Overview
overview
7Static
static
3DXSETUP.exe
windows11-21h2-x64
4Call of Du...12.exe
windows11-21h2-x64
7Call of Du...64.exe
windows11-21h2-x64
7Call of Du...64.exe
windows11-21h2-x64
7Call of Du...86.exe
windows11-21h2-x64
7Call of Du...64.exe
windows11-21h2-x64
7Call of Du...86.exe
windows11-21h2-x64
7Call of Du...64.exe
windows11-21h2-x64
7Call of Du...86.exe
windows11-21h2-x64
7Call of Du...64.exe
windows11-21h2-x64
7Call of Du...86.exe
windows11-21h2-x64
7Call of Du...64.exe
windows11-21h2-x64
7Call of Du...86.exe
windows11-21h2-x64
7Call of Du...64.exe
windows11-21h2-x64
7Call of Du...86.exe
windows11-21h2-x64
7Analysis
-
max time kernel
204s -
max time network
204s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
19-04-2024 17:36
Static task
static1
Behavioral task
behavioral1
Sample
DXSETUP.exe
Resource
win11-20240412-en
Behavioral task
behavioral2
Sample
Call of Duty Modern Warfare 3 DX12 Error Fixed Pack By ZOHAIB ROCK/Directx 12.exe
Resource
win11-20240412-en
Behavioral task
behavioral3
Sample
Call of Duty Modern Warfare 3 DX12 Error Fixed Pack By ZOHAIB ROCK/RuntimePack_x86_x64.exe
Resource
win11-20240412-en
Behavioral task
behavioral4
Sample
Call of Duty Modern Warfare 3 DX12 Error Fixed Pack By ZOHAIB ROCK/runtime c++/vcredist2005_x64.exe
Resource
win11-20240412-en
Behavioral task
behavioral5
Sample
Call of Duty Modern Warfare 3 DX12 Error Fixed Pack By ZOHAIB ROCK/runtime c++/vcredist2005_x86.exe
Resource
win11-20240412-en
Behavioral task
behavioral6
Sample
Call of Duty Modern Warfare 3 DX12 Error Fixed Pack By ZOHAIB ROCK/runtime c++/vcredist2008_x64.exe
Resource
win11-20240412-en
Behavioral task
behavioral7
Sample
Call of Duty Modern Warfare 3 DX12 Error Fixed Pack By ZOHAIB ROCK/runtime c++/vcredist2008_x86.exe
Resource
win11-20240412-en
Behavioral task
behavioral8
Sample
Call of Duty Modern Warfare 3 DX12 Error Fixed Pack By ZOHAIB ROCK/runtime c++/vcredist2010_x64.exe
Resource
win11-20240412-en
Behavioral task
behavioral9
Sample
Call of Duty Modern Warfare 3 DX12 Error Fixed Pack By ZOHAIB ROCK/runtime c++/vcredist2010_x86.exe
Resource
win11-20240412-en
Behavioral task
behavioral10
Sample
Call of Duty Modern Warfare 3 DX12 Error Fixed Pack By ZOHAIB ROCK/runtime c++/vcredist2012_x64.exe
Resource
win11-20240412-en
Behavioral task
behavioral11
Sample
Call of Duty Modern Warfare 3 DX12 Error Fixed Pack By ZOHAIB ROCK/runtime c++/vcredist2012_x86.exe
Resource
win11-20240412-en
Behavioral task
behavioral12
Sample
Call of Duty Modern Warfare 3 DX12 Error Fixed Pack By ZOHAIB ROCK/runtime c++/vcredist2013_x64.exe
Resource
win11-20240412-en
Behavioral task
behavioral13
Sample
Call of Duty Modern Warfare 3 DX12 Error Fixed Pack By ZOHAIB ROCK/runtime c++/vcredist2013_x86.exe
Resource
win11-20240412-en
Behavioral task
behavioral14
Sample
Call of Duty Modern Warfare 3 DX12 Error Fixed Pack By ZOHAIB ROCK/runtime c++/vcredist2015_2017_2019_x64.exe
Resource
win11-20240412-en
Behavioral task
behavioral15
Sample
Call of Duty Modern Warfare 3 DX12 Error Fixed Pack By ZOHAIB ROCK/runtime c++/vcredist2015_2017_2019_x86.exe
Resource
win11-20240412-en
General
-
Target
Call of Duty Modern Warfare 3 DX12 Error Fixed Pack By ZOHAIB ROCK/runtime c++/vcredist2005_x86.exe
-
Size
2.6MB
-
MD5
ce2922f83fb4b170affce0ea448b107b
-
SHA1
b8fab0bb7f62a24ddfe77b19cd9a1451abd7b847
-
SHA256
4ee4da0fe62d5fa1b5e80c6e6d88a4a2f8b3b140c35da51053d0d7b72a381d29
-
SHA512
e94b077e054bd8992374d359f3adc4d1d78d42118d878556715d77182f7d03635850b2b2f06c012ccb7c410e2b3c124cf6508473efe150d3c51a51857ce1c6b0
-
SSDEEP
49152:rqGRIgg2SirwkF9xdtb43lyGKCafpKkiwnaDahmPzpY4FPyaza:rxxLFfY/KCCpKk9aWMzZyau
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
MsiExec.exepid process 4880 MsiExec.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
vcredist2005_x86.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" vcredist2005_x86.exe -
Blocklisted process makes network request 1 IoCs
Processes:
msiexec.exeflow pid process 2 2900 msiexec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc process File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe -
Drops file in Program Files directory 1 IoCs
Processes:
msiexec.exedescription ioc process File created C:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia80.dll msiexec.exe -
Drops file in Windows directory 61 IoCs
Processes:
