4b94fe660e5e3a3b33dec8bf0b89cefd54a043cf01b8cfd20e0a5bb939d7d0c5

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 08:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b556bb94e138c7f58cde15b1f1ac7f89ee87e9ccd33250c61cbcbae8db183434.msi
Size 2.2MB
Sample240603-j2brvsaa68
SHA256 b556bb94e138c7f58cde15b1f1ac7f89ee87e9ccd33250c61cbcbae8db183434
MD5 bcfa5c3f6576f10863ff2239ac064526
SHA1 0989642cbc8b1d7cfe43a55914f03823df1e95a8
SHA512 b86bee3e14b9c0f25435328501e2ac832aa2d1efa3c00decd2628b6163dac383dbf41c1ba579646987f931c5c009a71712c9a96181e2a8f15ebed6f188d6d7eb
SSDEEP 49152:+WKRFfV5tLPGYzLFoc25e6+f/8J05wXIARgguIGUMBz5Hx:SlpPG6LfIGU
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3404	powershell.exe
3684	powershell.exe
1828	powershell.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	svchost.exe
File opened (read-only)	\??\S:	svchost.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	svchost.exe
File opened (read-only)	\??\G:	svchost.exe
File opened (read-only)	\??\M:	svchost.exe
File opened (read-only)	\??\Y:	svchost.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	svchost.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	svchost.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\T:	svchost.exe
File opened (read-only)	\??\Z:	svchost.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	svchost.exe
File opened (read-only)	\??\Q:	svchost.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\B:	svchost.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\U:	svchost.exe
File opened (read-only)	\??\W:	svchost.exe
File opened (read-only)	\??\X:	svchost.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\K:	svchost.exe
File opened (read-only)	\??\N:	svchost.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\V:	svchost.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\R:	svchost.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\L:	svchost.exe
File opened (read-only)	\??\P:	svchost.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Defenderr\cc.xml	msiexec.exe
File created	C:\Program Files\Windows Defenderr\svchost.exe	msiexec.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e578bb5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8D5D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8E89.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{938844A1-CF64-49FC-BE6E-368621A77F1C}	msiexec.exe
File opened for modification	C:\Windows\SystemTemp\Pro9D6D.tmp	MsiExec.exe
File created	C:\Windows\SystemTemp\scr9D6A.ps1	MsiExec.exe
File created	C:\Windows\SystemTemp\scr9D6B.txt	MsiExec.exe
File opened for modification	C:\Windows\Installer\e578bb5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8BF4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8CEF.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8EF9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9B7D.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\msi9D69.txt	MsiExec.exe
File opened for modification	C:\Windows\SystemTemp\pss9D6C.ps1	MsiExec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8D6E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8DEC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8E8A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9BDB.tmp	msiexec.exe

