Malware Analysis Report

2024-10-10 12:11

Sample ID 240410-rhl3gsaf29
Target cce564eb25a80549d746c180832d0b3d45dcd4419d9454470bfd7517868d0e10
SHA256 cce564eb25a80549d746c180832d0b3d45dcd4419d9454470bfd7517868d0e10
Tags
outsteel zgrat discovery rat spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

cce564eb25a80549d746c180832d0b3d45dcd4419d9454470bfd7517868d0e10

Threat Level: Known bad

The file cce564eb25a80549d746c180832d0b3d45dcd4419d9454470bfd7517868d0e10 was found to be: Known bad.

Malicious Activity Summary

outsteel zgrat discovery rat spyware stealer

Detect ZGRat V2

ZGRat

OutSteel

Modifies file permissions

Reads user/profile data of web browsers

Enumerates connected drives

AutoIT Executable

Suspicious use of SetThreadContext

Loads dropped DLL

Drops file in Windows directory

Executes dropped EXE

Suspicious use of AdjustPrivilegeToken

Uses Volume Shadow Copy service COM API

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Checks SCSI registry key(s)

Modifies data under HKEY_USERS

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-10 14:11

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-10 14:11

Reported

2024-04-10 14:14

Platform

win7-20240220-en

Max time kernel

144s

Max time network

148s

Command Line

msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\cce564eb25a80549d746c180832d0b3d45dcd4419d9454470bfd7517868d0e10.msi

Signatures

Detect ZGRat V2

Description Indicator Process Target
N/A N/A N/A N/A

OutSteel

stealer outsteel

ZGRat

rat zgrat

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\ICACLS.EXE N/A
N/A N/A C:\Windows\SysWOW64\ICACLS.EXE N/A

Reads user/profile data of web browsers

spyware stealer

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\e: C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\l: C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe N/A
File opened (read-only) \??\q: C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe N/A
File opened (read-only) \??\z: C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\r: C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe N/A
File opened (read-only) \??\s: C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe N/A
File opened (read-only) \??\y: C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe N/A
File opened (read-only) \??\g: C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe N/A
File opened (read-only) \??\v: C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe N/A
File opened (read-only) \??\x: C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\k: C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\t: C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\i: C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe N/A
File opened (read-only) \??\p: C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\o: C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\j: C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\m: C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe N/A
File opened (read-only) \??\n: C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\u: C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe N/A
File opened (read-only) \??\w: C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Installer\f762701.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI27AC.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\f762701.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI4442.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\f762702.ipi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\f762702.ipi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Logs\DPX\setupact.log C:\Windows\SysWOW64\EXPAND.EXE N/A
File opened for modification C:\Windows\Installer\MSI4452.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\INF\setupapi.ev3 C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\INF\setupapi.ev1 C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\INF\setupapi.dev.log C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\Logs\DPX\setuperr.log C:\Windows\SysWOW64\EXPAND.EXE N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs C:\Windows\system32\DrvInst.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\system32\DrvInst.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2712 wrote to memory of 1844 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2712 wrote to memory of 1844 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2712 wrote to memory of 1844 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2712 wrote to memory of 1844 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2712 wrote to memory of 1844 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2712 wrote to memory of 1844 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2712 wrote to memory of 1844 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 1844 wrote to memory of 1352 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\ICACLS.EXE
PID 1844 wrote to memory of 1352 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\ICACLS.EXE
PID 1844 wrote to memory of 1352 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\ICACLS.EXE
PID 1844 wrote to memory of 1352 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\ICACLS.EXE
PID 1844 wrote to memory of 2096 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\EXPAND.EXE
PID 1844 wrote to memory of 2096 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\EXPAND.EXE
PID 1844 wrote to memory of 2096 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\EXPAND.EXE
PID 1844 wrote to memory of 2096 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\EXPAND.EXE
PID 1844 wrote to memory of 1188 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe
PID 1844 wrote to memory of 1188 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe
PID 1844 wrote to memory of 1188 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe
PID 1844 wrote to memory of 1188 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe
PID 1188 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe
PID 1188 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe
PID 1188 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe
PID 1188 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe
PID 1188 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe
PID 1188 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe
PID 1188 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe
PID 1188 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe
PID 1188 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe
PID 1188 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe
PID 1188 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe
PID 1188 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe
PID 1188 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe
PID 1188 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe
PID 1188 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe
PID 1188 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe
PID 1188 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe
PID 1188 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe
PID 1188 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe
PID 1188 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe
PID 1188 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe
PID 1188 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe
PID 1188 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe
PID 1844 wrote to memory of 872 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\ICACLS.EXE
PID 1844 wrote to memory of 872 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\ICACLS.EXE
PID 1844 wrote to memory of 872 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\ICACLS.EXE
PID 1844 wrote to memory of 872 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\ICACLS.EXE
PID 3028 wrote to memory of 1072 N/A C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 1072 N/A C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 1072 N/A C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 1072 N/A C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 108 N/A C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 108 N/A C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 108 N/A C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 108 N/A C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 988 N/A C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 988 N/A C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 988 N/A C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 988 N/A C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 992 N/A C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 992 N/A C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 992 N/A C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 992 N/A C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe C:\Windows\SysWOW64\cmd.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Windows\system32\msiexec.exe

msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\cce564eb25a80549d746c180832d0b3d45dcd4419d9454470bfd7517868d0e10.msi

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\DrvInst.exe

DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000394" "00000000000005AC"

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 57D0DF17F366666E2756A1F985FC76C2

C:\Windows\SysWOW64\ICACLS.EXE

"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\." /SETINTEGRITYLEVEL (CI)(OI)HIGH

C:\Windows\SysWOW64\EXPAND.EXE

"C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files

C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe

"C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe"

C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe

C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe

C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe

C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe

C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe

C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe

C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe

C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe

C:\Windows\SysWOW64\ICACLS.EXE

"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\." /SETINTEGRITYLEVEL (CI)(OI)LOW

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.doc" /S /B /A

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pdf" /S /B /A

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.ppt" /S /B /A

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.dot" /S /B /A

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.xl" /S /B /A

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.csv" /S /B /A

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.rtf" /S /B /A

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.dot" /S /B /A

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.mdb" /S /B /A

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.accdb" /S /B /A

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pot" /S /B /A

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pps" /S /B /A

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.ppa" /S /B /A

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.rar" /S /B /A

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.zip" /S /B /A

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.tar" /S /B /A

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.7z" /S /B /A

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.txt" /S /B /A

Network

Country Destination Domain Proto
RU 45.146.165.91:8080 tcp
RU 45.146.165.91:8080 tcp
RU 45.146.165.91:8080 tcp
RU 45.146.165.91:8080 tcp
RU 45.146.165.91:8080 tcp
RU 45.146.165.91:8080 tcp
RU 45.146.165.91:8080 tcp

Files

C:\Windows\Installer\MSI27AC.tmp

MD5 4caaa03e0b59ca60a3d34674b732b702
SHA1 ee80c8f4684055ac8960b9720fb108be07e1d10c
SHA256 d01af2b8c692dffb04a5a04e3ccd0d0a3b2c67c8fc45a4b68c0a065b4e64cc3d
SHA512 25888848871286bdd1f9c43a0fba35640edb5bafbe0c6aa2f9708a070ea4e5b16745b7c4f744ae4f5643f75ef47f196d430bf70921ed27715f712825ec590a34

C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\msiwrapper.ini

MD5 79c6e888f6029c67a04080d440303395
SHA1 4b00516eac6c98bd799d0033e575ba190cc26b79
SHA256 78c61146f73b74f4b110359cbc27ee49060a58a1651875d69005b16e9e2344f3
SHA512 2b849d10679ac8daa13e9356376b6260bcd16eeaa4a464c7571d7db7486ca49f6d49a4775f43b9a03e4c9855f022e92a8c8628923d17467cbcd8d047526a2282

C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\msiwrapper.ini

MD5 30cc8cdbcdcebefae1546227a7d7b1b2
SHA1 2840a338fb9bcc78ace930a6b3ee6535fbba7177
SHA256 02e65dc3ed995cbc4cacb5ad6ac45766cc97ac4f8da6ac7f8d93e664dcfbc517
SHA512 a9126c18d8fe7fa3baec70eceb818297ccd9ecdfd8bada580ed7d42b1b88fed54b68826ed2e7003f055d33262bf85f6b21117208f04a0cec46285708e123b909

C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\msiwrapper.ini

MD5 e7e4fe82bd59a642e23db910aa797ea4
SHA1 a487baf3c0af3b07342e435e5381c05549241f73
SHA256 3b2e81ac6cdb09ed1f42d79d9b56fdfead56cdae9f09043f40a98fdd6ee8a0bc
SHA512 98c0aad77f7f18b605d56daa9a57426b2963cb2200e49ceb03c963f0fae249f0d55246be8b8c42a855844b72d369ca2df169fc938e532a14ec8756db9a95d932

