Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
10-09-2024 00:55
Static task
static1
Behavioral task
behavioral1
Sample
b4346702b4b5029cbd627b5df724550f8b783ba22876e5070dadc0ed5c214df2.msi
Resource
win7-20240903-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
b4346702b4b5029cbd627b5df724550f8b783ba22876e5070dadc0ed5c214df2.msi
Resource
win10v2004-20240802-en
windows10-2004-x64
17 signatures
150 seconds
General
-
Target
b4346702b4b5029cbd627b5df724550f8b783ba22876e5070dadc0ed5c214df2.msi
-
Size
23.0MB
-
MD5
4295dda40427af8df6738b3531d63389
-
SHA1
cb5a45de787c34eda399a3cad64abd3b6133f514
-
SHA256
b4346702b4b5029cbd627b5df724550f8b783ba22876e5070dadc0ed5c214df2
-
SHA512
31ae6245cc6188e9d8b471c9cb169263fb7189e3d7653266857db01e3b92b1773ddc1971e3468734f48294f48aaf1a1e93b21d3ffc89dc30f6fcf8549c6a24e2
-
SSDEEP
393216:u66L7jpW/sxwA0Ip5AGgrJmD1Y5D9xAgAmBOn4AZENqMJiaErOQtt4KgTD5v2X:uHWUxOQxZDKNfAuOri9rQtlKy
Malware Config
Signatures
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
MsiExec.exedescription pid Process procid_target PID 1176 created 1160 1176 MsiExec.exe 21 -
Blocklisted process makes network request 3 IoCs
Processes:
msiexec.exemsiexec.exeflow pid Process 3 2352 msiexec.exe 5 2352 msiexec.exe 7 2636 msiexec.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exemsiexec.exedescription ioc Process File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe -
Drops file in Windows directory 11 IoCs
Processes:
msiexec.exeDrvInst.exedescription ioc Process File opened for modification C:\Windows\Installer\f76c8ea.msi msiexec.exe File created C:\Windows\Installer\f76c8ed.msi msiexec.exe File opened for modification C:\Windows\Installer\f76c8eb.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSID4BA.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\f76c8ea.msi msiexec.exe File opened for modification C:\Windows\Installer\MSICC21.tmp msiexec.exe File created C:\Windows\Installer\f76c8eb.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe -
Loads dropped DLL 1 IoCs
Processes:
MsiExec.exepid Process 1176 MsiExec.exe -
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
MsiExec.exemsiexec.exedialer.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dialer.exe -
Modifies data under HKEY_USERS 46 IoCs
Processes:
DrvInst.exemsiexec.exedescription ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe -
Modifies registry class 22 IoCs
Processes:
msiexec.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\PackageCode = "7A74966847EC2A34B99EB7B98AF9DD09" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A425586BD2489EF4F8012A4FFEF4857B msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F44E241F0BCCADE479DE975C6A0CB160\DefaultFeature msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\DeploymentFlags = "2" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A425586BD2489EF4F8012A4FFEF4857B\F44E241F0BCCADE479DE975C6A0CB160 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\SourceList\Net msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\ProductName = "Installer" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\Version = "16777216" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\SourceList\PackageName = "b4346702b4b5029cbd627b5df724550f8b783ba22876e5070dadc0ed5c214df2.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F44E241F0BCCADE479DE975C6A0CB160 msiexec.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
MsiExec.exemsiexec.exedialer.exepid Process 1176 MsiExec.exe 1176 MsiExec.exe 2636 msiexec.exe 2636 msiexec.exe 1420 dialer.exe 1420 dialer.exe 1420 dialer.exe 1420 dialer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
msiexec.exepid Process 1284 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
msiexec.exemsiexec.exevssvc.exeDrvInst.exemsiexec.exedescription pid Process Token: SeShutdownPrivilege 2352 msiexec.exe Token: SeIncreaseQuotaPrivilege 2352 msiexec.exe Token: SeRestorePrivilege 2636 msiexec.exe Token: SeTakeOwnershipPrivilege 2636 msiexec.exe Token: SeSecurityPrivilege 2636 msiexec.exe Token: SeCreateTokenPrivilege 2352 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2352 msiexec.exe Token: SeLockMemoryPrivilege 2352 msiexec.exe Token: SeIncreaseQuotaPrivilege 2352 msiexec.exe Token: SeMachineAccountPrivilege 2352 msiexec.exe Token: SeTcbPrivilege 2352 msiexec.exe Token: SeSecurityPrivilege 2352 msiexec.exe Token: SeTakeOwnershipPrivilege 2352 msiexec.exe Token: SeLoadDriverPrivilege 2352 msiexec.exe Token: SeSystemProfilePrivilege 2352 msiexec.exe Token: SeSystemtimePrivilege 2352 msiexec.exe Token: SeProfSingleProcessPrivilege 2352 msiexec.exe Token: SeIncBasePriorityPrivilege 2352 msiexec.exe Token: SeCreatePagefilePrivilege 2352 msiexec.exe Token: SeCreatePermanentPrivilege 2352 msiexec.exe Token: SeBackupPrivilege 2352 msiexec.exe Token: SeRestorePrivilege 2352 msiexec.exe Token: SeShutdownPrivilege 2352 msiexec.exe Token: SeDebugPrivilege 2352 msiexec.exe Token: SeAuditPrivilege 2352 msiexec.exe Token: SeSystemEnvironmentPrivilege 2352 msiexec.exe Token: SeChangeNotifyPrivilege 2352 msiexec.exe Token: SeRemoteShutdownPrivilege 2352 msiexec.exe Token: SeUndockPrivilege 2352 msiexec.exe Token: SeSyncAgentPrivilege 2352 msiexec.exe Token: SeEnableDelegationPrivilege 2352 msiexec.exe Token: SeManageVolumePrivilege 2352 msiexec.exe Token: SeImpersonatePrivilege 2352 msiexec.exe Token: SeCreateGlobalPrivilege 2352 msiexec.exe Token: SeBackupPrivilege 3044 vssvc.exe Token: SeRestorePrivilege 3044 vssvc.exe Token: SeAuditPrivilege 3044 vssvc.exe Token: SeBackupPrivilege 2636 msiexec.exe Token: SeRestorePrivilege 2636 msiexec.exe Token: SeRestorePrivilege 1444 DrvInst.exe Token: SeRestorePrivilege 1444 DrvInst.exe Token: SeRestorePrivilege 1444 DrvInst.exe Token: SeRestorePrivilege 1444 DrvInst.exe Token: SeRestorePrivilege 1444 DrvInst.exe Token: SeRestorePrivilege 1444 DrvInst.exe Token: SeRestorePrivilege 1444 DrvInst.exe Token: SeLoadDriverPrivilege 1444 DrvInst.exe Token: SeLoadDriverPrivilege 1444 DrvInst.exe Token: SeLoadDriverPrivilege 1444 DrvInst.exe Token: SeRestorePrivilege 2636 msiexec.exe Token: SeTakeOwnershipPrivilege 2636 msiexec.exe Token: SeRestorePrivilege 2636 msiexec.exe Token: SeTakeOwnershipPrivilege 2636 msiexec.exe Token: SeShutdownPrivilege 1284 msiexec.exe Token: SeIncreaseQuotaPrivilege 1284 msiexec.exe Token: SeCreateTokenPrivilege 1284 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1284 msiexec.exe Token: SeLockMemoryPrivilege 1284 msiexec.exe Token: SeIncreaseQuotaPrivilege 1284 msiexec.exe Token: SeMachineAccountPrivilege 1284 msiexec.exe Token: SeTcbPrivilege 1284 msiexec.exe Token: SeSecurityPrivilege 1284 msiexec.exe Token: SeTakeOwnershipPrivilege 1284 msiexec.exe Token: SeLoadDriverPrivilege 1284 msiexec.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
msiexec.exemsiexec.exepid Process 2352 msiexec.exe 1284 msiexec.exe 2352 msiexec.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
