Analysis
-
max time kernel
90s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
05-08-2024 12:14
General
-
Target
Microsoft Visual C++/vcredist2005_x64.exe
-
Size
4.1MB
-
MD5
524da2fb61a1361e77704e9466bcd74e
-
SHA1
90a3d2a139c1a106bfccd98cbbd7c2c1d79f5ebe
-
SHA256
bb9e8606e26c2b76984252182f7db0d6e9108b204b81d2a7b036c9b618c1f9f1
-
SHA512
78a29872ed0a6fd871bc31ca23c579204705ba1bca997e55267889b41f93679b025f4e77c68e012eb49e4e9807809039ce6c446148f3ad4e6176dd6d2ad2bfdb
-
SSDEEP
98304:y4+PG8W44ij9RvbGOZUR241QZgC51B+PRPM:yPG8W4HhbVURp11CjgJM
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Windows directory 57 IoCs
-
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 3 IoCs
-
Modifies registry class 56 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++\vcredist2005_x64.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++\vcredist2005_x64.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~2.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~2.EXE2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec /i vcredist.msi3⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C79EBC303ACF09FE92810ED60C9DE2392⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.1MB
MD545109081338654c25e42aea404b7d40c
SHA17474003f1dffb4439381cb628ded660d28a41bdd
SHA25600fbdecf2f47d72cdd20a60d685d5d0f56e1f5ec571a7e43eebe1b178285eb76
SHA512cb89ea354aacf4560ab59ccbf1ae5f9d4913b0b4b6130bdaeb6f8eced7844c416875d0303e0f141165ca1681f6b9728d46a96fa44b3a2eb45616d904658179e2
-
Filesize
309KB
MD51f759e1b809cc291bbea00b43c6e9f74
SHA14038059d53fd925a9142642bbfd800e196ed888f
SHA256044969556a9ff7bfeb95cf1cc30fee41e57417814192749a6e7b2820ea1803c8
SHA51223682155c290c46c4673a80b6775f9e92ba1c855c4609454ed258d23f7a97cd5adff3a709a7348759755aeb941b71f4f13c7cd7288be4270aa772ef679774fdf
-
Filesize
3.8MB
MD5fa135204bb6146fca799cf06d30c444c
SHA1774b9fd7ca76502ae6c732432377d71dfd75a15a
SHA256cd7eb3fe76c008e2af85cab033f620e04e22af941797083a5fb51e269bb8fcbb
SHA512b2c20573b92766353db601a31d4409397fd5de3a32f9bde4b3e627b48c5b859d33c93f96ecb0c177eb16768f5dd744394857a078a7302fdf0f0e4f5d2543b73a
-
Filesize
24KB
MD57bfa56d222ecc4267e10c01462c6d0d9
SHA19b3236a45673ff3bb89df3e690784b673ae02038
SHA2566eeb255e1d5333a7b4f1b62e36afa1bea5cfd6c7e32058bb3a9efebc4d9f2ad6
SHA51210cec6bfd08a8b7cac1acbc3627cb014554ba71f44eb4bfe5b1471b81d6d292fd83a352d553af0de75fc1668a1f13d7f6f6c7bf1c6524117f363a3a7fc9b09e9
-
Filesize
23.7MB
MD5a5c0f0bbff503bfa826103751241c8c2
SHA1eb433b17287b6c525b713fb6f7d678ee799df96d
SHA256d3a3f904091608e410d87beee59401642e219c2c816113e57a85ae0218f85b46
SHA512a8caae11b1693778c6b91384fcb0ab24c10d137b258e9636e423c845e8be30c50f1a172668afc24119c66ddabd22af56284a317b92009dc2c70b4c6898644125
-
Filesize
6KB
MD5b414d26d96e12ab992864a132fa869b3
SHA106d437d3136b39f32d39f65a00dd83936d83eab0
SHA256c176265d8cf9a36fab3d92eaf85dfd226e9be30496d62e14c0e03fd2e9b1a974
SHA5124307db17ebb7f47267684341e365c79f8eb741a50fdbaac902936df285d1f551d576320eeeee094fdbcaea1892b5c89cfd2a7216aef4f860135bc197ee2c116a