Analysis
-
max time kernel
68s -
max time network
69s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
02/06/2024, 11:11
Static task
static1
Behavioral task
behavioral1
Sample
True_Iron_1.3.3_Setup.exe
Resource
win10v2004-20240426-en
General
-
Target
True_Iron_1.3.3_Setup.exe
-
Size
92.7MB
-
MD5
54d20866e766b98563a35e5c3cd975d5
-
SHA1
363715e81337e43683657979590b0fc1c12b6786
-
SHA256
3640fec744dac2a93b4329665e4a74bd922ca337a7c4e3a6bddced670bae6478
-
SHA512
ac372813ec0a07009a215b890a4b5755c5401c2505c3d1fe2c3a9bd4feb414bae4c82c750e73f6ab3f19eb03efdcf24cc9a96f4aad9ee5aea13690b606a96c6f
-
SSDEEP
1572864:NU2YQ51drrmYJH/HcjYdy+Pg5PgXTrmWXvZ0M2D0Vsdf7ayCVWytBDv:NfAYBcklPCgf9fonf7YUyTDv
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation vc_redist.x64.exe -
Executes dropped EXE 4 IoCs
pid Process 2004 True_Iron_1.3.3_Setup.tmp 4924 vc_redist.x64.exe 4176 vc_redist.x64.exe 1644 VC_redist.x64.exe -
Loads dropped DLL 2 IoCs
pid Process 4176 vc_redist.x64.exe 3424 VC_redist.x64.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{3746f21b-c990-4045-bb33-1cf98cff7a68} = "\"C:\\ProgramData\\Package Cache\\{3746f21b-c990-4045-bb33-1cf98cff7a68}\\VC_redist.x64.exe\" /burn.runonce" VC_redist.x64.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Z: msiexec.exe -
Drops file in System32 directory 50 IoCs
description ioc Process File created C:\Windows\system32\msvcp140_atomic_wait.dll msiexec.exe File created C:\Windows\system32\mfc140ita.dll msiexec.exe File created C:\Windows\system32\msvcp140_2.dll msiexec.exe File created C:\Windows\system32\vcomp140.dll msiexec.exe File opened for modification C:\Windows\system32\concrt140.dll msiexec.exe File created C:\Windows\system32\mfc140chs.dll msiexec.exe File created C:\Windows\system32\mfc140enu.dll msiexec.exe File created C:\Windows\system32\mfc140esn.dll msiexec.exe File created C:\Windows\system32\mfc140u.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140deu.dll msiexec.exe File created C:\Windows\system32\mfc140cht.dll msiexec.exe File created C:\Windows\system32\mfc140kor.dll msiexec.exe File opened for modification C:\Windows\system32\vcamp140.dll msiexec.exe File created C:\Windows\system32\vcamp140.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140_codecvt_ids.dll msiexec.exe File created C:\Windows\system32\concrt140.dll msiexec.exe File created C:\Windows\system32\vccorlib140.dll msiexec.exe File created C:\Windows\system32\vcruntime140.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140esn.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140ita.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140_2.dll msiexec.exe File created C:\Windows\system32\vcruntime140_1.dll msiexec.exe File created C:\Windows\system32\mfc140rus.dll msiexec.exe File created C:\Windows\system32\mfcm140u.dll msiexec.exe File created C:\Windows\system32\msvcp140_codecvt_ids.dll msiexec.exe File created C:\Windows\system32\msvcp140.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140kor.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140rus.dll msiexec.exe File opened for modification C:\Windows\system32\vcruntime140_1.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140cht.dll msiexec.exe File created C:\Windows\system32\mfc140jpn.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140_1.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140.dll msiexec.exe File opened for modification C:\Windows\system32\mfcm140.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140.dll msiexec.exe File created C:\Windows\system32\mfc140deu.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140_atomic_wait.dll msiexec.exe File opened for modification C:\Windows\system32\vccorlib140.dll msiexec.exe File opened for modification C:\Windows\system32\vcomp140.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140u.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140jpn.dll msiexec.exe File created C:\Windows\system32\mfc140.dll msiexec.exe File opened for modification C:\Windows\system32\vcruntime140.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140fra.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140chs.dll msiexec.exe File opened for modification C:\Windows\system32\mfcm140u.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140enu.dll msiexec.exe File created C:\Windows\system32\mfc140fra.dll msiexec.exe File created C:\Windows\system32\mfcm140.dll msiexec.exe File created C:\Windows\system32\msvcp140_1.dll msiexec.exe -
