Overview
overview
10Static
static
3RADCUI/RADCUI.dll
windows10-2004-x64
10RADCUI/pidgenx.dll
windows10-2004-x64
1RADCUI/termsrv.dll
windows10-2004-x64
1cdosys/cdosys.dll
windows10-2004-x64
1iasnap/iasnap.dll
windows10-2004-x64
1iasnap/mfds.dll
windows10-2004-x64
7iasnap/mprddm.dll
windows10-2004-x64
1setup.msi
windows7-x64
6setup.msi
windows10-2004-x64
10winmde/MMDevAPI.dll
windows10-2004-x64
1winmde/Win...cs.dll
windows10-2004-x64
1winmde/daxexec.dll
windows10-2004-x64
1winmde/mi.dll
windows10-2004-x64
1winmde/winmde.dll
windows10-2004-x64
1Analysis
-
max time kernel
119s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27-04-2024 22:49
Static task
static1
Behavioral task
behavioral1
Sample
RADCUI/RADCUI.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
RADCUI/pidgenx.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
RADCUI/termsrv.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
cdosys/cdosys.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
iasnap/iasnap.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
iasnap/mfds.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
iasnap/mprddm.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
setup.msi
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral9
Sample
setup.msi
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
winmde/MMDevAPI.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
winmde/Windows.Graphics.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
winmde/daxexec.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
winmde/mi.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
winmde/winmde.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
General
-
Target
setup.msi
-
Size
8.4MB
-
MD5
7d0e7e9083315bddec9bbc60fbf30ba3
-
SHA1
008eb06db4a300ae988ea004503382bec53f0743
-
SHA256
572e7f82c29a2be6f927cb28c1125eb4f7e62f0d5e82e8489706a64e8e8302e2
-
SHA512
8678ee4b95226e57d4ed867a3cec5827b01389e4542dccab48e11b10b14966117c698c4bd4e02ed752fb8383459a12b1d6cde3a6fdbe9bb87f4005ae72cab0bc
-
SSDEEP
196608:KN6gYGIfVlhQ+gtODuwjWT6mPY6T/9dFr5Wfbr:KD3IfVlhQ+glwY6ArT6fb
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI98AB.tmp msiexec.exe File opened for modification C:\Windows\Installer\f768115.ipi msiexec.exe File opened for modification C:\Windows\Installer\f768112.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI81AE.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI85D5.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI86FE.tmp msiexec.exe File created C:\Windows\Installer\f768117.msi msiexec.exe File created C:\Windows\Installer\f768112.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI8509.tmp msiexec.exe File created C:\Windows\Installer\f768115.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe -
Loads dropped DLL 4 IoCs
