Analysis
-
max time kernel
126s -
max time network
85s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
10-09-2024 02:09
Static task
static1
Behavioral task
behavioral1
Sample
b4346702b4b5029cbd627b5df724550f8b783ba22876e5070dadc0ed5c214df2.msi
Resource
win7-20240729-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
b4346702b4b5029cbd627b5df724550f8b783ba22876e5070dadc0ed5c214df2.msi
Resource
win10v2004-20240802-en
windows10-2004-x64
17 signatures
150 seconds
General
-
Target
b4346702b4b5029cbd627b5df724550f8b783ba22876e5070dadc0ed5c214df2.msi
-
Size
23.0MB
-
MD5
4295dda40427af8df6738b3531d63389
-
SHA1
cb5a45de787c34eda399a3cad64abd3b6133f514
-
SHA256
b4346702b4b5029cbd627b5df724550f8b783ba22876e5070dadc0ed5c214df2
-
SHA512
31ae6245cc6188e9d8b471c9cb169263fb7189e3d7653266857db01e3b92b1773ddc1971e3468734f48294f48aaf1a1e93b21d3ffc89dc30f6fcf8549c6a24e2
-
SSDEEP
393216:u66L7jpW/sxwA0Ip5AGgrJmD1Y5D9xAgAmBOn4AZENqMJiaErOQtt4KgTD5v2X:uHWUxOQxZDKNfAuOri9rQtlKy
Malware Config
Signatures
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
MsiExec.exedescription pid Process procid_target PID 2128 created 1244 2128 MsiExec.exe 21 -
Blocklisted process makes network request 4 IoCs
Processes:
msiexec.exemsiexec.exeflow pid Process 3 2636 msiexec.exe 6 2636 msiexec.exe 7 2636 msiexec.exe 8 1496 msiexec.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exemsiexec.exedescription ioc Process File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe -
Drops file in Windows directory 11 IoCs
Processes:
msiexec.exeDrvInst.exedescription ioc Process File opened for modification C:\Windows\Installer\f77b55b.msi msiexec.exe File created C:\Windows\Installer\f77b55c.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIC234.tmp msiexec.exe File opened for modification C:\Windows\Installer\f77b55c.ipi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\f77b55b.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIB72B.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\f77b55e.msi msiexec.exe -
Loads dropped DLL 1 IoCs
Processes:
MsiExec.exepid Process 2128 MsiExec.exe -
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
MsiExec.exemsiexec.exedialer.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dialer.exe -
Modifies data under HKEY_USERS 46 IoCs
Processes:
DrvInst.exemsiexec.exedescription ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D msiexec.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe -
Modifies registry class 22 IoCs
Processes:
msiexec.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\Version = "16777216" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A425586BD2489EF4F8012A4FFEF4857B msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\SourceList\Media\1 = ";" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F44E241F0BCCADE479DE975C6A0CB160 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\ProductName = "Installer" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\PackageCode = "7A74966847EC2A34B99EB7B98AF9DD09" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\DeploymentFlags = "2" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F44E241F0BCCADE479DE975C6A0CB160\DefaultFeature msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A425586BD2489EF4F8012A4FFEF4857B\F44E241F0BCCADE479DE975C6A0CB160 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\SourceList\PackageName = "b4346702b4b5029cbd627b5df724550f8b783ba22876e5070dadc0ed5c214df2.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
MsiExec.exedialer.exemsiexec.exepid Process 2128 MsiExec.exe 2128 MsiExec.exe 1536 dialer.exe 1536 dialer.exe 1496 msiexec.exe 1496 msiexec.exe 1536 dialer.exe 1536 dialer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