Drops file in Program Files directory 8 IoCs
description ioc Process File created C:\Program Files\Kazrog\unins000.dat True_Iron_1.3.3_Setup.tmp File created C:\Program Files\Kazrog\is-8EKOC.tmp True_Iron_1.3.3_Setup.tmp File created C:\Program Files\Steinberg\VSTPlugins\Kazrog\is-V5BQA.tmp True_Iron_1.3.3_Setup.tmp File created C:\Program Files\Common Files\VST3\is-HO3E8.tmp True_Iron_1.3.3_Setup.tmp File created C:\Program Files\Common Files\Avid\Audio\Plug-Ins\True Iron.aaxplugin\Contents\x64\is-6DN58.tmp True_Iron_1.3.3_Setup.tmp File created C:\Program Files\Kazrog\unins000.msg True_Iron_1.3.3_Setup.tmp File opened for modification C:\Program Files\Kazrog\unins000.dat True_Iron_1.3.3_Setup.tmp File opened for modification C:\Program Files\Steinberg\VSTPlugins\Kazrog\True Iron.dll True_Iron_1.3.3_Setup.tmp -
Drops file in Windows directory 15 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSIA700.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{F4499EE3-A166-496C-81BB-51D1BCDC70A9} msiexec.exe File created C:\Windows\Installer\e579ec9.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIA0A5.tmp msiexec.exe File created C:\Windows\Installer\e579eb3.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIA2B9.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA962.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\e579eb4.msi msiexec.exe File created C:\Windows\Installer\e579eb4.msi msiexec.exe File created C:\Windows\Installer\e579ea1.msi msiexec.exe File opened for modification C:\Windows\Installer\e579ea1.msi msiexec.exe File created C:\Windows\Installer\SourceHash{3407B900-37F5-4CC2-B612-5CD5D580A163} msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000003d697fb93d0c6eb40000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800003d697fb90000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809003d697fb9000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d3d697fb9000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000003d697fb900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe -
Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2D msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e msiexec.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.32,bundle\ = "{3746f21b-c990-4045-bb33-1cf98cff7a68}" VC_redist.x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.32,bundle\DisplayName = "Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.32.31332" VC_redist.x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.32,bundle\Dependents\{3746f21b-c990-4045-bb33-1cf98cff7a68} VC_redist.x64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Version = "14.32.31332" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3EE9944F661AC69418BB151DCBCD079A\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14 VC_redist.x64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.30,bundle\Dependents VC_redist.x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\009B70435F732CC46B21C55D5D081A36\Provider msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14 VC_redist.x64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList\Net msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3EE9944F661AC69418BB151DCBCD079A\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3EE9944F661AC69418BB151DCBCD079A\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\009B70435F732CC46B21C55D5D081A36 