Overview
overview
9Static
static
7GGKILLER/GGKiller.exe
windows11-21h2-x64
9GGKILLER/GGKiller.exe
windows11-21h2-x64
9install_al...ll.bat
windows11-21h2-x64
7install_al...64.exe
windows11-21h2-x64
4install_al...86.exe
windows11-21h2-x64
4install_al...64.exe
windows11-21h2-x64
7install_al...86.exe
windows11-21h2-x64
7install_al...64.exe
windows11-21h2-x64
7install_al...86.exe
windows11-21h2-x64
7install_al...64.exe
windows11-21h2-x64
7install_al...86.exe
windows11-21h2-x64
7install_al...64.exe
windows11-21h2-x64
7install_al...86.exe
windows11-21h2-x64
7install_al...64.exe
windows11-21h2-x64
7install_al...86.exe
windows11-21h2-x64
7install_al...64.exe
windows11-21h2-x64
4install_al...86.exe
windows11-21h2-x64
4Analysis
- max time kernel
133s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20240419-en - resource tags
arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system - submitted
08/06/2024, 17:19
Behavioral task
behavioral1
Sample
GGKILLER/GGKiller.exe
Resource
win11-20240508-en
windows11-21h2-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
GGKILLER/GGKiller.exe
Resource
win11-20240508-en
windows11-21h2-x64
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
install_all/A_install_all.bat
Resource
win11-20240419-en
windows11-21h2-x64
20 signatures
150 seconds
Behavioral task
behavioral4
Sample
install_all/dotnet-sdk-6.0.422-win-x64.exe
Resource
win11-20240426-en
windows11-21h2-x64
4 signatures
150 seconds
Behavioral task
behavioral5
Sample
install_all/dotnet-sdk-6.0.422-win-x86.exe
Resource
win11-20240508-en
windows11-21h2-x64
4 signatures
150 seconds
Behavioral task
behavioral6
Sample
install_all/vcredist2005_x64.exe
Resource
win11-20240426-en
windows11-21h2-x64
14 signatures
150 seconds
Behavioral task
behavioral7
Sample
install_all/vcredist2005_x86.exe
Resource
win11-20240419-en
windows11-21h2-x64
14 signatures
150 seconds
Behavioral task
behavioral8
Sample
install_all/vcredist2008_x64.exe
Resource
win11-20240508-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
install_all/vcredist2008_x86.exe
Resource
win11-20240508-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
install_all/vcredist2010_x64.exe
Resource
win11-20240426-en
windows11-21h2-x64
7 signatures
150 seconds
Behavioral task
behavioral11
Sample
install_all/vcredist2010_x86.exe
Resource
win11-20240426-en
windows11-21h2-x64
5 signatures
150 seconds
Behavioral task
behavioral12
Sample
install_all/vcredist2012_x64.exe
Resource
win11-20240508-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
install_all/vcredist2012_x86.exe
Resource
win11-20240508-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
install_all/vcredist2013_x64.exe
Resource
win11-20240426-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
install_all/vcredist2013_x86.exe
Resource
win11-20240508-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral16
Sample
install_all/vcredist2015_2017_2019_2022_x64.exe
Resource
win11-20240426-en
windows11-21h2-x64
4 signatures
150 seconds
Behavioral task
behavioral17
Sample
install_all/vcredist2015_2017_2019_2022_x86.exe
Resource
win11-20240426-en
windows11-21h2-x64
4 signatures
150 seconds
General
- Target install_all/vcredist2005_x86.exe
- Size 2.6MB
- Sample240608-vvze5aee82
- SHA256 4ee4da0fe62d5fa1b5e80c6e6d88a4a2f8b3b140c35da51053d0d7b72a381d29
- MD5 ce2922f83fb4b170affce0ea448b107b
- SHA1 b8fab0bb7f62a24ddfe77b19cd9a1451abd7b847
- SHA512 e94b077e054bd8992374d359f3adc4d1d78d42118d878556715d77182f7d03635850b2b2f06c012ccb7c410e2b3c124cf6508473efe150d3c51a51857ce1c6b0
- SSDEEP 49152:rqGRIgg2SirwkF9xdtb43lyGKCafpKkiwnaDahmPzpY4FPyaza:rxxLFfY/KCCpKk9aWMzZyau
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 1356 MsiExec.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" vcredist2005_x86.exe - Blocklisted process makes network request 1 IoCs
flow pid Process 2 3536 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe - Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia80.dll msiexec.exe - Drops file in Windows directory 61 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\InstallTemp\20240608172452059.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172452137.0\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_452bf920.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172452137.0\vcomp.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172452169.0\8.0.50727.6195.policy msiexec.exe File created C:\Windows\Installer\e58052f.msi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172452169.1\8.0.50727.6195.policy msiexec.exe File created C:\Windows\Installer\e58052b.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI7CB.tmp msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172451966.0\mfc80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172452059.0\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_6a5bb789.