Overview
overview
9Static
static
7GGKILLER/GGKiller.exe
windows11-21h2-x64
9GGKILLER/GGKiller.exe
windows11-21h2-x64
9install_al...ll.bat
windows11-21h2-x64
7install_al...64.exe
windows11-21h2-x64
4install_al...86.exe
windows11-21h2-x64
4install_al...64.exe
windows11-21h2-x64
7install_al...86.exe
windows11-21h2-x64
7install_al...64.exe
windows11-21h2-x64
7install_al...86.exe
windows11-21h2-x64
7install_al...64.exe
windows11-21h2-x64
7install_al...86.exe
windows11-21h2-x64
7install_al...64.exe
windows11-21h2-x64
7install_al...86.exe
windows11-21h2-x64
7install_al...64.exe
windows11-21h2-x64
7install_al...86.exe
windows11-21h2-x64
7install_al...64.exe
windows11-21h2-x64
4install_al...86.exe
windows11-21h2-x64
4Analysis
- max time kernel
82s - max time network
141s - platform
windows11-21h2_x64 - resource
win11-20240426-en - resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system - submitted
08/06/2024, 17:19
Behavioral task
behavioral1
Sample
GGKILLER/GGKiller.exe
Resource
win11-20240508-en
windows11-21h2-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
GGKILLER/GGKiller.exe
Resource
win11-20240508-en
windows11-21h2-x64
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
install_all/A_install_all.bat
Resource
win11-20240419-en
windows11-21h2-x64
20 signatures
150 seconds
Behavioral task
behavioral4
Sample
install_all/dotnet-sdk-6.0.422-win-x64.exe
Resource
win11-20240426-en
windows11-21h2-x64
4 signatures
150 seconds
Behavioral task
behavioral5
Sample
install_all/dotnet-sdk-6.0.422-win-x86.exe
Resource
win11-20240508-en
windows11-21h2-x64
4 signatures
150 seconds
Behavioral task
behavioral6
Sample
install_all/vcredist2005_x64.exe
Resource
win11-20240426-en
windows11-21h2-x64
14 signatures
150 seconds
Behavioral task
behavioral7
Sample
install_all/vcredist2005_x86.exe
Resource
win11-20240419-en
windows11-21h2-x64
14 signatures
150 seconds
Behavioral task
behavioral8
Sample
install_all/vcredist2008_x64.exe
Resource
win11-20240508-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
install_all/vcredist2008_x86.exe
Resource
win11-20240508-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
install_all/vcredist2010_x64.exe
Resource
win11-20240426-en
windows11-21h2-x64
7 signatures
150 seconds
Behavioral task
behavioral11
Sample
install_all/vcredist2010_x86.exe
Resource
win11-20240426-en
windows11-21h2-x64
5 signatures
150 seconds
Behavioral task
behavioral12
Sample
install_all/vcredist2012_x64.exe
Resource
win11-20240508-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
install_all/vcredist2012_x86.exe
Resource
win11-20240508-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
install_all/vcredist2013_x64.exe
Resource
win11-20240426-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
install_all/vcredist2013_x86.exe
Resource
win11-20240508-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral16
Sample
install_all/vcredist2015_2017_2019_2022_x64.exe
Resource
win11-20240426-en
windows11-21h2-x64
4 signatures
150 seconds
Behavioral task
behavioral17
Sample
install_all/vcredist2015_2017_2019_2022_x86.exe
Resource
win11-20240426-en
windows11-21h2-x64
4 signatures
150 seconds
General
- Target install_all/vcredist2005_x64.exe
- Size 3.0MB
- Sample240608-vvze5aee82
- SHA256 0551a61c85b718e1fa015b0c3e3f4c4eea0637055536c00e7969286b4fa663e0
- MD5 56eaf4e1237c974f6984edc93972c123
- SHA1 ee916012783024dac67fc606457377932c826f05
- SHA512 f8e15363e34db5b5445c41eea4dd80b2f682642cb8f1046f30ea4fb5f4f51b0b604f7bcb3000a35a7d3ba1d1bcc07df9b25e4533170c65640b2d137c19916736
- SSDEEP 49152:+r67+stI6RWGTAdyvlADUrpTmcOgohwJpEM5grO3oc1OXZViFeRyDErkLUMHzkRN:AM9l8pUr9m30L5grOQXZKAsErkbQRN
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 412 MsiExec.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" vcredist2005_x64.exe - Blocklisted process makes network request 1 IoCs
flow pid Process 2 488 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\X: msiexec.exe - Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\Microsoft Shared\VC\amd64\msdia80.dll msiexec.exe - Drops file in Windows directory 61 IoCs
description ioc Process File created C:\Windows\WinSxS\InstallTemp\20240608172451987.0\amd64_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_7735df00.cat msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240608172452018.0 msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240608172452050.0 msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240608172452065.0 msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIBCD8.tmp msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172452018.0\8.0.50727.6195.cat msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240608172451987.0 msiexec.exe File created C:\Windows\SystemTemp\~DFF3F87EA1646205F5.TMP msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172451800.0\mfcm80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172451800.0\mfc80u.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172451893.0\mfc80ENU.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172451893.0\mfc80KOR.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172451987.0\vcomp.dll msiexec.exe File created C:\Windows\Installer\e57ba6b.msi msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240608172451753.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172451753.0\msvcm80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172451800.0\mfcm80u.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172451893.0\amd64_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_9c659d69.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172451893.0\mfc80DEU.dll msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240608172451800.0 msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240608172451893.0 msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172451800.0\amd64_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_4716846b.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172451893.0\mfc80ESP.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172451893.0\mfc80ITA.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172451893.0\mfc80JPN.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172452065.0\8.0.50727.6195.cat msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240608172452034.0 msiexec.exe File created C:\Windows\Installer\SourceHash{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028} msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172451706.0\amd64_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_d6cffeda.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172452050.0\8.0.50727.6195.policy msiexec.exe File created C:\Windows\Installer\e57ba67.msi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172451893.0\amd64_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_9c659d69.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172451753.0\msvcr80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172451893.0\mfc80FRA.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172452003.0\8.0.50727.6195.cat msiexec.exe File created C:\Windows\SystemTemp\~DF84A6C257AE7B3C48.TMP msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172452003.0\8.0.50727.6195.policy msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172451753.0\amd64_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_76301166.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172452034.0\8.0.50727.6195.policy msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240608172451706.0 msiexec.exe File created C:\Windows\SystemTemp\~DF9B28D8C25FF7A259.TMP msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIC18C.tmp msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172451753.0\msvcp80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172451987.0\amd64_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_7735df00.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172451706.0\ATL80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172452065.0\8.0.50727.6195.policy msiexec.exe File created C:\Windows\SystemTemp\~DF6FBC005925F53F77.TMP msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172451800.0\amd64_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_4716846b.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172452050.0\8.0.50727.6195.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172452018.0\8.0.50727.6195.policy msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172452034.0\8.0.50727.6195.cat msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240608172452003.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172451706.0\amd64_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_d6cffeda.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172451800.0\mfc80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172451893.0\mfc80CHS.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172451893.0\mfc80CHT.dll msiexec.exe File opened for modification C:\Windows\Installer\e57ba67.msi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172451753.0\amd64_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_76301166.manifest msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000001b4a55745f2b98f90000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800001b4a55740000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809001b4a5574000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d1b4a5574000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000001b4a557400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b msiexec.exe - Modifies registry class 56 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.OpenMP,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e007e0078002d00360076007a0045007a007e003200650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\PackageName = "vcredist.