msiexec.exeMsiExec.exedescription pid Process procid_target PID 2636 wrote to memory of 1176 2636 msiexec.exe 35 PID 2636 wrote to memory of 1176 2636 msiexec.exe 35 PID 2636 wrote to memory of 1176 2636 msiexec.exe 35 PID 2636 wrote to memory of 1176 2636 msiexec.exe 35 PID 2636 wrote to memory of 1176 2636 msiexec.exe 35 PID 2636 wrote to memory of 1176 2636 msiexec.exe 35 PID 2636 wrote to memory of 1176 2636 msiexec.exe 35 PID 1176 wrote to memory of 1284 1176 MsiExec.exe 36 PID 1176 wrote to memory of 1284 1176 MsiExec.exe 36 PID 1176 wrote to memory of 1284 1176 MsiExec.exe 36 PID 1176 wrote to memory of 1284 1176 MsiExec.exe 36 PID 1176 wrote to memory of 1284 1176 MsiExec.exe 36 PID 1176 wrote to memory of 1284 1176 MsiExec.exe 36 PID 1176 wrote to memory of 1284 1176 MsiExec.exe 36 PID 1176 wrote to memory of 1420 1176 MsiExec.exe 37 PID 1176 wrote to memory of 1420 1176 MsiExec.exe 37 PID 1176 wrote to memory of 1420 1176 MsiExec.exe 37 PID 1176 wrote to memory of 1420 1176 MsiExec.exe 37 PID 1176 wrote to memory of 1420 1176 MsiExec.exe 37 PID 1176 wrote to memory of 1420 1176 MsiExec.exe 37 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1160
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\b4346702b4b5029cbd627b5df724550f8b783ba22876e5070dadc0ed5c214df2.msi2⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2352
-
-
C:\Windows\SysWOW64\dialer.exe"C:\Windows\system32\dialer.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1420
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B63CC763D038A1F58112C9B7DF76D41B2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\dXNlcg==.msi"3⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1284
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3044
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000470" "00000000000004C4"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1444
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD56c9b8cd43bb6761420aa88e111de61ac
SHA13482e3634b5d993a3efd8ca7ea589ee9fe4ba42d
SHA256412c81827a568377c03cf9459a74616cd97ea462465039370f1ceff6c590d844
SHA512dca3486addef28e1a2ba0937f6f2b38a9742ae9d983fd1e678582b37a28e05602ba73b08830686c0dadc94ac6683a7f4ef473223ac8990292fee881e45090791
-
Filesize
1KB
MD5e11e31581aae545302f6176a117b4d95
SHA1743af0529bd032a0f44a83cdd4baa97b7c2ec49a
SHA2562e7bf16cc22485a7bbe2aa8696750761b0ae39be3b2fe9d0cc6d4ef73491425c
SHA512c63aba6ca79c60a92b3bd26d784a5436e45a626022958bf6c194afc380c7bfb01fadf0b772513bbdbd7f1bb73691b0edb2f60b2f235ec9e0b81c427e04fbe451
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07298EE8EBA9732300AE62BDCA6B6898
Filesize312B
MD57fbfd101005e0e906c3e4b426c63f418
SHA1d90f9e02d716ff56f6fd27bc53f0ddf1173196c6
SHA256d360e641104aa4beafdcbfbf375220647f246c4d89b2a1d9e197ac4773571739
SHA512d1da13edba74138e1cfa870ce66439780d842faa6d78602858062063c76e184ad5ab5135db1b6805f941543851075fa666165776e2b4fd67bc943a18cdd78a81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55d2652ff326c5b5461164dd8d2ac7c05
SHA1a5fd5422b2e9d4f2314ad1ce5fee5053616f292b
SHA25659e8cc140dd60f180c554c3691d54305a5187e85201a98c3824b6942d955ff22
SHA51284202ab1066e08608fa5d8c35852959d5e0301b37c6708d76b40f065062a253b62ab8f901871f4c723e64ca4b42ebc9f0558d711c64db07560b25d707ef38513
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
22.3MB
MD5e969fa4b30951a66e9bf28b21fd75174
SHA1dc818acf470ad20f56f464e4839650564f023a7f
SHA25696811ea4f9266ba8ee5c758c146fbc84f3cfe5ec4c5c966b5885e11b5f696f74
SHA5126da2ec033f58843a06270ef04c55ba0ee8449df685f1902ab953bf511acd0a4735532db3bff73858c082005b4df27d5c376a4fb324f9506b85564356286b0f68
-
Filesize
193KB
MD57e274959f4347527c246a2c6343105e7
SHA18885c1a2624ccd01102d9eabfa9050fd19093f16
SHA256dbe502732e67c80c03fba12a885f3c68023eeff31fcde8170f4733d8261b540e
SHA512bf4666efec860030f2795ebdb5ed34a11f2611a342ea1b752dd232072425420b9155804fc43ed7546c4fd3973bc68cdfc9c5cd9765d3c529891a0862173df4b9