msiexec.exedescription ioc process File created C:\Windows\WinSxS\InstallTemp\20240419174248419.0\mfc80ENU.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240419174248497.0\8.0.50727.6195.policy msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240419174248497.2 msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240419174248232.0\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_a4c618fa.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240419174248279.0\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240419174248513.0\8.0.50727.6195.cat msiexec.exe File opened for modification C:\Windows\Installer\e57ab15.msi msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240419174248529.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240419174248341.0\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_150c9e8b.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240419174248419.0\mfc80CHS.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240419174248529.0\8.0.50727.6195.policy msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240419174248529.0\8.0.50727.6195.cat msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240419174248232.0 msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240419174248341.0\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_150c9e8b.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240419174248419.0\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_6a5bb789.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240419174248419.0\mfc80CHT.dll msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240419174248482.0 msiexec.exe File created C:\Windows\SystemTemp\~DFEFF9E0ED82FBC827.TMP msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240419174248279.0\msvcm80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240419174248497.1\8.0.50727.6195.cat msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240419174248497.1 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240419174248279.0\msvcr80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240419174248419.0\mfc80DEU.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240419174248497.2\8.0.50727.6195.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240419174248341.0\mfc80u.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240419174248341.0\mfcm80u.dll msiexec.exe File created C:\Windows\SystemTemp\~DF3D5F7F1D3ACB749D.TMP msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240419174248419.0\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_6a5bb789.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240419174248419.0\mfc80ITA.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240419174248482.0\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_452bf920.manifest msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240419174248419.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240419174248279.0\msvcp80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240419174248419.0\mfc80JPN.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240419174248419.0\mfc80KOR.dll msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240419174248341.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240419174248419.0\mfc80FRA.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240419174248513.0\8.0.50727.6195.policy msiexec.exe File created C:\Windows\Installer\e57ab15.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIADF3.tmp msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240419174248279.0\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240419174248497.2\8.0.50727.6195.policy msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240419174248497.0 msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240419174248513.0 msiexec.exe File created C:\Windows\SystemTemp\~DFB2ED3CDDF3DAF4ED.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{710f4c1c-cc18-4c49-8cbf-51240c89a1a2} msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240419174248341.0\mfcm80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240419174248419.0\mfc80ESP.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240419174248497.1\8.0.50727.6195.policy msiexec.exe File created C:\Windows\Installer\e57ab19.msi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240419174248232.0\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_a4c618fa.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240419174248482.0\vcomp.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240419174248232.0\ATL80.dll msiexec.exe File opened for modification C:\Windows\Installer\MSIB0E2.tmp msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240419174248341.0\mfc80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240419174248497.0\8.0.50727.6195.cat msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240419174248279.0 msiexec.exe File created C:\Windows\SystemTemp\~DF722B3E725D5916DF.TMP msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240419174248482.0\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_452bf920.cat msiexec.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
vssvc.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000007479042406fce8490000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000747904240000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090074790424000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d74790424000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000007479042400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe -
Modifies data under HKEY_USERS 3 IoCs
Processes:
msiexec.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 msiexec.exe -
