Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
222s -
max time network
305s -
platform
windows11-21h2_x64 -
resource
win11-20240704-en -
resource tags
arch:x64arch:x86image:win11-20240704-enlocale:en-usos:windows11-21h2-x64system -
submitted
07/07/2024, 18:23
Static task
static1
Behavioral task
behavioral1
Sample
Far30b6300.x64.20240407.msi
Resource
win11-20240704-en
General
-
Target
Far30b6300.x64.20240407.msi
-
Size
14.5MB
-
MD5
f2ecdb60e3769949220cdfa4151f5e69
-
SHA1
2887ae5dacbf02d07460a203ade656e404812e5e
-
SHA256
bb54ecf43a539dac9b0c4eb0b95b93b54547036e5d25ac6059eaa2cea26c1f71
-
SHA512
435b4ab37383850feda9cf92bafa45296d282694bb7fe7f1d0168a6195744a6b5e2bf26d19eb8bf4e77c5744d197e13e49fffae5984f773a9fd35b572da2a578
-
SSDEEP
393216:Nyg/fqsV+/a9TMji/2U8YE0uSg1EFc8gG8:Ag/B+24ji/2U8XVSg+Fc8
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Far Manager\Plugins\FarCmds\FarCmds.dll msiexec.exe File created C:\Program Files\Far Manager\Addons\Colors\Default Highlighting\FARColors242.farconfig msiexec.exe File created C:\Program Files\Far Manager\Plugins\ProcList\ProcBel.hlf msiexec.exe File created C:\Program Files\Far Manager\Plugins\ProcList\ProcList.map msiexec.exe File created C:\Program Files\Far Manager\Plugins\AutoWrap\WrapHun.lng msiexec.exe File created C:\Program Files\Far Manager\Plugins\FarColorer\base\common.zip msiexec.exe File created C:\Program Files\Far Manager\Plugins\ArcLite\arclite_spa.lng msiexec.exe File created C:\Program Files\Far Manager\Plugins\NetBox\NetBox.dll msiexec.exe File created C:\Program Files\Far Manager\Plugins\SameFolder\SameFolderUkr.lng msiexec.exe File created C:\Program Files\Far Manager\Addons\Colors\Interface\black_from_Fonarev.farconfig msiexec.exe File created C:\Program Files\Far Manager\Plugins\FileCase\CaseBel.hlf msiexec.exe File created C:\Program Files\Far Manager\Plugins\Compare\CompSpa.lng msiexec.exe File created C:\Program Files\Far Manager\Plugins\HlfViewer\HlfViewerEng.hlf msiexec.exe File created C:\Program Files\Far Manager\Plugins\FileCase\CaseHun.hlf msiexec.exe File created C:\Program Files\Far Manager\Addons\Colors\Default Highlighting\Colors_from_Gernichenko.farconfig msiexec.exe File created C:\Program Files\Far Manager\Plugins\EditCase\ECaseRus.lng msiexec.exe File created C:\Program Files\Far Manager\Plugins\HlfViewer\HlfViewerUkr.hlf msiexec.exe File created C:\Program Files\Far Manager\luafar3.map msiexec.exe File created C:\Program Files\Far Manager\Plugins\Compare\AdvCompare.CompareBufferSize.farconfig msiexec.exe File created C:\Program Files\Far Manager\Plugins\Align\AlignEng.lng msiexec.exe File created C:\Program Files\Far Manager\Plugins\Brackets\Brackets.map msiexec.exe File created C:\Program Files\Far Manager\Plugins\FileCase\CasePol.lng msiexec.exe File created C:\Program Files\Far Manager\Plugins\EditCase\ECaseCze.hlf msiexec.exe File created C:\Program Files\Far Manager\Plugins\FileCase\CaseRus.hlf msiexec.exe File created C:\Program Files\Far Manager\Plugins\FileCase\CaseUkr.lng msiexec.exe File created C:\Program Files\Far Manager\FarSky.hlf msiexec.exe File created C:\Program Files\Far Manager\Addons\XLat\Russian\Apps.lua msiexec.exe File created C:\Program Files\Far Manager\Plugins\HlfViewer\changelog msiexec.exe File created C:\Program Files\Far Manager\Plugins\Compare\Compare.map msiexec.exe File created C:\Program Files\Far Manager\Plugins\TmpPanel\TmpLit.lng msiexec.exe File created C:\Program Files\Far Manager\Plugins\TmpPanel\TmpSky.hlf msiexec.exe File created C:\Program Files\Far Manager\Plugins\Align\AlignHun.lng msiexec.exe File created C:\Program Files\Far Manager\Addons\Colors\Custom Highlighting\dn_like.farconfig msiexec.exe File created C:\Program Files\Far Manager\Plugins\EditCase\ECaseHun.hlf msiexec.exe File created C:\Program Files\Far Manager\Plugins\EMenu\HotkeyProperties.lua msiexec.exe File created C:\Program Files\Far