Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
172s -
max time network
165s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11/04/2024, 07:12 UTC
Static task
static1
Behavioral task
behavioral1
Sample
MeTSetup (1).exe
Resource
win7-20240221-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
MeTSetup (1).exe
Resource
win10v2004-20240226-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
MeTSetup (1).exe
-
Size
77.7MB
-
MD5
f0c83297881486535346fc2b7e12f1fd
-
SHA1
18c22e11378cca745750a9302e17495b48d6ce90
-
SHA256
c2c04f7a5b75da5fe87f100d9f8b92b340b66148dbef0c6314a54f2a8b8cb4cd
-
SHA512
f4cf463b428c4115eb5042db37e3896a039b916259951f64778f6aa6101941f187abe348b6f3e4f30746ceba6c003e76d8aa2266f2183f07f52606a2633277ee
-
SSDEEP
1572864:OGubpsnuEY7TBXuTCQlGuoeHxdEOH+PrJ+4YvQsD2s6FJ:OWnuEWVX+RlnDSOQhJ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2808 setup.exe 2764 MscKSPRegist.exe -
Loads dropped DLL 4 IoCs
pid Process 2648 MeTSetup (1).exe 2308 msiexec.exe 1032 Process not Found 1920 MsiExec.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MeT = "C:\\Program Files (x86)\\Microsec\\MeT\\MscCertificateManager.exe /system_tray /startup" msiexec.exe -
Blocklisted process makes network request 4 IoCs
flow pid Process 3 2424 msiexec.exe 5 2424 msiexec.exe 7 2424 msiexec.exe 9 2308 msiexec.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe -
Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\SysWOW64\MscKSPComLib.dll msiexec.exe File created C:\Windows\System32\MscKSPComLib.dll msiexec.exe File created C:\Windows\SysWOW64\MscKSPComLib2.dll msiexec.exe File created C:\Windows\System32\MscKSPComLib2.dll msiexec.exe File created C:\Windows\SysWOW64\MscKSP.dll msiexec.exe File created C:\Windows\System32\MscKSP.dll msiexec.exe -
Drops file in Program Files directory 26 IoCs
description ioc Process File created C:\Program Files (x86)\Microsec\MeT\certs\Microsec_e-Szigno_Test_Root_CA_2017.cer msiexec.exe File created C:\Program Files (x86)\Microsec\MeT\certs\Info_CA_ROOT.cer msiexec.exe File created C:\Program Files (x86)\Microsec\MeT\certs\KGYHSZ.cer msiexec.exe File created C:\Program Files (x86)\Microsec\MeT\certs\KGYHSZ2009.cer msiexec.exe File created C:\Program Files (x86)\Microsec\MeT\en-US\certs.xml msiexec.exe File created C:\Program Files (x86)\Microsec\MeT\MscCertificateManagerPanelSoftware.dll msiexec.exe File created C:\Program Files\Microsec\MeT\MscKSPRegist.exe msiexec.exe File created C:\Program Files (x86)\Microsec\MeT\certs\e-Szigno_Root_CA_2017.crt msiexec.exe File created C:\Program Files (x86)\Microsec\MeT\certs\Microsec_e-Szigno_Root_CA.cer msiexec.exe File created C:\Program Files (x86)\Microsec\MeT\certs\tlsrootca2023.crt msiexec.exe File created C:\Program Files (x86)\Microsec\MeT\certs\Microsec_e-Szigno_Root_CA_2009.cer msiexec.exe File created C:\Program Files (x86)\Microsec\MeT\mcardspe.dll msiexec.exe File created C:\Program Files (x86)\Microsec\MeT\certs\govca-ecc-root.cer msiexec.exe File created C:\Program Files (x86)\Microsec\MeT\certs\NetLock_Class_QA.cer msiexec.exe File created C:\Program Files (x86)\Microsec\MeT\MscCertificateManagerPanelCard.dll msiexec.exe File created C:\Program Files (x86)\Microsec\MeT\changelog.txt msiexec.exe File created C:\Program Files (x86)\Microsec\MeT\certs\Microsec_e-Szigno_Test_Root_CA_2008.cer msiexec.exe File created C:\Program Files (x86)\Microsec\MeT\certs\Trust_Sign_Root_CA.cer msiexec.exe File created C:\Program Files (x86)\Microsec\MeT\hu-HU\certs.xml msiexec.exe File created C:\Program Files (x86)\Microsec\MeT\certs\Magyar_Telekom_Root_CA.cer msiexec.exe File created C:\Program Files (x86)\Microsec\MeT\certs\NISZ_Root.cer msiexec.exe File created C:\Program Files (x86)\Microsec\MeT\certs\esmimeca2023.crt msiexec.exe File created C:\Program Files (x86)\Microsec\MeT\gpcpprm.dll msiexec.exe File created C:\Program Files (x86)\Microsec\MeT\MscCertificateManagerPanelStoredkey.dll msiexec.exe File created C:\Program Files (x86)\Microsec\MeT\winsparkle.dll msiexec.exe File created C:\Program Files (x86)\Microsec\MeT\MscCertificateManager.exe msiexec.exe -