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172452184.0\8.0.50727.6195.policy msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172452184.0\8.0.50727.6195.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172452216.0\8.0.50727.6195.policy msiexec.exe File opened for modification C:\Windows\Installer\e58052b.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172452169.0\8.0.50727.6195.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172452200.0\8.0.50727.6195.policy msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172451903.0\msvcr80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172452200.0\8.0.50727.6195.cat msiexec.exe File created C:\Windows\SystemTemp\~DFD13FF2C87C2B1CBA.TMP msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172452137.0\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_452bf920.manifest msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172451903.0\msvcm80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172452059.0\mfc80ENU.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172452059.0\mfc80JPN.dll msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240608172452216.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172451872.0\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_a4c618fa.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172451966.0\mfcm80.dll msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240608172452137.0 msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240608172452184.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172451872.0\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_a4c618fa.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172451966.0\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_150c9e8b.cat msiexec.exe File created C:\Windows\SystemTemp\~DF44B96356A7DB7525.TMP msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172452059.0\mfc80ESP.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172452059.0\mfc80KOR.dll msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240608172451872.0 msiexec.exe File created C:\Windows\Installer\SourceHash{710f4c1c-cc18-4c49-8cbf-51240c89a1a2} msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240608172451903.0 msiexec.exe File created C:\Windows\SystemTemp\~DF8563278DF3635E7C.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIDC7.tmp msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172451903.0\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172451903.0\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172452169.1\8.0.50727.6195.cat msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240608172452200.0 msiexec.exe File created C:\Windows\SystemTemp\~DF41D997D807989FCD.TMP msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172452059.0\mfc80DEU.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172452059.0\mfc80FRA.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172452059.0\mfc80ITA.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172451966.0\mfc80u.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172451966.0\mfcm80u.dll msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240608172451966.0 msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240608172452169.0 msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240608172452169.1 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172451872.0\ATL80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172452059.0\mfc80CHS.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172452059.0\mfc80CHT.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172452216.0\8.0.50727.6195.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172451903.0\msvcp80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172451966.0\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_150c9e8b.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240608172452059.0\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_6a5bb789.manifest msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000d35e07e9a716e6840000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000d35e07e90000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900d35e07e9000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dd35e07e9000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000d35e07e900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b msiexec.exe - Modifies registry class 56 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFC,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e003d0024006b00600049004e005d00490038004300650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\8 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Features\c1c4f01781cc94c4c8fb1542c0981a2a msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFC,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e0021004d00210026005a005a006300300025006e00650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.CRT,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e0061005a004f002c0048002a004b00320060004500650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\3 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFCLOC,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e006600720038005f006c0028006d0032004e004400650038004d006b0062004900640046007700550000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\10 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\ProductName = "Microsoft Visual C++ 2005 Redistributable" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\PackageCode = "84067013B7B56744BA0F51892982BC09" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\c1c4f01781cc94c4c8fb1542c0981a2a msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\1 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFCLOC,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e006900450024005b004d00310025002e0064002700650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.ATL,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e0036006b007d00700048004c004800240053004400650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AA5D9C68C00F12943B2F6CA09FE28244\c1c4f01781cc94c4c8fb1542c0981a2a msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\6 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\9 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AA5D9C68C00F12943B2F6CA09FE28244 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\Language = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\Version = "134278729" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\PackageName = "vcredist.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\4 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\11 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Win32Assemblies\Global msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.CRT,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e005f006a0030002c0059005d007300210053006f00650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\c1c4f01781cc94c4c8fb1542c0981a2a\VC_Redist msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\c1c4f01781cc94c4c8fb1542c0981a2a\Servicing_Key msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\7 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\c1c4f01781cc94c4c8fb1542c0981a2a msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\2 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.OpenMP,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e0035006f00300068002c0070004d0076004e003d00650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AA5D9C68C00F12943B2F6CA09FE28244 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\5 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.OpenMP,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e00370030002d0054002400210028002a0026004e00650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Net msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.ATL,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e00700052005e007000580049006000510075006f00650038004d006b0062004900640046007700550000000000 msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4872 msiexec.exe 4872 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3536 msiexec.exe Token: SeIncreaseQuotaPrivilege 3536 msiexec.exe Token: SeSecurityPrivilege 4872 msiexec.exe Token: SeCreateTokenPrivilege 3536 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3536 msiexec.exe Token: SeLockMemoryPrivilege 3536 msiexec.exe Token: SeIncreaseQuotaPrivilege 3536 msiexec.exe Token: SeMachineAccountPrivilege 3536 msiexec.exe Token: SeTcbPrivilege 3536 msiexec.exe Token: SeSecurityPrivilege 3536 msiexec.exe Token: SeTakeOwnershipPrivilege 3536 msiexec.exe Token: SeLoadDriverPrivilege 3536 msiexec.exe Token: SeSystemProfilePrivilege 3536 msiexec.exe Token: SeSystemtimePrivilege 3536 msiexec.exe Token: SeProfSingleProcessPrivilege 3536 msiexec.exe Token: SeIncBasePriorityPrivilege 3536 msiexec.exe Token: SeCreatePagefilePrivilege 3536 msiexec.exe Token: SeCreatePermanentPrivilege 3536 msiexec.exe Token: SeBackupPrivilege 3536 msiexec.exe Token: SeRestorePrivilege 3536 msiexec.exe Token: SeShutdownPrivilege 3536 msiexec.exe Token: SeDebugPrivilege 3536 msiexec.exe Token: SeAuditPrivilege 3536 msiexec.exe Token: SeSystemEnvironmentPrivilege 3536 msiexec.exe Token: SeChangeNotifyPrivilege 3536 msiexec.exe Token: SeRemoteShutdownPrivilege 3536 msiexec.exe Token: SeUndockPrivilege 3536 msiexec.exe Token: SeSyncAgentPrivilege 3536 msiexec.exe Token: SeEnableDelegationPrivilege 3536 msiexec.exe Token: SeManageVolumePrivilege 3536 msiexec.exe Token: SeImpersonatePrivilege 3536 msiexec.exe Token: SeCreateGlobalPrivilege 3536 msiexec.exe Token: SeBackupPrivilege 2496 vssvc.exe Token: SeRestorePrivilege 2496 vssvc.exe