Manager\Plugins\Network\NetRus.lng msiexec.exe File created C:\Program Files\Far Manager\Plugins\SameFolder\SameFolder.dll msiexec.exe File created C:\Program Files\Far Manager\Plugins\ArcLite\arclite.dll msiexec.exe File created C:\Program Files\Far Manager\Plugins\DrawLine\DrawIta.lng msiexec.exe File created C:\Program Files\Far Manager\Plugins\EMenu\EMenuUkr.lng msiexec.exe File created C:\Program Files\Far Manager\Addons\Macros\F9Table.lua msiexec.exe File created C:\Program Files\Far Manager\Addons\Macros\Panel.SpaceToSelect.lua msiexec.exe File created C:\Program Files\Far Manager\Plugins\AutoWrap\AutoWrap.map msiexec.exe File created C:\Program Files\Far Manager\Addons\Colors\Interface\black_and_white.farconfig msiexec.exe File created C:\Program Files\Far Manager\Plugins\DrawLine\DrawRus.lng msiexec.exe File created C:\Program Files\Far Manager\Documentation\eng\Far.FAQ.txt msiexec.exe File created C:\Program Files\Far Manager\Plugins\Network\Network.map msiexec.exe File created C:\Program Files\Far Manager\Plugins\ArcLite\changelog msiexec.exe File created C:\Program Files\Far Manager\Plugins\LuaMacro\lang.lua msiexec.exe File created C:\Program Files\Far Manager\Plugins\FarColorer\README.md msiexec.exe File created C:\Program Files\Far Manager\Addons\Macros\AltSearch.lua msiexec.exe File created C:\Program Files\Far Manager\Plugins\Brackets\BrackHun.lng msiexec.exe File created C:\Program Files\Far Manager\Plugins\Compare\Compare.dll msiexec.exe File created C:\Program Files\Far Manager\Plugins\DrawLine\DrawGer.lng msiexec.exe File created C:\Program Files\Far Manager\Plugins\FarCmds\FARCmdsPol.hlf msiexec.exe File created C:\Program Files\Far Manager\Plugins\HlfViewer\HlfViewerEng.lng msiexec.exe File created C:\Program Files\Far Manager\Plugins\TmpPanel\changelog msiexec.exe File created C:\Program Files\Far Manager\Plugins\Compare\CompBel.lng msiexec.exe File created C:\Program Files\Far Manager\Addons\Colors\Default Highlighting\GreenMile.farconfig msiexec.exe File created C:\Program Files\Far Manager\Addons\Colors\Custom Highlighting\nc5pal2.farconfig msiexec.exe File created C:\Program Files\Far Manager\Plugins\HlfViewer\HlfViewerCze.hlf msiexec.exe File created C:\Program Files\Far Manager\Plugins\NetBox\LICENSE.txt msiexec.exe File created C:\Program Files\Far Manager\Plugins\TmpPanel\TmpCze.lng msiexec.exe File created C:\Program Files\Far Manager\Plugins\AutoWrap\WrapUkr.lng msiexec.exe -
Drops file in Windows directory 17 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIF398.tmp msiexec.exe File opened for modification C:\Windows\Installer\{7DC08EAD-2E44-48D1-BAA3-DB96082053BE}\Far.ico msiexec.exe File opened for modification C:\Windows\Installer\e57ef80.msi msiexec.exe File created C:\Windows\SystemTemp\~DFDFE934D0763B8181.TMP msiexec.exe File created C:\Windows\Installer\{7DC08EAD-2E44-48D1-BAA3-DB96082053BE}\Far.ico msiexec.exe File opened for modification C:\Windows\Installer\MSI8D8.tmp msiexec.exe File created C:\Windows\Installer\e57ef82.msi msiexec.exe File created C:\Windows\SystemTemp\~DFAA5B003846BD3E1C.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIF07A.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{7DC08EAD-2E44-48D1-BAA3-DB96082053BE} msiexec.exe File created C:\Windows\SystemTemp\~DFA9E20C666A80A8D4.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIF5CC.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF6D4953FE919C8CBB.TMP msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\e57ef80.msi msiexec.exe -
Loads dropped DLL 3 IoCs
pid Process 2348 MsiExec.exe 2348 MsiExec.exe 2340 MsiExec.exe -
Event Triggered Execution: Installer Packages 1 TTPs 1 IoCs
pid Process 1636 msiexec.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000a33b37abd739b6c20000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000a33b37ab0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900a33b37ab000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1da33b37ab000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000a33b37ab00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\FileCase.Lithuanian = "FileCase" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\FileCase.Changelogs = "FileCase" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\Docs.Polish = "Far" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\DrawLine.Slovak = "DrawLine" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\EditCase.Polish = "EditCase" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\arclite.Russian = "arclite" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\FileCase.German = "FileCase" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\Brackets.Lithuanian = "Brackets" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\FileCase.Russian = "FileCase" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\LuaMacro.Russian = "LuaMacro" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\Brackets.Slovak = "Brackets" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\FarHere = "\x06System" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\TmpPanel.Polish = "TmpPanel" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\Hungarian = "Languages" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\Align.German = "Align" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\EditCase.Changelogs = "EditCase" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\EMenu.Ukrainian = "EMenu" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\Proclist.Belarusian = "Proclist" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\Proclist.Czech = "Proclist" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\Align.Czech = "Align" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\EditCase.Lithuanian = "EditCase" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\arclite.Changelogs = "arclite" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\EMenu.Belarusian = "EMenu" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\FileCase.Hungarian = "FileCase" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\Italian = "Languages" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\Align.Spanish = "Align" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\DrawLine.Belarusian = "DrawLine" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\Proclist.Lithuanian = "Proclist" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DAE80CD744E21D84AB3ABD69800235EB\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\arclite.Spanish = "arclite" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\SameFolder.Spanish = "SameFolder" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\HlfViewer.Ukrainian = "HlfViewer" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\_7z.dll = "arclite" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\AutoWrap = "Editor" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\Brackets.Belarusian = "Brackets" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\SameFolder.MapFiles = "SameFolder" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\HlfViewer.Spanish = "HlfViewer" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\Proclist.German = "Proclist" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\AutoWrap.Lithuanian = "AutoWrap" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\FarColorer.MapFiles = "FarColorer" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\Docs.Russian = "Far" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\Align.Russian = "Align" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\Network.Hungarian = "Network" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\Network.MapFiles = "Network" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\AutoWrap.Russian = "AutoWrap" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\Proclist.Changelogs = "Proclist" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\LuaMacro.Italian = "LuaMacro" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\Brackets.Russian = "Brackets" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\DrawLine.Italian = "DrawLine" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\DrawLine.Czech = "DrawLine" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\EditCase.Czech = "EditCase" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\NetBox.Russian = "NetBox" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\LuaMacro.Slovak = "LuaMacro" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\AutoWrap.Czech = "AutoWrap" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\DrawLine.Ukrainian = "DrawLine" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\HlfViewer.Belarusian = "HlfViewer" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\Proclist.Slovak = "Proclist" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A11CE73AEE49CF141B616EFF9745B507\DAE80CD744E21D84AB3ABD69800235EB msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DAE80CD744E21D84AB3ABD69800235EB\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\AutoWrap.Spanish = "AutoWrap" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\FarQuickLaunchShortcut = "\x06FarShortcuts" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\AutoWrap.Changelogs = "AutoWrap" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DAE80CD744E21D84AB3ABD69800235EB\DrawLine.Spanish = "DrawLine" msiexec.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4784 msiexec.exe 4784 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1636 msiexec.exe Token: SeIncreaseQuotaPrivilege 1636 msiexec.exe Token: SeSecurityPrivilege 4784 msiexec.exe Token: SeCreateTokenPrivilege 1636 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1636 msiexec.exe Token: SeLockMemoryPrivilege 1636 msiexec.exe Token: SeIncreaseQuotaPrivilege 1636 msiexec.exe Token: SeMachineAccountPrivilege 1636 msiexec.exe Token: SeTcbPrivilege 1636 msiexec.exe Token: SeSecurityPrivilege 1636 msiexec.exe Token: SeTakeOwnershipPrivilege 1636 msiexec.exe Token: SeLoadDriverPrivilege 1636 msiexec.exe Token: SeSystemProfilePrivilege 1636 msiexec.exe Token: SeSystemtimePrivilege 1636 msiexec.exe Token: SeProfSingleProcessPrivilege 1636 msiexec.exe Token: SeIncBasePriorityPrivilege 1636 msiexec.exe Token: SeCreatePagefilePrivilege 1636 msiexec.exe Token: SeCreatePermanentPrivilege 1636 msiexec.exe Token: SeBackupPrivilege 1636 msiexec.exe Token: SeRestorePrivilege 1636 msiexec.exe Token: SeShutdownPrivilege 1636 msiexec.exe Token: SeDebugPrivilege 1636 msiexec.exe Token: SeAuditPrivilege 1636 msiexec.exe Token: SeSystemEnvironmentPrivilege 1636 msiexec.exe Token: SeChangeNotifyPrivilege 1636 msiexec.exe Token: SeRemoteShutdownPrivilege 1636 msiexec.exe Token: SeUndockPrivilege 1636 msiexec.exe Token: SeSyncAgentPrivilege 1636 msiexec.exe Token: SeEnableDelegationPrivilege 1636 msiexec.exe Token: SeManageVolumePrivilege 1636 msiexec.exe Token: SeImpersonatePrivilege 1636 msiexec.exe Token: SeCreateGlobalPrivilege 1636 msiexec.exe Token: SeBackupPrivilege 1424 vssvc.exe Token: SeRestorePrivilege 1424 vssvc.exe Token: SeAuditPrivilege 1424 vssvc.exe Token: SeBackupPrivilege 4784 msiexec.exe Token: SeRestorePrivilege 4784 msiexec.exe Token: SeRestorePrivilege 4784 msiexec.exe Token: SeTakeOwnershipPrivilege 4784 msiexec.exe Token: SeRestorePrivilege 4784 msiexec.exe Token: SeTakeOwnershipPrivilege 4784 msiexec.exe Token: SeRestorePrivilege 4784 msiexec.exe Token: SeTakeOwnershipPrivilege 4784 msiexec.exe Token: SeRestorePrivilege 4784 msiexec.exe Token: SeTakeOwnershipPrivilege 4784 msiexec.exe Token: SeRestorePrivilege 4784 msiexec.exe Token: SeTakeOwnershipPrivilege 4784 msiexec.exe Token: SeRestorePrivilege 4784 msiexec.exe Token: SeTakeOwnershipPrivilege 4784 msiexec.exe Token: SeRestorePrivilege 