wermgr.exe 2692 wermgr.exe 2692 wermgr.exe 2692 wermgr.exe 2692 wermgr.exe 2692 wermgr.exe 2692 wermgr.exe 2692 wermgr.exe 2692 wermgr.exe 2692 wermgr.exe 2692 wermgr.exe 2692 wermgr.exe 2692 wermgr.exe 2692 wermgr.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
msiexec.exemsiexec.exedescription pid Process Token: SeShutdownPrivilege 2368 msiexec.exe Token: SeIncreaseQuotaPrivilege 2368 msiexec.exe Token: SeRestorePrivilege 1776 msiexec.exe Token: SeTakeOwnershipPrivilege 1776 msiexec.exe Token: SeSecurityPrivilege 1776 msiexec.exe Token: SeCreateTokenPrivilege 2368 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2368 msiexec.exe Token: SeLockMemoryPrivilege 2368 msiexec.exe Token: SeIncreaseQuotaPrivilege 2368 msiexec.exe Token: SeMachineAccountPrivilege 2368 msiexec.exe Token: SeTcbPrivilege 2368 msiexec.exe Token: SeSecurityPrivilege 2368 msiexec.exe Token: SeTakeOwnershipPrivilege 2368 msiexec.exe Token: SeLoadDriverPrivilege 2368 msiexec.exe Token: SeSystemProfilePrivilege 2368 msiexec.exe Token: SeSystemtimePrivilege 2368 msiexec.exe Token: SeProfSingleProcessPrivilege 2368 msiexec.exe Token: SeIncBasePriorityPrivilege 2368 msiexec.exe Token: SeCreatePagefilePrivilege 2368 msiexec.exe Token: SeCreatePermanentPrivilege 2368 msiexec.exe Token: SeBackupPrivilege 2368 msiexec.exe Token: SeRestorePrivilege 2368 msiexec.exe Token: SeShutdownPrivilege 2368 msiexec.exe Token: SeDebugPrivilege 2368 msiexec.exe Token: SeAuditPrivilege 2368 msiexec.exe Token: SeSystemEnvironmentPrivilege 2368 msiexec.exe Token: SeChangeNotifyPrivilege 2368 msiexec.exe Token: SeRemoteShutdownPrivilege 2368 msiexec.exe Token: SeUndockPrivilege 2368 msiexec.exe Token: SeSyncAgentPrivilege 2368 msiexec.exe Token: SeEnableDelegationPrivilege 2368 msiexec.exe Token: SeManageVolumePrivilege 2368 msiexec.exe Token: SeImpersonatePrivilege 2368 msiexec.exe Token: SeCreateGlobalPrivilege 2368 msiexec.exe Token: SeCreateTokenPrivilege 2368 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2368 msiexec.exe Token: SeLockMemoryPrivilege 2368 msiexec.exe Token: SeIncreaseQuotaPrivilege 2368 msiexec.exe Token: SeMachineAccountPrivilege 2368 msiexec.exe Token: SeTcbPrivilege 2368 msiexec.exe Token: SeSecurityPrivilege 2368 msiexec.exe Token: SeTakeOwnershipPrivilege 2368 msiexec.exe Token: SeLoadDriverPrivilege 2368 msiexec.exe Token: SeSystemProfilePrivilege 2368 msiexec.exe Token: SeSystemtimePrivilege 2368 msiexec.exe Token: SeProfSingleProcessPrivilege 2368 msiexec.exe Token: SeIncBasePriorityPrivilege 2368 msiexec.exe Token: SeCreatePagefilePrivilege 2368 msiexec.exe Token: SeCreatePermanentPrivilege 2368 msiexec.exe Token: SeBackupPrivilege 2368 msiexec.exe Token: SeRestorePrivilege 2368 msiexec.exe Token: SeShutdownPrivilege 2368 msiexec.exe Token: SeDebugPrivilege 2368 msiexec.exe Token: SeAuditPrivilege 2368 msiexec.exe Token: SeSystemEnvironmentPrivilege 2368 msiexec.exe Token: SeChangeNotifyPrivilege 2368 msiexec.exe Token: SeRemoteShutdownPrivilege 2368 msiexec.exe Token: SeUndockPrivilege 2368 msiexec.exe Token: SeSyncAgentPrivilege 2368 msiexec.exe Token: SeEnableDelegationPrivilege 2368 msiexec.exe Token: SeManageVolumePrivilege 2368 msiexec.exe Token: SeImpersonatePrivilege 2368 msiexec.exe Token: SeCreateGlobalPrivilege 2368 msiexec.exe Token: SeCreateTokenPrivilege 2368 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
msiexec.exepid Process 2368 msiexec.exe 2368 msiexec.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
msiexec.exerundll32.exedescription pid Process procid_target PID 1776 wrote to memory of 324 1776 msiexec.exe 29 PID 1776 wrote to memory of 324 1776 msiexec.exe 29 PID 1776 wrote to memory of 324 1776 msiexec.exe 29 PID 1776 wrote to memory of 324 1776 msiexec.exe 29 PID 1776 wrote to memory of 324 1776 msiexec.exe 29 PID 1776 wrote to memory of 324 1776 msiexec.exe 29 PID 1776 wrote to memory of 324 1776 msiexec.exe 29 PID 1776 wrote to memory of 2848 1776 msiexec.exe 33 PID 1776 wrote to memory of 2848 1776 msiexec.exe 33 PID 1776 wrote to memory of 2848 1776 msiexec.exe 33 PID 1776 wrote to memory of 2848 1776 msiexec.exe 33 PID 1776 wrote to memory of 2848 1776 msiexec.exe 33 PID 1776 wrote to