Token: SeAuditPrivilege 2496 vssvc.exe Token: SeBackupPrivilege 4872 msiexec.exe Token: SeRestorePrivilege 4872 msiexec.exe Token: SeRestorePrivilege 4872 msiexec.exe Token: SeTakeOwnershipPrivilege 4872 msiexec.exe Token: SeRestorePrivilege 4872 msiexec.exe Token: SeTakeOwnershipPrivilege 4872 msiexec.exe Token: SeRestorePrivilege 4872 msiexec.exe Token: SeTakeOwnershipPrivilege 4872 msiexec.exe Token: SeRestorePrivilege 4872 msiexec.exe Token: SeTakeOwnershipPrivilege 4872 msiexec.exe Token: SeRestorePrivilege 4872 msiexec.exe Token: SeTakeOwnershipPrivilege 4872 msiexec.exe Token: SeRestorePrivilege 4872 msiexec.exe Token: SeTakeOwnershipPrivilege 4872 msiexec.exe Token: SeRestorePrivilege 4872 msiexec.exe Token: SeTakeOwnershipPrivilege 4872 msiexec.exe Token: SeRestorePrivilege 4872 msiexec.exe Token: SeTakeOwnershipPrivilege 4872 msiexec.exe Token: SeRestorePrivilege 4872 msiexec.exe Token: SeTakeOwnershipPrivilege 4872 msiexec.exe Token: SeRestorePrivilege 4872 msiexec.exe Token: SeTakeOwnershipPrivilege 4872 msiexec.exe Token: SeRestorePrivilege 4872 msiexec.exe Token: SeTakeOwnershipPrivilege 4872 msiexec.exe Token: SeRestorePrivilege 4872 msiexec.exe Token: SeTakeOwnershipPrivilege 4872 msiexec.exe Token: SeRestorePrivilege 4872 msiexec.exe Token: SeTakeOwnershipPrivilege 4872 msiexec.exe Token: SeRestorePrivilege 4872 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3536 msiexec.exe 3536 msiexec.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3660 wrote to memory of 3536 3660 vcredist2005_x86.exe 79 PID 3660 wrote to memory of 3536 3660 vcredist2005_x86.exe 79 PID 3660 wrote to memory of 3536 3660 vcredist2005_x86.exe 79 PID 4872 wrote to memory of 740 4872 msiexec.exe 86 PID 4872 wrote to memory of 740 4872 msiexec.exe 86 PID 4872 wrote to memory of 1356 4872 msiexec.exe 88 PID 4872 wrote to memory of 1356 4872 msiexec.exe 88 PID 4872 wrote to memory of 1356 4872 msiexec.exe 88 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\install_all\vcredist2005_x86.exe"C:\Users\Admin\AppData\Local\Temp\install_all\vcredist2005_x86.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Windows\SysWOW64\msiexec.exemsiexec /i vcredist.msi2⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3536
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:740
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding AE1ECA8DEE4D630A12FD2A17C801ADEB2⤵
- Loads dropped DLL
PID:1356
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2496
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredis1.cab
- Size 247KB
- SHA256 913ee5a1cae3e5a1872b3a5efaaa00c58e4beb692492b138f76967da671b0477
- MD5 cc064d4b81619991de8131a86ad77681
- SHA1 88d80d86cc20c27d7d2a872af719300bd2bb73f9
- SHA512 5aff0eb26cfc187bf58721b2b6d73357d9f1e66d1ac5340ad9ddc08b40ad0eda27a144cb3b650604637a7476c282ded83ed890de98a73ccaf0cc021da3a9eb25
- SSDEEP 6144:jdHDtJKx9Q5+LMfpMjU3B0QPdCtngtpoEvdpYKJFj9gGmO:xti+YLYpM45PUtgvTvdfDj9YO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredist.msi
- Size 2.6MB
- SHA256 91bdd063f6c53126737791c9eccf0b2f4cf44927831527245bc89a0be06c0cb4
- MD5 b20bbeb818222b657df49a9cfe4fed79
- SHA1 3f6508e880b86502773a3275bc9527f046d45502
- SHA512 f534bc7bf1597e728940e6c3b77f864adfaa413bb1e080458326b692b0f96bddf4fbd294eeed36d7764a3578e6c8e919488bbf63b8fe2d4355ab3efd685424a4
- SSDEEP 49152:BxtG+uBvEH/sbE3EyyBU5czkhwZawV4mC5kRuhg6MmqmPAhe75LzNyS:TuVOTWBdzkkawxSh4iAhm51yS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI7CB.tmp
- Size 28KB
- SHA256 f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f
- MD5 85221b3bcba8dbe4b4a46581aa49f760
- SHA1 746645c92594bfc739f77812d67cfd85f4b92474
- SHA512 060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d
- SSDEEP 192:XOdG/6G4nnykxsdYZ+mrv2ySzLUHypLGgjuXFw5acHKBNtHjhuHWrkA9uBP1WWzT:P6GuZBrvkzAHyxxHKBdaA2dWWzm0ZH
- MD5 SHA1 SHA512 SSDEEP
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.6MB
- SHA256 aa3b7c4c39c56ce2462da44bc6c782788434f55cf9190cba073431c6f685b856
- MD5 70eb3f39643d2688001fc52e0b6a714e
- SHA1 f38a8cb3b9d3531f225cf1a20fd8418e0be0cea9
- SHA512 2662da3faaefcd163f224f893cab65ed152960fbad0e83f877d60ae9cb756c49b0e56b956f4aeef83160609203630492636639370a44d7f9b5d37dbf2f76dc4d
- SSDEEP 24576:FZVmSp7LdoO/vvTLNWK+Rkn6/a3jwoEA2WJNXpE6DBa40WuCoB7nb3QN2N:Tq
- MD5 SHA1 SHA512 SSDEEP
- Path \??\Volume{e9075ed3-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{f4fb5d64-2622-4c49-a446-309e721e4206}_OnDiskSnapshotProp
- Size 6KB
- SHA256 a0f8bcb72b90cfde73fe6ec7d94d298287e5877f5942f6576b26599b03e8d5ab
- MD5 12ae972f8b801841d0f450a224575446
- SHA1 6b75b35d7d0e692a5a1a786e83ce805305ac7c6c
- SHA512 d86c675c4268baadba229fbe9dafe6af9935c1dbf663f609b53a74317949170d6e08e1eaf0185545d10cee9ea8abc45718e9f7fa3e599fc873749f93f0d68136
- SSDEEP 96:Fk59K3pADD84LTHzbOHXOHBlBRQ78Sc9XE56tOSVQpu:GJb++mVm
- MD5 SHA1 SHA512 SSDEEP