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\92091D8AC5E822E408118470F0E997E6 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\5 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\9 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Win32Assemblies\Global msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFC,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e00240062003000290043004b0076003d0035002700650038004d006b0062004900640046007700550000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1af2a8da7e60d0b429d7e6453b3d0182 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\Version = "134278728" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1af2a8da7e60d0b429d7e6453b3d0182\VC_Redist msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\Clients = 3a0000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.CRT,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e0049004c005400540052005900320074004f005700650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.ATL,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e007b004c0046003d0042004900620074004f002800650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\PackageCode = "C558A51006735C645AEE5A0FC6A310C9" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\3 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.OpenMP,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e007a0050005400310026006e0073004b0064007a00650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\92091D8AC5E822E408118470F0E997E6\1af2a8da7e60d0b429d7e6453b3d0182 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\6 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Net msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Net msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Features\1af2a8da7e60d0b429d7e6453b3d0182 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\10 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\4 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.ATL,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e005a00310021003d00520046007900460072005700650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFCLOC,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e00500054005d002700660025002b0027004b002800650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\ProductName = "Microsoft Visual C++ 2005 Redistributable (x64)" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFCLOC,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e00530021004900240047002e004f005f0078006800650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFC,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e0069002a0048004e00530057007d0024007e005500650038004d006b0062004900640046007700550000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\2 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.CRT,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e004b0039007000540041002700650026005d002900650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\7 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\8 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\92091D8AC5E822E408118470F0E997E6 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\Language = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\DeploymentFlags = "3" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1af2a8da7e60d0b429d7e6453b3d0182 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1af2a8da7e60d0b429d7e6453b3d0182\Servicing_Key msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\1 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\11 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 560 msiexec.exe 560 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 488 msiexec.exe Token: SeIncreaseQuotaPrivilege 488 msiexec.exe Token: SeSecurityPrivilege 560 msiexec.exe Token: SeCreateTokenPrivilege 488 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 488 msiexec.exe Token: SeLockMemoryPrivilege 488 msiexec.exe Token: SeIncreaseQuotaPrivilege 488 msiexec.exe Token: SeMachineAccountPrivilege 488 msiexec.exe Token: SeTcbPrivilege 488 msiexec.exe Token: SeSecurityPrivilege 488 msiexec.exe Token: SeTakeOwnershipPrivilege 488 msiexec.exe Token: SeLoadDriverPrivilege 488 msiexec.exe Token: SeSystemProfilePrivilege 488 msiexec.exe Token: SeSystemtimePrivilege 488 msiexec.exe Token: SeProfSingleProcessPrivilege 488 msiexec.exe Token: SeIncBasePriorityPrivilege 488 msiexec.exe Token: SeCreatePagefilePrivilege 488 msiexec.exe Token: SeCreatePermanentPrivilege 488 msiexec.exe Token: SeBackupPrivilege 488 msiexec.exe Token: SeRestorePrivilege 488 msiexec.exe Token: SeShutdownPrivilege 488 msiexec.exe Token: SeDebugPrivilege 488 msiexec.exe Token: SeAuditPrivilege 488 msiexec.exe Token: SeSystemEnvironmentPrivilege 488 msiexec.exe Token: SeChangeNotifyPrivilege 488 msiexec.exe Token: SeRemoteShutdownPrivilege 488 msiexec.exe Token: SeUndockPrivilege 488 msiexec.exe Token: SeSyncAgentPrivilege 488 msiexec.exe Token: SeEnableDelegationPrivilege 488 msiexec.exe Token: SeManageVolumePrivilege 488 msiexec.exe Token: SeImpersonatePrivilege 488 msiexec.exe Token: SeCreateGlobalPrivilege 