48d75213df96f594a6d84b0c9346338d7569ff5a9558174998dca5f2f43919af

Analysis

max time kernel
121s
max time network
145s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
23-04-2024 23:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OFFICE2016/groove.es-es/groovemui.msi
Size

2.3MB
MD5

e50796bc085e0be45df6f0f61819ac16
SHA1

cd7d5515646fb357e879def013d2ff49149c6a90
SHA256

8c0411e735d2e7feb7b6000bb572f5c2b7dba6b5eb88f4507687812c9400f823
SHA512

c9d804399ef5a7d54c50a09905d10383eb89b4726b95fafe84d03633ea50062db575afb337cf810ca3fa13a0d7fb42647bcb17b728b6244b3e8e1dc3db88a0b2
SSDEEP

49152:ZhIu+svi4ut1yFXyzEKqle+93GwtF2VbJPkXt:ZhIuFvPut1WKM3Gw7Yb

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe

Drops file in Windows directory 7 IoCs

Processes:

DrvInst.exemsiexec.exe

description	ioc	process
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\f768334.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f768334.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI83C2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8597.tmp	msiexec.exe

Loads dropped DLL 2 IoCs

Processes:

MsiExec.exe

pid process

2332 MsiExec.exe
2332 MsiExec.exe

pid	process
2332	MsiExec.exe
2332	MsiExec.exe

Modifies data under HKEY_USERS 43 IoCs

Processes:

DrvInst.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

msiexec.exe

pid process

1792 msiexec.exe

pid	process
1792	msiexec.exe

Suspicious use of AdjustPrivilegeToken 55 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exeDrvInst.exe

description	pid	process
Token: SeShutdownPrivilege	1792	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1792	msiexec.exe
Token: SeRestorePrivilege	2644	msiexec.exe
Token: SeTakeOwnershipPrivilege	2644	msiexec.exe
Token: SeSecurityPrivilege	2644	msiexec.exe
Token: SeCreateTokenPrivilege	1792	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1792	msiexec.exe
Token: SeLockMemoryPrivilege	1792	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1792	msiexec.exe
Token: SeMachineAccountPrivilege	1792	msiexec.exe
Token: SeTcbPrivilege	1792	msiexec.exe
Token: SeSecurityPrivilege	1792	msiexec.exe
Token: SeTakeOwnershipPrivilege	1792	msiexec.exe
Token: SeLoadDriverPrivilege	1792	msiexec.exe
Token: SeSystemProfilePrivilege	1792	msiexec.exe
Token: SeSystemtimePrivilege	1792	msiexec.exe
Token: SeProfSingleProcessPrivilege	1792	msiexec.exe
Token: SeIncBasePriorityPrivilege	1792	msiexec.exe
Token: SeCreatePagefilePrivilege	1792	msiexec.exe
Token: SeCreatePermanentPrivilege	1792	msiexec.exe
Token: SeBackupPrivilege	1792	msiexec.exe
Token: SeRestorePrivilege	1792	msiexec.exe
Token: SeShutdownPrivilege	1792	msiexec.exe
Token: SeDebugPrivilege	1792	msiexec.exe
Token: SeAuditPrivilege	1792	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1792	msiexec.exe
Token: SeChangeNotifyPrivilege	1792	msiexec.exe
Token: SeRemoteShutdownPrivilege	1792	msiexec.exe
Token: SeUndockPrivilege	1792	msiexec.exe
Token: SeSyncAgentPrivilege	1792	msiexec.exe
Token: SeEnableDelegationPrivilege	1792	msiexec.exe
Token: SeManageVolumePrivilege	1792	msiexec.exe
Token: SeImpersonatePrivilege	1792	msiexec.exe
Token: SeCreateGlobalPrivilege	1792	msiexec.exe
Token: SeBackupPrivilege	2552	vssvc.exe
Token: SeRestorePrivilege	2552	vssvc.exe
Token: SeAuditPrivilege	2552	vssvc.exe
Token: SeBackupPrivilege	2644	msiexec.exe
Token: SeRestorePrivilege	2644	msiexec.exe
Token: SeRestorePrivilege	2372	DrvInst.exe
Token: SeRestorePrivilege	2372	DrvInst.exe
Token: SeRestorePrivilege	2372	DrvInst.exe
Token: SeRestorePrivilege	2372	DrvInst.exe
Token: SeRestorePrivilege	2372	DrvInst.exe
Token: SeRestorePrivilege	2372	DrvInst.exe
Token: SeRestorePrivilege	2372	DrvInst.exe
Token: SeLoadDriverPrivilege	2372	DrvInst.exe
Token: SeLoadDriverPrivilege	2372	DrvInst.exe
Token: SeLoadDriverPrivilege	2372	DrvInst.exe
Token: SeRestorePrivilege	2644	msiexec.exe
Token: SeTakeOwnershipPrivilege	2644	msiexec.exe
Token: SeRestorePrivilege	2644	msiexec.exe
Token: SeTakeOwnershipPrivilege	2644	msiexec.exe
Token: SeRestorePrivilege	2644	msiexec.exe
Token: SeTakeOwnershipPrivilege	2644	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

msiexec.exe

pid process

1792 msiexec.exe

pid	process
1792	msiexec.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

msiexec.exe

description	pid	process	target process
PID 2644 wrote to memory of 2332	2644	msiexec.exe	MsiExec.exe
PID 2644 wrote to memory of 2332	2644	msiexec.exe	MsiExec.exe
PID 2644 wrote to memory of 2332	2644	msiexec.exe	MsiExec.exe
PID 2644 wrote to memory of 2332	2644	msiexec.exe	MsiExec.exe
PID 2644 wrote to memory of 2332	2644	msiexec.exe	MsiExec.exe
PID 2644 wrote to memory of 2332	2644	msiexec.exe	MsiExec.exe
PID 2644 wrote to memory of 2332	2644	msiexec.exe	MsiExec.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\OFFICE2016\groove.es-es\groovemui.msi
1⤵
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1792

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2644

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 5CBAA474ADADA129B771DBD912A586FC
2⤵
- Loads dropped DLL
PID:2332

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2552

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005A4" "00000000000002D0"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2372

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
425291666f9608b1470f045ba7dea496

SHA1
cf80403163f894e9a4e19d1d2e98908a2459839c

SHA256
3e08771f56e054f4e305ec56c2693aa4e150dc0fa1c31f768387e37ad8337fd4

SHA512
09af492a95198e1b84133fa30965b80a0e6957f012897a941be58c949147339fa44a6a1d5762a8a1d10b2aa41aeed1aa223a9728bf8041f17c1ec9de8b8e50f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8382.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Windows\Installer\MSI83C2.tmp
Filesize
95KB

MD5
acfd123d0e36411b9c1f556853dd9ea5

SHA1
812025408e21687dcd6e8eeb1667025a7b7abcbf

SHA256
d89dd83af50bfc6e325e2b4e7eecd982ec3ddee9ccb9cfef86d8a5593907c317

SHA512
e01da6d2867ca5a029d60bac781cef6639485255ce515bc8e094a43fa107b0d8c120b7bb3de75457407479de71585dfd9475b1b1f39d2d82d303586ccdb9024d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads