5419c3c3738a5d197893dca193601ccaf0eb6198fefeaec34c263780a339602b

Analysis

max time kernel
120s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 07:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.msi
Size

46.6MB
MD5

6786f27c9558db89f94917e7846bdfa9
SHA1

f9dd7ed3eb6508bb3dda12a8d6a9bf0604c12c80
SHA256

151791fe4ab09c2611ecd4a6543fb62bbb8336853a5769827954ef6354d70f43
SHA512

06f65a18edb5b841cae84c3dd488f3e2e337fd73c194626c2f498628432d19ceda9d33139794a40f06d5bdac82bf2158954fd565e9597e1b6dd3e3bedc3ecf01
SSDEEP

196608:5Jwa6efw7kjueNqGLWlByaWjIu4pNMewsyhOoytlBzFoaK+qlJKDBeY:7r6efNueNqm34pNmER7oaK+qlJKDBe

Score

6^/10

persistence

Malware Config

Signatures

Blocklisted process makes network request 3 IoCs

flow	pid	Process
2	3196	msiexec.exe
6	3196	msiexec.exe
8	3196	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe

Drops file in Program Files directory 29 IoCs

description	ioc	Process
File created	C:\Program Files\DriverUpdate\Open-Source Licenses.txt	msiexec.exe
File created	C:\Program Files\SlimWare Utilities\Services\SlimWare.Core.dll	msiexec.exe
File created	C:\Program Files\SlimWare Utilities\Services\SlimWare.Services.exe	msiexec.exe
File created	C:\Program Files\DriverUpdate\UninstallStub.exe	msiexec.exe
File created	C:\Program Files\SlimWare Utilities\Services\DriverUpdate.UpdateLauncher.exe	msiexec.exe
File created	C:\Program Files\SlimWare Utilities\Services\BugSplat.dll	msiexec.exe
File created	C:\Program Files\SlimWare Utilities\Services\SlimWare.Session.ProxyStub.dll	msiexec.exe
File created	C:\Program Files\DriverUpdate\UnifiedLogger.dll	msiexec.exe
File created	C:\Program Files\SlimWare Utilities\Services\BugSplatRC64.dll	msiexec.exe
File created	C:\Program Files\DriverUpdate\BsSndRpt.exe	msiexec.exe
File created	C:\Program Files\DriverUpdate\dbghelp.dll	msiexec.exe
File created	C:\Program Files\DriverUpdate\InAppBrowserProxy.dll	msiexec.exe
File created	C:\Program Files\DriverUpdate\lib-inappbrowser.dll	msiexec.exe
File created	C:\Program Files\DriverUpdate\SlimWare.Messaging.dll	msiexec.exe
File created	C:\Program Files\DriverUpdate\SlimWare.PushNotification.Services.dll	msiexec.exe
File created	C:\Program Files\SlimWare Utilities\Services\BsSndRpt.exe	msiexec.exe
File created	C:\Program Files\SlimWare Utilities\Services\SlimWare.Session.exe	msiexec.exe
File created	C:\Program Files\DriverUpdate\BugSplat.dll	msiexec.exe
File created	C:\Program Files\DriverUpdate\BugSplatRc.dll	msiexec.exe
File created	C:\Program Files\SlimWare Utilities\Services\dbghelp.dll	msiexec.exe
File created	C:\Program Files\DriverUpdate\dbghelp-app.dll	msiexec.exe
File created	C:\Program Files\DriverUpdate\htmlayout.dll	msiexec.exe
File created	C:\Program Files\DriverUpdate\SlimWare.DriverUpdate.Services.dll	msiexec.exe
File created	C:\Program Files\SlimWare Utilities\Services\SlimWare.Services.ProxyStub.dll	msiexec.exe
File opened for modification	C:\Program Files\DriverUpdate\DriverUpdate.exe	MsiExec.exe
File created	C:\Program Files\SlimWare Utilities\Services\BsSndRpt64.exe	msiexec.exe
File created	C:\Program Files\DriverUpdate\DriverUpdate.exe	msiexec.exe
File created	C:\Program Files\SlimWare Utilities\Services\BugSplat64.dll	msiexec.exe
File created	C:\Program Files\SlimWare Utilities\Services\BugSplatRC.dll	msiexec.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\Installer\SourceHash{5519CAE7-A06E-4E9A-97E8-AFEE6D67F7BE}	msiexec.exe
File created	C:\Windows\Installer\{5519CAE7-A06E-4E9A-97E8-AFEE6D67F7BE}\Icon.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{5519CAE7-A06E-4E9A-97E8-AFEE6D67F7BE}\Icon.exe	msiexec.exe
File created	C:\Windows\Installer\e573cdc.msi	msiexec.exe
File created	C:\Windows\Installer\e573cda.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e573cda.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3E03.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3FF8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4047.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe

Loads dropped DLL 2 IoCs

pid	Process
2760	MsiExec.exe
2760	MsiExec.exe

Registers COM server for autorun 1 TTPs 20 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{36137FA3-91C0-48EF-B1A8-27C1974708B8}\LocalServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E58DA376-0D39-45ED-A6EE-A7B6DD10BED2}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BDF76960-B341-4592-BDBA-DFC8C74165A9}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BDF76960-B341-4592-BDBA-DFC8C74165A9}\InprocServer32\ = "C:\\Program Files\\SlimWare Utilities\\Services\\SlimWare.Session.ProxyStub.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E58DA376-0D39-45ED-A6EE-A7B6DD10BED2}\InprocServer32\ = "C:\\Program Files\\SlimWare Utilities\\Services\\SlimWare.Services.ProxyStub.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{25C88C47-EB26-40D1-BDC7-BBB30E0F752B}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{25C88C47-EB26-40D1-BDC7-BBB30E0F752B}\LocalServer32\ = "\"C:\\Program Files\\SlimWare Utilities\\Services\\SlimWare.Session.exe\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{25C88C47-EB26-40D1-BDC7-BBB30E0F752B}\LocalServer32\ThreadingModel = "Free"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BDF76960-B341-4592-BDBA-DFC8C74165A9}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5139FDE1-9FDE-4D4C-89D0-5D016161B13A}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36137FA3-91C0-48EF-B1A8-27C1974708B8}\LocalServer32\ = "\"C:\\Program Files\\SlimWare Utilities\\Services\\SlimWare.Services.exe\""	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{E58DA376-0D39-45ED-A6EE-A7B6DD10BED2}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E58DA376-0D39-45ED-A6EE-A7B6DD10BED2}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{25C88C47-EB26-40D1-BDC7-BBB30E0F752B}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5139FDE1-9FDE-4D4C-89D0-5D016161B13A}\LocalServer32\ = "\"C:\\Program Files\\SlimWare Utilities\\Services\\DriverUpdate.UpdateLauncher.exe\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5139FDE1-9FDE-4D4C-89D0-5D016161B13A}\LocalServer32\ThreadingModel = "Free"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36137FA3-91C0-48EF-B1A8-27C1974708B8}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36137FA3-91C0-48EF-B1A8-27C1974708B8}\LocalServer32\ThreadingModel = "Free"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{BDF76960-B341-4592-BDBA-DFC8C74165A9}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{5139FDE1-9FDE-4D4C-89D0-5D016161B13A}\LocalServer32	msiexec.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\DriverUpdate.exe = "11001"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\DriverUpdate.exe = "11001"	MsiExec.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDF76960-B341-4592-BDBA-DFC8C74165A9}\TypeLib\Version = "1.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE74B1E6-4EBC-42A1-A4EF-E03F45195608}\1.0\0\win64\ = "C:\\Program Files\\SlimWare Utilities\\Services\\SlimWare.Session.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E58DA376-0D39-45ED-A6EE-A7B6DD10BED2}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31E87E80-E113-49FD-9789-A97E83CEA4F1}\1.0\0\win64	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7EAC9155E60AA9E4798EFAEED6767FEB\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{E58DA376-0D39-45ED-A6EE-A7B6DD10BED2}\NumMethods	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{BDF76960-B341-4592-BDBA-DFC8C74165A9}\NumMethods	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{9AEC63C2-831A-4134-8EB0-02C0B7B97620}\NumMethods	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7EAC9155E60AA9E4798EFAEED6767FEB	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{3B8B86CB-0248-4F00-AC0E-EE5C6795D7F4}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7EAC9155E60AA9E4798EFAEED6767FEB\ProductName = "DriverUpdate"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{25C88C47-EB26-40D1-BDC7-BBB30E0F752B}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{3B8B86CB-0248-4F00-AC0E-EE5C6795D7F4}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9AEC63C2-831A-4134-8EB0-02C0B7B97620}\TypeLib\Version = "1.