488 msiexec.exe Token: SeBackupPrivilege 3412 vssvc.exe Token: SeRestorePrivilege 3412 vssvc.exe Token: SeAuditPrivilege 3412 vssvc.exe Token: SeBackupPrivilege 560 msiexec.exe Token: SeRestorePrivilege 560 msiexec.exe Token: SeRestorePrivilege 560 msiexec.exe Token: SeTakeOwnershipPrivilege 560 msiexec.exe Token: SeRestorePrivilege 560 msiexec.exe Token: SeTakeOwnershipPrivilege 560 msiexec.exe Token: SeRestorePrivilege 560 msiexec.exe Token: SeTakeOwnershipPrivilege 560 msiexec.exe Token: SeRestorePrivilege 560 msiexec.exe Token: SeTakeOwnershipPrivilege 560 msiexec.exe Token: SeRestorePrivilege 560 msiexec.exe Token: SeTakeOwnershipPrivilege 560 msiexec.exe Token: SeRestorePrivilege 560 msiexec.exe Token: SeTakeOwnershipPrivilege 560 msiexec.exe Token: SeRestorePrivilege 560 msiexec.exe Token: SeTakeOwnershipPrivilege 560 msiexec.exe Token: SeRestorePrivilege 560 msiexec.exe Token: SeTakeOwnershipPrivilege 560 msiexec.exe Token: SeRestorePrivilege 560 msiexec.exe Token: SeTakeOwnershipPrivilege 560 msiexec.exe Token: SeRestorePrivilege 560 msiexec.exe Token: SeTakeOwnershipPrivilege 560 msiexec.exe Token: SeRestorePrivilege 560 msiexec.exe Token: SeTakeOwnershipPrivilege 560 msiexec.exe Token: SeRestorePrivilege 560 msiexec.exe Token: SeTakeOwnershipPrivilege 560 msiexec.exe Token: SeRestorePrivilege 560 msiexec.exe Token: SeTakeOwnershipPrivilege 560 msiexec.exe Token: SeRestorePrivilege 560 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 488 msiexec.exe 488 msiexec.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4832 wrote to memory of 488 4832 vcredist2005_x64.exe 75 PID 4832 wrote to memory of 488 4832 vcredist2005_x64.exe 75 PID 4832 wrote to memory of 488 4832 vcredist2005_x64.exe 75 PID 560 wrote to memory of 1324 560 msiexec.exe 82 PID 560 wrote to memory of 1324 560 msiexec.exe 82 PID 560 wrote to memory of 412 560 msiexec.exe 84 PID 560 wrote to memory of 412 560 msiexec.exe 84 PID 560 wrote to memory of 412 560 msiexec.exe 84 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\install_all\vcredist2005_x64.exe"C:\Users\Admin\AppData\Local\Temp\install_all\vcredist2005_x64.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Windows\SysWOW64\msiexec.exemsiexec /i vcredist.msi2⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:488
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:1324
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 8DDD0BCEDB621834471070DF081EA4902⤵
- Loads dropped DLL
PID:412
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3412
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredis1.cab
- Size 312KB
- SHA256 20a26ed9a1edf7763a9b515522c5e29720048a482c7fbc8b7ff6bbdd27e61038
- MD5 77a9bff5af149160775741e204734d47
- SHA1 7b5126af69b5a79593f39db94180f1ff11b0e39d
- SHA512 bb0440f58f07e113bddd9a0afb5aab8af6493218784fe5fa6f4032e3a37088f91b7e766dee87cec4a9ea11d425d27b3b536430de3a52222e8bca3e0247d81e3b
- SSDEEP 6144:t4hYeVCicX007FZ+S33LibEvo5axZHkfKu96hXp8V0EuZo5YemLDwcEmW6Y:GYGC3kw2bEwAxZgZ96hLEuZo5YemHiv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredist.msi
- Size 3.0MB
- SHA256 200fef5d4994523a02c4daa00060db28eb289b99d47fc6c1305183101e72bdeb
- MD5 6dbdf338a0a25cdb236d43ea3ca2395e
- SHA1 685b6ea61e574e628392eaac8b10aff4309f1081
- SHA512 6b5b31c55cf72ab92b17fb6074b3901a1e6afe0796ef9bc831e4dfb97450376d2889cd24b1cf3fce60eb3c1bcd1b31254b5cfa3ef6107974dfa0b35c233daf5a
- SSDEEP 49152:HgdGyDmDdLz8tDP2KlMTCXoVwEf2pH+uNn4qfKzi2elcvEwXLEMjP4Y9CM:QYeP22Meyf2pH+xqiNkiEwXvQY9B
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSIBCD8.tmp
- Size 28KB
- SHA256 f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f
- MD5 85221b3bcba8dbe4b4a46581aa49f760
- SHA1 746645c92594bfc739f77812d67cfd85f4b92474
- SHA512 060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d
- SSDEEP 192:XOdG/6G4nnykxsdYZ+mrv2ySzLUHypLGgjuXFw5acHKBNtHjhuHWrkA9uBP1WWzT:P6GuZBrvkzAHyxxHKBdaA2dWWzm0ZH
- MD5 SHA1 SHA512 SSDEEP
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 12.8MB
- SHA256 2d7888d4e48f1269c00b52e8835260d76574d568dd0ed004d6946b50d2bc026f
- MD5 62e631925dee55a9958111cd129b60d1
- SHA1 ddbb7232269ab8cff2b16a474c89e1bef62fd4f2
- SHA512 71a77f968e0e58f51011e9e536176a1d4b9d1ca8e9c5efd876f0d5cfacb5ab643f368249fbf81f61f2715265a749d1f992c2e37b9719393c7c2656b4bc7f7884
- SSDEEP 12288:l0l1UbaH9QlO/bLnWA81aEG8zCVKl5phXqC1ipfmM1T0WUx6dXyHOat9zbjc9GBV:2IadoO/vrVKlZ5L6wDHr7hg3jBARBn
- MD5 SHA1 SHA512 SSDEEP
- Path \??\Volume{74554a1b-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{45a92bdf-a428-467c-b02a-e339c791f9a8}_OnDiskSnapshotProp
- Size 6KB
- SHA256 efa78062ea311f13fe64d5dd761e302382086eb5efd66d4771e181624c326893
- MD5 1f5607f78b3e252019f746d76ac3574c
- SHA1 1b60dcb97928ffb0348507bfb28666e197a1c70f
- SHA512 19a3362b7a6ce08dadc1e661f09fc0c5e453e9451359d45a07546cd1335f3d54d04d2882c57e83322a54719672c5314240463c09143c5e546f68b58a6b8232bb
- SSDEEP 96:FWbI5WYUcpADD84LTHzbOHXOHBlBRQL8Sc9XE56tOSVQpuN:zsb++2VmN
- MD5 SHA1 SHA512 SSDEEP