4784 msiexec.exe Token: SeTakeOwnershipPrivilege 4784 msiexec.exe Token: SeRestorePrivilege 4784 msiexec.exe Token: SeTakeOwnershipPrivilege 4784 msiexec.exe Token: SeRestorePrivilege 4784 msiexec.exe Token: SeTakeOwnershipPrivilege 4784 msiexec.exe Token: SeRestorePrivilege 4784 msiexec.exe Token: SeTakeOwnershipPrivilege 4784 msiexec.exe Token: SeRestorePrivilege 4784 msiexec.exe Token: SeTakeOwnershipPrivilege 4784 msiexec.exe Token: SeRestorePrivilege 4784 msiexec.exe Token: SeTakeOwnershipPrivilege 4784 msiexec.exe Token: SeRestorePrivilege 4784 msiexec.exe Token: SeTakeOwnershipPrivilege 4784 msiexec.exe Token: SeRestorePrivilege 4784 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1636 msiexec.exe 1636 msiexec.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4784 wrote to memory of 2008 4784 msiexec.exe 84 PID 4784 wrote to memory of 2008 4784 msiexec.exe 84 PID 4784 wrote to memory of 2348 4784 msiexec.exe 86 PID 4784 wrote to memory of 2348 4784 msiexec.exe 86 PID 4784 wrote to memory of 2340 4784 msiexec.exe 87 PID 4784 wrote to memory of 2340 4784 msiexec.exe 87 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Far30b6300.x64.20240407.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1636
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:2008
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 7B52DC8A28CF8C12A481754D2961E1662⤵
- Loads dropped DLL
PID:2348
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding D0613942AD17C140C7E004D0ECBB8419 E Global\MSI00002⤵
- Loads dropped DLL
PID:2340
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1424
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
239KB
MD5ec330717f75bbb7c7c91ac040416872a
SHA142e250e9c77e10600c566aa286fe039c7d2b2235
SHA2563a3f62e98e3f016fc15e2acc36d8a6ce3e575e989f2e33878163c5f0170b0d79
SHA512e792911dcf6f56a85c45cb1ca2adefb7a8bf543cee1a792a0f4b71cdc36823f0e5043ff4f0b3bd2417489ea9dafd75ea8f6b522849915a30ade47be13d59471a
-
Filesize
4.8MB
MD5cce69c6d78fc91aa58191668fa5424fb
SHA1c29b64c1135fad8e12ddd8d4e13dda6a925f5f04
SHA256484d6f6a71a822c7a5bf3b0e6dfbc2a870a2b82e222f92d1a5e4e6df211c5c80
SHA512970f7971e7382f347ebffb03fa7199c5ecfbbc9080b5f83110d1eb6f23c91f928100e51de555b50f11c878a777594bab8ad49e0c2035de6397601d851845e5fc
-
Filesize
1KB
MD544d298d395e9811ce455bd5435ec03cb
SHA167e937cc4497c10c7b79ec83bf481a3ee6494b5e
SHA2562e19f55bfb23e027adb31902d72936f5555dd586ad5312cf10b1c1e240e96719
SHA512e9c47ecd925577f13f5db3a931bef1522bd05fd0ac417173b0c397037914e621089d36d05bb8f21e98d12d61086cbbdae2ef456980b09b43f1e95a19614f364d
-
Filesize
195KB
MD5980379427f86689d99f38ea699026b17
SHA143f3231848d714ca9331e42396dbd5e9f263046e
SHA25600f1945cbc8cc97ab10968e111de0b708c05837e9f1fb37c12b8bac7397a7b30
SHA5123b3eb5ca4094d237a349224eab58df5529ba699e3fa7044ff91e90f2dceeb00cf498ec17daee65a6d516f97d308acc5441d7a940c77913a3daf8492e65becc77
-
Filesize
14.5MB
MD5f2ecdb60e3769949220cdfa4151f5e69
SHA12887ae5dacbf02d07460a203ade656e404812e5e
SHA256bb54ecf43a539dac9b0c4eb0b95b93b54547036e5d25ac6059eaa2cea26c1f71
SHA512435b4ab37383850feda9cf92bafa45296d282694bb7fe7f1d0168a6195744a6b5e2bf26d19eb8bf4e77c5744d197e13e49fffae5984f773a9fd35b572da2a578
-
Filesize
12.8MB
MD57108bd80b5292f47e6f0ab563be2fcf0
SHA17dd403efce3a4b7c1422909a0f46ad0fd6a0e07d
SHA256abd8446eaf03472a614982cbeaea13416769e5859b706c507bc3393df50e112e
SHA512ab2d0b3fbaf5d0f106ce7f015b300b10dd027b9301951983d95ba25ea16e415272730ab00f84b31428f166756f6564406c3046ee74df0eddfc275025e54de93b
-
\??\Volume{ab373ba3-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{ff40a667-655f-4132-9c42-eba9110419fc}_OnDiskSnapshotProp
Filesize6KB
MD590c8e3689ea2fb9aecc44d1600fdbc27
SHA1cf3aaabea29444672a4676fbd8b2d5d25688069e
SHA256694f6fe1d6b730e50fdfad8b93c048205eb5ffc05ba5ccc14639e4122338e7b9
SHA512a45f88a90e5b00dbbe7a3c484d1b12fbe0c1013f0a084aadefb37d8469a4a50dc941ddbf6d5e8424aa29d2ab8f4757c41392a30533316b679bcd6111c19fc822