fatalrat | fee4bc48a833facbde77aeb03320697fe7a1e54d633f6d9f157cf994b2a405f1

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10-09-2024 20:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d348b2fd315d69bb969cd00d30f1f11eeb45656e4e429e6555eebdd5a566e5b2.msi
Size

45.4MB
MD5

b548cd27d7cc4d966305c2fc5c0ee5e1
SHA1

2f116d9e09a8796c040abe8ca5f6637e1110ea8c
SHA256

d348b2fd315d69bb969cd00d30f1f11eeb45656e4e429e6555eebdd5a566e5b2
SHA512

8f5ec981769a44575f215fe53b58b4c6522efa98bfd7eb409ca166cd1dca766fc5f6f8af04ec9d3ace3ad1b54b3ad62612e8a599840161ff685c001aab32c086
SSDEEP

786432:1ELiyuxCaAPkt69LZSq5EfJ9WEH9aSeLHDKsn3MoNh2Z51JbY+R4+pjRxt7iQetk:1EiEaAW6FZSqSWs9aSeLHDWk2Z5O+fxX

Score

10^/10

fatalrat discovery infostealer persistence privilege_escalation rat

Malware Config

Signatures

FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
infostealer rat fatalrat

Fatal Rat payload 2 IoCs

rat infostealer

Processes:

resource	yara_rule
behavioral2/memory/4164-266-0x0000000002A90000-0x0000000002ABA000-memory.dmp	fatalrat
behavioral2/memory/4344-298-0x0000000003230000-0x000000000325A000-memory.dmp	fatalrat

Blocklisted process makes network request 5 IoCs

Processes:

msiexec.exeMsiExec.exe

flow	pid	Process
3	4688	msiexec.exe
6	4688	msiexec.exe
11	4688	msiexec.exe
13	4688	msiexec.exe
35	4972	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	Process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

thelper.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	thelper.exe

Drops file in Windows directory 23 IoCs

Processes:

msiexec.exe

description	ioc	Process
File created	C:\Windows\Installer\e579f1e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA0C4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA1EE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA5DB.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{3AEAE5B8-91CC-4989-AD2C-33C505411950}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA93C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA337.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA443.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA765.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA8CD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA8CE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA9AB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e579f1e.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA3F4.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAAD6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA5CA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA6A7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA6D7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAAC5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAAD7.tmp	msiexec.exe

Executes dropped EXE 5 IoCs

Processes:

MSIAAC5.tmpMSIAAD6.tmpthelper.exethelper.exeSogou.exe

pid	Process
4524	MSIAAC5.tmp
3840	MSIAAD6.tmp
4164	thelper.exe
4344	thelper.exe
1448	Sogou.exe

Loads dropped DLL 48 IoCs

Processes:

MsiExec.exeMsiExec.exethelper.exethelper.exeSogou.exe

pid	Process
4972	MsiExec.exe
4972	MsiExec.exe
4972	MsiExec.exe
4972	MsiExec.exe
4972	MsiExec.exe
4972	MsiExec.exe
4972	MsiExec.exe
4972	MsiExec.exe
4972	MsiExec.exe
4972	MsiExec.exe
4972	MsiExec.exe
4800	MsiExec.exe
4800	MsiExec.exe
4972	MsiExec.exe
4164	thelper.exe
4164	thelper.exe
4164	thelper.exe
4164	thelper.exe
4164	thelper.exe
4164	thelper.exe
4164	thelper.exe
4164	thelper.exe
4164	thelper.exe
4164	thelper.exe
4164	thelper.exe
4164	thelper.exe
4164	thelper.exe
4164	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
1448	Sogou.exe
1448	Sogou.exe
1448	Sogou.exe
1448	Sogou.exe
1448	Sogou.exe
1448	Sogou.exe
1448	Sogou.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

Processes:

msiexec.exe

pid	Process
4688	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

MsiExec.exeMSIAAC5.tmpMSIAAD6.tmpthelper.exethelper.exeSogou.exeMsiExec.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIAAC5.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIAAD6.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	thelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	thelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sogou.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssvc.exe

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e7a671f193ce7b7c0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e7a671f10000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900e7a671f1000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de7a671f1000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000e7a671f100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

thelper.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	thelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	thelper.exe

Modifies data under HKEY_USERS 3 IoCs

Processes:

msiexec.exe

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

MsiExec.exemsiexec.exeSogou.exethelper.exe

pid	Process
4972	MsiExec.exe
4972	MsiExec.exe
3168	msiexec.exe
3168	msiexec.exe
1448	Sogou.exe
1448	Sogou.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe
4344	thelper.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exesrtasks.exe