Executes dropped EXE 1 IoCs

pid	Process
4644	svchost.exe

Loads dropped DLL 9 IoCs

pid	Process
4792	MsiExec.exe
4792	MsiExec.exe
4792	MsiExec.exe
4792	MsiExec.exe
4792	MsiExec.exe
4792	MsiExec.exe
4792	MsiExec.exe
3592	MsiExec.exe
3592	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000003f3ccc8c3b3921e10000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800003f3ccc8c0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809003f3ccc8c000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d3f3ccc8c000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000003f3ccc8c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2156	msiexec.exe
2156	msiexec.exe
3404	powershell.exe
3404	powershell.exe
3404	powershell.exe
3684	powershell.exe
3684	powershell.exe
3684	powershell.exe
1828	powershell.exe
1828	powershell.exe
1828	powershell.exe
4644	svchost.exe
4644	svchost.exe
4644	svchost.exe
4644	svchost.exe
4644	svchost.exe
4644	svchost.exe
4644	svchost.exe
4644	svchost.exe
4644	svchost.exe
4644	svchost.exe
4644	svchost.exe
4644	svchost.exe
4644	svchost.exe
4644	svchost.exe
4644	svchost.exe
4644	svchost.exe
4644	svchost.exe
4644	svchost.exe
4644	svchost.exe
4644	svchost.exe
4644	svchost.exe
4644	svchost.exe
4644	svchost.exe
4644	svchost.exe
4644	svchost.exe
4644	svchost.exe
4644	svchost.exe
4644	svchost.exe
4644	svchost.exe
4644	svchost.exe
4644	svchost.exe
4644	svchost.exe
4644	svchost.exe
4644	svchost.exe
4644	svchost.exe
4644	svchost.exe
4644	svchost.exe
4644	svchost.exe
4644	svchost.exe
4644	svchost.exe
4644	svchost.exe
4644	svchost.exe
4644	svchost.exe
4644	svchost.exe
4644	svchost.exe
4644	svchost.exe
4644	svchost.exe
4644	svchost.exe
4644	svchost.exe
4644	svchost.exe
4644	svchost.exe
4644	svchost.exe
4644	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4644	svchost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2276	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2276	msiexec.exe
Token: SeSecurityPrivilege	2156	msiexec.exe
Token: SeCreateTokenPrivilege	2276	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2276	msiexec.exe
Token: SeLockMemoryPrivilege	2276	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2276	msiexec.exe
Token: SeMachineAccountPrivilege	2276	msiexec.exe
Token: SeTcbPrivilege	2276	msiexec.exe
Token: SeSecurityPrivilege	2276	msiexec.exe
Token: SeTakeOwnershipPrivilege	2276	msiexec.exe
Token: SeLoadDriverPrivilege	2276	msiexec.exe
Token: SeSystemProfilePrivilege	2276	msiexec.exe
Token: SeSystemtimePrivilege	2276	msiexec.exe
Token: SeProfSingleProcessPrivilege	2276	msiexec.exe
Token: SeIncBasePriorityPrivilege	2276	msiexec.exe
Token: SeCreatePagefilePrivilege	2276	msiexec.exe
Token: SeCreatePermanentPrivilege	2276	msiexec.exe
Token: SeBackupPrivilege	2276	msiexec.exe
Token: SeRestorePrivilege	2276	msiexec.exe
Token: SeShutdownPrivilege	2276	msiexec.exe
Token: SeDebugPrivilege	2276	msiexec.exe
Token: SeAuditPrivilege	2276	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2276	msiexec.exe
Token: SeChangeNotifyPrivilege	2276	msiexec.exe
Token: SeRemoteShutdownPrivilege	2276	msiexec.exe
Token: SeUndockPrivilege	2276	msiexec.exe
Token: SeSyncAgentPrivilege	2276	msiexec.exe
Token: SeEnableDelegationPrivilege	2276	msiexec.exe
Token: SeManageVolumePrivilege	2276	msiexec.exe
Token: SeImpersonatePrivilege	2276	msiexec.exe
Token: SeCreateGlobalPrivilege	2276	msiexec.exe
Token: SeBackupPrivilege	4672	vssvc.exe
Token: SeRestorePrivilege	4672	vssvc.exe
Token: SeAuditPrivilege	4672	vssvc.exe
Token: SeBackupPrivilege	2156	msiexec.exe
Token: SeRestorePrivilege	2156	msiexec.exe
Token: SeRestorePrivilege	2156	msiexec.exe
Token: SeTakeOwnershipPrivilege	2156	msiexec.exe
Token: SeRestorePrivilege	2156	msiexec.exe
Token: SeTakeOwnershipPrivilege	2156	msiexec.exe
Token: SeRestorePrivilege	2156	msiexec.exe
Token: SeTakeOwnershipPrivilege	2156	msiexec.exe
Token: SeRestorePrivilege	2156	msiexec.exe
Token: SeTakeOwnershipPrivilege	2156	msiexec.exe
Token: SeRestorePrivilege	2156	msiexec.exe
Token: SeTakeOwnershipPrivilege	2156	msiexec.exe
Token: SeRestorePrivilege	2156	msiexec.exe
Token: SeTakeOwnershipPrivilege	2156	msiexec.exe
Token: SeRestorePrivilege	2156	msiexec.exe
Token: SeTakeOwnershipPrivilege	2156	msiexec.exe
Token: SeRestorePrivilege	2156	msiexec.exe
Token: SeTakeOwnershipPrivilege	2156	msiexec.exe
Token: SeRestorePrivilege	2156	msiexec.exe
Token: SeTakeOwnershipPrivilege	2156	msiexec.exe
Token: SeDebugPrivilege	3404	powershell.exe
Token: SeRestorePrivilege	2156	msiexec.exe
Token: SeTakeOwnershipPrivilege	2156	msiexec.exe
Token: SeRestorePrivilege	2156	msiexec.exe
Token: SeTakeOwnershipPrivilege	2156	msiexec.exe
Token: SeDebugPrivilege	3684	powershell.exe
Token: SeDebugPrivilege	1828	powershell.exe
Token: SeRestorePrivilege	2156	msiexec.exe
Token: SeTakeOwnershipPrivilege	2156	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2276	msiexec.exe
2276	msiexec.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4684	OpenWith.exe
4644	svchost.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 440	2156	msiexec.exe	99
PID 2156 wrote to memory of 440	2156	msiexec.exe	99
PID 2156 wrote to memory of 4792	2156	msiexec.exe	101
PID 2156 wrote to memory of 4792	2156	msiexec.exe	101
PID 2156 wrote to memory of 4792	2156	msiexec.exe	101
PID 4792 wrote to memory of 3404	4792	MsiExec.exe	102
PID 4792 wrote to memory of 3404	4792	MsiExec.exe	102
PID 4792 wrote to memory of 3404	4792	MsiExec.exe	102
PID 2156 wrote to memory of 3592	2156	msiexec.exe	105
PID 2156 wrote to memory of 3592	2156	msiexec.exe	105
PID 2156 wrote to memory of 3592	2156	msiexec.exe	105
PID 3592 wrote to memory of 3684	3592	MsiExec.exe	106
PID 3592 wrote to memory of 3684	3592	MsiExec.exe	106
PID 3592 wrote to memory of 3684	3592	MsiExec.exe	106
PID 3684 wrote to memory of 1828	3684	powershell.exe	108
PID 3684 wrote to memory of 1828	3684	powershell.exe	108
PID 3684 wrote to memory of 1828	3684	powershell.exe	108