msiexec.exepid Process 916 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
msiexec.exemsiexec.exevssvc.exeDrvInst.exemsiexec.exedescription pid Process Token: SeShutdownPrivilege 2636 msiexec.exe Token: SeIncreaseQuotaPrivilege 2636 msiexec.exe Token: SeRestorePrivilege 1496 msiexec.exe Token: SeTakeOwnershipPrivilege 1496 msiexec.exe Token: SeSecurityPrivilege 1496 msiexec.exe Token: SeCreateTokenPrivilege 2636 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2636 msiexec.exe Token: SeLockMemoryPrivilege 2636 msiexec.exe Token: SeIncreaseQuotaPrivilege 2636 msiexec.exe Token: SeMachineAccountPrivilege 2636 msiexec.exe Token: SeTcbPrivilege 2636 msiexec.exe Token: SeSecurityPrivilege 2636 msiexec.exe Token: SeTakeOwnershipPrivilege 2636 msiexec.exe Token: SeLoadDriverPrivilege 2636 msiexec.exe Token: SeSystemProfilePrivilege 2636 msiexec.exe Token: SeSystemtimePrivilege 2636 msiexec.exe Token: SeProfSingleProcessPrivilege 2636 msiexec.exe Token: SeIncBasePriorityPrivilege 2636 msiexec.exe Token: SeCreatePagefilePrivilege 2636 msiexec.exe Token: SeCreatePermanentPrivilege 2636 msiexec.exe Token: SeBackupPrivilege 2636 msiexec.exe Token: SeRestorePrivilege 2636 msiexec.exe Token: SeShutdownPrivilege 2636 msiexec.exe Token: SeDebugPrivilege 2636 msiexec.exe Token: SeAuditPrivilege 2636 msiexec.exe Token: SeSystemEnvironmentPrivilege 2636 msiexec.exe Token: SeChangeNotifyPrivilege 2636 msiexec.exe Token: SeRemoteShutdownPrivilege 2636 msiexec.exe Token: SeUndockPrivilege 2636 msiexec.exe Token: SeSyncAgentPrivilege 2636 msiexec.exe Token: SeEnableDelegationPrivilege 2636 msiexec.exe Token: SeManageVolumePrivilege 2636 msiexec.exe Token: SeImpersonatePrivilege 2636 msiexec.exe Token: SeCreateGlobalPrivilege 2636 msiexec.exe Token: SeBackupPrivilege 1948 vssvc.exe Token: SeRestorePrivilege 1948 vssvc.exe Token: SeAuditPrivilege 1948 vssvc.exe Token: SeBackupPrivilege 1496 msiexec.exe Token: SeRestorePrivilege 1496 msiexec.exe Token: SeRestorePrivilege 2736 DrvInst.exe Token: SeRestorePrivilege 2736 DrvInst.exe Token: SeRestorePrivilege 2736 DrvInst.exe Token: SeRestorePrivilege 2736 DrvInst.exe Token: SeRestorePrivilege 2736 DrvInst.exe Token: SeRestorePrivilege 2736 DrvInst.exe Token: SeRestorePrivilege 2736 DrvInst.exe Token: SeLoadDriverPrivilege 2736 DrvInst.exe Token: SeLoadDriverPrivilege 2736 DrvInst.exe Token: SeLoadDriverPrivilege 2736 DrvInst.exe Token: SeRestorePrivilege 1496 msiexec.exe Token: SeTakeOwnershipPrivilege 1496 msiexec.exe Token: SeRestorePrivilege 1496 msiexec.exe Token: SeTakeOwnershipPrivilege 1496 msiexec.exe Token: SeShutdownPrivilege 916 msiexec.exe Token: SeIncreaseQuotaPrivilege 916 msiexec.exe Token: SeCreateTokenPrivilege 916 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 916 msiexec.exe Token: SeLockMemoryPrivilege 916 msiexec.exe Token: SeIncreaseQuotaPrivilege 916 msiexec.exe Token: SeMachineAccountPrivilege 916 msiexec.exe Token: SeTcbPrivilege 916 msiexec.exe Token: SeSecurityPrivilege 916 msiexec.exe Token: SeTakeOwnershipPrivilege 916 msiexec.exe Token: SeLoadDriverPrivilege 916 msiexec.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
msiexec.exemsiexec.exepid Process 2636 msiexec.exe 916 msiexec.exe 2636 msiexec.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
