Analysis
- max time kernel
1642s - max time network
1477s - platform
windows11-21h2_x64 - resource
win11-20240802-en - resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system - submitted
30/08/2024, 19:34
Static task
static1
Behavioral task
behavioral1
Sample
CN.msi
Resource
win10v2004-20240802-en
windows10-2004-x64
16 signatures
1800 seconds
Behavioral task
behavioral2
Sample
CN.msi
Resource
win11-20240802-en
windows11-21h2-x64
16 signatures
1800 seconds
General
- Target CN.msi
- Size 1.6MB
- Sample240830-x926nssdpp
- SHA256 334c3f529b1c580ea83e2ea1e85b7a937dcceb3dd3b2a533afb936f53100c222
- MD5 329259260ebe046b0e80bec91f632ba0
- SHA1 db1184c14af32cf859d7f089d1dacc685257cc11
- SHA512 cfa0235623ec962266dbe9bcba5eac4535eff365aa784e6cf4d2a877aa6fedcc0801e5ba751b35ad176997337b72e4141f42ee07faf1017abcfda42b3228b2a4
- SSDEEP 49152:L/c3YuW8zBQSc0ZnSKYZKumZr7AVXP4XnEPvw:CY90ZniK/AVXP
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detects Latrodectus 1 IoCs
Detects Latrodectus v1.4.
resource yara_rule behavioral2/memory/3208-62-0x0000024EE5360000-0x0000024EE5376000-memory.dmp family_latrodectus_1_4 - Latrodectus loader
Latrodectus is a loader written in C++.
- Blocklisted process makes network request 6 IoCs
flow pid Process 7 3208 rundll32.exe 8 3208 rundll32.exe 11 3208 rundll32.exe 12 3208 rundll32.exe 13 3208 rundll32.exe 14 3208 rundll32.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe - Drops file in Windows directory 14 IoCs
description ioc Process File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF19F61664078C0FC3.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIA441.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA3D2.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\SourceHash{C3EF75B7-DF56-4658-B4FD-77A897CEA03F} msiexec.exe File created C:\Windows\SystemTemp\~DF692F3DCA30A374B3.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIA50D.tmp msiexec.exe File created C:\Windows\Installer\e57a2c8.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIA325.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DFB61479C3C7DFE9D3.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF2FEE92E07180B09D.TMP msiexec.exe File opened for modification C:\Windows\Installer\e57a2c8.msi msiexec.exe - Executes dropped EXE 1 IoCs
pid Process 3276 MSIA50D.tmp - Loads dropped DLL 13 IoCs
pid Process 4808 MsiExec.exe 4808 MsiExec.exe 4808 MsiExec.exe 4808 MsiExec.exe 4808 MsiExec.exe 4808 MsiExec.exe 1748 MsiExec.exe 1748 MsiExec.exe 4360 rundll32.exe 3208 rundll32.exe 612 rundll32.exe 2484 rundll32.exe 4676 rundll32.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 244 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSIA50D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000010ed058f6a88e7de0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000010ed058f0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090010ed058f000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d10ed058f000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000010ed058f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2412 msiexec.exe 2412 msiexec.exe 3276 MSIA50D.tmp 3276 MSIA50D.tmp - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 244 msiexec.exe Token: SeIncreaseQuotaPrivilege 244 msiexec.exe Token: SeSecurityPrivilege 2412 msiexec.exe Token: SeCreateTokenPrivilege 244 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 244 msiexec.exe Token: SeLockMemoryPrivilege 244 msiexec.exe Token: SeIncreaseQuotaPrivilege 244 msiexec.exe Token: SeMachineAccountPrivilege 244 msiexec.exe Token: SeTcbPrivilege 244 msiexec.exe Token: SeSecurityPrivilege 244 msiexec.exe Token: SeTakeOwnershipPrivilege 244 msiexec.exe Token: SeLoadDriverPrivilege 244 msiexec.exe Token: SeSystemProfilePrivilege 244 msiexec.exe Token: SeSystemtimePrivilege 244 msiexec.exe Token: SeProfSingleProcessPrivilege 244 msiexec.exe Token: SeIncBasePriorityPrivilege 244 msiexec.exe Token: SeCreatePagefilePrivilege 244 msiexec.exe Token: SeCreatePermanentPrivilege 244 msiexec.exe Token: SeBackupPrivilege 244 msiexec.exe Token: SeRestorePrivilege 244 msiexec.exe Token: SeShutdownPrivilege 244 msiexec.exe Token: SeDebugPrivilege 244 msiexec.exe Token: SeAuditPrivilege 244 msiexec.exe Token: SeSystemEnvironmentPrivilege 244 msiexec.exe Token: SeChangeNotifyPrivilege 244 msiexec.exe Token: SeRemoteShutdownPrivilege 244 msiexec.exe Token: SeUndockPrivilege 244 msiexec.exe Token: SeSyncAgentPrivilege 244 msiexec.exe Token: SeEnableDelegationPrivilege 244 msiexec.exe Token: SeManageVolumePrivilege 244 msiexec.exe Token: SeImpersonatePrivilege 244 msiexec.exe Token: SeCreateGlobalPrivilege 244 msiexec.exe Token: SeCreateTokenPrivilege 244 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 244 msiexec.exe Token: SeLockMemoryPrivilege 244 msiexec.exe Token: SeIncreaseQuotaPrivilege 244 msiexec.exe Token: SeMachineAccountPrivilege 244 msiexec.exe Token: SeTcbPrivilege 244 msiexec.exe Token: SeSecurityPrivilege 244 msiexec.exe Token: SeTakeOwnershipPrivilege 244 msiexec.exe Token: SeLoadDriverPrivilege 244 msiexec.exe Token: SeSystemProfilePrivilege 244 msiexec.exe Token: SeSystemtimePrivilege 244 msiexec.exe Token: SeProfSingleProcessPrivilege 244 msiexec.exe Token: SeIncBasePriorityPrivilege 244 msiexec.exe Token: SeCreatePagefilePrivilege 244 msiexec.exe Token: SeCreatePermanentPrivilege 244 msiexec.exe Token: SeBackupPrivilege 244 msiexec.exe Token: SeRestorePrivilege 244 msiexec.exe Token: SeShutdownPrivilege 244 msiexec.exe Token: SeDebugPrivilege 244 msiexec.exe Token: SeAuditPrivilege 244 msiexec.exe Token: SeSystemEnvironmentPrivilege 244 msiexec.exe Token: SeChangeNotifyPrivilege 244 msiexec.exe Token: SeRemoteShutdownPrivilege 244 msiexec.exe Token: SeUndockPrivilege 244 msiexec.exe Token: SeSyncAgentPrivilege 244 msiexec.exe Token: SeEnableDelegationPrivilege 244 msiexec.exe Token: SeManageVolumePrivilege 244 msiexec.exe Token: SeImpersonatePrivilege 244 msiexec.exe Token: SeCreateGlobalPrivilege 244 msiexec.exe Token: SeCreateTokenPrivilege 244 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 244 msiexec.exe Token: SeLockMemoryPrivilege 244 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 244 msiexec.exe 244 msiexec.exe - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 2412 wrote to memory of 4808 2412 msiexec.exe 82 PID 2412 wrote to memory of 4808 2412 msiexec.exe 82 PID 2412 wrote to memory of 4808 2412 msiexec.exe 82 PID 2412 wrote to memory of 1796 2412 msiexec.exe 86 PID 2412 wrote to memory of 1796 2412 msiexec.exe 86 PID 2412 wrote to memory of 1748 2412 msiexec.exe 88 PID 2412 wrote to memory of 1748 2412 msiexec.exe 88 PID 2412 wrote to memory of 1748 2412 msiexec.exe 88 PID 2412 wrote to memory of 3276 2412 msiexec.exe 89 PID 2412 wrote to memory of 3276 2412 msiexec.exe 89 PID 2412 wrote to memory of 3276 2412 msiexec.exe 89 PID 4360 wrote to memory of 3208 4360 rundll32.exe 91 PID 4360 wrote to memory of 3208 4360 rundll32.exe 91 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\CN.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:244
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F00ED20B1819E68A53398AADDBAFE0EF C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4808
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:1796
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 40B11FC8ACDD16CD4640173BB91724932⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1748
-
-
C:\Windows\Installer\MSIA50D.tmp"C:\Windows\Installer\MSIA50D.tmp" C:/Windows/System32/rundll32.exe C:\Users\Admin\AppData\Roaming\tz6.dll, NvCreateMPEG4MuxSink2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3276
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:1464
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\tz6.dll, NvCreateMPEG4MuxSink1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Windows\System32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Roaming\Custom_update\Update_2a11a5a9.dll", NvCreateMPEG4MuxSink2⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:3208
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Roaming\Custom_update\Update_2a11a5a9.dll", NvCreateMPEG4MuxSink1⤵
- Loads dropped DLL
PID:612
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Roaming\Custom_update\Update_2a11a5a9.dll", NvCreateMPEG4MuxSink1⤵
- Loads dropped DLL
PID:2484
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Roaming\Custom_update\Update_2a11a5a9.dll", NvCreateMPEG4MuxSink1⤵
- Loads dropped DLL
PID:4676
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e57a2c9.rbs
- Size 1KB
- SHA256 0bd4754c9e1c92b731666cce78087ab4e60d903087717f0f42387fe7b11c29c9
- MD5 23f778c642562f3bd2cd0c861ac136ef
- SHA1 fc2ecc963ae52e95591d94d41ac5601800db3329
- SHA512 041a25baf05550cf987b0748099e3ed4fb8f8cb763dc43b837c3ba1d334f282ad508c1b54cd9b4cec8023e0a5c51d5cb7be8179ca62418dbffce5c15b59f1196
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\MSI83F5.tmp
- Size 436KB
- SHA256 426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
- MD5 475d20c0ea477a35660e3f67ecf0a1df
- SHA1 67340739f51e1134ae8f0ffc5ae9dd710e8e3a08
- SHA512 99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
- SSDEEP 6144:5x0A4eCDsgvSd7ftYx5fnLHT7ybjfgaUFfQiAOuv2IaZeB+:5x0ECIgYOx5fnL/tYi8OBZr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\tz6.dll
- Size 1.1MB
- SHA256 4dabba4dbabba2b5201fca7e525859946ad860e2693574dc2a6d18348b0c8b95
- MD5 11bba295ee381161292c384c2eca7a0c
- SHA1 2ce64388e396af0c1d96c8544fca6cfee0644f54
- SHA512 42d926b2a6a4dc99f264a7a38ab951e55f5b126313d8f3250698aca65aea6330030940c91179b29b563c625ddd8f2672ddb7ec3a4f440ffe32dcd3d6cb982f55
- SSDEEP 24576:v5ES9brXkkkZGzAUQX9cVPPCGNFpTbMe9:R7brUsI9cVPPCGNFtwe9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSIA50D.tmp
- Size 389KB
- SHA256 1e0e63b446eecf6c9781c7d1cae1f46a3bb31654a70612f71f31538fb4f4729a
- MD5 b9545ed17695a32face8c3408a6a3553
- SHA1 f6c31c9cd832ae2aebcd88e7b2fa6803ae93fc83
- SHA512 f6d6dc40dcba5ff091452d7cc257427dcb7ce2a21816b4fec2ee249e63246b64667f5c4095220623533243103876433ef8c12c9b612c0e95fdfffe41d1504e04
- SSDEEP 6144:gMvZx0Flyv/UB8zBQSnuJnO6n4ZSaHwLvFnNLqrFWeyp1uBxfAOT3VDqO1:gMvZx0FlS68zBQSncb4ZPQTpAjZxqO1
- MD5 SHA1 SHA512 SSDEEP
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 12.8MB
- SHA256 ba53ef439fc6afd4f4d51605f9e83c1d63a5046d3c0400e9a729386ec5272cdb
- MD5 dd672bb9f36fa1b7773cb5b250e81867
- SHA1 83bbf02062f3ebd1bccd0bd1c70da7bec4469918
- SHA512 2ed8811f2d12058e593cb556d4365640ef67f365e73ba6f6fed779bd535869865bc8768b2b53f19da16f3b7af6f8418a449c4cd5c02db680f4d30188b110d255
- SSDEEP 12288:P0l1HbSH9QlO/bLn8w8joUGGT0laDZJnh6EDw/fGqjlUWkH4tXi3UYb7lrj29mhi:87SdoO/v9laDvpNaWuxLbBmHTRWXhL
- MD5 SHA1 SHA512 SSDEEP
- Path \??\Volume{8f05ed10-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{0b3062b2-099d-4a47-a195-f3a0856dcc03}_OnDiskSnapshotProp
- Size 6KB
- SHA256 54af9698f70349ec7c8e88c9e468f1c110834169e0ac4e9966e9ecec7c560ed2
- MD5 02b2775185fab14e490ce7901d51b595
- SHA1 9c1181233999956f95fedbb4de1dd5deb2fc5616
- SHA512 344a4a12a8d4d1deafd4b04b243868ca48efe31f7b8d9882ec23adbe25b3e77c2da1c49661a3b4f25ccd9847893935ff4648d1ec28e5b997612cc5859745f817
- SSDEEP 96:FRi2lXpADD84LTHzbOHXOHBlBRQ78Sc9XE56tOSVQpu:q1b++mVm
- MD5 SHA1 SHA512 SSDEEP