Modifies registry class 56 IoCs
Processes:
msiexec.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AA5D9C68C00F12943B2F6CA09FE28244 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFC,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e003d0024006b00600049004e005d00490038004300650038004d006b0062004900640046007700550000000000 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\c1c4f01781cc94c4c8fb1542c0981a2a\Servicing_Key msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\DeploymentFlags = "3" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.ATL,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e0036006b007d00700048004c004800240053004400650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\6 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\7 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\2 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\3 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\8 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Win32Assemblies\Global msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFC,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e0021004d00210026005a005a006300300025006e00650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\5 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\11 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFCLOC,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e006900450024005b004d00310025002e0064002700650038004d006b0062004900640046007700550000000000 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Net msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFCLOC,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e006600720038005f006c0028006d0032004e004400650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.OpenMP,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e00370030002d0054002400210028002a0026004e00650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\PackageName = "vcredist.msi" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.CRT,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e0061005a004f002c0048002a004b00320060004500650038004d006b0062004900640046007700550000000000 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.OpenMP,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e0035006f00300068002c0070004d0076004e003d00650038004d006b0062004900640046007700550000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Features\c1c4f01781cc94c4c8fb1542c0981a2a msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.ATL,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e00700052005e007000580049006000510075006f00650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.CRT,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e005f006a0030002c0059005d007300210053006f00650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\PackageCode = "84067013B7B56744BA0F51892982BC09" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\Version = "134278729" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\4 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\c1c4f01781cc94c4c8fb1542c0981a2a\VC_Redist msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\ProductName = "Microsoft Visual C++ 2005 Redistributable" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\Language = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\c1c4f01781cc94c4c8fb1542c0981a2a msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\1 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\9 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\10 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AA5D9C68C00F12943B2F6CA09FE28244 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AA5D9C68C00F12943B2F6CA09FE28244\c1c4f01781cc94c4c8fb1542c0981a2a msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\c1c4f01781cc94c4c8fb1542c0981a2a msiexec.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
msiexec.exepid process 3908 msiexec.exe 3908 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
msiexec.exemsiexec.exevssvc.exedescription pid process Token: SeShutdownPrivilege 2900 msiexec.exe Token: SeIncreaseQuotaPrivilege 2900 msiexec.exe Token: SeSecurityPrivilege 3908 msiexec.exe Token: SeCreateTokenPrivilege 2900 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2900 msiexec.exe Token: SeLockMemoryPrivilege 2900 msiexec.exe Token: SeIncreaseQuotaPrivilege 2900 msiexec.exe Token: SeMachineAccountPrivilege 2900 msiexec.exe Token: SeTcbPrivilege 2900 msiexec.exe Token: SeSecurityPrivilege 2900 msiexec.exe Token: SeTakeOwnershipPrivilege 2900 msiexec.exe Token: SeLoadDriverPrivilege 2900 msiexec.exe Token: SeSystemProfilePrivilege 2900 msiexec.exe Token: SeSystemtimePrivilege 2900 msiexec.exe Token: SeProfSingleProcessPrivilege 2900 msiexec.exe Token: SeIncBasePriorityPrivilege 2900 msiexec.exe Token: SeCreatePagefilePrivilege 2900 msiexec.exe Token: SeCreatePermanentPrivilege 2900 msiexec.exe Token: SeBackupPrivilege 2900 msiexec.exe Token: SeRestorePrivilege 2900 msiexec.exe