Overview
overview
9Static
static
7CupFixer R...i..rar
windows7-x64
3CupFixer R...i..rar
windows10-2004-x64
3Spoofer/C+...ll.bat
windows7-x64
7Spoofer/C+...ll.bat
windows10-2004-x64
7Spoofer/C+...64.exe
windows7-x64
7Spoofer/C+...64.exe
windows10-2004-x64
7Spoofer/C+...86.exe
windows7-x64
7Spoofer/C+...86.exe
windows10-2004-x64
7Spoofer/C+...64.exe
windows7-x64
7Spoofer/C+...64.exe
windows10-2004-x64
7Spoofer/C+...86.exe
windows7-x64
7Spoofer/C+...86.exe
windows10-2004-x64
7Spoofer/C+...64.exe
windows7-x64
7Spoofer/C+...64.exe
windows10-2004-x64
7Spoofer/C+...86.exe
windows7-x64
7Spoofer/C+...86.exe
windows10-2004-x64
7Spoofer/C+...64.exe
windows7-x64
7Spoofer/C+...64.exe
windows10-2004-x64
7Spoofer/C+...86.exe
windows7-x64
7Spoofer/C+...86.exe
windows10-2004-x64
7Spoofer/C+...64.exe
windows7-x64
7Spoofer/C+...64.exe
windows10-2004-x64
7Spoofer/C+...86.exe
windows7-x64
7Spoofer/C+...86.exe
windows10-2004-x64
7Spoofer/C+...64.exe
windows7-x64
4Spoofer/C+...64.exe
windows10-2004-x64
4Spoofer/C+...86.exe
windows7-x64
4Spoofer/C+...86.exe
windows10-2004-x64
4Spoofer/CupFixer.exe
windows7-x64
9Spoofer/CupFixer.exe
windows10-2004-x64
9Spoofer/Mac.exe
windows7-x64
9Spoofer/Mac.exe
windows10-2004-x64
9Analysis
-
max time kernel
141s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
20-07-2024 21:24
Behavioral task
behavioral1
Sample
CupFixer Replica by .type_shi..rar
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
CupFixer Replica by .type_shi..rar
Resource
win10v2004-20240704-en
Behavioral task
behavioral3
Sample
Spoofer/C++/install_all.bat
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
Spoofer/C++/install_all.bat
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
Spoofer/C++/vcredist2005_x64.exe
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
Spoofer/C++/vcredist2005_x64.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
Spoofer/C++/vcredist2005_x86.exe
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
Spoofer/C++/vcredist2005_x86.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
Spoofer/C++/vcredist2008_x64.exe
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
Spoofer/C++/vcredist2008_x64.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
Spoofer/C++/vcredist2008_x86.exe
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
Spoofer/C++/vcredist2008_x86.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
Spoofer/C++/vcredist2010_x64.exe
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
Spoofer/C++/vcredist2010_x64.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
Spoofer/C++/vcredist2010_x86.exe
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
Spoofer/C++/vcredist2010_x86.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral17
Sample
Spoofer/C++/vcredist2012_x64.exe
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
Spoofer/C++/vcredist2012_x64.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral19
Sample
Spoofer/C++/vcredist2012_x86.exe
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
Spoofer/C++/vcredist2012_x86.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral21
Sample
Spoofer/C++/vcredist2013_x64.exe
Resource
win7-20240705-en
Behavioral task
behavioral22
Sample
Spoofer/C++/vcredist2013_x64.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral23
Sample
Spoofer/C++/vcredist2013_x86.exe
Resource
win7-20240708-en
Behavioral task
behavioral24
Sample
Spoofer/C++/vcredist2013_x86.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral25
Sample
Spoofer/C++/vcredist2015_2017_2019_2022_x64.exe
Resource
win7-20240704-en
Behavioral task
behavioral26
Sample
Spoofer/C++/vcredist2015_2017_2019_2022_x64.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral27
Sample
Spoofer/C++/vcredist2015_2017_2019_2022_x86.exe
Resource
win7-20240705-en
Behavioral task
behavioral28
Sample
Spoofer/C++/vcredist2015_2017_2019_2022_x86.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral29
Sample
Spoofer/CupFixer.exe
Resource
win7-20240705-en
Behavioral task
behavioral30
Sample
Spoofer/CupFixer.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral31
Sample
Spoofer/Mac.exe
Resource
win7-20240704-en
General
-
Target
Spoofer/C++/vcredist2005_x86.exe
-
Size
2.6MB
-
MD5
ce2922f83fb4b170affce0ea448b107b
-
SHA1
b8fab0bb7f62a24ddfe77b19cd9a1451abd7b847
-
SHA256
4ee4da0fe62d5fa1b5e80c6e6d88a4a2f8b3b140c35da51053d0d7b72a381d29
-
SHA512
e94b077e054bd8992374d359f3adc4d1d78d42118d878556715d77182f7d03635850b2b2f06c012ccb7c410e2b3c124cf6508473efe150d3c51a51857ce1c6b0
-
SSDEEP
49152:rqGRIgg2SirwkF9xdtb43lyGKCafpKkiwnaDahmPzpY4FPyaza:rxxLFfY/KCCpKk9aWMzZyau
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
Processes:
MsiExec.exepid process 4600 MsiExec.exe 4600 MsiExec.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
vcredist2005_x86.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" vcredist2005_x86.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc process File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe -
Drops file in Program Files directory 1 IoCs
Processes:
msiexec.exedescription ioc process File created C:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia80.dll msiexec.exe -
Drops file in Windows directory 57 IoCs
Processes:
msiexec.exedescription ioc process File created C:\Windows\WinSxS\InstallTemp\20240720212633304.0\mfc80CHT.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240720212633382.0\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_452bf920.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240720212633429.0\8.0.50727.6195.cat msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240720212633226.0\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_150c9e8b.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240720212633382.0\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_452bf920.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240720212633429.1\8.0.50727.6195.policy msiexec.exe File opened for modification C:\Windows\Installer\MSI3A06.tmp msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240720212633304.0\mfc80ENU.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240720212633304.0\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_6a5bb789.manifest msiexec.exe File created C:\Windows\Installer\e5834ab.msi msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240720212633429.1 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240720212633148.0\ATL80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240720212633163.0\msvcm80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240720212633226.0\mfcm80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240720212633304.0\mfc80KOR.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240720212633382.0\vcomp.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240720212633429.2\8.0.50727.6195.policy msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240720212633382.0 msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240720212633226.0\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_150c9e8b.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240720212633148.0\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_a4c618fa.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240720212633226.0\mfc80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240720212633304.0\mfc80FRA.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240720212633413.0\8.0.50727.6195.policy msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240720212633445.0\8.0.50727.6195.cat msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240720212633429.0 msiexec.exe File created C:\Windows\Installer\e5834a7.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI409F.tmp msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240720212633163.0\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240720212633413.0\8.0.50727.6195.cat msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240720212633226.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240720212633148.0\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_a4c618fa.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240720212633226.0\mfcm80u.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240720212633429.1\8.0.50727.6195.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240720212633445.0\8.0.50727.6195.policy msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240720212633163.0 msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240720212633413.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240720212633304.0\mfc80ITA.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240720212633304.0\mfc80JPN.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240720212633304.0\mfc80DEU.dll msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240720212633445.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240720212633163.0\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240720212633304.0\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_6a5bb789.cat msiexec.exe File created C:\Windows\Installer\SourceHash{710f4c1c-cc18-4c49-8cbf-51240c89a1a2} msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240720212633163.0\msvcr80.dll msiexec.exe File opened for modification C:\Windows\Installer\e5834a7.msi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240720212633163.0\msvcp80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240720212633304.0\mfc80ESP.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240720212633429.0\8.0.50727.6195.policy msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240720212633429.2\8.0.50727.6195.cat msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240720212633148.0 msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240720212633304.0 msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240720212633429.2 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240720212633226.0\mfc80u.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240720212633304.0\mfc80CHS.dll msiexec.exe -
