Analysis
- max time kernel
95s - max time network
97s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 01:30
Static task
static1
Behavioral task
behavioral1
Sample
tgr-FILE.msi
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
tgr-FILE.msi
Resource
win10v2004-20240611-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target tgr-FILE.msi
- Size 547KB
- Sample240613-bw7ncasgrk
- SHA256 26eab70f00aba19298d31f6c645ab03762acc1f8ac9026948a62c5ff1ea224d4
- MD5 a467a633cc852a2e071d9a7df28f427e
- SHA1 fbdeea98ac98ca5cd3965599861a787d23032a98
- SHA512 d95a012ee056c614dbd67bce3ca5381a6b56bb15f3dfbf0c290614622dfcb29a994e563ffac43de62724194391ce0eb29b8f6422494de6322fdd1213659b3fa1
- SSDEEP 12288:qCUYtFIWlAJPlP41dpd5e6mBLUVEVWE72W8wrjAyjmv:qBYtFId/5IqVXCWJrjAyC
- MD5 SHA1 SHA512 SSDEEP
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TCUBQI90464CHEM = "\"C:\\BHtVZhF8bt\\d3F7zwHoZY.exe\" \"C:\\BHtVZhF8bt\\zdR9uSarn7\" \"C:\\BHtVZhF8bt\\ZYDIyJglnI.dll\"" MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\T: msiexec.exe - Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI689E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI68ED.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI690D.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{FC5F0FDA-9B01-4CE8-8A1D-B697B910E0A4} msiexec.exe File opened for modification C:\Windows\Installer\MSI696C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI67C2.tmp msiexec.exe File opened for modification C:\Windows\Installer\e576784.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\e576784.msi msiexec.exe - Loads dropped DLL 4 IoCs
pid Process 3976 MsiExec.exe 3976 MsiExec.exe 3976 MsiExec.exe 3976 MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000a1a8d825d9cc14480000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000a1a8d8250000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900a1a8d825000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1da1a8d825000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000a1a8d82500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1200 msiexec.exe 1200 msiexec.exe - Suspicious use of AdjustPrivilegeToken 61 IoCs
description pid Process Token: SeShutdownPrivilege 1880 msiexec.exe Token: SeIncreaseQuotaPrivilege 1880 msiexec.exe Token: SeSecurityPrivilege 1200 msiexec.exe Token: SeCreateTokenPrivilege 1880 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1880 msiexec.exe Token: SeLockMemoryPrivilege 1880 msiexec.exe Token: SeIncreaseQuotaPrivilege 1880 msiexec.exe Token: SeMachineAccountPrivilege 1880 msiexec.exe Token: SeTcbPrivilege 1880 msiexec.exe Token: SeSecurityPrivilege 1880 msiexec.exe Token: SeTakeOwnershipPrivilege 1880 msiexec.exe Token: SeLoadDriverPrivilege 1880 msiexec.exe Token: SeSystemProfilePrivilege 1880 msiexec.exe Token: SeSystemtimePrivilege 1880 msiexec.exe Token: SeProfSingleProcessPrivilege 1880 msiexec.exe Token: SeIncBasePriorityPrivilege 1880 msiexec.exe Token: SeCreatePagefilePrivilege 1880 msiexec.exe Token: SeCreatePermanentPrivilege 1880 msiexec.exe Token: SeBackupPrivilege 1880 msiexec.exe Token: SeRestorePrivilege 1880 msiexec.exe Token: SeShutdownPrivilege 1880 msiexec.exe Token: SeDebugPrivilege 1880 msiexec.exe Token: SeAuditPrivilege 1880 msiexec.exe Token: SeSystemEnvironmentPrivilege 1880 msiexec.exe Token: SeChangeNotifyPrivilege 1880 msiexec.exe Token: SeRemoteShutdownPrivilege 1880 msiexec.exe Token: SeUndockPrivilege 1880 msiexec.exe Token: SeSyncAgentPrivilege 1880 msiexec.exe Token: SeEnableDelegationPrivilege 1880 msiexec.exe Token: SeManageVolumePrivilege 1880 msiexec.exe Token: SeImpersonatePrivilege 1880 msiexec.exe Token: SeCreateGlobalPrivilege 1880 msiexec.exe Token: SeBackupPrivilege 3844 vssvc.exe Token: SeRestorePrivilege 3844 vssvc.exe Token: SeAuditPrivilege 3844 vssvc.exe Token: SeBackupPrivilege 1200 msiexec.exe Token: SeRestorePrivilege 1200 msiexec.exe Token: SeRestorePrivilege 1200 msiexec.exe Token: SeTakeOwnershipPrivilege 1200 msiexec.exe Token: SeRestorePrivilege 1200 msiexec.exe Token: SeTakeOwnershipPrivilege 1200 msiexec.exe Token: SeRestorePrivilege 1200 msiexec.exe Token: SeTakeOwnershipPrivilege 1200 msiexec.exe Token: SeRestorePrivilege 1200 msiexec.exe Token: SeTakeOwnershipPrivilege 1200 msiexec.exe Token: SeRestorePrivilege 1200 msiexec.exe Token: SeTakeOwnershipPrivilege 1200 msiexec.exe Token: SeRestorePrivilege 1200 msiexec.exe Token: SeTakeOwnershipPrivilege 1200 msiexec.exe Token: SeBackupPrivilege 3768 srtasks.exe Token: SeRestorePrivilege 3768 srtasks.exe Token: SeSecurityPrivilege 3768 srtasks.exe Token: SeTakeOwnershipPrivilege 3768 srtasks.exe Token: SeBackupPrivilege 3768 srtasks.exe Token: SeRestorePrivilege 3768 srtasks.exe Token: SeSecurityPrivilege 3768 srtasks.exe Token: SeTakeOwnershipPrivilege 3768 srtasks.exe Token: SeRestorePrivilege 1200 msiexec.exe Token: SeTakeOwnershipPrivilege 1200 msiexec.exe Token: SeRestorePrivilege 1200 msiexec.exe Token: SeTakeOwnershipPrivilege 1200 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1880 msiexec.exe 1880 msiexec.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1200 wrote to memory of 3768 1200 msiexec.exe 89 PID 1200 wrote to memory of 3768 1200 msiexec.exe 89 PID 1200 wrote to memory of 3976 1200 msiexec.exe 91 PID 1200 wrote to memory of 3976 1200 msiexec.exe 91 PID 1200 wrote to memory of 3976 1200 msiexec.exe 91 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\tgr-FILE.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1880
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:3768
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding BD177B3F71FB4A437A9EE1C94408DB732⤵
- Adds Run key to start application
- Loads dropped DLL
PID:3976
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3844
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e576787.rbs
- Size 1KB
- SHA256 6b4f985153948a1c35ae9b3408e8505c0b6b62cefbabd38622cdf5b8b51cf324
- MD5 1d688e6655e19692a40161ca954484d2
- SHA1 20559c8a655d66473cbdc6061f96ff90d6ec5537
- SHA512 225957cd0fe5d568a3cb260f8f9255c6b9173c118912e7cb6d096469fb0930f7f347a3c1edd6983dbeba777efe3aa949d5e7bec3c45314e8417b3880284c89a0
- MD5 SHA1 SHA512
- Path C:\Windows\Installer\MSI67C2.tmp
- Size 372KB
- SHA256 9692a12baf2113db4921678f3cf8746933d26d05141748fe09dcef11e5d94f54
- MD5 a3b4d222a755f43b34a0963f13f77500
- SHA1 e3bd216f35434287197082745b9f789b9a4f93c6
- SHA512 7baf4279fe8409db2a10638b060d2f19259be82363180c521a83f786d64c5b6e5b024ebeeedb163773d9d19efa1f1da036b55a94cc4009108eb2b910c64a3e50
- SSDEEP 6144:idP44IWEkaPATnAJPlPA5L1dp9As5H+w7mOKMSTAO+VEVkL1ER7KZW8wr+u:8FIWlAJPlP41dpd5e6mBLUVEVWE72W8Y
- MD5 SHA1 SHA512 SSDEEP
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 23.7MB
- SHA256 9268b6c8530fb3f62fcfece3c5be0bee66e5e48436363ffe8c85eb932d8bd5e3
- MD5 0df65f57aeb3eceb57bb3fb8edd625ef
- SHA1 bb37e67b7b01c7952c0ce28853261b63b2d4f0db
- SHA512 c250eeaad3145e21516fd6e96a24e452917536dddc4d97f9993e9cff162e69a888e33065f11992a9ce14be32cfb7af8ee52db689a15b9e7e9763d7e7a7c85221
- SSDEEP 24576:aSqm41x7doO/vvTLkzDOEXmzAA8JBgKqHjj9ZoQGaG6PyAPWIxFs7KDWE:g
- MD5 SHA1 SHA512 SSDEEP
- Path \??\Volume{25d8a8a1-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{2cb9bb83-be0d-4698-bfdb-608b1a8628b4}_OnDiskSnapshotProp
- Size 6KB
- SHA256 2d2cf5efcc66939ebffb4f31e6029f8f40369bc83f2ed6769701a37556e08f10
- MD5 30d1ed212b571e84342a9d06ae1e60d2
- SHA1 18f3b8a96188f46b1c198d582bf37114435818f4
- SHA512 75283388ddf5faf946e5ea33a20b159352b97d402db5849bb94033213dcfdf8af7acc2ba1b7d69001ea19a88ca99160744a7ed844cb2c5663e1cf371ba52204a
- SSDEEP 96:FFetdztJc4wDD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:ibt4b++1VmN
- MD5 SHA1 SHA512 SSDEEP