Token: SeShutdownPrivilege 2900 msiexec.exe Token: SeDebugPrivilege 2900 msiexec.exe Token: SeAuditPrivilege 2900 msiexec.exe Token: SeSystemEnvironmentPrivilege 2900 msiexec.exe Token: SeChangeNotifyPrivilege 2900 msiexec.exe Token: SeRemoteShutdownPrivilege 2900 msiexec.exe Token: SeUndockPrivilege 2900 msiexec.exe Token: SeSyncAgentPrivilege 2900 msiexec.exe Token: SeEnableDelegationPrivilege 2900 msiexec.exe Token: SeManageVolumePrivilege 2900 msiexec.exe Token: SeImpersonatePrivilege 2900 msiexec.exe Token: SeCreateGlobalPrivilege 2900 msiexec.exe Token: SeBackupPrivilege 2776 vssvc.exe Token: SeRestorePrivilege 2776 vssvc.exe Token: SeAuditPrivilege 2776 vssvc.exe Token: SeBackupPrivilege 3908 msiexec.exe Token: SeRestorePrivilege 3908 msiexec.exe Token: SeRestorePrivilege 3908 msiexec.exe Token: SeTakeOwnershipPrivilege 3908 msiexec.exe Token: SeRestorePrivilege 3908 msiexec.exe Token: SeTakeOwnershipPrivilege 3908 msiexec.exe Token: SeRestorePrivilege 3908 msiexec.exe Token: SeTakeOwnershipPrivilege 3908 msiexec.exe Token: SeRestorePrivilege 3908 msiexec.exe Token: SeTakeOwnershipPrivilege 3908 msiexec.exe Token: SeRestorePrivilege 3908 msiexec.exe Token: SeTakeOwnershipPrivilege 3908 msiexec.exe Token: SeRestorePrivilege 3908 msiexec.exe Token: SeTakeOwnershipPrivilege 3908 msiexec.exe Token: SeRestorePrivilege 3908 msiexec.exe Token: SeTakeOwnershipPrivilege 3908 msiexec.exe Token: SeRestorePrivilege 3908 msiexec.exe Token: SeTakeOwnershipPrivilege 3908 msiexec.exe Token: SeRestorePrivilege 3908 msiexec.exe Token: SeTakeOwnershipPrivilege 3908 msiexec.exe Token: SeRestorePrivilege 3908 msiexec.exe Token: SeTakeOwnershipPrivilege 3908 msiexec.exe Token: SeRestorePrivilege 3908 msiexec.exe Token: SeTakeOwnershipPrivilege 3908 msiexec.exe Token: SeRestorePrivilege 3908 msiexec.exe Token: SeTakeOwnershipPrivilege 3908 msiexec.exe Token: SeRestorePrivilege 3908 msiexec.exe Token: SeTakeOwnershipPrivilege 3908 msiexec.exe Token: SeRestorePrivilege 3908 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
msiexec.exepid process 2900 msiexec.exe 2900 msiexec.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
vcredist2005_x86.exemsiexec.exedescription pid process target process PID 4756 wrote to memory of 2900 4756 vcredist2005_x86.exe msiexec.exe PID 4756 wrote to memory of 2900 4756 vcredist2005_x86.exe msiexec.exe PID 4756 wrote to memory of 2900 4756 vcredist2005_x86.exe msiexec.exe PID 3908 wrote to memory of 4688 3908 msiexec.exe srtasks.exe PID 3908 wrote to memory of 4688 3908 msiexec.exe srtasks.exe PID 3908 wrote to memory of 4880 3908 msiexec.exe MsiExec.exe PID 3908 wrote to memory of 4880 3908 msiexec.exe MsiExec.exe PID 3908 wrote to memory of 4880 3908 msiexec.exe MsiExec.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Call of Duty Modern Warfare 3 DX12 Error Fixed Pack By ZOHAIB ROCK\runtime c++\vcredist2005_x86.exe"C:\Users\Admin\AppData\Local\Temp\Call of Duty Modern Warfare 3 DX12 Error Fixed Pack By ZOHAIB ROCK\runtime c++\vcredist2005_x86.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec /i vcredist.msi2⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 2C956986A1D7093FCB428BDF305D46E42⤵
- Loads dropped DLL
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredis1.cabFilesize
247KB
MD5cc064d4b81619991de8131a86ad77681
SHA188d80d86cc20c27d7d2a872af719300bd2bb73f9
SHA256913ee5a1cae3e5a1872b3a5efaaa00c58e4beb692492b138f76967da671b0477
SHA5125aff0eb26cfc187bf58721b2b6d73357d9f1e66d1ac5340ad9ddc08b40ad0eda27a144cb3b650604637a7476c282ded83ed890de98a73ccaf0cc021da3a9eb25
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredist.msiFilesize
2.6MB
MD5b20bbeb818222b657df49a9cfe4fed79
SHA13f6508e880b86502773a3275bc9527f046d45502
SHA25691bdd063f6c53126737791c9eccf0b2f4cf44927831527245bc89a0be06c0cb4
SHA512f534bc7bf1597e728940e6c3b77f864adfaa413bb1e080458326b692b0f96bddf4fbd294eeed36d7764a3578e6c8e919488bbf63b8fe2d4355ab3efd685424a4
-
C:\Windows\Installer\MSIADF3.tmpFilesize
28KB
MD585221b3bcba8dbe4b4a46581aa49f760
SHA1746645c92594bfc739f77812d67cfd85f4b92474
SHA256f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f
SHA512060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d
-
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2Filesize
12.8MB
MD53797506968c646308a472b11ae0c5268
SHA1cb98751d5a91f1724502b2e0cc3ff83cdcfd0535
SHA25617133895ddfeafa71d11f2b3788bf31cb2a42db3abbf7430b22ec47fb84c99fe
SHA5125efc7d098d7876915192db6927171163625dd68dc7349613dd398033efa2b55b2079ee4f16d3ef9dace26d55a3abde573612b5b3e013506d0b421ec14127e5c7
-
\??\Volume{24047974-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{c84fa561-3a3e-4746-bb78-b9396537a286}_OnDiskSnapshotPropFilesize
6KB
MD530f58f2963ffd3f8d694595f08bcdd1c
SHA19b2759d354f8a3c00dfcc29e0e60f08c5f89479c
SHA25651ad04af064c182fafea208b54057f62cf806b17f5886d794bc7a1662595ee76
SHA512f903c4e44a7e033a01ba4a47558b79c3c8bdb0fd38e058e5bb9bc28f1631a9f7e6ec07c10023251c9005cc01f0d8ba0083d5822e362a555412c1052b7f11fabf