c6de06a61756dc3b5d4ee71674d4132971fb7ed8db7b2e504905f23571ed7bf2

Analysis

max time kernel
60s
max time network
58s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 06:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

oxc.msi
Size

3.4MB
MD5

b1ae202dc4e66b9a125d28fe4680fe42
SHA1

f87422fa9ac8c2b52eb99f3616335c1484db8857
SHA256

c6de06a61756dc3b5d4ee71674d4132971fb7ed8db7b2e504905f23571ed7bf2
SHA512

dede0c88db06c4912d0e57fcba472b522eb6a2d2bbca62f8616bfa3df6c93301486172b03992a6dfefda77f4a89711c70dcc89c1d78e79574a7122f1c57b5ac1
SSDEEP

98304:DpkchD0ow0KHR8h/YM9dWhX+Rdx42lfyZc4vOKl4:ecFBw00R8h/YMauRr42lY2

Score

7^/10

discovery persistence

Malware Config

Signatures

Modifies file permissions 1 TTPs 2 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

ICACLS.EXEICACLS.EXE

pid process

640 ICACLS.EXE
1152 ICACLS.EXE

pid	process
640	ICACLS.EXE
1152	ICACLS.EXE

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\HomeDLL = "C:\\Windows\\SysWOW64\\rundll32 /sta {AAE802DB-FB67-4407-A175-61223EFF30D4}"	reg.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 1096 set thread context of 2340 1096 rundll32.exe WINDBVERS.EXE

description	pid	process	target process
PID 1096 set thread context of 2340	1096	rundll32.exe	WINDBVERS.EXE

Drops file in Windows directory 11 IoCs

Processes:

DrvInst.exemsiexec.exeEXPAND.EXE

description	ioc	process
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\f763d3f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3E0A.tmp	msiexec.exe
File opened for modification	C:\Windows\Logs\DPX\setupact.log	EXPAND.EXE
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File created	C:\Windows\Installer\f763d3f.msi	msiexec.exe
File created	C:\Windows\Installer\f763d40.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Logs\DPX\setuperr.log	EXPAND.EXE
File opened for modification	C:\Windows\Installer\f763d40.ipi	msiexec.exe

Executes dropped EXE 2 IoCs

Processes:

elevate.exeWINDBVERS.EXE

pid process

1972 elevate.exe
2340 WINDBVERS.EXE

pid	process
1972	elevate.exe
2340	WINDBVERS.EXE

Loads dropped DLL 10 IoCs

Processes:

MsiExec.exerundll32.exerundll32.exe

pid	process
1820	MsiExec.exe
1820	MsiExec.exe
1820	MsiExec.exe
1820	MsiExec.exe
1820	MsiExec.exe
2428	rundll32.exe
1096	rundll32.exe
1096	rundll32.exe
1096	rundll32.exe
1096	rundll32.exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Processes:

reg.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Wow6432Node\CLSID\{AAE802DB-FB67-4407-A175-61223EFF30D4}\InprocServer32	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Wow6432Node\CLSID\{AAE802DB-FB67-4407-A175-61223EFF30D4}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\WMProjectFiles\\soundtrack.ocx"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Wow6432Node\CLSID\{AAE802DB-FB67-4407-A175-61223EFF30D4}\InprocServer32\ThreadingModel = "Apartment"	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2972 2428 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2972	2428	WerFault.exe	rundll32.exe

Modifies data under HKEY_USERS 43 IoCs

Processes:

DrvInst.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe

Modifies registry class 16 IoCs

Processes:

reg.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Wow6432Node\CLSID\{AAE802DB-FB67-4407-A175-61223EFF30D4}\InprocServer32	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Wow6432Node\CLSID\{AAE802DB-FB67-4407-A175-61223EFF30D4}\VERSION\ = "1.0"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Wow6432Node\CLSID	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Wow6432Node\CLSID\{AAE802DB-FB67-4407-A175-61223EFF30D4}\ = "functions.under_review"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Wow6432Node\CLSID\{AAE802DB-FB67-4407-A175-61223EFF30D4}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	reg.exe
Key created	\Registry\User\S-1-5-21-2737914667-933161113-3798636211-1000_Classes\Wow6432Node\CLSID\{AAE802DB-FB67-4407-A175-61223EFF30D4}	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Wow6432Node\CLSID\{AAE802DB-FB67-4407-A175-61223EFF30D4}\ProgID	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Wow6432Node\CLSID\{AAE802DB-FB67-4407-A175-61223EFF30D4}\TypeLib	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Wow6432Node\CLSID\{AAE802DB-FB67-4407-A175-61223EFF30D4}	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Wow6432Node\CLSID\{AAE802DB-FB67-4407-A175-61223EFF30D4}\InprocServer32\ThreadingModel = "Apartment"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Wow6432Node\CLSID\{AAE802DB-FB67-4407-A175-61223EFF30D4}\ProgID\ = "functions.under_review"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Wow6432Node\CLSID\{AAE802DB-FB67-4407-A175-61223EFF30D4}\Programmable	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Wow6432Node\CLSID\{AAE802DB-FB67-4407-A175-61223EFF30D4}\VERSION	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Wow6432Node	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Wow6432Node\CLSID\{AAE802DB-FB67-4407-A175-61223EFF30D4}\Implemented Categories	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Wow6432Node\CLSID\{AAE802DB-FB67-4407-A175-61223EFF30D4}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\WMProjectFiles\\soundtrack.ocx"	reg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

msiexec.exe

pid process

2236 msiexec.exe
2236 msiexec.exe

pid	process
2236	msiexec.exe
2236	msiexec.exe

Suspicious use of AdjustPrivilegeToken 53 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exeDrvInst.exe

description	pid	process
Token: SeShutdownPrivilege	1692	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1692	msiexec.exe
Token: SeRestorePrivilege	2236	msiexec.exe
Token: SeTakeOwnershipPrivilege	2236	msiexec.exe
Token: SeSecurityPrivilege	2236	msiexec.exe
Token: SeCreateTokenPrivilege	1692	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1692	msiexec.exe
Token: SeLockMemoryPrivilege	1692	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1692	msiexec.exe
Token: SeMachineAccountPrivilege	1692	msiexec.exe
Token: SeTcbPrivilege	1692	msiexec.exe
Token: SeSecurityPrivilege	1692	msiexec.exe
Token: SeTakeOwnershipPrivilege	1692	msiexec.exe
Token: SeLoadDriverPrivilege	1692	msiexec.exe
Token: SeSystemProfilePrivilege	1692	msiexec.exe
Token: SeSystemtimePrivilege	1692	msiexec.exe
Token: SeProfSingleProcessPrivilege	1692	msiexec.exe
Token: SeIncBasePriorityPrivilege	1692	msiexec.exe
Token: SeCreatePagefilePrivilege	1692	msiexec.exe
Token: SeCreatePermanentPrivilege	1692	msiexec.exe
Token: SeBackupPrivilege	1692	msiexec.exe
Token: SeRestorePrivilege	1692	msiexec.exe
Token: SeShutdownPrivilege	1692	msiexec.exe
Token: SeDebugPrivilege	1692	msiexec.exe
Token: SeAuditPrivilege	1692	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1692	msiexec.exe
Token: SeChangeNotifyPrivilege	1692	msiexec.exe
Token: SeRemoteShutdownPrivilege	1692	msiexec.exe
Token: SeUndockPrivilege	1692	msiexec.exe
Token: SeSyncAgentPrivilege	1692	msiexec.exe
Token: SeEnableDelegationPrivilege	1692	msiexec.exe
Token: SeManageVolumePrivilege	1692	msiexec.exe
Token: SeImpersonatePrivilege	1692	msiexec.exe
Token: SeCreateGlobalPrivilege	1692	msiexec.exe
Token: SeBackupPrivilege	2288	vssvc.exe
Token: SeRestorePrivilege	2288	vssvc.exe
Token: SeAuditPrivilege	2288	vssvc.exe
Token: SeBackupPrivilege	2236	msiexec.exe
Token: SeRestorePrivilege	2236	msiexec.exe
Token: SeRestorePrivilege	2700	DrvInst.exe
Token: SeRestorePrivilege	2700	DrvInst.exe
Token: SeRestorePrivilege	2700	DrvInst.exe
Token: SeRestorePrivilege	2700	DrvInst.exe
Token: SeRestorePrivilege	2700	DrvInst.exe
Token: SeRestorePrivilege	2700	DrvInst.exe
Token: SeRestorePrivilege	2700	DrvInst.exe
Token: SeLoadDriverPrivilege	2700	DrvInst.exe
Token: SeLoadDriverPrivilege	2700	DrvInst.exe
Token: SeLoadDriverPrivilege	2700	DrvInst.exe
Token: SeRestorePrivilege	2236	msiexec.exe
Token: SeTakeOwnershipPrivilege	2236	msiexec.exe
Token: SeRestorePrivilege	2236	msiexec.exe
Token: SeTakeOwnershipPrivilege	2236	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

1692 msiexec.exe
1692 msiexec.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

rundll32.exerundll32.exeWINDBVERS.EXE

pid process

2428 rundll32.exe
2428 rundll32.exe
2428 rundll32.exe
2428 rundll32.exe
1096 rundll32.exe
2340 WINDBVERS.EXE

pid	process
1692	msiexec.exe
1692	msiexec.exe

pid	process
2428	rundll32.exe
2428	rundll32.exe
2428	rundll32.exe
2428	rundll32.exe
1096	rundll32.exe
2340	WINDBVERS.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msiexec.exeMsiExec.exerundll32.execmd.exerundll32.exe

description	pid	process	target process
PID 2236 wrote to memory of 1820	2236	msiexec.exe	MsiExec.exe
PID 2236 wrote to memory of 1820	2236	msiexec.exe	MsiExec.exe
PID 2236 wrote to memory of 1820	2236	msiexec.exe	MsiExec.exe
PID 2236 wrote to memory of 1820	2236	msiexec.exe	MsiExec.exe
PID 2236 wrote to memory of 1820	2236	msiexec.exe	MsiExec.exe
PID 2236 wrote to memory of 1820	2236	msiexec.exe	MsiExec.exe
PID 2236 wrote to memory of 1820	2236	msiexec.exe	MsiExec.exe
PID 1820 wrote to memory of 640	1820	MsiExec.exe	ICACLS.EXE
PID 1820 wrote to memory of 640	1820	MsiExec.exe	ICACLS.EXE
PID 1820 wrote to memory of 640	1820	MsiExec.exe	ICACLS.EXE
PID 1820 wrote to memory of 640	1820	MsiExec.exe	ICACLS.EXE
PID 1820 wrote to memory of 2316	1820	MsiExec.exe	EXPAND.EXE
PID 1820 wrote to memory of 2316	1820	MsiExec.exe	EXPAND.EXE
PID 1820 wrote to memory of 2316	1820	MsiExec.exe	EXPAND.EXE
PID 1820 wrote to memory of 2316	1820	MsiExec.exe	EXPAND.EXE
PID 1820 wrote to memory of 2068	1820	MsiExec.exe	reg.exe
PID 1820 wrote to memory of 2068	1820	MsiExec.exe	reg.exe
PID 1820 wrote to memory of 2068	1820	MsiExec.exe	reg.exe
PID 1820 wrote to memory of 2068	1820	MsiExec.exe	reg.exe
PID 1820 wrote to memory of 1972	1820	MsiExec.exe	elevate.exe
PID 1820 wrote to memory of 1972	1820	MsiExec.exe	elevate.exe
PID 1820 wrote to memory of 1972	1820	MsiExec.exe	elevate.exe
PID 1820 wrote to memory of 1972	1820	MsiExec.exe	elevate.exe
PID 1820 wrote to memory of 2428	1820	MsiExec.exe	rundll32.exe
PID 1820 wrote to memory of 2428	1820	MsiExec.exe	rundll32.exe
PID 1820 wrote to memory of 2428	1820	MsiExec.exe	rundll32.exe
PID 1820 wrote to memory of 2428	1820	MsiExec.exe	rundll32.exe
PID 1820 wrote to memory of 2428	1820	MsiExec.exe	rundll32.exe
PID 1820 wrote to memory of 2428	1820	MsiExec.exe	rundll32.exe
PID 1820 wrote to memory of 2428	1820	MsiExec.exe	rundll32.exe
PID 2428 wrote to memory of 1984	2428	rundll32.exe	cmd.exe
PID 2428 wrote to memory of 1984	2428	rundll32.exe	cmd.exe
PID 2428 wrote to memory of 1984	2428	rundll32.exe	cmd.exe
PID 2428 wrote to memory of 1984	2428	rundll32.exe	cmd.exe
PID 1984 wrote to memory of 2312	1984	cmd.exe	reg.exe
PID 1984 wrote to memory of 2312	1984	cmd.exe	reg.exe
PID 1984 wrote to memory of 2312	1984	cmd.exe	reg.exe
PID 1984 wrote to memory of 2312	1984	cmd.exe	reg.exe
PID 2428 wrote to memory of 1096	2428	rundll32.exe	rundll32.exe
PID 2428 wrote to memory of 1096	2428	rundll32.exe	rundll32.exe
PID 2428 wrote to memory of 1096	2428	rundll32.exe	rundll32.exe
PID 2428 wrote to memory of 1096	2428	rundll32.exe	rundll32.exe
PID 2428 wrote to memory of 1096	2428	rundll32.exe	rundll32.exe
PID 2428 wrote to memory of 1096	2428	rundll32.exe	rundll32.exe
PID 2428 wrote to memory of 1096	2428	rundll32.exe	rundll32.exe
PID 1096 wrote to memory of 2340	1096	rundll32.exe	WINDBVERS.EXE
PID 1096 wrote to memory of 2340	1096	rundll32.exe	WINDBVERS.EXE
PID 1096 wrote to memory of 2340	1096	rundll32.exe	WINDBVERS.EXE
PID 1096 wrote to memory of 2340	1096	rundll32.exe	WINDBVERS.EXE
PID 1096 wrote to memory of 2340	1096	rundll32.exe	WINDBVERS.EXE
PID 1096 wrote to memory of 2340	1096	rundll32.exe	WINDBVERS.EXE
PID 1096 wrote to memory of 2340	1096	rundll32.exe	WINDBVERS.EXE
PID 1096 wrote to memory of 2340	1096	rundll32.exe	WINDBVERS.EXE
PID 1096 wrote to memory of 2340	1096	rundll32.exe	WINDBVERS.EXE
PID 2428 wrote to memory of 2972	2428	rundll32.exe	WerFault.exe
PID 2428 wrote to memory of 2972	2428	rundll32.exe	WerFault.exe
PID 2428 wrote to memory of 2972	2428	rundll32.exe	WerFault.exe
PID 2428 wrote to memory of 2972	2428	rundll32.exe	WerFault.exe
PID 1820 wrote to memory of 920	1820	MsiExec.exe	cmd.exe
PID 1820 wrote to memory of 920	1820	MsiExec.exe	cmd.exe
PID 1820 wrote to memory of 920	1820	MsiExec.exe	cmd.exe
PID 1820 wrote to memory of 920	1820	MsiExec.exe	cmd.exe
PID 1820 wrote to memory of 1152	1820	MsiExec.exe	ICACLS.EXE
PID 1820 wrote to memory of 1152	1820	MsiExec.exe	ICACLS.EXE

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\oxc.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1692

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2236

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 9652C7FC340F54FCAD20D9DB57CFF127
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1820

C:\Windows\SysWOW64\ICACLS.EXE
"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-eca71443-d907-4e9a-84b7-71ce34581115\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
3⤵
- Modifies file permissions
PID:640

C:\Windows\SysWOW64\EXPAND.EXE
"C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
3⤵
- Drops file in Windows directory
PID:2316

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "HomeDLL" /t REG_SZ /F /D "C:\Windows\SysWOW64\rundll32 /sta {AAE802DB-FB67-4407-A175-61223EFF30D4}"
3⤵
- Adds Run key to start application
PID:2068

C:\Users\Admin\AppData\Local\Temp\MW-eca71443-d907-4e9a-84b7-71ce34581115\files\elevate.exe
"C:\Users\Admin\AppData\Local\Temp\MW-eca71443-d907-4e9a-84b7-71ce34581115\files\elevate.exe"
3⤵
- Executes dropped EXE
PID:1972

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" MAFWIKFNMUI9430.ocx, RunDllEntryPointW
3⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2428

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c cd C:\Users\Admin\AppData\Roaming\WMProjectFiles&&reg.exe import info.txt
4⤵
- Suspicious use of WriteProcessMemory
PID:1984

C:\Windows\SysWOW64\reg.exe
reg.exe import info.txt
5⤵
- Registers COM server for autorun
- Modifies registry class
PID:2312

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\SysWOW64\rundll32.exe" /sta {AAE802DB-FB67-4407-A175-61223EFF30D4}
4⤵
- Suspicious use of SetThreadContext
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1096

C:\Users\Admin\AppData\Roaming\ProductConfigurations\WINDBVERS.EXE
C:\Users\Admin\AppData\Roaming\ProductConfigurations\WINDBVERS.EXE
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 356
4⤵
- Program crash
PID:2972

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\Admin\AppData\Local\Temp\MW-eca71443-d907-4e9a-84b7-71ce34581115\files"
3⤵
PID:920

C:\Windows\SysWOW64\ICACLS.EXE
"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-eca71443-d907-4e9a-84b7-71ce34581115\." /SETINTEGRITYLEVEL (CI)(OI)LOW
3⤵
- Modifies file permissions
PID:1152

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2288

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005B8" "0000000000000584"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MW-eca71443-d907-4e9a-84b7-71ce34581115\files.cab

Filesize
3.2MB

MD5
2f807297f7a507ae395dbad419499fe7

SHA1
f6c3d7eb4ce30ac36ea14805a35c5d0e131af7a6

SHA256
f2894b5e9cc70bdadd842ea5cce47539b9ebfbe7f1873626477168a698468978

SHA512
9bc9e7a70a41c502833317506ddab8c723e76690346036da175e965ec85b72511b284e3cf1505be9a8ab8a6dc93834cacc8d1a26f5831846ab2bc4a9248c4d31

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-eca71443-d907-4e9a-84b7-71ce34581115\files\MAFWIKFNMUI9430.ocx

Filesize
3.1MB

MD5
7a969fb05e6382aa56fe5754e82fc179

SHA1
9f81731e391fadc79c170b4da2f01b21727e67be

SHA256
1cbb6ed84195d88da51de5ecf1fd06815d10b582942fb92266b34ceb5f77e826

SHA512
bc9926d8b073e0069caba3aba30302835ea90bc54d3cd7c284bacc08ad18f9523b13869c13b7e1861a77562a4e456f385067193fda5400eb79cfb9d3ac026069

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-eca71443-d907-4e9a-84b7-71ce34581115\files\Sound.mp3

Filesize
45KB

MD5
f3260efd0b21dde6a808319149614ac7

SHA1
c7aff49218b38624937742ac31854d77b086a55f

SHA256
3c55e3e41d4b12815dc543ca653d3d22dd3466c604f47498f8661a29d4c0c44f

SHA512
8d0602f072f12fe6a8fa73eabcc57712e95c72a4e32c144778b86d7b577b2cc1424e7dbf0e31bf6dc50787b25169dbe394d8c7d11e4fbffc96852dbb976e76cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-eca71443-d907-4e9a-84b7-71ce34581115\files\WMFile01.tmp

Filesize
7.9MB

MD5
bd21b0b1a2448fe8017532d94561f4d9

SHA1
3a046d4893f0fe702fdd0023cb4366368afcfd40

SHA256
759ae83bce7475dba576953992075942bcd6e1055e18555c9f9dfc81524107a2

SHA512
dd97d88b422be7c6b89ee5aceee59b72996367564b00eadcd04d6fe9ca03265ecae016c5205f43448b76496ac154f61de9856f2c4eca408c034a8d521b64f00b

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-eca71443-d907-4e9a-84b7-71ce34581115\files\elevate.exe

Filesize
116KB

MD5
beeb28be4600b914647ef7cb8dbdda87

SHA1
d36ce53c3703a2a438a253c9c90f71696fd0f909

SHA256
25f473f312de5dab2f6f8959d46da75f0e9d14ce8741d5cdcc29b29889cc14b1

SHA512
13de0290739236714b84c74f026e4a2614cf6cf2ab45c62397587eb7e56c2075f40c5a0d3ec4294b46b80582d623afd431b28e29b3a441bf4fa40892c2e5a05c

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-eca71443-d907-4e9a-84b7-71ce34581115\msiwrapper.ini

Filesize
382B

MD5
f8a61828398efab5cbe2460ba7e117f4

SHA1
ec383592b86089e12191978f0030c4389b3c1dab

SHA256
359ed512526e038c4ac7305d99c395712421a71d72f73eb586e1c57ff9e20a62

SHA512
70d4adc56ce66618266b0964ff61f2edd6418b8d1cc06f610ae6f70d52a286b0f63105694f438327f02d9ab2d5b33c3caa2dc5dcfd2ef7a6602f5218a01f72db

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-eca71443-d907-4e9a-84b7-71ce34581115\msiwrapper.ini

Filesize
1KB

MD5
2c44847f05c05b9d73f28a0207a1c21c

SHA1
137183b31ce3a6d5117c4ebf96bdb34b177e1554

SHA256
1e0e65c4e1669c0de3f2c60987582811c04c078ead79aa7388c75734eb2e6772

SHA512
456899d7dc2528474ec04395543a7713710d2e0103b752fb05b8395cf3063a0dfa2dae024fdf4b145eb866abcb8cd260274905f96d249502e287f17aefc8eae5