memory of 2848 1776 msiexec.exe 33 PID 1776 wrote to memory of 2848 1776 msiexec.exe 33 PID 1776 wrote to memory of 2492 1776 msiexec.exe 34 PID 1776 wrote to memory of 2492 1776 msiexec.exe 34 PID 1776 wrote to memory of 2492 1776 msiexec.exe 34 PID 1776 wrote to memory of 2492 1776 msiexec.exe 34 PID 1776 wrote to memory of 2492 1776 msiexec.exe 34 PID 1776 wrote to memory of 2492 1776 msiexec.exe 34 PID 1776 wrote to memory of 2492 1776 msiexec.exe 34 PID 3056 wrote to memory of 2692 3056 rundll32.exe 36 PID 3056 wrote to memory of 2692 3056 rundll32.exe 36 PID 3056 wrote to memory of 2692 3056 rundll32.exe 36 PID 3056 wrote to memory of 2692 3056 rundll32.exe 36 PID 3056 wrote to memory of 2692 3056 rundll32.exe 36 PID 3056 wrote to memory of 2692 3056 rundll32.exe 36 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\93a98b919aec23411ae62dba8d0d22f939da45dec19db2b4e7293124d8f1507f.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2368
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 56D042A85CA163DCDF4B71DD20270003 C2⤵
- Loads dropped DLL
PID:324
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding E99FC1C77D0E5F914674E9B7EB38BBD92⤵
- Loads dropped DLL
PID:2848
-
-
C:\Windows\Installer\MSI5D8F.tmp"C:\Windows\Installer\MSI5D8F.tmp" /HideWindow rundll32 C:\Users\Admin\AppData\Roaming\KROST.dll,hvsi2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2492
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:1484
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003B0" "0000000000000590"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2260
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\KROST.dll,hvsi1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\System32\wermgr.exeC:\Windows\System32\wermgr.exe2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2692
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5b31153afa087bc20d239637b3b1cec2e
SHA175f73e9dda7edca45c3a695b9b380ddeb767fc60
SHA256466786583fe5ca35a1e49bf3baf4036740ec4c448ad22a29f3607a9730f915c2
SHA512c3800754dc4e51a4dc37fd5069197fb4086c1e729c4cc162268f7e7ef85fb1f9a39c01f9da78edf7683b7cbd6bc3bcb6dd8117f6cc56daeee28e4108be4117fe
-
Filesize
1KB
MD5866912c070f1ecacacc2d5bca55ba129
SHA1b7ab3308d1ea4477ba1480125a6fbda936490cbb
SHA25685666a562ee0be5ce925c1d8890a6f76a87ec16d4d7d5f29ea7419cf20123b69
SHA512f91e855e0346ac8c3379129154e01488bb22cff7f6a6df2a80f1671e43c5df8acae36fdf5ee0eb2320f287a681a326b6f1df36e8e37aa5597c4797dd6b43b7cf
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8555326CC9661C9937DC5053B6C38763
Filesize326B
MD5870f57134696617d8dddea2837d31d1d
SHA13bd1ed9a36a2399768e88e5e4fcc6035a6af2cde
SHA25638c00d97ba747406deddcf3418fae661b8ad00d5dd5fec32b81f90ec27f4ba78
SHA5124ad865bb00a908fb148e3a9a2859f5ab60b56ab076fffa7c5dd259d43be1b4c09a4315361eca28044e719d2f22e3adccafb43248adc89021e8aecbf519c283dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c325cf01b4eaf5fe655defcf89a392b8
SHA153331484337491fbc8bbb5e80fed1b61aba2d58a
SHA2563309dfcb0a9f38e2e1e2949d4ddb20564f46037486431b588c1fac764aa9789b
SHA51260cb7ad8ea517f5bfde76c5ae2ad9dd84fe02ae8ac95cf5249b6f32a155e39d0d2914c88d43eb4d9a74bfd1489ead9c269ced0d3e97e9cd5a9f29c71d0596611
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
721KB
MD55a1f2196056c0a06b79a77ae981c7761
SHA1a880ae54395658f129e24732800e207ecd0b5603
SHA25652f41817669af7ac55b1516894ee705245c3148f2997fa0e6617e9cc6353e41e
SHA5129afc180ebc10c0ee0d7306f4b7085608a4e69321044d474691587bf7e63f945888781a9fc5e69568d351ac690b0335214bd04bdf5c75fd8a3bd1ec4be5d3475a
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
Filesize
459KB
MD50a29918110937641bbe4a2d5ee5e4272
SHA17d4a6976c1ece81e01d1f16ac5506266d5210734
SHA256780be7a70ce3567ef268f6c768fc5a3d2510310c603bf481ebffd65e4fe95ff3
SHA512998a6ee2fa6b345aeea72afaa91add8433e986a2678dbb8995ead786c30bdc00704c39c4857935b20669005b292736d50e1c6ad38901aa1f29db7b6a597fae3f
-
Filesize
397KB
MD5b41e1b0ae2ec215c568c395b0dbb738a
SHA190d8e50176a1f4436604468279f29a128723c64b
SHA256a97e782c5612c1a9c8a56c56a943f6190fa7a73c346566860b519ef02efd0dca
SHA512828d00ea08aa5c5d28b2e513687ee1ff910670f49f938064682e56da05544ba9d73ba9244f77b5df8acaeeb7b756d62f67e5acbc95bae86b4706f6324c4ccaba