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\009B70435F732CC46B21C55D5D081A36\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3EE9944F661AC69418BB151DCBCD079A msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3EE9944F661AC69418BB151DCBCD079A\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.32,bundle\Version = "14.32.31332.0" VC_redist.x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Version = "14.32.31332" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\DisplayName = "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.32.31332" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\009B70435F732CC46B21C55D5D081A36\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\009B70435F732CC46B21C55D5D081A36\Version = "237009508" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8A567BD6FA501A947AD1F646E53EEC14 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3EE9944F661AC69418BB151DCBCD079A\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{F4499EE3-A166-496C-81BB-51D1BCDC70A9}v14.32.31332\\packages\\vcRuntimeAdditional_amd64\\" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.30,bundle VC_redist.x64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\009B70435F732CC46B21C55D5D081A36 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\009B70435F732CC46B21C55D5D081A36\SourceList\PackageName = "vc_runtimeMinimum_x64.msi" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3EE9944F661AC69418BB151DCBCD079A\AuthorizedLUAApp = "0" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEADDITIONALVSU_AMD64,V14\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13} VC_redist.x64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\009B70435F732CC46B21C55D5D081A36\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\009B70435F732CC46B21C55D5D081A36\SourceList\Net msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3EE9944F661AC69418BB151DCBCD079A\ProductName = "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.32.31332" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3EE9944F661AC69418BB151DCBCD079A\SourceList\Media msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\009B70435F732CC46B21C55D5D081A36\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3EE9944F661AC69418BB151DCBCD079A\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.32,bundle\Dependents VC_redist.x64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\009B70435F732CC46B21C55D5D081A36\PackageCode = "6903DE0222E9E8E4394261D4BC98C5A9" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\009B70435F732CC46B21C55D5D081A36\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\DisplayName = "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.32.31332" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3EE9944F661AC69418BB151DCBCD079A\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Dependents\{3746f21b-c990-4045-bb33-1cf98cff7a68} VC_redist.x64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEMINIMUMVSU_AMD64,V14\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13} VC_redist.x64.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.32,bundle VC_redist.x64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8800A266DCF6DD54E97A86760485EA5D msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\009B70435F732CC46B21C55D5D081A36\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Dependents\{3746f21b-c990-4045-bb33-1cf98cff7a68} VC_redist.x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3EE9944F661AC69418BB151DCBCD079A\PackageCode = "2E26CECC343D09D4AA024D443BCB4FF1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3EE9944F661AC69418BB151DCBCD079A\SourceList\Net msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\009B70435F732CC46B21C55D5D081A36\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{3407B900-37F5-4CC2-B612-5CD5D580A163}v14.32.31332\\packages\\vcRuntimeMinimum_amd64\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1\3EE9944F661AC69418BB151DCBCD079A msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3EE9944F661AC69418BB151DCBCD079A\SourceList\PackageName = "vc_runtimeAdditional_x64.