matanbuchus | ff06cffedc00b97f82005c9768951d0e8c18c63ba36e584aef3c7c9e845e62e0

General

Target

ff06cffedc00b97f82005c9768951d0e8c18c63ba36e584aef3c7c9e845e62e0.msi
Size

1008KB
MD5

660df6ef0e19375001cd6988f18c105b
SHA1

f6bdeb2faba1d834b39827eb90e9c8d328d32bd1
SHA256

ff06cffedc00b97f82005c9768951d0e8c18c63ba36e584aef3c7c9e845e62e0
SHA512

4c5c2a9dab4728a47784f23a98e578273c157eb2d49a3225202062f41b59c5d646f0cd0832b60bda8f97da071f0204ab2a27e1bc0dc1d75ac8fb65d4cffa034a
SSDEEP

24576:7/9WGtBFV4aFt7u70p71YF73bPI4yXhecIWqHcI0FbbJgxkW:7ntJ42t80y73bJy8cIWq+FbbJI

Score

10^/10

matanbuchus loader

Malware Config

Signatures

Matanbuchus
A loader sold as MaaS first seen in February 2021.
loader matanbuchus

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Drops file in Windows directory 10 IoCs

Processes:

msiexec.exeDrvInst.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\f763ef4.msi	msiexec.exe
File created	C:\Windows\Installer\f763ef7.msi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\f763ef4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3FBE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f763ef5.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File created	C:\Windows\Installer\f763ef5.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1752 regsvr32.exe

pid	process
1752	regsvr32.exe

Modifies data under HKEY_USERS 43 IoCs

Processes:

DrvInst.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

msiexec.exe

pid process

2536 msiexec.exe
2536 msiexec.exe

pid	process
2536	msiexec.exe
2536	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exeDrvInst.exe

description	pid	process
Token: SeShutdownPrivilege	2164	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2164	msiexec.exe
Token: SeRestorePrivilege	2536	msiexec.exe
Token: SeTakeOwnershipPrivilege	2536	msiexec.exe
Token: SeSecurityPrivilege	2536	msiexec.exe
Token: SeCreateTokenPrivilege	2164	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2164	msiexec.exe
Token: SeLockMemoryPrivilege	2164	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2164	msiexec.exe
Token: SeMachineAccountPrivilege	2164	msiexec.exe
Token: SeTcbPrivilege	2164	msiexec.exe
Token: SeSecurityPrivilege	2164	msiexec.exe
Token: SeTakeOwnershipPrivilege	2164	msiexec.exe
Token: SeLoadDriverPrivilege	2164	msiexec.exe
Token: SeSystemProfilePrivilege	2164	msiexec.exe
Token: SeSystemtimePrivilege	2164	msiexec.exe
Token: SeProfSingleProcessPrivilege	2164	msiexec.exe
Token: SeIncBasePriorityPrivilege	2164	msiexec.exe
Token: SeCreatePagefilePrivilege	2164	msiexec.exe
Token: SeCreatePermanentPrivilege	2164	msiexec.exe
Token: SeBackupPrivilege	2164	msiexec.exe
Token: SeRestorePrivilege	2164	msiexec.exe
Token: SeShutdownPrivilege	2164	msiexec.exe
Token: SeDebugPrivilege	2164	msiexec.exe
Token: SeAuditPrivilege	2164	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2164	msiexec.exe
Token: SeChangeNotifyPrivilege	2164	msiexec.exe
Token: SeRemoteShutdownPrivilege	2164	msiexec.exe
Token: SeUndockPrivilege	2164	msiexec.exe
Token: SeSyncAgentPrivilege	2164	msiexec.exe
Token: SeEnableDelegationPrivilege	2164	msiexec.exe
Token: SeManageVolumePrivilege	2164	msiexec.exe
Token: SeImpersonatePrivilege	2164	msiexec.exe
Token: SeCreateGlobalPrivilege	2164	msiexec.exe
Token: SeBackupPrivilege	2616	vssvc.exe
Token: SeRestorePrivilege	2616	vssvc.exe
Token: SeAuditPrivilege	2616	vssvc.exe
Token: SeBackupPrivilege	2536	msiexec.exe
Token: SeRestorePrivilege	2536	msiexec.exe
Token: SeRestorePrivilege	2424	DrvInst.exe
Token: SeRestorePrivilege	2424	DrvInst.exe
Token: SeRestorePrivilege	2424	DrvInst.exe
Token: SeRestorePrivilege	2424	DrvInst.exe
Token: SeRestorePrivilege	2424	DrvInst.exe
Token: SeRestorePrivilege	2424	DrvInst.exe
Token: SeRestorePrivilege	2424	DrvInst.exe
Token: SeLoadDriverPrivilege	2424	DrvInst.exe
Token: SeLoadDriverPrivilege	2424	DrvInst.exe
Token: SeLoadDriverPrivilege	2424	DrvInst.exe
Token: SeRestorePrivilege	2536	msiexec.exe
Token: SeTakeOwnershipPrivilege	2536	msiexec.exe
Token: SeRestorePrivilege	2536	msiexec.exe
Token: SeTakeOwnershipPrivilege	2536	msiexec.exe
Token: SeRestorePrivilege	2536	msiexec.exe
Token: SeTakeOwnershipPrivilege	2536	msiexec.exe
Token: SeRestorePrivilege	2536	msiexec.exe
Token: SeTakeOwnershipPrivilege	2536	msiexec.exe
Token: SeRestorePrivilege	2536	msiexec.exe
Token: SeTakeOwnershipPrivilege	2536	msiexec.exe
Token: SeRestorePrivilege	2536	msiexec.exe
Token: SeTakeOwnershipPrivilege	2536	msiexec.exe
Token: SeRestorePrivilege	2536	msiexec.exe
Token: SeTakeOwnershipPrivilege	2536	msiexec.exe
Token: SeRestorePrivilege	2536	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