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\b556bb94e138c7f58cde15b1f1ac7f89ee87e9ccd33250c61cbcbae8db183434.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2276

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:440
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding CA9BDFA9740D4C4D6D62690B8B03CB70
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4792
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss90C9.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msi90C6.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scr90C7.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scr90C8.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3404
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 29FB1B6278C4C58E8B8BBD10A5504128 E Global\MSI0000
  2⤵
  - Drops file in Windows directory
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3592
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Windows\SystemTemp\pss9D6C.ps1" -propFile "C:\Windows\SystemTemp\msi9D69.txt" -scriptFile "C:\Windows\SystemTemp\scr9D6A.ps1" -scriptArgsFile "C:\Windows\SystemTemp\scr9D6B.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3684
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command Add-MpPreference -ExclusionPath "C:\Program` Files\Windows` Defenderr"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1828

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4672

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4684

C:\Program Files\Windows Defenderr\svchost.exe
"C:\Program Files\Windows Defenderr\svchost.exe"
1⤵
- Enumerates connected drives
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e578bb8.rbs

Path C:\Config.Msi\e578bb8.rbs
Size 217KB
SHA256 7ee33acae82d8c01678b066b2bfd05dbffe8f997674d73631727d03f80846e06
MD5 bf6334d3eb58907b99df5d8573487ec6
SHA1 377416776b7ba453f178126d4169b093e078323b
SHA512 6fa7b3d30812e2031479b2b921e48aa2be1694f770c7753c98f78f3bdb97b1b5385de0dd5484e3452e586304302b47be04da9ca42db5364d83e671a35e4e4348
SSDEEP 3072:NMQfq2SlI4cSYPeK9J2SLYetgjsmCr1MVys84ahCdlAKAk3k5DdhHeLdI3QFxB5k:QPAi584ld3nk5D2nV5vgQ+
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.xml

Path C:\Program Files\Windows Defenderr\cc.xml
Size 2KB
SHA256 1854d65dbe82f3b882bdba70f2a68ce2036481cb5495247aa0bbe20258f756ca
MD5 6545a6580ae9527fdd498a5f115b919e
SHA1 41a7469766e1259382b66b6dd779ae81c7cddca6
SHA512 d3faacb670200a744a4bedb32b7466949f291cca1310eb3b53c7ac9f556c22fc6e80c36dd4d9ab0bb9523d8c825aaf7f71fee4124499bc0be52bc31e1e99409e
MD5 SHA1 SHA512