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53\009B70435F732CC46B21C55D5D081A36 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\009B70435F732CC46B21C55D5D081A36\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{3407B900-37F5-4CC2-B612-5CD5D580A163}v14.32.31332\\packages\\vcRuntimeMinimum_amd64\\" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3EE9944F661AC69418BB151DCBCD079A msiexec.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2004 True_Iron_1.3.3_Setup.tmp 2004 True_Iron_1.3.3_Setup.tmp 1436 msiexec.exe 1436 msiexec.exe 1436 msiexec.exe 1436 msiexec.exe 1436 msiexec.exe 1436 msiexec.exe 1436 msiexec.exe 1436 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeBackupPrivilege 920 vssvc.exe Token: SeRestorePrivilege 920 vssvc.exe Token: SeAuditPrivilege 920 vssvc.exe Token: SeShutdownPrivilege 1644 VC_redist.x64.exe Token: SeIncreaseQuotaPrivilege 1644 VC_redist.x64.exe Token: SeSecurityPrivilege 1436 msiexec.exe Token: SeCreateTokenPrivilege 1644 VC_redist.x64.exe Token: SeAssignPrimaryTokenPrivilege 1644 VC_redist.x64.exe Token: SeLockMemoryPrivilege 1644 VC_redist.x64.exe Token: SeIncreaseQuotaPrivilege 1644 VC_redist.x64.exe Token: SeMachineAccountPrivilege 1644 VC_redist.x64.exe Token: SeTcbPrivilege 1644 VC_redist.x64.exe Token: SeSecurityPrivilege 1644 VC_redist.x64.exe Token: SeTakeOwnershipPrivilege 1644 VC_redist.x64.exe Token: SeLoadDriverPrivilege 1644 VC_redist.x64.exe Token: SeSystemProfilePrivilege 1644 VC_redist.x64.exe Token: SeSystemtimePrivilege 1644 VC_redist.x64.exe Token: SeProfSingleProcessPrivilege 1644 VC_redist.x64.exe Token: SeIncBasePriorityPrivilege 1644 VC_redist.x64.exe Token: SeCreatePagefilePrivilege 1644 VC_redist.x64.exe Token: SeCreatePermanentPrivilege 1644 VC_redist.x64.exe Token: SeBackupPrivilege 1644 VC_redist.x64.exe Token: SeRestorePrivilege 1644 VC_redist.x64.exe Token: SeShutdownPrivilege 1644 VC_redist.x64.exe Token: SeDebugPrivilege 1644 VC_redist.x64.exe Token: SeAuditPrivilege 1644 VC_redist.x64.exe Token: SeSystemEnvironmentPrivilege 1644 VC_redist.x64.exe Token: SeChangeNotifyPrivilege 1644 VC_redist.x64.exe Token: SeRemoteShutdownPrivilege 1644 VC_redist.x64.exe Token: SeUndockPrivilege 1644 VC_redist.x64.exe Token: SeSyncAgentPrivilege 1644 VC_redist.x64.exe Token: SeEnableDelegationPrivilege 1644 VC_redist.x64.exe Token: SeManageVolumePrivilege 1644 VC_redist.x64.exe Token: SeImpersonatePrivilege 1644 VC_redist.x64.exe Token: SeCreateGlobalPrivilege 1644 VC_redist.x64.exe Token: SeRestorePrivilege 1436 msiexec.exe Token: SeTakeOwnershipPrivilege 1436 msiexec.exe Token: SeRestorePrivilege 1436 msiexec.exe Token: SeTakeOwnershipPrivilege 1436 msiexec.exe Token: SeRestorePrivilege 1436 msiexec.exe Token: SeTakeOwnershipPrivilege 1436 msiexec.exe Token: SeRestorePrivilege 1436 msiexec.exe Token: SeTakeOwnershipPrivilege 1436 msiexec.exe Token: SeRestorePrivilege 1436 msiexec.exe Token: SeTakeOwnershipPrivilege 1436 msiexec.exe Token: SeRestorePrivilege 1436 msiexec.exe Token: SeTakeOwnershipPrivilege 1436 msiexec.exe Token: SeRestorePrivilege 1436 msiexec.exe Token: SeTakeOwnershipPrivilege 1436 msiexec.exe Token: SeRestorePrivilege 1436 msiexec.exe Token: SeTakeOwnershipPrivilege 1436 msiexec.exe Token: SeRestorePrivilege 1436 msiexec.exe Token: SeTakeOwnershipPrivilege 1436 msiexec.exe Token: SeRestorePrivilege 1436 msiexec.exe Token: SeTakeOwnershipPrivilege 1436 msiexec.exe Token: SeRestorePrivilege 1436 msiexec.exe Token: SeTakeOwnershipPrivilege 1436 msiexec.exe Token: SeRestorePrivilege 1436 msiexec.exe Token: SeTakeOwnershipPrivilege 1436 msiexec.exe Token: SeRestorePrivilege 1436 msiexec.exe Token: SeTakeOwnershipPrivilege 1436 msiexec.exe Token: SeRestorePrivilege 1436 msiexec.exe Token: SeTakeOwnershipPrivilege 1436 msiexec.exe Token: SeRestorePrivilege 1436 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2004 True_Iron_1.3.3_Setup.tmp 4176 vc_redist.x64.