C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\msiwrapper.ini

MD5 907444359e2773b00eaf97f2614ecceb
SHA1 62d09a6d41228a728dbd0d135e35b42f53200015
SHA256 a88619529f6ae0f2defc59f0394f4b3ee928564a56d1ac6a5fe59d26597845e1
SHA512 64011d2e6fd13c4433dd05c4e5cc848878b687381532f1e5ea78dc170f762911cfb5415d382cb7365e58d0e01c9c9ecf47ece6a229142b2dc4b54493833de866

C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files.cab

MD5 2e806bafbbbe71cc9a1d7edae31d0c08
SHA1 e3e63d8e6632bab379564da97806d9838303cfef
SHA256 969646f8e2cee5b0920e467e9031d3b729ddc6e25a3e7e0b596c6629b0c5194f
SHA512 9dc685914a7dd93b7d934108220217ac8785698bc562880500cac3f7d46d7ad328cb166400155250c98927b1fe078dc399d0806b5580d5b6457e8afc6b45e02e

C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\files\BbevNayvqJPVQfqy.exe

MD5 d7510192dd826e6c63266ba412c4a8c6
SHA1 e51431ab4448d503db3d154d1da7bec25eb5aaac
SHA256 ffad5217eb782aced4ab2c746b49891b496e1b90331ca24186f8349a5fa71a28
SHA512 d73107b3f061d95a10f3e2ae025bfccad587866d4ccca8a71b31d51f34119d5127ed313a96ef3fe3421939ae871575d5e7ff7fd28eb9b2ddb3eef7f29c528ebc

memory/1188-73-0x0000000072E30000-0x000000007351E000-memory.dmp

memory/1188-72-0x00000000002B0000-0x000000000039E000-memory.dmp

memory/1188-74-0x0000000000270000-0x00000000002B0000-memory.dmp

memory/1188-75-0x00000000008F0000-0x000000000092A000-memory.dmp

memory/3028-83-0x0000000000400000-0x00000000004E2000-memory.dmp

memory/1188-86-0x0000000072E30000-0x000000007351E000-memory.dmp

memory/3028-87-0x0000000000400000-0x00000000004E2000-memory.dmp

memory/3028-88-0x0000000000400000-0x00000000004E2000-memory.dmp

memory/3028-89-0x0000000000400000-0x00000000004E2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\MW-070d953c-8419-4290-8d4f-84949b24111e\msiwrapper.ini

MD5 7951a383923ecfe8ae1214499ec6f5b2
SHA1 5c8da901f4bf6bcf810befdcd666d354f530e7fa
SHA256 15f6a71b659460afc8786af096ec77ec840ebd38c1d8e423f5e60d832a8674bc
SHA512 10a7d44d206b7ef9dce46c95a7bdb74cde4c56bd316893b77bd220885a19cf7c7e91d9d69b336b673f1f0aa4be098585a30846d120078a77528f098642664ba3

memory/3028-100-0x0000000000400000-0x00000000004E2000-memory.dmp

memory/3028-106-0x0000000000400000-0x00000000004E2000-memory.dmp

memory/3028-116-0x0000000000400000-0x00000000004E2000-memory.dmp

memory/3028-120-0x0000000000400000-0x00000000004E2000-memory.dmp

memory/3028-132-0x0000000000400000-0x00000000004E2000-memory.dmp

memory/3028-137-0x0000000000400000-0x00000000004E2000-memory.dmp

memory/3028-148-0x0000000000400000-0x00000000004E2000-memory.dmp

memory/3028-152-0x0000000000400000-0x00000000004E2000-memory.dmp

memory/3028-170-0x0000000000400000-0x00000000004E2000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-10 14:11

Reported

2024-04-10 14:14

Platform

win10v2004-20240226-en

Max time kernel

152s

Max time network

160s

Command Line

msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\cce564eb25a80549d746c180832d0b3d45dcd4419d9454470bfd7517868d0e10.msi

Signatures

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000064efbbd21686319b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000064efbbd20000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090064efbbd2000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d64efbbd2000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000064efbbd200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\system32\vssvc.exe N/A
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\system32\vssvc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters C:\Windows\system32\vssvc.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters C:\Windows\system32\vssvc.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr C:\Windows\system32\vssvc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Windows\system32\msiexec.exe

msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\cce564eb25a80549d746c180832d0b3d45dcd4419d9454470bfd7517868d0e10.msi

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1416 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
GB 142.250.187.234:443 tcp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 13.107.246.64:443 tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 24.139.73.23.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 201.203.100.95.in-addr.arpa udp
US 8.8.8.8:53 239.249.30.184.in-addr.arpa udp

Files

N/A