Overview

overview

7

Static

static

1

C++.zip

windows7-x64

1

C++.zip

windows10-2004-x64

1

C++/Visual...20.zip

windows7-x64

1

C++/Visual...20.zip

windows10-2004-x64

1

install_all.bat

windows7-x64

7

install_all.bat

windows10-2004-x64

7

vcredist2005_x64.exe

windows7-x64

7

vcredist2005_x64.exe

windows10-2004-x64

7

vcredist2005_x86.exe

windows7-x64

7

vcredist2005_x86.exe

windows10-2004-x64

7

vcredist2008_x64.exe

windows7-x64

7

vcredist2008_x64.exe

windows10-2004-x64

7

vcredist2008_x86.exe

windows7-x64

7

vcredist2008_x86.exe

windows10-2004-x64

7

vcredist2010_x64.exe

windows7-x64

7

vcredist2010_x64.exe

windows10-2004-x64

7

vcredist2010_x86.exe

windows7-x64

7

vcredist2010_x86.exe

windows10-2004-x64

7

vcredist2012_x64.exe

windows7-x64

7

vcredist2012_x64.exe

windows10-2004-x64

7

vcredist2012_x86.exe

windows7-x64

7

vcredist2012_x86.exe

windows10-2004-x64

7

vcredist2013_x64.exe

windows7-x64

7

vcredist2013_x64.exe

windows10-2004-x64

7

vcredist2013_x86.exe

windows7-x64

7

vcredist2013_x86.exe

windows10-2004-x64

7

vcredist20...64.exe

windows7-x64

7

vcredist20...64.exe

windows10-2004-x64

7

vcredist20...86.exe

windows7-x64

7

vcredist20...86.exe

windows10-2004-x64

7

C++/install_all.bat

windows7-x64

7

C++/install_all.bat

windows10-2004-x64

7

Analysis

  • max time kernel
    91s
  • max time network
    130s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/08/2024, 22:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    vcredist2005_x64.exe
  • Size 3.1MB
  • Sample240813-2bm2bazapb
  • SHA256 b1cbcde3791e0b1c6df3def43d8c05035c60fe2f6a2d8ba091abb4509fb43ef1
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
discoverypersistenceprivilege_escalation

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 57 IoCs
  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 45 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\vcredist2005_x64.exe
    "C:\Users\Admin\AppData\Local\Temp\vcredist2005_x64.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1052
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~2.EXE
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~2.EXE
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4028
      • C:\Windows\SysWOW64\msiexec.exe
        msiexec /i vcredist.msi
        3⤵
        • Enumerates connected drives
        • Event Triggered Execution: Installer Packages
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:1464
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2552
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4900
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding D3D86B7E691394E3868EA0314B1FA543
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:3344
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:4720

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        e57ebda.rbs
        • Path C:\Config.Msi\e57ebda.rbs
        • Size 65KB
        • SHA256 68b499dcfab94efcd09e1b166c464b6d72037065f440a989e0a4c164e9f20083
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        VCREDI~2.EXE
        • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~2.EXE
        • Size 3.0MB
        • SHA256 bfc68a9e609ee8a850c21be8c459b99f09e34309b8113e43b12be7a27f0b445a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        vcredis1.cab
        • Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vcredis1.cab
        • Size 312KB
        • SHA256 64570910e03c337d4e1f8ab1b9fb8e4dc46fdccb93857a1e9c73b296c6850fe0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        vcredist.msi
        • Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vcredist.msi
        • Size 3.0MB
        • SHA256 a9a8dac04e3b38c2f8d33ee7cf6d658fa4ea089bbf9f4014eb61b9d5de7dc6a2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MSIEDFA.tmp
        • Path C:\Windows\Installer\MSIEDFA.tmp
        • Size 28KB
        • SHA256 f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        metadata-2
        • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
        • Size 23.7MB
        • SHA256 3c25c9cda21fbbb6980f19a8ae05b43dd19f70671aa23fc3a9fe129cfb631fdc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        {ac95a337-76d2-45d5-b868-d15a5e1b7b62}_OnDiskSnapshotProp
        • Path \??\Volume{fa35ad82-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{ac95a337-76d2-45d5-b868-d15a5e1b7b62}_OnDiskSnapshotProp
        • Size 6KB
        • SHA256 12d940476daae0a4fa81b9499a5eb19c50697fd5a1f32f1c7bf485c0956efc28
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download