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 3732 wrote to memory of 2004 3732 True_Iron_1.3.3_Setup.exe 84 PID 3732 wrote to memory of 2004 3732 True_Iron_1.3.3_Setup.exe 84 PID 3732 wrote to memory of 2004 3732 True_Iron_1.3.3_Setup.exe 84 PID 2004 wrote to memory of 4924 2004 True_Iron_1.3.3_Setup.tmp 92 PID 2004 wrote to memory of 4924 2004 True_Iron_1.3.3_Setup.tmp 92 PID 2004 wrote to memory of 4924 2004 True_Iron_1.3.3_Setup.tmp 92 PID 4924 wrote to memory of 4176 4924 vc_redist.x64.exe 93 PID 4924 wrote to memory of 4176 4924 vc_redist.x64.exe 93 PID 4924 wrote to memory of 4176 4924 vc_redist.x64.exe 93 PID 4176 wrote to memory of 1644 4176 vc_redist.x64.exe 94 PID 4176 wrote to memory of 1644 4176 vc_redist.x64.exe 94 PID 4176 wrote to memory of 1644 4176 vc_redist.x64.exe 94 PID 1644 wrote to memory of 2724 1644 VC_redist.x64.exe 104 PID 1644 wrote to memory of 2724 1644 VC_redist.x64.exe 104 PID 1644 wrote to memory of 2724 1644 VC_redist.x64.exe 104 PID 2724 wrote to memory of 3424 2724 VC_redist.x64.exe 105 PID 2724 wrote to memory of 3424 2724 VC_redist.x64.exe 105 PID 2724 wrote to memory of 3424 2724 VC_redist.x64.exe 105 PID 3424 wrote to memory of 1364 3424 VC_redist.x64.exe 106 PID 3424 wrote to memory of 1364 3424 VC_redist.x64.exe 106 PID 3424 wrote to memory of 1364 3424 VC_redist.x64.exe 106 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\True_Iron_1.3.3_Setup.exe"C:\Users\Admin\AppData\Local\Temp\True_Iron_1.3.3_Setup.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\is-BCQKT.tmp\True_Iron_1.3.3_Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-BCQKT.tmp\True_Iron_1.3.3_Setup.tmp" /SL5="$D00E8,96517713,799744,C:\Users\Admin\AppData\Local\Temp\True_Iron_1.3.3_Setup.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\is-9OAS8.tmp\vc_redist.x64.exe"C:\Users\Admin\AppData\Local\Temp\is-9OAS8.tmp\vc_redist.x64.exe" /passive /norestart3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Windows\Temp\{46BA8E71-2080-4176-AEB2-4CDFEFAE8337}\.cr\vc_redist.x64.exe"C:\Windows\Temp\{46BA8E71-2080-4176-AEB2-4CDFEFAE8337}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-9OAS8.tmp\vc_redist.x64.exe" -burn.filehandle.attached=544 -burn.filehandle.self=556 /passive /norestart4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Windows\Temp\{57340C75-9C5F-4BE0-97AE-62F73E27C156}\.be\VC_redist.x64.exe"C:\Windows\Temp\{57340C75-9C5F-4BE0-97AE-62F73E27C156}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{41C5AB53-DFC9-48D2-A5F1-E168395D26D5} {747F8D70-A953-433E-AB79-E9D210F9BA42} 41765⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={3746f21b-c990-4045-bb33-1cf98cff7a68} -burn.filehandle.self=1140 -burn.embedded BurnPipe.{9B89DCE2-CF34-4AC0-9102-6056B7CE3549} {2BD8816A-FD48-4D22-A77F-AF2E8D87E121} 16446⤵
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 -uninstall -quiet -burn.related.upgrade -burn.ancestors={3746f21b-c990-4045-bb33-1cf98cff7a68} -burn.filehandle.self=1140 -burn.embedded BurnPipe.{9B89DCE2-CF34-4AC0-9102-6056B7CE3549} {2BD8816A-FD48-4D22-A77F-AF2E8D87E121} 16447⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{9C8750E6-EFDE-42C4-83EF-4A5C7BC1D21A} {A253AA85-FA2B-45DD-B909-94211C0A7D49} 34248⤵
- Modifies registry class
PID:1364
-
-
-
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:920
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵PID:3932
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1436
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD535b9d1bca6d25096b6532d9db62b0859
SHA1e3795370f8f9b55821ab8de7a0497800497dd43a
SHA2560fce1cbcb0f3bd8aa6b8c36cc133cb2e39b19631dfdc14dccc8f0df91c047f36
SHA5128d967847fc3bcdec597fb4b00b341cd5babeb0d72d34f0fb51165fc59527d98b4422888b2a4be1492ef6b6f77f7d630e7fdfc95bc02f897b5b3713c4a3675c19
-
Filesize
19KB
MD580271129d0d9d6299f3b288d06eb8d1e
SHA1d16a5b7380f30d34fe5c9c73b710a1c35ce8a199