pid Process 2844 MsiExec.exe 2844 MsiExec.exe 2844 MsiExec.exe 2844 MsiExec.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2696 powershell.exe 2220 msiexec.exe 2220 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2756 msiexec.exe Token: SeIncreaseQuotaPrivilege 2756 msiexec.exe Token: SeRestorePrivilege 2220 msiexec.exe Token: SeTakeOwnershipPrivilege 2220 msiexec.exe Token: SeSecurityPrivilege 2220 msiexec.exe Token: SeCreateTokenPrivilege 2756 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2756 msiexec.exe Token: SeLockMemoryPrivilege 2756 msiexec.exe Token: SeIncreaseQuotaPrivilege 2756 msiexec.exe Token: SeMachineAccountPrivilege 2756 msiexec.exe Token: SeTcbPrivilege 2756 msiexec.exe Token: SeSecurityPrivilege 2756 msiexec.exe Token: SeTakeOwnershipPrivilege 2756 msiexec.exe Token: SeLoadDriverPrivilege 2756 msiexec.exe Token: SeSystemProfilePrivilege 2756 msiexec.exe Token: SeSystemtimePrivilege 2756 msiexec.exe Token: SeProfSingleProcessPrivilege 2756 msiexec.exe Token: SeIncBasePriorityPrivilege 2756 msiexec.exe Token: SeCreatePagefilePrivilege 2756 msiexec.exe Token: SeCreatePermanentPrivilege 2756 msiexec.exe Token: SeBackupPrivilege 2756 msiexec.exe Token: SeRestorePrivilege 2756 msiexec.exe Token: SeShutdownPrivilege 2756 msiexec.exe Token: SeDebugPrivilege 2756 msiexec.exe Token: SeAuditPrivilege 2756 msiexec.exe Token: SeSystemEnvironmentPrivilege 2756 msiexec.exe Token: SeChangeNotifyPrivilege 2756 msiexec.exe Token: SeRemoteShutdownPrivilege 2756 msiexec.exe Token: SeUndockPrivilege 2756 msiexec.exe Token: SeSyncAgentPrivilege 2756 msiexec.exe Token: SeEnableDelegationPrivilege 2756 msiexec.exe Token: SeManageVolumePrivilege 2756 msiexec.exe Token: SeImpersonatePrivilege 2756 msiexec.exe Token: SeCreateGlobalPrivilege 2756 msiexec.exe Token: SeRestorePrivilege 2220 msiexec.exe Token: SeTakeOwnershipPrivilege 2220 msiexec.exe Token: SeRestorePrivilege 2220 msiexec.exe Token: SeTakeOwnershipPrivilege 2220 msiexec.exe Token: SeRestorePrivilege 2220 msiexec.exe Token: SeTakeOwnershipPrivilege 2220 msiexec.exe Token: SeRestorePrivilege 2220 msiexec.exe Token: SeTakeOwnershipPrivilege 2220 msiexec.exe Token: SeRestorePrivilege 2220 msiexec.exe Token: SeTakeOwnershipPrivilege 2220 msiexec.exe Token: SeDebugPrivilege 2696 powershell.exe Token: SeRestorePrivilege 2220 msiexec.exe Token: SeTakeOwnershipPrivilege 2220 msiexec.exe Token: SeRestorePrivilege 2220 msiexec.exe Token: SeTakeOwnershipPrivilege 2220 msiexec.exe Token: SeRestorePrivilege 2220 msiexec.exe Token: SeTakeOwnershipPrivilege 2220 msiexec.exe Token: SeRestorePrivilege 2220 msiexec.exe Token: SeTakeOwnershipPrivilege 2220 msiexec.exe Token: SeRestorePrivilege 2220 msiexec.exe Token: SeTakeOwnershipPrivilege 2220 msiexec.exe Token: SeRestorePrivilege 2220 msiexec.exe Token: SeTakeOwnershipPrivilege 2220 msiexec.exe Token: SeRestorePrivilege 2220 msiexec.exe Token: SeTakeOwnershipPrivilege 2220 msiexec.exe Token: SeRestorePrivilege 2220 msiexec.exe Token: SeTakeOwnershipPrivilege 2220 msiexec.exe Token: SeRestorePrivilege 2220 msiexec.exe Token: SeTakeOwnershipPrivilege 2220 msiexec.exe Token: SeRestorePrivilege 2220 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2756 msiexec.exe 2756 msiexec.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2220 wrote to memory of 2844 2220 msiexec.exe 29 PID 2220 wrote to memory of 2844 2220 msiexec.exe 29 PID 2220 wrote to memory of 2844 2220 msiexec.exe 29 PID 2220 wrote to memory of 2844 2220 msiexec.exe 29 PID 2220 wrote to memory of 2844 2220 msiexec.exe 29 PID 2220 wrote to memory of 2844 2220 msiexec.exe 29 PID 2220 wrote to memory of 2844 2220 msiexec.exe 29 PID 2844 wrote to memory of 2696 2844 MsiExec.exe 30 PID 2844 wrote to memory of 2696 2844 MsiExec.exe 30 PID 2844 wrote to memory of 2696 2844 MsiExec.exe 30 PID 2844 wrote to memory of 2696 2844 MsiExec.exe 30