Event Triggered Execution: Installer Packages 1 TTPs 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000750203050573ea680000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000750203050000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090075020305000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d75020305000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000007502030500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe -
Modifies data under HKEY_USERS 3 IoCs
Processes:
msiexec.exedescription ioc process Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E msiexec.exe -
Modifies registry class 45 IoCs
Processes:
msiexec.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.OpenMP,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e0035006f00300068002c0070004d0076004e003d00650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFCLOC,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e006600720038005f006c0028006d0032004e004400650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\c1c4f01781cc94c4c8fb1542c0981a2a\Servicing_Key msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\11 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\PackageName = "vcredist.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\1 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFC,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e0021004d00210026005a005a006300300025006e00650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFC,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e003d0024006b00600049004e005d00490038004300650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\PackageCode = "84067013B7B56744BA0F51892982BC09" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\AuthorizedLUAApp = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AA5D9C68C00F12943B2F6CA09FE28244\c1c4f01781cc94c4c8fb1542c0981a2a msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\9 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\ProductName = "Microsoft Visual C++ 2005 Redistributable" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\3 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\4 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.ATL,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e00700052005e007000580049006000510075006f00650038004d006b0062004900640046007700550000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\Language = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\Version = "134278729" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AA5D9C68C00F12943B2F6CA09FE28244 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.CRT,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e005f006a0030002c0059005d007300210053006f00650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.ATL,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e0036006b007d00700048004c004800240053004400650038004d006b0062004900640046007700550000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\c1c4f01781cc94c4c8fb1542c0981a2a msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\6 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.CRT,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e0061005a004f002c0048002a004b00320060004500650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\5 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\8 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFCLOC,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e006900450024005b004d00310025002e0064002700650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.OpenMP,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e00370030002d0054002400210028002a0026004e00650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\2 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\7 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\c1c4f01781cc94c4c8fb1542c0981a2a\VC_Redist msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\10 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
msiexec.exepid process 1900 msiexec.exe 1900 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
msiexec.exemsiexec.exevssvc.exedescription pid process Token: SeShutdownPrivilege 3448 msiexec.exe Token: SeIncreaseQuotaPrivilege 3448 msiexec.exe Token: SeSecurityPrivilege 1900 msiexec.exe Token: SeCreateTokenPrivilege 3448 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3448 msiexec.exe Token: SeLockMemoryPrivilege 3448 msiexec.exe Token: SeIncreaseQuotaPrivilege 3448 msiexec.exe Token: SeMachineAccountPrivilege 3448 msiexec.exe Token: SeTcbPrivilege 3448 msiexec.exe Token: SeSecurityPrivilege 3448 msiexec.exe Token: SeTakeOwnershipPrivilege 3448 msiexec.exe Token: SeLoadDriverPrivilege 3448 msiexec.exe Token: SeSystemProfilePrivilege 3448 msiexec.exe Token: SeSystemtimePrivilege 3448 msiexec.exe Token: SeProfSingleProcessPrivilege 3448 msiexec.exe Token: SeIncBasePriorityPrivilege 3448 msiexec.exe Token: SeCreatePagefilePrivilege 3448 msiexec.exe Token: SeCreatePermanentPrivilege 3448 msiexec.exe Token: SeBackupPrivilege 3448 msiexec.exe Token: SeRestorePrivilege 3448 msiexec.exe Token: SeShutdownPrivilege 3448 msiexec.exe Token: SeDebugPrivilege 3448 msiexec.exe Token: SeAuditPrivilege 3448 msiexec.exe Token: SeSystemEnvironmentPrivilege 