Drops file in Windows directory 13 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\f78954e.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\f78954e.ipi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File created C:\Windows\Installer\f78954d.msi msiexec.exe File opened for modification C:\Windows\Installer\f78954d.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIA1D9.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\Installer\{ACB51CC5-ABDF-4F22-A3B2-17A8F6B9E3DD}\_5D7C3A7ED82C4 msiexec.exe File created C:\Windows\Installer\f789550.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIBE6F.tmp msiexec.exe File created C:\Windows\Installer\{ACB51CC5-ABDF-4F22-A3B2-17A8F6B9E3DD}\_5D7C3A7ED82C4 msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 46 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe -
Modifies registry class 40 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5CC15BCAFDBA22F43A2B718A6F9B3EDD msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5CC15BCAFDBA22F43A2B718A6F9B3EDD\Winsparkle = "ProductFeature" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5CC15BCAFDBA22F43A2B718A6F9B3EDD\Registrator = "ProductFeature" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5CC15BCAFDBA22F43A2B718A6F9B3EDD\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\msccertmgr\FriendlyTypeName = "MeT" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\msccertmgr\shell\open\command msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5CC15BCAFDBA22F43A2B718A6F9B3EDD\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5CC15BCAFDBA22F43A2B718A6F9B3EDD\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5CC15BCAFDBA22F43A2B718A6F9B3EDD\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5CC15BCAFDBA22F43A2B718A6F9B3EDD\ProductIcon = "C:\\Windows\\Installer\\{ACB51CC5-ABDF-4F22-A3B2-17A8F6B9E3DD}\\_5D7C3A7ED82C4" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5CC15BCAFDBA22F43A2B718A6F9B3EDD\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\msccertmgr msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\msccertmgr\shell msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5CC15BCAFDBA22F43A2B718A6F9B3EDD\ProductFeature msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5CC15BCAFDBA22F43A2B718A6F9B3EDD msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5CC15BCAFDBA22F43A2B718A6F9B3EDD\Version = "33554433" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5CC15BCAFDBA22F43A2B718A6F9B3EDD\Language = "1038" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5CC15BCAFDBA22F43A2B718A6F9B3EDD\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5CC15BCAFDBA22F43A2B718A6F9B3EDD\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\msccertmgr\Default Icon msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\msccertmgr msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\msccertmgr\shell\open msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5CC15BCAFDBA22F43A2B718A6F9B3EDD\KeyManager = "ProductFeature" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5CC15BCAFDBA22F43A2B718A6F9B3EDD\Changelog = "ProductFeature" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5CC15BCAFDBA22F43A2B718A6F9B3EDD\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\MET_a02760\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\msccertmgr\URL Protocol msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\msccertmgr\Default Icon\ = "\"C:\\Program Files (x86)\\Microsec\\MeT\\MscCertificateManager.exe\",1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\msccertmgr\shell\open\command\ = "\"C:\\Program Files (x86)\\Microsec\\MeT\\MscCertificateManager.exe\" \"%1\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5CC15BCAFDBA22F43A2B718A6F9B3EDD\PackageCode = "CF2D9CBA1BD08F44FAABB3176B83B1D1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5CC15BCAFDBA22F43A2B718A6F9B3EDD\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5CC15BCAFDBA22F43A2B718A6F9B3EDD\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\msccertmgr\ = "URL:msccertmgr protocol" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\msccertmgr\shell\open\command msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5CC15BCAFDBA22F43A2B718A6F9B3EDD\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\098F982F0B6E5EB4A9C94B59B18F001A\5CC15BCAFDBA22F43A2B718A6F9B3EDD msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5CC15BCAFDBA22F43A2B718A6F9B3EDD\SourceList\PackageName = "setup.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5CC15BCAFDBA22F43A2B718A6F9B3EDD\DLL = "ProductFeature" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5CC15BCAFDBA22F43A2B718A6F9B3EDD\ProductName = "MeT" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\098F982F0B6E5EB4A9C94B59B18F001A msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5CC15BCAFDBA22F43A2B718A6F9B3EDD\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MET_a02760\\" msiexec.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2808 setup.exe 2808 setup.exe 2308 msiexec.exe 2308 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2424 msiexec.exe Token: SeIncreaseQuotaPrivilege 2424 msiexec.exe Token: SeRestorePrivilege 2308 msiexec.exe Token: SeTakeOwnershipPrivilege 2308 msiexec.exe Token: SeSecurityPrivilege 2308 msiexec.exe Token: SeCreateTokenPrivilege 2424 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2424 msiexec.exe Token: SeLockMemoryPrivilege 2424 msiexec.exe Token: SeIncreaseQuotaPrivilege 2424 msiexec.exe Token: SeMachineAccountPrivilege 2424 msiexec.exe Token: SeTcbPrivilege 2424 msiexec.exe Token: SeSecurityPrivilege 2424 msiexec.exe Token: SeTakeOwnershipPrivilege 2424 msiexec.exe Token: SeLoadDriverPrivilege 2424 msiexec.exe Token: SeSystemProfilePrivilege 2424 msiexec.exe Token: SeSystemtimePrivilege 2424 msiexec.exe Token: SeProfSingleProcessPrivilege 2424 msiexec.exe Token: SeIncBasePriorityPrivilege 2424 msiexec.exe Token: SeCreatePagefilePrivilege 2424 msiexec.exe Token: SeCreatePermanentPrivilege 2424 msiexec.exe Token: SeBackupPrivilege 2424 msiexec.exe Token: SeRestorePrivilege 2424 msiexec.exe Token: SeShutdownPrivilege 2424 msiexec.exe Token: SeDebugPrivilege 2424 msiexec.exe Token: SeAuditPrivilege 2424 msiexec.exe Token: SeSystemEnvironmentPrivilege 2424 msiexec.exe Token: SeChangeNotifyPrivilege 2424 msiexec.exe Token: SeRemoteShutdownPrivilege 2424 msiexec.exe Token: SeUndockPrivilege 2424 msiexec.exe Token: SeSyncAgentPrivilege 2424 msiexec.exe Token: SeEnableDelegationPrivilege 2424 msiexec.exe Token: SeManageVolumePrivilege 2424 msiexec.exe Token: SeImpersonatePrivilege 2424 msiexec.exe Token: SeCreateGlobalPrivilege 2424 msiexec.exe Token: SeBackupPrivilege 1568 vssvc.exe Token: SeRestorePrivilege 1568 vssvc.exe Token: SeAuditPrivilege 1568 vssvc.exe Token: SeBackupPrivilege 2308 msiexec.exe Token: SeRestorePrivilege 2308 msiexec.exe Token: SeRestorePrivilege 1020 DrvInst.exe Token: SeRestorePrivilege 1020 DrvInst.exe Token: SeRestorePrivilege 1020 DrvInst.exe Token: SeRestorePrivilege 1020 DrvInst.exe Token: SeRestorePrivilege 1020 DrvInst.exe Token: SeRestorePrivilege 1020 DrvInst.exe Token: SeRestorePrivilege 1020 DrvInst.exe Token: SeLoadDriverPrivilege 1020 DrvInst.exe Token: SeLoadDriverPrivilege 1020 DrvInst.exe Token: SeLoadDriverPrivilege 1020 DrvInst.exe Token: SeRestorePrivilege 2308 msiexec.exe Token: SeTakeOwnershipPrivilege 2308 msiexec.exe Token: SeRestorePrivilege 2308 msiexec.exe Token: SeTakeOwnershipPrivilege 2308 msiexec.exe Token: SeRestorePrivilege 2308 msiexec.exe Token: SeTakeOwnershipPrivilege 2308 msiexec.exe Token: SeRestorePrivilege 2308 msiexec.exe Token: SeTakeOwnershipPrivilege 2308 msiexec.exe Token: SeRestorePrivilege 2308 msiexec.exe Token: SeTakeOwnershipPrivilege 2308 msiexec.exe Token: SeRestorePrivilege 2308 msiexec.exe Token: SeTakeOwnershipPrivilege 2308 msiexec.exe Token: SeRestorePrivilege 2308 msiexec.exe Token: SeTakeOwnershipPrivilege 2308 msiexec.exe Token: SeRestorePrivilege 2308 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2424 msiexec.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2648 wrote to memory of 2808 2648 MeTSetup (1).exe 29 PID 2648 wrote to memory of 2808 2648 MeTSetup (1).exe 29 PID 2648 wrote to memory of 2808 2648 MeTSetup (1).exe 29 PID 2648 wrote to memory of 2808 2648 MeTSetup (1).exe 29 PID 2648 wrote to memory of 2808 2648 MeTSetup (1).exe 29 PID 2648 wrote to memory of 2808 2648 MeTSetup (1).exe 29 PID 2648 wrote to memory of 2808 2648 MeTSetup (1).exe 29 PID 2808 wrote to memory of 2424 2808 setup.exe 30 PID 2808 wrote to memory of 2424 2808 setup.exe 30 PID 2808 wrote to memory of 2424 2808 setup.exe 30 PID 2808 wrote to memory of 2424 2808 setup.exe 30 PID 2808 wrote to memory of 2424 2808 setup.exe 30 PID 2808 wrote to memory of 2424 2808 setup.exe 30 PID 2808 wrote to memory of 2424 2808 setup.exe 30 PID 2308 wrote to memory of 2764 2308 msiexec.exe 35 PID 2308 wrote to memory of 2764 2308 msiexec.exe 35 PID 2308 wrote to memory of 2764 2308 msiexec.exe 35 PID 2308 wrote to memory of 1920 2308 msiexec.exe 38 PID 2308 wrote to memory of 1920 2308 msiexec.exe 38 PID 2308 wrote to memory of 1920 2308 msiexec.exe 38 PID 2308 wrote to memory of 1920 2308 msiexec.exe 38 PID 2308 wrote to memory of 1920 2308 msiexec.exe 38 PID 2308 wrote to memory of 1920 2308 msiexec.exe 38 PID 2308 wrote to memory of 1920 2308 msiexec.exe 38 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\MeTSetup (1).exe"C:\Users\Admin\AppData\Local\Temp\MeTSetup (1).exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\MET_SETUP_a02444\setup.exesetup.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\MET_a02760\setup.msi"3⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2424
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Loads dropped DLL
- Adds Run key to start application
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Program Files\Microsec\MeT\MscKSPRegist.exe"C:\Program Files\Microsec\MeT\MscKSPRegist.exe" -register2⤵
- Executes dropped EXE
PID:2764
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding DCA1F57417525E29DF3C5C2246DBA349 M Global\MSI00002⤵
- Loads dropped DLL
PID:1920
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1568
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005C0" "0000000000000338"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1020
Network
-