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\setup.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2756
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A31B46C1B271D0DB86FC5134D459310E2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe-NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss895E.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msi894C.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scr894D.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scr894E.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2696
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17KB
MD5a5ff96315d8e674244880886ad0b4910
SHA1c4add0479ef6c53da5e54cac0b01ddac171b769f
SHA2562fa98c9df133aee62fc6ce41954cb4e6dce749474183af5a15908af546053a65
SHA512772d276d99c2482dd7724a40fefcf1708f2cf3bf5e3955118206c696340b37c7b17a636fedce7ee1782039c33cb45b150520bfe737abe71d234cfe9c3e41df6f
-
Filesize
42B
MD50fb609a6d2027ec24eb33cf64bd95b20
SHA1ec07f4535b17f362ba12924d62fd952a93e61547
SHA256b9227e3366d64bcf11da5683b8fc1d5e10afa40b66434ddb7b279f835a9401c9
SHA512cc522dfac8b6958b97cc495af936b7c716199d1b257f3aa4f9eaf08a78f003c5a4ea8b90ab506db46ea751988d51b0f99bea9fdbcc46037b4c0997ccb86557b3
-
Filesize
6KB
MD530c30ef2cb47e35101d13402b5661179
SHA125696b2aab86a9233f19017539e2dd83b2f75d4e
SHA25653094df6fa4e57a3265ff04bc1e970c10bcdb3d4094ad6dd610c05b7a8b79e0f
SHA512882be2768138bb75ff7dde7d5ca4c2e024699398baacd0ce1d4619902402e054297e4f464d8cb3c22b2f35d3dabc408122c207facad64ec8014f2c54834cf458
-
Filesize
542B
MD5753240f3d0c58563dcba1244db69b0d7
SHA14a0f248fccc2431ece50f717cbf80f6681504932
SHA256e77dbd670eaa228e96cb8ab002b0aa7f55a78779fb58754436ec691e6de14e5a
SHA51203987837557d6342280d7871b19472e7c05cabc203824081f6fff38083ecef2da8135642644b598b21ee294816d1ed22d0573db04e5c739b2b08c28f7c441ae9
-
Filesize
792KB
MD5ed2da404c1bc70efc1a249f609a9cedd
SHA18abbf1a5b85d678385764cceb7457988beaf5117
SHA256b4acc6c738ec4a72209ec67f3c1f8fd7e23fe4fe493686d2bc5c59dca26b9ac5
SHA512ad997bd588c7c9867b198a0c4233d842a760176df653b457580bb6b6c9ccb1c751d999aba80de36182d42ea6549335ff6c67b3134655d60bf1e51fce1d93ec6b
-
Filesize
738KB
MD5b158d8d605571ea47a238df5ab43dfaa
SHA1bb91ae1f2f7142b9099e3cc285f4f5b84de568e4
SHA256ca763693cc25d316f14a9ebad80ebf00590329550c45adb7e5205486533c2504
SHA51256aef59c198acf2fcd0d95ea6e32ce1c706e5098a0800feff13ddb427bfb4d538de1c415a5cb5496b09a5825155e3abb1c13c8c37dc31549604bd4d63cb70591
-
Filesize
758KB
MD5fb4665320c9da54598321c59cc5ed623
SHA189e87b3cc569edd26b5805244cfacb2f9c892bc7
SHA2569fb3156c665211a0081b189142c1d1ab18cda601ee54d5f5d8883ecfa4177a59
SHA512b205552a3cfbaa2202e6ef7e39e229af167b2342a7dc4a2f4cadfe4d05000966cf19e9e208e44d6bb0fd6a56f4283caeed9c13f523e5b301b87f79febb1840cf
-
Filesize
8.4MB
MD57d0e7e9083315bddec9bbc60fbf30ba3
SHA1008eb06db4a300ae988ea004503382bec53f0743
SHA256572e7f82c29a2be6f927cb28c1125eb4f7e62f0d5e82e8489706a64e8e8302e2
SHA5128678ee4b95226e57d4ed867a3cec5827b01389e4542dccab48e11b10b14966117c698c4bd4e02ed752fb8383459a12b1d6cde3a6fdbe9bb87f4005ae72cab0bc