Analysis

  • max time kernel
    94s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-09-2024 03:29

General

  • Target

    mnfclub-setup-win.msi

  • Size

    9.2MB

  • MD5

    8fb4b0015988417a06216c492d051a9f

  • SHA1

    1f8528631296965b45d9e804f1d6b31440557825

  • SHA256

    0aa5b3912429387f9b5f6150f49f929b5f6e00fab539c7372108f37c7aa6c44a

  • SHA512

    31a9d67b4d3e848448ae3109e0c5f810916b591879a16f2649d5837ca7bdad8a4483f1116c9a23f6bce0c7de73f4264e35141008d6d0ee562657a25f09d45a17

  • SSDEEP

    196608:bP1FFmPoT8CQEfP6HZE8/mHN78b5UWD966GJYH15nNexCxHLrs4V:T1FYAlHPAF/G78be6Gq151xrrj

Malware Config

Signatures

  • CryptOne packer 2 IoCs

    Detects CryptOne packer defined in NCC blogpost.

  • Blocklisted process makes network request 5 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 15 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 11 IoCs
  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 24 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\mnfclub-setup-win.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2492
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1920
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 2A7BF9CE8467A89B1B4767EF2811591C C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:116
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:3344
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 00121080F0DFEE9835B328565DD87824
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4384
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:3932
    • C:\Program Files (x86)\MNF Club\MNF Club.exe
      "C:\Program Files (x86)\MNF Club\MNF Club.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Suspicious use of SetWindowsHookEx
      PID:4800
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x4f4 0x4ac
      1⤵
        PID:2680

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Config.Msi\e57c0b1.rbs

        Filesize

        8KB

        MD5

        a5bd9435a7c1a6956f9b609e701be7af

        SHA1

        8afbd2cfcec139e99f312fdd3898860210362677

        SHA256

        2fe74a04823048ace3f808957f3105467a2c24834be8690615210b4cb5a668f0

        SHA512

        4e30248fb32cc2bf18fc77ff6df7bba3a04feecf6aff92d2d632e7672aa322b4bf547a134a329d2a32a1de3908119eead57c6216e060144040080a162cc56c73

      • C:\Program Files (x86)\MNF Club\MNF Club.exe

        Filesize

        17.4MB

        MD5

        8e6f2257f9ac8b84d9f9450b5b211f0a

        SHA1

        f04dc5ae9cf8dadaacb508f9e0ab2a04832252c3

        SHA256

        2b31cf72304d6ffe6b93c5133a9ede8e2e7487f6a7cbc867ba6d16e9aec3ed10

        SHA512

        287adc69653993e5f5bc58950b7092185630f0042128137d3c7563a41b1043c04b366c520868a460ac7f4883e808f2972c2f3ab189808f6443354f3ce8f3fd17

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_E6095CD2AECC9011BCD0D7B421356B17

        Filesize

        2KB

        MD5

        e8c488626cdb99149641b5b8017e4074

        SHA1

        ce6e5a97161f768e5cb9b900f6fe1481fb3103d7

        SHA256

        6701f241820c220c0e77f6bf24059c586bd69bee85d5f489423d0fd78a4bf910

        SHA512

        f776b7b22a870407bbf78057f1ef970129cead337a65f97ee2d16e8739bcf96d3dadecf74069fd4e0aa39c832eb8f7401a8d5a6f868075498aac055a17458e76

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

        Filesize

        1KB

        MD5

        555f06562d84c651989da999b2f2ffed

        SHA1

        a92f99ca18069367e5f90cc551bcdbf2b2e367cc

        SHA256

        442efd2ed928058c9c0cafd67dd2532cf2abe1059a83a1643ba7e1da5039153d

        SHA512

        7c64146dffb7a880286a719f94804baca36d0350a5c47de0e9048db7352daf1b941f6d60d01838ee3df957fb9e4d6ba295c6c0c98b5e7e0ef4693a153be4affe

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D7833C286363AD25C70511661A83D581_67EE047A9B85FFFE874C7B3793642FFD

        Filesize

        510B

        MD5

        51def7643a2b9aada66ff45936ae803d

        SHA1

        735cb43822adcf7d7c4acd4fa19a998c674b8ecf

        SHA256

        ec5989f1d114a0ca2419328124735f4cddfe45b831aa0465b0b1e409fa4e394b

        SHA512

        c0a15dfd5ff29d1b24ebbddcec3396eb844e86369581c64303f6de25f6dd2e673b0d9979928d2ba4233c49695d3a5c1ed8a254354ff09381af6fa2100d49a6f5

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_E6095CD2AECC9011BCD0D7B421356B17

        Filesize

        488B

        MD5

        9ba2818239cb66c8470ee3e175191b6f

        SHA1

        e1fe90c2589f2d0147fb8fa61185ec94efd41297

        SHA256

        c982fb82b53c18f7eeae6874992a76ca3ca6a2e4a01e00ec8eb969b09bcadfc9

        SHA512

        500d6f2d92a1d476da4b41aac71984c8650bc26e76a660ca0ff7802058307e3e5d12a3826436fb7d8a96056086dfe21708bd961102af95abde981efc2c2b95a5

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

        Filesize

        482B

        MD5

        f22cc67bbe9fde92239072991cfc3f73

        SHA1

        ad66e73cb857186bdbf243b8f952cb5979526a30

        SHA256

        993104cbc220c1205848a09443717f510d7fc5c3b224c07e6b051095dce9786d

        SHA512

        467a1d113072850d5ef157eb46b07d714879de242df868e922dbad8609699c6830157007cea0cb3ce7ccbce676b816f60c70ddf9acece7818005f57c435473d5

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D7833C286363AD25C70511661A83D581_67EE047A9B85FFFE874C7B3793642FFD

        Filesize

        476B

        MD5

        1def9fc426c3ab22c9fe37148df41c6e

        SHA1

        a0d75c4e6e85aa41c058f6de61d4f3b09932003e

        SHA256

        7a0c44fc15a0761cd47d279f7a856b3c4bd553e61ce36124de40d367ef3d08b2

        SHA512

        37e55ac9454a3d073c31aaae32a2a67708636d44139fb2b988efea052ba18766a1b8ad7d68b1edb76dd0c7401766a8f55bc509497feaa56958459273df751481

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3HDB1LPD\avatar[1].swf

        Filesize

        897KB

        MD5

        180019e63ee8576b6f04bc715de7cb47

        SHA1

        f21c1e9cc91bff3d2f50102ca9a53427dca7bde1

        SHA256

        795dfb216c295e795a8442d2721d4873a9fd16fe416bf9542c35416bd5086d3e

        SHA512

        811f9171a1ea1f1cbd3ff9bcf6ff3462732931dd41652f0ad5c329468535232fcbe6badce5bf63e5c43c2d4c484601ca3f755cc9ee06d55cf72c1224edac286f

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LNHEOAK4\outlined_font[1].swf

        Filesize

        21KB

        MD5

        474f276419a517d03bb762ee6022cd9c

        SHA1

        2f7ca1b164bc48a29b1c2a4ddcd21c0cb5815e2e

        SHA256

        4bf6f335ba256852dd34ea29f42dc25753a8c33a6827b3aa2f09a153e4d35cef

        SHA512

        453957c41bbb595dbd336e056f63e5b33cb727851ffd730b0fce84f473303eee4c36c1d708f95714b972573017018010fa1bd66abf2d2cb2658f3eb1c65b0490

      • C:\Users\Admin\AppData\Local\Temp\E7B0.tmp

        Filesize

        16.9MB

        MD5

        a53cbcc0a445f3aaee3e7a79eb3a4759

        SHA1

        8dcdbb0f08bfad44727adb73173e6a5562f9f4a5

        SHA256

        401444bc7dfe73e88ace53e349620e2977e1532f7e46f52c7a288b1374abf938

        SHA512

        b245dda7878adcba5c917381143a1086ff11b1e977a17193b92342e96d819e652a00f0712cbc201367187894212a2a3a2604cc3ce66364b58b405a6a5a4f5836

      • C:\Users\Admin\AppData\Local\Temp\MSI7FA0.tmp

        Filesize

        364KB

        MD5

        ca95f207ec70ba34b46c785f7bcb5570

        SHA1

        25c0d45cb9f94892e2877033d06fe8909e5b9972

        SHA256

        8ac4b42fb36d10194a14c32f6f499a6ac6acb79adbec858647495ba64f6dd2bb

        SHA512

        c7003a2159f5adab0a3b4a4f3c0dd494d916062a57e84a23ccc18410fa394438d49208769027c641569b3025616e99ca1730a540846aaf1c5d91338b90008831

      • C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sxx

        Filesize

        492B

        MD5

        38a76c2be5e65825aaf3200481ad55ca

        SHA1

        b25b5bdbe291cf91833b388c060d02ab76739439

        SHA256

        4616eec3a9d6a9740b57bd25fabce7004813461279b64f1a24cb3ce5597fb421

        SHA512

        0e44ebf4853fa8d85a7a3453339af7ecfee7b039e57ee962b34b6eb62c83c459debdba2af702c5dde64dabf5ec104299de1caf36f13376bbbe538e7264834d2f

      • C:\Windows\Installer\e57c0b0.msi

        Filesize

        9.2MB

        MD5

        8fb4b0015988417a06216c492d051a9f

        SHA1

        1f8528631296965b45d9e804f1d6b31440557825

        SHA256

        0aa5b3912429387f9b5f6150f49f929b5f6e00fab539c7372108f37c7aa6c44a

        SHA512

        31a9d67b4d3e848448ae3109e0c5f810916b591879a16f2649d5837ca7bdad8a4483f1116c9a23f6bce0c7de73f4264e35141008d6d0ee562657a25f09d45a17

      • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

        Filesize

        23.7MB

        MD5

        dcd52c67a2b7f6497fbf9cc22e83aa93

        SHA1

        344bcc752df2116a9b58c3177612d581211766ba

        SHA256

        acb5529669a2d9d7177c126a564a8bd287ca92081b51c1f371f0ce100f573177

        SHA512

        abb86ff1381b156ef86bc4540e8fc282fbc5ea13142175b4342f08393e03b77f0415e23b4e84f9e00ee97466348c2d9d65ade16296d591419df6d85ca8eeea03

      • \??\Volume{f171a6e7-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{fa94f359-d744-48ee-b00e-f010c7a970df}_OnDiskSnapshotProp

        Filesize

        6KB

        MD5

        990ef1ab05f41979c7b94307033889fb

        SHA1

        a987d21a41aa5e78af9d24797f252502981205d8

        SHA256

        e051dc412b0d87b6e413a1921c7d78695096b9b5d8f6da81da5c596f7cef4297

        SHA512

        1726d52c04946074d6a06183cd98a51f0ce613bda86fc496605b87244d2911126486af81622b6c02238edc478ba033ad6376601be847f90e64eb1fa4c123279b

      • memory/4800-105-0x00000000724F0000-0x00000000736C9000-memory.dmp

        Filesize

        17.8MB

      • memory/4800-107-0x00000000724F0000-0x00000000736C9000-memory.dmp

        Filesize

        17.8MB

      • memory/4800-108-0x00000000724F0000-0x00000000736C9000-memory.dmp

        Filesize

        17.8MB

      • memory/4800-106-0x00000000724F0000-0x00000000736C9000-memory.dmp

        Filesize

        17.8MB