Analysis
-
max time kernel
50s -
max time network
54s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
28-06-2024 06:24
General
-
Target
windows_exporter-Agent.msi
-
Size
10.1MB
-
MD5
7096892e6330a1630ac9c588aa01e3a2
-
SHA1
3adbaa05e9def1d97823615f2f47669bcb1d8395
-
SHA256
822166c33ce415436a287f4f5bf34c9737da5201cda3b6a31ffc5b2be5023679
-
SHA512
73462b1b03ee2b81eb421e13fc466224666db2c6312e4424cf6451001f2d94ea5006f71957ab1a5c9617a862bb44f27f919dffc370637345a5b17fe7f885e540
-
SSDEEP
196608:djo2fy0hWWpfeZdkW2ijrtlT95y0DalZEM/Jbr1ZOONCbLmUo2hWN:dES/UWQdz24R2JbrzOsamU+N
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 1 IoCs
-
Drops file in Windows directory 14 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 5 IoCs
-
Event Triggered Execution: Installer Packages 1 TTPs 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 64 IoCs
-
Modifies registry class 22 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\windows_exporter-Agent.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0BF04B7C8F57319E8C3F83E0C7CA46612⤵
- Loads dropped DLL
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D1B8530D94B5D913608EED043D24B4DC E Global\MSI00002⤵
- Drops file in Windows directory
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Program Files\windows_exporter\windows_exporter.exe"C:\Program Files\windows_exporter\windows_exporter.exe" --log.format logger:eventlog?name=windows_exporter1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
329KB
MD5a897f8b8240e9893ebe2b542fac1dd63
SHA1afc81d238e7ec533aacb013f8588748fa28d5556
SHA2560508ae59ff8b9f684265d65ae24a13eba79b0b9278b7558687d8559d865ab854
SHA51212d187da96dce14d8e4c6f454f271c00d7ef50325f34176df90ce489c0a4ec807b0560b8f79fc4160dc0d5319fcb436f79f47f4ccb7ed576bdea1c71a9cfa998
-
Filesize
19.5MB
MD58a41cd83c16f6e9d060036ffee985f88
SHA10f90cc3cc01f3b96c74314dc562675948f5c89b1
SHA256e99bcd3b0b4cc65c7ac40e95eb8a43c0ffa769fcb6b733a9ebc6c9f9d4ff69eb
SHA5126eadb6dc7e8c79e8df88100643d86780a14bdcfd3617adfd4959c118493e1bb92bbf15b0969c645bb9502e1ca4caec9c866be309a565f784ac6085ef9f9c6d19
-
Filesize
118KB
MD5f2d47929b432a0be6db3b25ac5f50ae6
SHA1dbbd61fb1379e1d94dc0384f0c2e908c9c632d42
SHA2560eae25d188cd1589844050135065aa302e716a2b691dda27d6ed18140aedef4f
SHA51297601fd72456409ad3dc7aa816e29e53f6e7be80368fcc95c5fee90ff03fc7f36f8b105a705eea0e1af3d612b86c7793e74371d436ffa866d399c386078be58d
-
Filesize
202KB
MD5ba84dd4e0c1408828ccc1de09f585eda
SHA1e8e10065d479f8f591b9885ea8487bc673301298
SHA2563cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
SHA5127a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
-
Filesize
10.1MB
MD57096892e6330a1630ac9c588aa01e3a2
SHA13adbaa05e9def1d97823615f2f47669bcb1d8395
SHA256822166c33ce415436a287f4f5bf34c9737da5201cda3b6a31ffc5b2be5023679
SHA51273462b1b03ee2b81eb421e13fc466224666db2c6312e4424cf6451001f2d94ea5006f71957ab1a5c9617a862bb44f27f919dffc370637345a5b17fe7f885e540
-
Filesize
23.7MB
MD58580605c010e8bc5c3538bdc9af9ae78
SHA106ece6074f74dd92615b292bfd598229a2caacc7
SHA2567559d05a097aaab8601391b2cd737638089208f2b2edde58af25243cc827bfc4
SHA51257397a808094e878043fcf515a0db2be8d56cff755fe88f16e8fed5f3c30d692fc0449451dfbb831d4b27dae109d9612bb903df2e6b593a8a99095e04e9a1e78
-
Filesize
6KB
MD5b0294751ccf3964db40ea53073e6bcf0
SHA1084862580a9354ee025a08559a69561f49b31328
SHA256ec16b61343ff91dbe35f0b9adccf5b3817db0e1b3a3ba8ca6cd2a6d3a429ce50
SHA512e32b257c862f6edf389c250c97d654ddeccaf936a3c14736073ebaf68944892366543d108d196ddf7e2a8e20ad5e528c0557f964de1c7631058cfb2ea09a69fc