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C9276E23-AD64-404D-8D3C-1EBB1F965E40}\TypeLib\ = "{31E87E80-E113-49FD-9789-A97E83CEA4F1}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31E87E80-E113-49FD-9789-A97E83CEA4F1}\1.0\FLAGS\ = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7EAC9155E60AA9E4798EFAEED6767FEB\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\50D2BAFD096C90345A82B25A790BDF69\7EAC9155E60AA9E4798EFAEED6767FEB	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{36137FA3-91C0-48EF-B1A8-27C1974708B8}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E58DA376-0D39-45ED-A6EE-A7B6DD10BED2}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{BDF76960-B341-4592-BDBA-DFC8C74165A9}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{25C88C47-EB26-40D1-BDC7-BBB30E0F752B}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9AEC63C2-831A-4134-8EB0-02C0B7B97620}\ = "IJobLauncher"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5139FDE1-9FDE-4D4C-89D0-5D016161B13A}\Elevation\Enabled = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7EAC9155E60AA9E4798EFAEED6767FEB\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{58A8BF1A-3608-41EA-AAD1-581AB79105E6}\1.0\0\win64	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E58DA376-0D39-45ED-A6EE-A7B6DD10BED2}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E58DA376-0D39-45ED-A6EE-A7B6DD10BED2}\InprocServer32\ = "C:\\Program Files\\SlimWare Utilities\\Services\\SlimWare.Services.ProxyStub.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AppID\{6D3BC646-CFCD-4098-8495-B7BD0DF13133}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE74B1E6-4EBC-42A1-A4EF-E03F45195608}\1.0	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5139FDE1-9FDE-4D4C-89D0-5D016161B13A}\LocalServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31E87E80-E113-49FD-9789-A97E83CEA4F1}\1.0\0	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7EAC9155E60AA9E4798EFAEED6767FEB\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{E58DA376-0D39-45ED-A6EE-A7B6DD10BED2}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BDF76960-B341-4592-BDBA-DFC8C74165A9}\ = "PSFactoryBuffer"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{E58DA376-0D39-45ED-A6EE-A7B6DD10BED2}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{36137FA3-91C0-48EF-B1A8-27C1974708B8}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{58A8BF1A-3608-41EA-AAD1-581AB79105E6}\1.0\FLAGS	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7EAC9155E60AA9E4798EFAEED6767FEB\ProductIcon = "C:\\Windows\\Installer\\{5519CAE7-A06E-4E9A-97E8-AFEE6D67F7BE}\\Icon.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36137FA3-91C0-48EF-B1A8-27C1974708B8}\AppID = "{F6A8CE42-CB2D-4920-85E7-24966D63D4B9}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDF76960-B341-4592-BDBA-DFC8C74165A9}\TypeLib\ = "{CE74B1E6-4EBC-42A1-A4EF-E03F45195608}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDF76960-B341-4592-BDBA-DFC8C74165A9}\NumMethods\ = "4"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{25C88C47-EB26-40D1-BDC7-BBB30E0F752B}\Version	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C9276E23-AD64-404D-8D3C-1EBB1F965E40}\ = "DJobLauncherEvents"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{C9276E23-AD64-404D-8D3C-1EBB1F965E40}\ProxyStubClsid32	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7EAC9155E60AA9E4798EFAEED6767FEB\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AppID\{F6A8CE42-CB2D-4920-85E7-24966D63D4B9}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B8B86CB-0248-4F00-AC0E-EE5C6795D7F4}\ProxyStubClsid32\ = "{BDF76960-B341-4592-BDBA-DFC8C74165A9}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{BDF76960-B341-4592-BDBA-DFC8C74165A9}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{25C88C47-EB26-40D1-BDC7-BBB30E0F752B}\LocalServer32\ThreadingModel = "Free"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31E87E80-E113-49FD-9789-A97E83CEA4F1}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E58DA376-0D39-45ED-A6EE-A7B6DD10BED2}\ = "PSFactoryBuffer"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{E58DA376-0D39-45ED-A6EE-A7B6DD10BED2}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{E58DA376-0D39-45ED-A6EE-A7B6DD10BED2}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{CE74B1E6-4EBC-42A1-A4EF-E03F45195608}\1.0\0\win64	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE74B1E6-4EBC-42A1-A4EF-E03F45195608}\1.0\FLAGS\ = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{BAF61B64-5D1A-4108-97CB-A10B7DDF730E}\ = "DriverUpdate.UpdateLauncher"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7EAC9155E60AA9E4798EFAEED6767FEB\Application	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7EAC9155E60AA9E4798EFAEED6767FEB\SourceList\PackageName = "sample.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36137FA3-91C0-48EF-B1A8-27C1974708B8}\LocalServer32\ = "\"C:\\Program Files\\SlimWare Utilities\\Services\\SlimWare.Services.exe\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{F6A8CE42-CB2D-4920-85E7-24966D63D4B9}\ = "SlimWare.Services"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{58A8BF1A-3608-41EA-AAD1-581AB79105E6}\1.0\0\win64\ = "C:\\Program Files\\SlimWare Utilities\\Services\\SlimWare.Services.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{25C88C47-EB26-40D1-BDC7-BBB30E0F752B}\TypeLib	msiexec.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2760	MsiExec.exe
2760	MsiExec.exe
2760	MsiExec.exe
2760	MsiExec.exe
388	msiexec.exe
388	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3196	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3196	msiexec.exe
Token: SeSecurityPrivilege	388	msiexec.exe
Token: SeCreateTokenPrivilege	3196	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3196	msiexec.exe
Token: SeLockMemoryPrivilege	3196	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3196	msiexec.exe
Token: SeMachineAccountPrivilege	3196	msiexec.exe
Token: SeTcbPrivilege	3196	msiexec.exe
Token: SeSecurityPrivilege	3196	msiexec.exe
Token: SeTakeOwnershipPrivilege	3196	msiexec.exe
Token: SeLoadDriverPrivilege	3196	msiexec.exe
Token: SeSystemProfilePrivilege	3196	msiexec.exe
Token: SeSystemtimePrivilege	3196	msiexec.exe
Token: SeProfSingleProcessPrivilege	3196	msiexec.exe
Token: SeIncBasePriorityPrivilege	3196	msiexec.exe
Token: SeCreatePagefilePrivilege	3196	msiexec.exe
Token: SeCreatePermanentPrivilege	3196	msiexec.exe
Token: SeBackupPrivilege	3196	msiexec.exe
Token: SeRestorePrivilege	3196	msiexec.exe
Token: SeShutdownPrivilege	3196	msiexec.exe
Token: SeDebugPrivilege	3196	msiexec.exe
Token: SeAuditPrivilege	3196	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3196	msiexec.exe
Token: SeChangeNotifyPrivilege	3196	msiexec.exe
Token: SeRemoteShutdownPrivilege	3196	msiexec.exe
Token: SeUndockPrivilege	3196	msiexec.exe
Token: SeSyncAgentPrivilege	3196	msiexec.exe
Token: SeEnableDelegationPrivilege	3196	msiexec.exe
Token: SeManageVolumePrivilege	3196	msiexec.exe
Token: SeImpersonatePrivilege	3196	msiexec.exe
Token: SeCreateGlobalPrivilege	3196	msiexec.exe
Token: SeBackupPrivilege	3192	vssvc.exe
Token: SeRestorePrivilege	3192	vssvc.exe
Token: SeAuditPrivilege	3192	vssvc.exe
Token: SeRestorePrivilege	388	msiexec.exe
Token: SeTakeOwnershipPrivilege	388	msiexec.exe
Token: SeRestorePrivilege	388	msiexec.exe
Token: SeTakeOwnershipPrivilege	388	msiexec.exe
Token: SeRestorePrivilege	388	msiexec.exe
Token: SeTakeOwnershipPrivilege	388	msiexec.exe
Token: SeRestorePrivilege	388	msiexec.exe
Token: SeTakeOwnershipPrivilege	388	msiexec.exe
Token: SeRestorePrivilege	388	msiexec.exe
Token: SeTakeOwnershipPrivilege	388	msiexec.exe
Token: SeRestorePrivilege	388	msiexec.exe
Token: SeTakeOwnershipPrivilege	388	msiexec.exe
Token: SeRestorePrivilege	388	msiexec.exe
Token: SeTakeOwnershipPrivilege	388	msiexec.exe
Token: SeRestorePrivilege	388	msiexec.exe
Token: SeTakeOwnershipPrivilege	388	msiexec.exe
Token: SeRestorePrivilege	388	msiexec.exe
Token: SeTakeOwnershipPrivilege	388	msiexec.exe
Token: SeRestorePrivilege	388	msiexec.exe
Token: SeTakeOwnershipPrivilege	388	msiexec.exe
Token: SeRestorePrivilege	388	msiexec.exe
Token: SeTakeOwnershipPrivilege	388	msiexec.exe
Token: SeRestorePrivilege	388	msiexec.exe
Token: SeTakeOwnershipPrivilege	388	msiexec.exe
Token: SeRestorePrivilege	388	msiexec.exe
Token: SeTakeOwnershipPrivilege	388	msiexec.exe
Token: SeRestorePrivilege	388	msiexec.exe
Token: SeTakeOwnershipPrivilege	388	msiexec.exe
Token: SeRestorePrivilege	388	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3196	msiexec.exe
3196	msiexec.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 388 wrote to memory of 2760	388	msiexec.exe	87
PID 388 wrote to memory of 2760	388	msiexec.exe	87

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\sample.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3196

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Registers COM server for autorun
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:388
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding D268206E2B710A9FE4E894BB620C4FA9
  2⤵
  - Drops file in Program Files directory
  - Loads dropped DLL
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  PID:2760

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e573cdb.rbs

Filesize
21KB

MD5
fb9faa664f5e9859efdbce0cfc6812d8

SHA1
526439c91f559107f3ad6d85aec53cabb9287903

SHA256
7972bc292bfe58ee947889e5c3f3e3dd6ed8e83c9b9c72b07c4a731eedfbbd30

SHA512
edd50e27eb14dda2a414e37ab5fc328994a14de328dd25e338c0542ed89e3df24b4c70dd1e5435bd64ffd3bde78b19fda7db7e7cae67a2b744270b294601ece8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\40C68D5626484A90937F0752C8B950AB

Filesize
834B

MD5
cbed24fd2b55aea95367efca5ee889de

SHA1
946f48b5c344fd57113845cd483fed5fb9fa3e54

SHA256
1dc8a0fcbe260b77adfe5ad9aaac543239b2a0d9f4e1f3c2657beee4376ffee4

SHA512
c504a11ea576f8ce14de26a0617e22e71e14db0f1dadefc187ce94e4a35a83743c743824e3629899c262aae4772bb86a0ee5bb643db20645483f0c376215ec6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE

Filesize
5B

MD5
4842e206e4cfff2954901467ad54169e

SHA1
80c9820ff2efe8aa3d361df7011ae6eee35ec4f0

SHA256
2acab1228e8935d5dfdd1756b8a19698b6c8b786c90f87993ce9799a67a96e4e

SHA512
ff537b1808fcb03cfb52f768fbd7e7bd66baf6a8558ee5b8f2a02f629e021aa88a1df7a8750bae1f04f3b9d86da56f0bdcba2fdbc81d366da6c97eb76ecb6cba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C46E7B0F942663A1EDC8D9D6D7869173_DF4CA81DC775CDA9B3214BDB5B55900E

Filesize
5B

MD5
5bfa51f3a417b98e7443eca90fc94703

SHA1
8c015d80b8a23f780bdd215dc842b0f5551f63bd

SHA256
bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

SHA512
4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EA618097E393409AFA316F0F87E2C202_2280A2210A1DD6666EC3A552D924ABF6

Filesize
1KB

MD5
97b2f1c84cc5b6e8026d05d016eb7597

SHA1
5d28b11fee3c3b6006840409d5fccdae0f1a7b7d

SHA256
1d5971fb49b11cc3b28741fe6849c1b5285822421b0963c4102041d01b1e21a9

SHA512
8e037b304913cd195f85fa71731e1724f8b2fc31bd7f63136566e5261be2c49d64c0e2305b22735863ca25970ec8d12de1b7b35563f16eff76cf641a2bad477d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\40C68D5626484A90937F0752C8B950AB

Filesize
180B

MD5
298fc942c8122cbec2cdaf57c9139fac

SHA1
c631a515bbac933b4e06154e859c6f85c9561a0b

SHA256
deb11d39e169bc16a9f8953bc2a9984b1f2d9198034e6802531422cdbfcf4784

SHA512
4d4ccadac84775e9df1a59f85d15534daefa4fb2b96225adce0ac5a9293328f19846b100fffc9d541857a8f3a64b624601b02ede4efad7a8678ba8821721790a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE

Filesize
398B

MD5
b4827d0f7d98374bca8cb73995e8d8fb

SHA1
ff3fccfe6dfb69a8b040d26c681b7296e38ed16a

SHA256
b8cdf58c848c9194ba7a43e956e8f5308828f06be3bb4e17908c477bc67105cb

SHA512
e8bac8fbe65ce3b0b8b52333202304c9872cf09b94282376a413f0c88979dbca79bb6efd5407c5ac8bd7349183aba4743905fd23ed2b7f303c87482b7bb11571

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C46E7B0F942663A1EDC8D9D6D7869173_DF4CA81DC775CDA9B3214BDB5B55900E

Filesize
476B

MD5
6451c4de3cc329dffe9ec578d02b8fcb

SHA1
62e22d7527e4ca9db630e69ba4944c64dff23ec9

SHA256
bc9f9ea8407c9573c6bcefcc65b2c8676e1a1d85596b1c8d684bc7de37bd9302

SHA512
05de8fa7ff1eee070c4cf480d4f0e15a2bf79d23c8021202a941e0bfdfd15378cb9feed523b39e7bea6a25093d62f3ed77232695610290eb2bd4b91c8752c8db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EA618097E393409AFA316F0F87E2C202_2280A2210A1DD6666EC3A552D924ABF6

Filesize
398B

MD5
4986379c8e7c9b0a28f7476d3931ed18

SHA1
ba4b32e4b2480074bb0a680457de2be2e65247c1

SHA256
2a6c594eaa84a054603bc582ca7920d3687507ead91f6cef70d61d5cd1f6b75e

SHA512
cbbd8f4369ac5a4669b455a301bd6414255890d4099d4355c4fea21d682215a5bbe31188d5cc6da91922e79fde664b0c6dcd3e4ae509bc77e9e58cb18ca66489

Download Submit
C:\Windows\Installer\MSI3E03.tmp

Filesize
169KB

MD5
defa0cbafb360ab80b7cdcc0d6029aec

SHA1
16a5c55a62b3859ea04942c5f831f7d192c3d545

SHA256
ebcce6dff23eb731d2ec49e32886d44d1dc0fd0cfb92f65d43922e8e8bcba26d

SHA512
e024dea0d228a63357255d9fce6dfd43317f7e3612a82be4a5a8a6b213f1e6dd8c932f70c35fa4c7692c566c5208df3783d5c7c0e8666ce90fff5c06e1b83b22

Download Submit
C:\Windows\Installer\e573cda.msi

Filesize
46.6MB

MD5
6786f27c9558db89f94917e7846bdfa9

SHA1
f9dd7ed3eb6508bb3dda12a8d6a9bf0604c12c80

SHA256
151791fe4ab09c2611ecd4a6543fb62bbb8336853a5769827954ef6354d70f43

SHA512
06f65a18edb5b841cae84c3dd488f3e2e337fd73c194626c2f498628432d19ceda9d33139794a40f06d5bdac82bf2158954fd565e9597e1b6dd3e3bedc3ecf01

Download Submit