Submit Download

svchost.exe

Path C:\Program Files\Windows Defenderr\svchost.exe
Size 102KB
SHA256 d3449e60c02258d03b42b06c5eb0a2f759dd7b1433b565d5cd9a6be7ccc523ea
MD5 c8de233601e5dd254517522a275b661c
SHA1 15eef70b3ada2b55aebd526446be9a32fd41a796
SHA512 a16d0a59029455b1b6d8d9d165b6ab10a9eb4cff2c7bdbf6738e9be6badbfa8ab12d39fa94b7b4f8705c69b56d89ea71a2c55e649f27e9c8baf35c7b50bc3cde
SSDEEP 1536:vai5iT1lccXYry49iO9u3yUyJCb8SLz7ZOh:vabzccMy49nKhK
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 7f036b1837d205690b992027eb8b81939ba0228fc296d3f30039eeba00bd4476
MD5 25604a2821749d30ca35877a7669dff9
SHA1 49c624275363c7b6768452db6868f8100aa967be
SHA512 206d70af0b332208ace2565699f5b5da82b6a3806ffa51dd05f16ab568a887d63449da79bbaeb46183038837446a49515d62cb6615e5c5b27563cd5f774b93f5
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 dc0224660412e272753f107b9b66d39841915bdfbc4fb61006d005fee0c3d9d9
MD5 453153028641111b15e0d2ef948d301e
SHA1 13e89e79b30a3639705bdd267af646c64210b03e
SHA512 37c8f080b238d658680ae22b25fe07c418f06b8bea2768629afcf6366d72b4e648d889895e7fa5ed7dfa283556c587175b484254646456d2f2806393d17c8a19
SSDEEP 384:lrf+FaG9RBiZaAX8wtYVHVCWACzlNY1kdXi5y5xnVexqPPhAA0dGy97TO1:Nf/+iZaAX1tMYrC5NBX9bVU+PhA9dHC
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 17KB
SHA256 1cb53a903c24b81570adfbcdd4b024bdd0ad9babe0eeda8da0755f4680457b26
MD5 6819aace908ce7f3d98bdc0bf3c8e31f
SHA1 4f057adbd2c3d3f6b6f38cb970f955e03c74ceb6
SHA512 13ef5be582cfc92dd658b60c7bb08fdfd37e5c3b234791d6034ca81c7449d13c629f503b0a75955c7ad556a2dd23561d4fa8e887e0dbf3b96e12bcdf266b59e7
SSDEEP 384:7rf+FGm9m+Tb1pcfBizckQ+cHATHDK6seYqdWOq5cE1g1Qxq6kjaEOky9A:vfTKbKo7TcgTHDNQx2ERXkOEIO
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_injzomqr.nwt.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_injzomqr.nwt.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

pss90C9.ps1

Path C:\Users\Admin\AppData\Local\Temp\pss90C9.ps1
Size 6KB
SHA256 53094df6fa4e57a3265ff04bc1e970c10bcdb3d4094ad6dd610c05b7a8b79e0f
MD5 30c30ef2cb47e35101d13402b5661179
SHA1 25696b2aab86a9233f19017539e2dd83b2f75d4e
SHA512 882be2768138bb75ff7dde7d5ca4c2e024699398baacd0ce1d4619902402e054297e4f464d8cb3c22b2f35d3dabc408122c207facad64ec8014f2c54834cf458
SSDEEP 96:5Wb5VNkKmeHn/V2BVrIovmgNlGjxcj6BngOcvjb:5WbyZ/gVyvb
MD5 SHA1 SHA512 SSDEEP

Submit Download

scr90C7.ps1

Path C:\Users\Admin\AppData\Local\Temp\scr90C7.ps1
Size 134B
SHA256 a56cba74db063b4996549de89fec07432fb7470724ec292dab8b97e73c567c51
MD5 7ef79aff6608fd03a304a1a87344c576
SHA1 9c57ed39cec3a1c0278ff50d536da34d55f52162
SHA512 36c5fd4a6d3c875cb311b8b454c39952a36146f2f000926324e0cf16c162409f49c675c575479222a7c28ce26390f473474107859073b37a1813c6aae0e617e6
MD5 SHA1 SHA512