Remote address:8.8.8.8:53Requestrootca2017-ca1.e-szigno.huIN AResponserootca2017-ca1.e-szigno.huIN A193.42.222.125
-
Remote address:193.42.222.125:80RequestGET /rootca2017.crt HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: rootca2017-ca1.e-szigno.hu
ResponseHTTP/1.1 200 OK
Date: Thu, 11 Apr 2024 07:14:28 GMT
Server: Apache
Last-Modified: Tue, 19 Sep 2017 19:06:40 GMT
ETag: "244-5598f8f203000"
Accept-Ranges: bytes
Content-Length: 580
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/x-x509-ca-cert
-
416 B 1.1kB 6 5
HTTP Request
GET http://rootca2017-ca1.e-szigno.hu/rootca2017.crtHTTP Response
200
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD5fa715454245aa56f8a183aeb957d0889
SHA1979f7e09d1f9fa9b546593376e29a8499eb40fe2
SHA2567b53e030e289c8c00e978841ffea9ab128856d8a31575d9cd0b4fe6c6d4f60d5
SHA5123aff756383412b9c9b964575c0e3bd55db149d47cad7bcf63af733ee75e358ef8468e535ed2cf82dadc111c847f5e69a946323afbc33761d541b157b699e2b2c
-
Filesize
7.5MB
MD5089cd1cef36a26e1a24c3b6cb427821f
SHA11565c489fb6e4663fc09cad10abe32c8227b796d
SHA256d99c70b0bf9ebbcbd2494415f43ab26c699a1acc5c7995c82d9debf770b8b5f8
SHA51206c01593c39014b7d7df90d791be88ced8bc2d0166313adf26b98ba3939c2a218124726d3e2ae58e102720600d395fa87eabf71b406f2d00b7e8708f24c53ae9
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
580B
MD5de1ff69e84aea7b421ce1e587dd18498
SHA189d483034f9e9a48805f7237d4a9a6efcb7c1fd1
SHA256beb00b30839b9bc32c32e4447905950641f26421b15ed089198b518ae2ea1b99
SHA512b47857b84854b2e6c73bc883554fd42077d060d115696f005131e94e60badbe6e750ca88995f53edd9abdbdb8d19c2d7b341358f61fa068c840864fd066c27cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55563f4d1b25414f192a044f4ff0e1802
SHA110807e007c5479b04daf5e46466722d68bdaf52f
SHA2562358250cbf8ff227995e417c9aff5825920d1a1f527471cf287b16e44fc8df5a
SHA51239cdc0b68eebfd24dc90c7bf7e85c99feb49b13c8f61a60f8f98ad3c16c1a703c797ce3f018058f1e382d5d4ede50b34c23fc62d25ee67187d18b96befce65f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CE8B5763061589BB1835A4B6566F644D
Filesize254B
MD5af766c59ec90c404f72d0ab6a1c8cec4
SHA1e8097b1887936521f5b0d32aaeed55f9f16de249
SHA25607743371822a25ac2b2fed56df1ebad9c3edfdd6909ffcf4adef323497768b81
SHA512959288f102f0b0d8a6a49fb4a61b61eec30c13b86faf39d87f3f4f7fed01b8b1ddae7bd1abaecf4208cdafe1d8de811529d1b4279e050467c1a9228126d11710
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
43.9MB
MD580f780f89273fed90c84d7ba9901437d
SHA170106b845e69a69e9e98229a4a7942c1b77ec20d
SHA25696e65c40e476ad1a6c32b4af0c1378fabb8f86577d7a6fbe984981fd460b0739
SHA512f4b079a8cb53c0437aca51d77c5d8d8c915c142acff67043f25b563bfeafd735848a3d8c9e5c4231319a8e5b5dcc513512df7e44461967728a7e1f06cec277cf
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
Filesize
1.9MB
MD5641c3181c7d469d68d934c56dd6bba09
SHA1305d139560cbefd6de48184ac0086502b036ce94
SHA2561d2660f3d6fd3b6b245b383fab30466af1e521bee31884092b8442c12d84b48a
SHA5124a91e4d05de7bd66258f5c07fe928a1edbe46dbffeaaafc522622a61e72c2e5504bb9da98452dd701355a51092ca22fded29907c3cd68bd09c4bdede1488d1c2
-
Filesize
134KB
MD5fa8aba7e52cf9c1422b71b2543dc814e
SHA13ba2e62a2b3e56da05dfe9b06e1b59620c430a8f
SHA25605b44932ed728b108d3f23906b69de2deedb5b72b5a2e7bbb926d31ecebb48e2
SHA512f9528f30188ce3cd17f3b05059190d254ff91333bd4ea1bb8f54da9df941d6e197f1e49666fa73f3335982754d0ee7511c16855e0c6b3154816bf12c98559bc9
-
Filesize
77.4MB
MD567ce46f5508574cbeca12583960b4717
SHA196130fc87ad6657eb62adac61655613c9d267e6f
SHA2564969f7f0653c2f9353a878be2577664d68110090ea503efffb75ff5e6cac820c
SHA512d89d7cb7b0d1fdf198d8dd0f8cd900c353ef3359314e9a326e195f61eeb770c36d67b19e1eca2c6d92446f6eddc6a918002be589285c3c34ce387ed65696149e