3448 msiexec.exe Token: SeChangeNotifyPrivilege 3448 msiexec.exe Token: SeRemoteShutdownPrivilege 3448 msiexec.exe Token: SeUndockPrivilege 3448 msiexec.exe Token: SeSyncAgentPrivilege 3448 msiexec.exe Token: SeEnableDelegationPrivilege 3448 msiexec.exe Token: SeManageVolumePrivilege 3448 msiexec.exe Token: SeImpersonatePrivilege 3448 msiexec.exe Token: SeCreateGlobalPrivilege 3448 msiexec.exe Token: SeBackupPrivilege 2204 vssvc.exe Token: SeRestorePrivilege 2204 vssvc.exe Token: SeAuditPrivilege 2204 vssvc.exe Token: SeBackupPrivilege 1900 msiexec.exe Token: SeRestorePrivilege 1900 msiexec.exe Token: SeRestorePrivilege 1900 msiexec.exe Token: SeTakeOwnershipPrivilege 1900 msiexec.exe Token: SeRestorePrivilege 1900 msiexec.exe Token: SeTakeOwnershipPrivilege 1900 msiexec.exe Token: SeRestorePrivilege 1900 msiexec.exe Token: SeTakeOwnershipPrivilege 1900 msiexec.exe Token: SeRestorePrivilege 1900 msiexec.exe Token: SeTakeOwnershipPrivilege 1900 msiexec.exe Token: SeRestorePrivilege 1900 msiexec.exe Token: SeTakeOwnershipPrivilege 1900 msiexec.exe Token: SeRestorePrivilege 1900 msiexec.exe Token: SeTakeOwnershipPrivilege 1900 msiexec.exe Token: SeRestorePrivilege 1900 msiexec.exe Token: SeTakeOwnershipPrivilege 1900 msiexec.exe Token: SeRestorePrivilege 1900 msiexec.exe Token: SeTakeOwnershipPrivilege 1900 msiexec.exe Token: SeRestorePrivilege 1900 msiexec.exe Token: SeTakeOwnershipPrivilege 1900 msiexec.exe Token: SeRestorePrivilege 1900 msiexec.exe Token: SeTakeOwnershipPrivilege 1900 msiexec.exe Token: SeRestorePrivilege 1900 msiexec.exe Token: SeTakeOwnershipPrivilege 1900 msiexec.exe Token: SeRestorePrivilege 1900 msiexec.exe Token: SeTakeOwnershipPrivilege 1900 msiexec.exe Token: SeRestorePrivilege 1900 msiexec.exe Token: SeTakeOwnershipPrivilege 1900 msiexec.exe Token: SeRestorePrivilege 1900 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
msiexec.exepid process 3448 msiexec.exe 3448 msiexec.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
vcredist2005_x86.exemsiexec.exedescription pid process target process PID 1600 wrote to memory of 3448 1600 vcredist2005_x86.exe msiexec.exe PID 1600 wrote to memory of 3448 1600 vcredist2005_x86.exe msiexec.exe PID 1600 wrote to memory of 3448 1600 vcredist2005_x86.exe msiexec.exe PID 1900 wrote to memory of 3796 1900 msiexec.exe srtasks.exe PID 1900 wrote to memory of 3796 1900 msiexec.exe srtasks.exe PID 1900 wrote to memory of 4600 1900 msiexec.exe MsiExec.exe PID 1900 wrote to memory of 4600 1900 msiexec.exe MsiExec.exe PID 1900 wrote to memory of 4600 1900 msiexec.exe MsiExec.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Spoofer\C++\vcredist2005_x86.exe"C:\Users\Admin\AppData\Local\Temp\Spoofer\C++\vcredist2005_x86.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec /i vcredist.msi2⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 64250F054CAE7FDBA7506C03CC243B6C2⤵
- Loads dropped DLL
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Config.Msi\e5834aa.rbsFilesize
73KB
MD5fcd4b65e528358a14624431655c87d25
SHA18be8be9e7bca8e2a7b9b83a55aad158e93066ced
SHA256ae6f5ebb55e9d1e3e5a2770e7be3fff6b769dd6e5e036ab3a34f6524a513f6e3
SHA512abc556c6b0f9e05f45fe117430aaa0295b1e1c95a49caf1973e5d461091b5857f9f711ce75e059f652a2c69cb88dd34d16e64060df3c2a8a241b00308843916f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredis1.cabFilesize
247KB
MD5cc064d4b81619991de8131a86ad77681
SHA188d80d86cc20c27d7d2a872af719300bd2bb73f9
SHA256913ee5a1cae3e5a1872b3a5efaaa00c58e4beb692492b138f76967da671b0477
SHA5125aff0eb26cfc187bf58721b2b6d73357d9f1e66d1ac5340ad9ddc08b40ad0eda27a144cb3b650604637a7476c282ded83ed890de98a73ccaf0cc021da3a9eb25
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredist.msiFilesize
2.6MB
MD5b20bbeb818222b657df49a9cfe4fed79
SHA13f6508e880b86502773a3275bc9527f046d45502
SHA25691bdd063f6c53126737791c9eccf0b2f4cf44927831527245bc89a0be06c0cb4
SHA512f534bc7bf1597e728940e6c3b77f864adfaa413bb1e080458326b692b0f96bddf4fbd294eeed36d7764a3578e6c8e919488bbf63b8fe2d4355ab3efd685424a4
-
C:\Windows\Installer\MSI3A06.tmpFilesize
28KB
MD585221b3bcba8dbe4b4a46581aa49f760
SHA1746645c92594bfc739f77812d67cfd85f4b92474
SHA256f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f
SHA512060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d
-
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2Filesize
23.7MB
MD5df52753aab4198300fe164aeffa00d71
SHA1eeb278533b82a1566a8ed48ccda3db3cd1651e71
SHA25698874bb608f9da68d924df1a50c4b4c520613080dfc5f0c6e81d38428c8a15d1
SHA512c8b00484af21d8b3b256ac5523a97a4d5a995b8201aba688fbc52cd969c6d83b9e4e5ea5f1734b22824b833fcbd0a955b7f67328b20a6817b635b3928b938ca8
-
\??\Volume{05030275-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{8516bac8-a6f0-4be8-a640-87f0e706864c}_OnDiskSnapshotPropFilesize
6KB
MD5ede529a514fbe07c82b7d9ceee7cd4e5
SHA1c046d8319ef72a3786cab93e342e6130cdfb07e2
SHA256f19c7a4f51f8a6a69e7299a1a87897cc291b0f881e5138b41e88028c784577e2
SHA512bc77e067816653c7ca0d34ad7decf14b0fb19c44421f4d322f698d153bd78d307fb2cc2637112371c59226623dd529d935ae6cbababbebaa59c208b1ce2a151c