Submit Download

MSI8BF4.tmp

Path C:\Windows\Installer\MSI8BF4.tmp
Size 738KB
SHA256 118a551eef23bf842ed470316aa1a50bf17b6d656652879802d4acc0184608ca
MD5 ee45c6dffaf86ed2a76d8f969c390c08
SHA1 ff5b2942ffa7d28ed3f72208e8e76391b2991b5a
SHA512 a92bc7aff5da3dc33263ea3d43cf617d47a2a6c589118f7ee3c5f293d63171778a7a37815ec23cb426558546cf0a1e694c67c7cbc36cca92677de566d1d71664
SSDEEP 12288:UCw0mKFlJ/FFhmNKxhjszLF9lph0lhSMXlez0yw5v2cX+f/8O:U70fnJ/PhmNKnYzLFhh0lhSMXlM0yw50
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI8E8A.tmp

Path C:\Windows\Installer\MSI8E8A.tmp
Size 215KB
SHA256 d058a04e0b5550db64d816485d9d25411fba27d3b9a4ef1d2dfe47e98c4a054b
MD5 fa6cf27d72756d6a0794c65d1133befa
SHA1 90949a22d68347f6834c581abc88faf63e7cb8c0
SHA512 6ecc9b610325f015659c2a79deaac50f879f0261236a54c76468150f5194ae8c1a7ff284d13818908fae26ea2a2077f982e97ecc5d7264d7c77d74610ad1dede
SSDEEP 3072:2MQfq2SlI4cSYPeK9J2SLYetgjsmCr1MVys84ahCdlAKAk3k5DdhHeLdI3QFxB5+:HPAi584ld3nk5D2nV5vgQ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI8EF9.tmp

Path C:\Windows\Installer\MSI8EF9.tmp
Size 758KB
SHA256 58800c0b1f916f5ac032ab6e9410d2e5d687eebc95c2955bded68ac97dacd639
MD5 743c67416aa1d2568679f45ef36e0179
SHA1 dc7163deb7e0d0e493f0ced46fb2fd0b29e19910
SHA512 f35f5a19aa3fe6fc723b771e7199e35cff4de5ed26a5a0a86377288f9487875bbdb19231743f2a7a019642f59ab57ed7cc02e7b4b9a6ec3c11b595596aa6066c
SSDEEP 12288:9o3WB4nkFwLMfa5c8kBLMzwAPWIARggu3nc/G5AA5cjph0lhSMXleSeA5FBxk:+3W1Fw555wXIARgguX4G+AyVh0lhSMXU
MD5 SHA1 SHA512 SSDEEP

Submit Download

scr9D6A.ps1

Path C:\Windows\SystemTemp\scr9D6A.ps1
Size 220B
SHA256 3e51b88f2e7f6d26e2b6b1a6403044af1d8b6c1805affee19848bf0d1b3a03e5
MD5 0a4a4ecab6e633aa2b189c9fdca38f1f
SHA1 81d0d5e4f77de2c33cd72d812b7a5d3b7b02b2ad
SHA512 ee53f855d8ca9cf72b76bde7f4cf5e674201f85095ee60f4f515e49ce12e08d5303932e364338be2d9206a37ec84e874f2f458afa36164fc7d1a35d460fd702e
MD5 SHA1 SHA512

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 23.7MB
SHA256 1f269f6a9babf79871028a9417393063a4fba8038f41d4d4010010d8bbab6f8b
MD5 04e2206db46c46f9a4bb4bddc3171b0e
SHA1 9b77900809acdca0e9bd62015da208cc0263efb3
SHA512 7f28288135e08bc09ada5e68c4d89315aa9eebc05f20de061cc1ad4703568a5b3bff73660e090f97dfc624d89a384c956b415b579073dadf5c5dfe83f4a26e2f
SSDEEP 24576:tSqm41xZdoO/vvTLE3HugnWXkEI51A6ajjHd58wWaWq7WU72oRFoL63CA:J
MD5 SHA1 SHA512 SSDEEP