msiexec.exeMsiExec.exedescription pid Process procid_target PID 1496 wrote to memory of 2128 1496 msiexec.exe 34 PID 1496 wrote to memory of 2128 1496 msiexec.exe 34 PID 1496 wrote to memory of 2128 1496 msiexec.exe 34 PID 1496 wrote to memory of 2128 1496 msiexec.exe 34 PID 1496 wrote to memory of 2128 1496 msiexec.exe 34 PID 1496 wrote to memory of 2128 1496 msiexec.exe 34 PID 1496 wrote to memory of 2128 1496 msiexec.exe 34 PID 2128 wrote to memory of 916 2128 MsiExec.exe 35 PID 2128 wrote to memory of 916 2128 MsiExec.exe 35 PID 2128 wrote to memory of 916 2128 MsiExec.exe 35 PID 2128 wrote to memory of 916 2128 MsiExec.exe 35 PID 2128 wrote to memory of 916 2128 MsiExec.exe 35 PID 2128 wrote to memory of 916 2128 MsiExec.exe 35 PID 2128 wrote to memory of 916 2128 MsiExec.exe 35 PID 2128 wrote to memory of 1536 2128 MsiExec.exe 36 PID 2128 wrote to memory of 1536 2128 MsiExec.exe 36 PID 2128 wrote to memory of 1536 2128 MsiExec.exe 36 PID 2128 wrote to memory of 1536 2128 MsiExec.exe 36 PID 2128 wrote to memory of 1536 2128 MsiExec.exe 36 PID 2128 wrote to memory of 1536 2128 MsiExec.exe 36 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1244
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\b4346702b4b5029cbd627b5df724550f8b783ba22876e5070dadc0ed5c214df2.msi2⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2636
-
-
C:\Windows\SysWOW64\dialer.exe"C:\Windows\system32\dialer.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1536
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding AD2774D903FC71D44327A4B1F5E13CA42⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\dXNlcg==.msi"3⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:916
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1948
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003E0" "00000000000003D4"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2736
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD55d2b3677b2e3b97f40b13b2ca36d925f
SHA1455c978e9a49be17c4c91c1737d0f1b42618ee06
SHA256b15de284b5e2a7aca2034f0ef6ebce413c6c4a8664044ca24d613f3df47728ff
SHA512c4f39c161bacf7895270798e9c7ccff00f0911a1371ae555783cb75e71dc0d737454312f8acbcc2eb3b844ff1ff47cefdcf2ba9c1b2056f9eaf2cfce018c549c
-
Filesize
1KB
MD5e11e31581aae545302f6176a117b4d95
SHA1743af0529bd032a0f44a83cdd4baa97b7c2ec49a
SHA2562e7bf16cc22485a7bbe2aa8696750761b0ae39be3b2fe9d0cc6d4ef73491425c
SHA512c63aba6ca79c60a92b3bd26d784a5436e45a626022958bf6c194afc380c7bfb01fadf0b772513bbdbd7f1bb73691b0edb2f60b2f235ec9e0b81c427e04fbe451
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07298EE8EBA9732300AE62BDCA6B6898
Filesize312B
MD554c3c7bbc4abf692986fa54303d589be
SHA1d5481a3fdc0066a6afdf6a1631ff5497fd108494
SHA2567853aff454af2d1e7094b4b2010f315d28de38c2c72431e7bf99c95e19269b92
SHA512ef821bc51c780decdaffa92289fb3aca51a88fcf461483496e7cbc4fc83755dc5c94d8f24d71610a5e31d6d523b2814761ff675600b952ecd0045fed07a93878
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD519ed51470a28e0ce12424b587157da3f
SHA1eaa29672f59f59e353d5371a188ea0890a2edcd7
SHA25696fc478a58e09e9a9534667735fc3786866262754b9e64a512fef01502db0b69
SHA5121e214b5c96b054a932ebff375bc5cadac3f7f6767aa628649c896c908d1bfe76372b25844a173c3c0f9c78a66442cc9bb439c9ecbdc744910844c133f2a6246a
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
22.3MB
MD5e969fa4b30951a66e9bf28b21fd75174
SHA1dc818acf470ad20f56f464e4839650564f023a7f
SHA25696811ea4f9266ba8ee5c758c146fbc84f3cfe5ec4c5c966b5885e11b5f696f74
SHA5126da2ec033f58843a06270ef04c55ba0ee8449df685f1902ab953bf511acd0a4735532db3bff73858c082005b4df27d5c376a4fb324f9506b85564356286b0f68
-
Filesize
193KB
MD57e274959f4347527c246a2c6343105e7
SHA18885c1a2624ccd01102d9eabfa9050fd19093f16
SHA256dbe502732e67c80c03fba12a885f3c68023eeff31fcde8170f4733d8261b540e
SHA512bf4666efec860030f2795ebdb5ed34a11f2611a342ea1b752dd232072425420b9155804fc43ed7546c4fd3973bc68cdfc9c5cd9765d3c529891a0862173df4b9