SHA256446048a840245d162c9c050151e7085e13148da72db773112ff3a958fe1910bd
SHA5127883c1304273bcffb2af3b18d4318a753c31a96358f1ba752783736375f44e66a4cf49bf389fe3559ec27e134e1630825644fd73f451aebdbd3b57b222bfe1f7
-
Filesize
21KB
MD57ef8451d5dd168e5918fdf500ff4f5b5
SHA124aa67076b00c54470e01fd1aba4a89e29c3a481
SHA256a56f264227c66a93ede53bf7262a2bd0cc640b0c4543e9f5e40e1c0e58198fa3
SHA512d1354d25e8cf65a6156411616e18e3c5682a826b4c4c609884ef9e60c9cd8f1b84e14f5c0430262c194147c99eb710600561e3e3c11877a6bd4151abb824225f
-
Filesize
21KB
MD5dcc866ec68cfd48f4af749bcb70d17b7
SHA1b0c575a3bd7e68a46e467e744e0a91309d01527b
SHA2565f24f04af826a978f70d1e3a2790febf41e010f9e1ae27a8a3a4da5a7278cece
SHA5122f43cd2b02832177be126333f21b705f1e1b9627a258a382499cfce0eaebe9546185cbd7792358a510db738d468f8c8ea67bb5190bfba28ede2dcae560ef70b7
-
Filesize
2KB
MD54b65fdeb155eb5f8ae6a3d0033dc4aff
SHA1b60f9924a00d553e0675f394e5eb39c992516815
SHA2562df23c26a0ca3779fbac3bbb61a8a9d5ee973097c2b38541a96f5ee8d38eb6d3
SHA512e298f66dd44191a98d8334f9bdf6e18d26062de8e58bd0e59811625dbd8ccf03d9160632d4b7984cca8f6b088977ec7993cb41cad995104a6b5768c28b26d36d
-
Filesize
2KB
MD57d4438264473ba87e7cf81ca38aa0bef
SHA1bfec8edbed742913f543ccffb4cf494410f9635d
SHA2567e37e0b7474ccee5a44b28571375892d2a6ec832765df30d4afedfe347198d0c
SHA512bbc7cfea119cb1dd20438c86c52c8175e5aaeb76096d1bdb0105374a79fdbf275d5cd4ec302a8ef82ee032f85233a6af8f7b78c2ee62856a24fe6d9a9c207824
-
Filesize
24.1MB
MD5cdce5d5ee259d8071fa82f522c5c7d6e
SHA1d4f9181e70e3f1aa6c8edffcc15b3c3d4babe36b
SHA256ce6593a1520591e7dea2b93fd03116e3fc3b3821a0525322b0a430faa6b3c0b4
SHA5128f86693bf9fb4ee0ba021b826663028158d580a0424417a30d8f95ef8853fcd224b5a213beba5d99b48be0607a0a6870158bf1899fe1445da9ca19a208608527
-
Filesize
2.5MB
MD5d7c5572cb60a32aad36f072a43c8a8f2
SHA1576cddce03b4e05666d23b6ed8c98cc44bd80b19
SHA256af6a2b17e21896d98911b92d73765b95be81330b4155fc0bb3125beebec07bfd
SHA512c46baf4840c99acdb171a9bd3f77c3cfe24474c27c8c68eb7f2bc6e8c4d288b8e36831d5b2454078fdade2ded6818049640d475775443ce746f20b931b3ee41c
-
Filesize
635KB
MD5d940ea062ed6e99f6d873c2f5f09d1c9
SHA16abec3341d3bca045542c7b812947b55ddaf6b64
SHA256a0fce2b6c865ae4f00145c9b366c39484daf3160b526c77005e59f6f65adb202
SHA512e4069e41311e8bd4599de0a1bdf0ee0b76316359a0c83ac663c23da8833e5dc0effa260fe8d0e47f4befa94c87fc7bf93bce2b79792abe8befc59acf5401cfe1
-
Filesize
1KB
MD5d6bd210f227442b3362493d046cea233
SHA1ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA256335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
SHA512464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
-
Filesize
191KB
MD5eab9caf4277829abdf6223ec1efa0edd
SHA174862ecf349a9bedd32699f2a7a4e00b4727543d
SHA256a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
SHA51245b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
-
Filesize
5.4MB
MD5be501f118803c6b283e5743cb94d4f44
SHA1a9530c227fb73f98d137e6c178f48c4fcb78a1da
SHA256008ca0b47d627692050c2b7fd16bc670c2ea2a7541ed4cad9abd1675a481b6c5
SHA512ddb3f7913f45e9d9c757cbc7b75b7a65c3eb9bf429c97ad73e9b321849427617ea4a1fdc15ca5166a5417345552046c6ba043a8d14ff4fc61d58a1f38f288356
-
Filesize
883KB
MD5c1f40b16e6dfd6c841c1f97524ac53f6
SHA17eaf1a916ac8498253a310ef30d6e2198f2c0555
SHA256a05b0138d3c22af4593feb5b4a3a55f92e4d958246bc4a87754eee73e5e52600
SHA512b5aba56c88d9375157954996cae73e1d55faaf956181a2ef8c1f62612da91356454ad367ae5a5eb370d5c96cc27bf2b7d359f874a191c8913cfc3723b166ee6e
-
Filesize
180KB
MD5049e4621dbd5337ae926e067b6b442b5
SHA16dae8d1d8106021c21b47b06765849e93f8e3359
SHA256f76e2807b845c49e15d8a41e3191716eac9931467bfdd8366b60900b1fef4235
SHA51246788a3c050508ac0868d8fc312a62724ae44d9f04f456075413d5a364b7152faab1027659435e39163952bb216b629ae77ab2f6a6b4318e8a8bb33f7d6413d3
-
Filesize
180KB
MD561f974cf8f47f9a47760c3fb21a2ce3f
SHA116ba7bd668619f8e284bd7cbce08fad3ce97fcb9
SHA25678f2a39485d7b48733bc4767619baa34310cf8f9dedc120d054d0842eb4201ea
SHA512152a520fb24857ab0a834f1c94e0f7a21c1b998c71861843e37d55a2364a6730fae2f3a02507941ff593a9c1c9f57018d9912bd0d80ab0b87d7b4158194b927c