Analysis
-
max time kernel
12s -
max time network
12s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07-08-2024 12:48
Static task
static1
Behavioral task
behavioral1
Sample
FaturaVivo.pdf96.msi
Resource
win7-20240729-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
FaturaVivo.pdf96.msi
Resource
win10v2004-20240802-en
windows10-2004-x64
16 signatures
150 seconds
Errors
Reason
Machine shutdown
General
-
Target
FaturaVivo.pdf96.msi
-
Size
4.6MB
-
MD5
4d5f7f3d73e21811b607b14070935390
-
SHA1
f8d216641c89ca58df0f5ed0b8543f68f02ef1c9
-
SHA256
cd0d64c504bcb77944ea917ec72d8fd95d2c3c6a073f0b19b2e7beedfa0b85e4
-
SHA512
c0e25f68dc681835021e6238c08ed33430275a520df68d4a831d2788d22a514d44c2803b581ad720ecf1f948318ea9898c63c596de57ff5a18ade73992df59a9
-
SSDEEP
98304:IY5AqbFUXb52TaeHbV7FVAs/i24NaHdAeah32ILTauGLCY4YUR5IhciUHc4kJT:NxUXb5saeHbVBVAsOaHdSQ2BfYY5Kcif
Score
7/10
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bate.cmd msiexec.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Adminb2btr© = "\"C:\\Adminb2btr©\\aNBMh©.exe\"" reg.exe -
Blocklisted process makes network request 1 IoCs
flow pid Process 7 2856 MsiExec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe -
Drops file in Windows directory 9 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI6746.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{E1369ADC-7950-4D8F-B500-22284D3305B3} msiexec.exe File opened for modification C:\Windows\Installer\MSI67D4.tmp msiexec.exe File opened for modification C:\Windows\Installer\e5765ce.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI660D.tmp msiexec.exe File created C:\Windows\Installer\e5765ce.msi msiexec.exe -
Loads dropped DLL 2 IoCs
pid Process 2856 MsiExec.exe 2856 MsiExec.exe -
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2140 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language shutdown.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "126" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 4248 reg.exe -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 7 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1940 msiexec.exe 1940 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeShutdownPrivilege 2140 msiexec.exe Token: SeIncreaseQuotaPrivilege 2140 msiexec.exe Token: SeSecurityPrivilege 1940 msiexec.exe Token: SeCreateTokenPrivilege 2140 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2140 msiexec.exe Token: SeLockMemoryPrivilege 2140 msiexec.exe Token: SeIncreaseQuotaPrivilege 2140 msiexec.exe Token: SeMachineAccountPrivilege 2140 msiexec.exe Token: SeTcbPrivilege 2140 msiexec.exe Token: SeSecurityPrivilege 2140 msiexec.exe Token: SeTakeOwnershipPrivilege 2140 msiexec.exe Token: SeLoadDriverPrivilege 2140 msiexec.exe Token: SeSystemProfilePrivilege 2140 msiexec.exe Token: SeSystemtimePrivilege 2140 msiexec.exe Token: SeProfSingleProcessPrivilege 2140 msiexec.exe Token: SeIncBasePriorityPrivilege 2140 msiexec.exe Token: SeCreatePagefilePrivilege 2140 msiexec.exe Token: SeCreatePermanentPrivilege 2140 msiexec.exe Token: SeBackupPrivilege 2140 msiexec.exe Token: SeRestorePrivilege 2140 msiexec.exe Token: SeShutdownPrivilege 2140 msiexec.exe Token: SeDebugPrivilege 2140 msiexec.exe Token: SeAuditPrivilege 2140 msiexec.exe Token: SeSystemEnvironmentPrivilege 2140 msiexec.exe Token: SeChangeNotifyPrivilege 2140 msiexec.exe Token: SeRemoteShutdownPrivilege 2140 msiexec.exe Token: SeUndockPrivilege 2140 msiexec.exe Token: SeSyncAgentPrivilege 2140 msiexec.exe Token: SeEnableDelegationPrivilege 2140 msiexec.exe Token: SeManageVolumePrivilege 2140 msiexec.exe Token: SeImpersonatePrivilege 2140 msiexec.exe Token: SeCreateGlobalPrivilege 2140 msiexec.exe Token: SeRestorePrivilege 1940 msiexec.exe Token: SeTakeOwnershipPrivilege 1940 msiexec.exe Token: SeRestorePrivilege 1940 msiexec.exe Token: SeTakeOwnershipPrivilege 1940 msiexec.exe Token: SeRestorePrivilege 1940 msiexec.exe Token: SeTakeOwnershipPrivilege 1940 msiexec.exe Token: SeRestorePrivilege 1940 msiexec.exe Token: SeTakeOwnershipPrivilege 1940 msiexec.exe Token: SeRestorePrivilege 1940 msiexec.exe Token: SeTakeOwnershipPrivilege 1940 msiexec.exe Token: SeRestorePrivilege 1940 msiexec.exe Token: SeTakeOwnershipPrivilege 1940 msiexec.exe Token: SeShutdownPrivilege 2936 shutdown.exe Token: SeRemoteShutdownPrivilege 2936 shutdown.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 2140 msiexec.exe 2856 MsiExec.exe 2856 MsiExec.exe 2856 MsiExec.exe 2140 msiexec.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4448 LogonUI.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1940 wrote to memory of 2856 1940 msiexec.exe 86 PID 1940 wrote to memory of 2856 1940 msiexec.exe 86 PID 1940 wrote to memory of 2856 1940 msiexec.exe 86 PID 2856 wrote to memory of 2400 2856 MsiExec.exe 89 PID 2856 wrote to memory of 2400 2856 MsiExec.exe 89 PID 2856 wrote to memory of 2400 2856 MsiExec.exe 89 PID 2856 wrote to memory of 3700 2856 MsiExec.exe 91 PID 2856 wrote to memory of 3700 2856 MsiExec.exe 91 PID 2856 wrote to memory of 3700 2856 MsiExec.exe 91 PID 3700 wrote to memory of 2936 3700 cmd.exe 93 PID 3700 wrote to memory of 2936 3700 cmd.exe 93 PID 3700 wrote to memory of 2936 3700 cmd.exe 93 PID 2400 wrote to memory of 4248 2400 cmd.exe 94 PID 2400 wrote to memory of 4248 2400 cmd.exe 94 PID 2400 wrote to memory of 4248 2400 cmd.exe 94
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\FaturaVivo.pdf96.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2140
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Drops startup file
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding FDD4284906E946DE790071B3AEDB84922⤵
- Blocklisted process makes network request
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C start /MIN reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Adminb2btr©" /t reg_sz /d "\"C:\Adminb2btr©\aNBMh©.exe\"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\SysWOW64\reg.exereg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Adminb2btr©" /t reg_sz /d "\"C:\Adminb2btr©\aNBMh©.exe\"4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:4248
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C start /MIN shutdown -r -f -t 003⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Windows\SysWOW64\shutdown.exeshutdown -r -f -t 004⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2936
-
-
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39be055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4448
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14.5MB
MD5a3a91dbee0686872da99c9b5af8c92ce
SHA15a9e830e9da11c0ce0e7b9227ee12333f89b4015
SHA2563d4ba4825beb10790650c8badb9d6e4c7eabbf5252e5731fb63a737a20c2e99c
SHA512dfd1d0c8a32786de636a4dd663d85fadccf02a468bafcadfc85c3687281a89b7bdb7cab860cf73aa3cee6b255d72c63de9aaac617c66f0dbcbe3b32bc06b3059
-
Filesize
1KB
MD599de97107085187028053b455ae8bbb5
SHA18b7ee777b833e4cebe99e448c901c2874a0b6e75
SHA2565989ad98f0c650099c5facea687e8324aa27f492f4c122c9cec686febd0eb5bc
SHA5124ddc79ee0909a1d7e04e7e572b3cc22ed76aae438abad4118ccfdbd84c68024d35300b173951aeb26abf69f14faf20a8e7f1549d8e6dbcf0e8f1b534c34e5b01
-
Filesize
20KB
MD52e9944fed7c8017382bf9692fa1bbfc8
SHA19c05f1169dcaf58591b25c1eff2475c033294a41
SHA256f4d080f282513c5914680d3440dc094b5ccc417e5d8028429749a87193087831
SHA51286bef6ca52f8e5858ab7be8be77feabd08ecfea42961db529479ddb3cdd8e4ca20e43a28a7c5ac9d7bc389ceaca8601fce1df85922f1c7668930dba8f5ab9b32
-
Filesize
91KB
MD55c5bef05b6f3806106f8f3ce13401cc1
SHA16005fbe17f6e917ac45317552409d7a60976db14
SHA256f2f3ae8ca06f5cf320ca1d234a623bf55cf2b84c1d6dea3d85d5392e29aaf437
SHA51297933227b6002127385ace025f85a26358e47ee79c883f03180d474c15dbaf28a88492c8e53aefc0d305872edd27db0b4468da13e6f0337988f58d2ee35fd797