Submit Download

{e9af19e3-3975-4bfc-9279-dea1a2452f66}_OnDiskSnapshotProp

Path \??\Volume{8ccc3c3f-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{e9af19e3-3975-4bfc-9279-dea1a2452f66}_OnDiskSnapshotProp
Size 6KB
SHA256 625c7cae0be4c162473f8c3e2815fc453166956e8381c326696702df80b13375
MD5 82c1ba4748f47ef33eed05e71a3d4e0c
SHA1 778a1cf1b3b73937a47c936539f60859831c5878
SHA512 650daa2094b7c67e6d94032b96e69622ad73a0db5544808a3cd7ff0c7108b4a1e0963ea632fa5d62044c342dac7aa7c1f4c55763a541607245de5cabd679f8e2
SSDEEP 96:FNAzRQc4HsDD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:/A5b++1VmN
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1828-98-0x0000000006E00000-0x0000000006E32000-memory.dmp

Download

memory/1828-99-0x000000006F370000-0x000000006F3BC000-memory.dmp

Download

memory/1828-116-0x00000000071E0000-0x00000000071E8000-memory.dmp

Download

memory/1828-115-0x00000000072A0000-0x00000000072BA000-memory.dmp

Download

memory/1828-114-0x00000000071B0000-0x00000000071C4000-memory.dmp

Download

memory/1828-113-0x00000000071A0000-0x00000000071AE000-memory.dmp

Download

memory/1828-112-0x0000000007160000-0x0000000007171000-memory.dmp

Download

memory/1828-111-0x0000000006FE0000-0x0000000006FEA000-memory.dmp

Download

memory/1828-110-0x0000000006E40000-0x0000000006EE3000-memory.dmp

Download

memory/1828-109-0x0000000006DE0000-0x0000000006DFE000-memory.dmp

Download

memory/3404-52-0x0000000006330000-0x000000000634E000-memory.dmp

Download

memory/3404-38-0x0000000005530000-0x0000000005B58000-memory.dmp

Download

memory/3404-53-0x00000000068A0000-0x00000000068EC000-memory.dmp

Download

memory/3404-37-0x0000000002D40000-0x0000000002D76000-memory.dmp

Download

memory/3404-55-0x0000000007A90000-0x000000000810A000-memory.dmp

Download

memory/3404-58-0x00000000072E0000-0x0000000007302000-memory.dmp

Download

memory/3404-56-0x0000000006830000-0x000000000684A000-memory.dmp

Download

memory/3404-57-0x0000000007610000-0x00000000076A6000-memory.dmp

Download

memory/3404-59-0x00000000086C0000-0x0000000008C64000-memory.dmp

Download

memory/3404-51-0x0000000005D30000-0x0000000006084000-memory.dmp

Download

memory/3404-41-0x0000000005CC0000-0x0000000005D26000-memory.dmp

Download

memory/3404-40-0x0000000005C50000-0x0000000005CB6000-memory.dmp

Download

memory/3404-39-0x0000000005490000-0x00000000054B2000-memory.dmp

Download

memory/3684-75-0x0000000005AF0000-0x0000000005E44000-memory.dmp

Download

memory/3684-86-0x00000000066A0000-0x00000000066EC000-memory.dmp

Download

memory/4644-144-0x00000000006E0000-0x0000000000702000-memory.dmp

Download

memory/4644-146-0x00000000006E0000-0x0000000000702000-memory.dmp

Download

memory/4644-145-0x00000000006E0000-0x0000000000702000-memory.dmp

Download

memory/4644-147-0x00000000006E0000-0x0000000000702000-memory.dmp

Download

memory/4644-148-0x00000000032B0000-0x00000000032E8000-memory.dmp

Download

memory/4644-149-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/4644-150-0x00000000032B0000-0x00000000032E8000-memory.dmp

Download

memory/4644-151-0x00000000032B0000-0x00000000032E8000-memory.dmp

Download

memory/4644-152-0x00000000032B0000-0x00000000032E8000-memory.dmp

Download

memory/4644-153-0x00000000006E0000-0x0000000000702000-memory.dmp

Download