Download Submit
C:\Users\Admin\AppData\Roaming\WMProjectFiles\Video01.mp4

Filesize
13.0MB

MD5
3cc34d74677bcf9088c5c4666923476e

SHA1
429543d90147dd60525a3f76513eb1b22194bf56

SHA256
9c0e4999fcc2629ff921cc903b4bb3718f5983698b1c82826ac8b4a78117180b

SHA512
5162f8a100bb0a3d43da77e3393994907dbc7e332d5a57f535729ab7332ee15482508e13273bc649c043a8aca5465aaec2cdd6e5c227f45f1baa7afe01d7b3b5

Download Submit
C:\Users\Admin\AppData\Roaming\WMProjectFiles\info.txt

Filesize
1KB

MD5
56a1ad1818fb3bd63db9c8c86d40884e

SHA1
89a599219c4017b88b097ddef64939c1ea2083a3

SHA256
c8cb3dca3d91579f88e729e2a001869f0b4064246206a5be934834d77a831d56

SHA512
757b4323be249c5b1196a4c75c4de4af91f0ae06e8a4a03d20b86db1f2f607ee756dcd04f8f55949948178685b586fe64c488e9bd72080d62bc84497fb415764

Download Submit
C:\Users\Admin\AppData\Roaming\WMProjectFiles\info.txt

Filesize
1000B

MD5
c63bd4cff6dd7c34e32c46d372fde002

SHA1
4590da674e9f87ba109ec64ebc18fe4e24c65032

SHA256
01df3b4a70230a8eddd6334399f19864e218945adf2c42ce0c47f2be37482f18

SHA512
d19a40a55bb39f25af4ea967083fbf721387a504bc10badab8c95ce890ab2102101732359b3d51ef48042712799628a63407f7856de6c4b04fa03d79cd0f7981

Download Submit
C:\Users\Admin\AppData\Roaming\WMProjectFiles\soundtrack.ocx

Filesize
1.3MB

MD5
ecedc82a044dd6cce5e8dc1c811ea471

SHA1
11488750da5a36ca9bb531505fa55f789efc232a

SHA256
8f4c32cfe1a449fd8bdb929025f61522c574e82a3667c936a306f35976efe2de

SHA512
193c94332d49ba728a738e15b72a8c32bac2dca8909ff800bfa1f3136d91c9f0c9dee0cab748b4f3ad920d1c15ca62db5e50e313f99d1b8d580cc016a24ecf3d

Download Submit
C:\Windows\Installer\MSI3E0A.tmp

Filesize
208KB

MD5
0c8921bbcc37c6efd34faf44cf3b0cb5

SHA1
dcfa71246157edcd09eecaf9d4c5e360b24b3e49

SHA256
fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1

SHA512
ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108

Download Submit
\Users\Public\Libraries\WMFile01.dll

Filesize
7.9MB

MD5
b818d9388d7e8da45758e5a479ff8cc5

SHA1
d273dd3d22285821eb3263e2c0d61300cfddea24

SHA256
9254ba70d1139214015fbe3dee7edc1c68aeb0993fec0bd6cb14c30aff318f5c

SHA512
11322b5dac590f8812ba0217e096588aaf6c9c2a5ca52b52e92b4be99554437a96ad0afd6a942a075d840fe2cbb800a6d5f2c42793217bbc4aeb28755554a516

Download Submit
memory/1096-118-0x0000000003550000-0x0000000003D32000-memory.dmp

Filesize
7.9MB

Download
memory/2340-137-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2340-132-0x0000000000400000-0x00000000010FE000-memory.dmp

Filesize
13.0MB

Download
memory/2340-130-0x0000000000400000-0x00000000010FE000-memory.dmp

Filesize
13.0MB

Download
memory/2340-131-0x0000000000400000-0x00000000010FE000-memory.dmp

Filesize
13.0MB

Download
memory/2340-140-0x0000000000400000-0x00000000010FE000-memory.dmp

Filesize
13.0MB

Download
memory/2340-136-0x0000000000400000-0x00000000010FE000-memory.dmp

Filesize
13.0MB

Download
memory/2340-144-0x0000000000400000-0x00000000010FE000-memory.dmp

Filesize
13.0MB

Download
memory/2340-150-0x0000000000400000-0x00000000010FE000-memory.dmp

Filesize
13.0MB

Download