2164 msiexec.exe
2164 msiexec.exe

pid	process
2164	msiexec.exe
2164	msiexec.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

msiexec.exe

description	pid	process	target process
PID 2536 wrote to memory of 1752	2536	msiexec.exe	regsvr32.exe
PID 2536 wrote to memory of 1752	2536	msiexec.exe	regsvr32.exe
PID 2536 wrote to memory of 1752	2536	msiexec.exe	regsvr32.exe
PID 2536 wrote to memory of 1752	2536	msiexec.exe	regsvr32.exe
PID 2536 wrote to memory of 1752	2536	msiexec.exe	regsvr32.exe
PID 2536 wrote to memory of 1752	2536	msiexec.exe	regsvr32.exe
PID 2536 wrote to memory of 1752	2536	msiexec.exe	regsvr32.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ff06cffedc00b97f82005c9768951d0e8c18c63ba36e584aef3c7c9e845e62e0.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2164

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2536
- \??\c:\windows\SysWoW64\regsvr32.exe
  c:\windows\SysWoW64\regsvr32.exe "C:\Users\Admin\AppData\Local\EdgeTools\edgecef.dll"
  2⤵
  - Loads dropped DLL
  PID:1752

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2616

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005A8" "00000000000003AC"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f763ef6.rbs

Filesize
8KB

MD5
7ae5584bb7b27d06cd6791794c29f82b

SHA1
473cc4f17aef9485b581e12a0957d3f7ed647f38

SHA256
70c2c390fcb0bd68a0f34c4bb778a98088ec7d87279f529f59c322f5b10b51ba

SHA512
906bf2b2af83b36539c6a59473f17a16239c31268317670585617099d48a8984c9a34881fd8797b7694e237dd316d16a1041a6eb4c34b531ef4c8901b00fa29a

Download Submit
C:\Users\Admin\AppData\Local\EdgeTools\edgecef.dll

Filesize
990KB

MD5
e0ecf5e7d2a4656457fabeee2918ef38

SHA1
ca05587d9bd333a62735705ba6b3f919ea7d6d17

SHA256
4eb85a5532b98cbc4a6db1697cf46b9e2b7e28e89d6bbfc137b36c0736cd80e2

SHA512
f2dc88e57feab0dcc8ad36dd313413d4735350343573f6c8721b5cae48a8ceff393dfd9bcf327d9eb4114347ad704de6dbcfffc42aa53876ba0b017011ac9ddc

Download Submit
C:\Windows\Installer\f763ef4.msi

Filesize
1008KB

MD5
660df6ef0e19375001cd6988f18c105b

SHA1
f6bdeb2faba1d834b39827eb90e9c8d328d32bd1

SHA256
ff06cffedc00b97f82005c9768951d0e8c18c63ba36e584aef3c7c9e845e62e0

SHA512
4c5c2a9dab4728a47784f23a98e578273c157eb2d49a3225202062f41b59c5d646f0cd0832b60bda8f97da071f0204ab2a27e1bc0dc1d75ac8fb65d4cffa034a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads