Analysis
-
max time kernel
1152s -
max time network
1158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
07-09-2024 07:04
General
-
Target
vcredist2005_x86.exe
-
Size
2.6MB
-
MD5
ce2922f83fb4b170affce0ea448b107b
-
SHA1
b8fab0bb7f62a24ddfe77b19cd9a1451abd7b847
-
SHA256
4ee4da0fe62d5fa1b5e80c6e6d88a4a2f8b3b140c35da51053d0d7b72a381d29
-
SHA512
e94b077e054bd8992374d359f3adc4d1d78d42118d878556715d77182f7d03635850b2b2f06c012ccb7c410e2b3c124cf6508473efe150d3c51a51857ce1c6b0
-
SSDEEP
49152:rqGRIgg2SirwkF9xdtb43lyGKCafpKkiwnaDahmPzpY4FPyaza:rxxLFfY/KCCpKk9aWMzZyau
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 1 IoCs
-
Drops file in Windows directory 57 IoCs
-
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 3 IoCs
-
Modifies registry class 45 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\vcredist2005_x86.exe"C:\Users\Admin\AppData\Local\Temp\vcredist2005_x86.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec /i vcredist.msi2⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding ACBAA670573786FAE532BB51ABE0F8952⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
73KB
MD5a17569408fd86eb566fdb3a78f96e2f1
SHA1b19e232f1a2c561be2809f6fbfef0be761ef4337
SHA256224da534f6601bfd962699d2983f40ab59d261ec0afd546f609cef13d8ec45fd
SHA51269b91c14455ed38461b836fd8776aca9666a4e83936d53a1acd8c74612ef363a3150341e5b9327d40bfae78d1843a18e83d7dc394f65e6a0f3b66a2360466369
-
Filesize
247KB
MD5cc064d4b81619991de8131a86ad77681
SHA188d80d86cc20c27d7d2a872af719300bd2bb73f9
SHA256913ee5a1cae3e5a1872b3a5efaaa00c58e4beb692492b138f76967da671b0477
SHA5125aff0eb26cfc187bf58721b2b6d73357d9f1e66d1ac5340ad9ddc08b40ad0eda27a144cb3b650604637a7476c282ded83ed890de98a73ccaf0cc021da3a9eb25
-
Filesize
2.6MB
MD5b20bbeb818222b657df49a9cfe4fed79
SHA13f6508e880b86502773a3275bc9527f046d45502
SHA25691bdd063f6c53126737791c9eccf0b2f4cf44927831527245bc89a0be06c0cb4
SHA512f534bc7bf1597e728940e6c3b77f864adfaa413bb1e080458326b692b0f96bddf4fbd294eeed36d7764a3578e6c8e919488bbf63b8fe2d4355ab3efd685424a4
-
Filesize
28KB
MD585221b3bcba8dbe4b4a46581aa49f760
SHA1746645c92594bfc739f77812d67cfd85f4b92474
SHA256f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f
SHA512060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d
-
Filesize
23.7MB
MD56801db6fedf14708bd358d71386dec97
SHA1715435af24651adffe5c892124ed82ef022ebf68
SHA256a365d700953ccfc2d7d3c44cc4f0b003f577e26c17a490a1acf317a79e71121f
SHA51207317fece32cf237e0b07757c3dae1fcf2ee37478da416bc7820675af048b20e2d70b89b9bf0fd10839c7ae36a835bf0e15b2b4ced6a79e9b703cd2275da64fd
-
Filesize
6KB
MD5c1354779b744a7a073b1b3600d09efd2
SHA1c10455e8b6caf2408eddcd767167df0b3ec538ff
SHA256cc5415ac8e6648abfb8f748f69fe98594b4f580d14c6d6e9c613fa468566767d
SHA5122726eb07c8a5279d9e3c46ca335fdb4dd3446d75b81f93670b23167d9525681705fe4707de835a15964859a957c847ee52396f3774493a22f7f9470c8e741f11