description	pid	Process
Token: SeShutdownPrivilege	4688	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4688	msiexec.exe
Token: SeSecurityPrivilege	3168	msiexec.exe
Token: SeCreateTokenPrivilege	4688	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4688	msiexec.exe
Token: SeLockMemoryPrivilege	4688	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4688	msiexec.exe
Token: SeMachineAccountPrivilege	4688	msiexec.exe
Token: SeTcbPrivilege	4688	msiexec.exe
Token: SeSecurityPrivilege	4688	msiexec.exe
Token: SeTakeOwnershipPrivilege	4688	msiexec.exe
Token: SeLoadDriverPrivilege	4688	msiexec.exe
Token: SeSystemProfilePrivilege	4688	msiexec.exe
Token: SeSystemtimePrivilege	4688	msiexec.exe
Token: SeProfSingleProcessPrivilege	4688	msiexec.exe
Token: SeIncBasePriorityPrivilege	4688	msiexec.exe
Token: SeCreatePagefilePrivilege	4688	msiexec.exe
Token: SeCreatePermanentPrivilege	4688	msiexec.exe
Token: SeBackupPrivilege	4688	msiexec.exe
Token: SeRestorePrivilege	4688	msiexec.exe
Token: SeShutdownPrivilege	4688	msiexec.exe
Token: SeDebugPrivilege	4688	msiexec.exe
Token: SeAuditPrivilege	4688	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4688	msiexec.exe
Token: SeChangeNotifyPrivilege	4688	msiexec.exe
Token: SeRemoteShutdownPrivilege	4688	msiexec.exe
Token: SeUndockPrivilege	4688	msiexec.exe
Token: SeSyncAgentPrivilege	4688	msiexec.exe
Token: SeEnableDelegationPrivilege	4688	msiexec.exe
Token: SeManageVolumePrivilege	4688	msiexec.exe
Token: SeImpersonatePrivilege	4688	msiexec.exe
Token: SeCreateGlobalPrivilege	4688	msiexec.exe
Token: SeBackupPrivilege	116	vssvc.exe
Token: SeRestorePrivilege	116	vssvc.exe
Token: SeAuditPrivilege	116	vssvc.exe
Token: SeBackupPrivilege	3168	msiexec.exe
Token: SeRestorePrivilege	3168	msiexec.exe
Token: SeRestorePrivilege	3168	msiexec.exe
Token: SeTakeOwnershipPrivilege	3168	msiexec.exe
Token: SeRestorePrivilege	3168	msiexec.exe
Token: SeTakeOwnershipPrivilege	3168	msiexec.exe
Token: SeBackupPrivilege	3872	srtasks.exe
Token: SeRestorePrivilege	3872	srtasks.exe
Token: SeSecurityPrivilege	3872	srtasks.exe
Token: SeTakeOwnershipPrivilege	3872	srtasks.exe
Token: SeRestorePrivilege	3168	msiexec.exe
Token: SeTakeOwnershipPrivilege	3168	msiexec.exe
Token: SeRestorePrivilege	3168	msiexec.exe
Token: SeTakeOwnershipPrivilege	3168	msiexec.exe
Token: SeRestorePrivilege	3168	msiexec.exe
Token: SeTakeOwnershipPrivilege	3168	msiexec.exe
Token: SeRestorePrivilege	3168	msiexec.exe
Token: SeTakeOwnershipPrivilege	3168	msiexec.exe
Token: SeBackupPrivilege	3872	srtasks.exe
Token: SeRestorePrivilege	3872	srtasks.exe
Token: SeSecurityPrivilege	3872	srtasks.exe
Token: SeTakeOwnershipPrivilege	3872	srtasks.exe
Token: SeRestorePrivilege	3168	msiexec.exe
Token: SeTakeOwnershipPrivilege	3168	msiexec.exe
Token: SeRestorePrivilege	3168	msiexec.exe
Token: SeTakeOwnershipPrivilege	3168	msiexec.exe
Token: SeRestorePrivilege	3168	msiexec.exe
Token: SeTakeOwnershipPrivilege	3168	msiexec.exe
Token: SeRestorePrivilege	3168	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid	Process
4688	msiexec.exe
4688	msiexec.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Sogou.exe

pid	Process
1448	Sogou.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

msiexec.exethelper.exe

description	pid	Process	procid_target
PID 3168 wrote to memory of 3872	3168	msiexec.exe	98
PID 3168 wrote to memory of 3872	3168	msiexec.exe	98
PID 3168 wrote to memory of 4972	3168	msiexec.exe	101
PID 3168 wrote to memory of 4972	3168	msiexec.exe	101
PID 3168 wrote to memory of 4972	3168	msiexec.exe	101
PID 3168 wrote to memory of 4800	3168	msiexec.exe	102
PID 3168 wrote to memory of 4800	3168	msiexec.exe	102
PID 3168 wrote to memory of 4800	3168	msiexec.exe	102
PID 3168 wrote to memory of 4524	3168	msiexec.exe	103
PID 3168 wrote to memory of 4524	3168	msiexec.exe	103
PID 3168 wrote to memory of 4524	3168	msiexec.exe	103
PID 3168 wrote to memory of 3840	3168	msiexec.exe	104
PID 3168 wrote to memory of 3840	3168	msiexec.exe	104
PID 3168 wrote to memory of 3840	3168	msiexec.exe	104
PID 4164 wrote to memory of 4344	4164	thelper.exe	107
PID 4164 wrote to memory of 4344	4164	thelper.exe	107
PID 4164 wrote to memory of 4344	4164	thelper.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\d348b2fd315d69bb969cd00d30f1f11eeb45656e4e429e6555eebdd5a566e5b2.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4688

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3168
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3872
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 41E45AD8F019ECFABE3BA781A2612E98
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4972
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7AD835B83647AA8BB169BD40BBFC0FA7 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4800
- C:\Windows\Installer\MSIAAC5.tmp
  "C:\Windows\Installer\MSIAAC5.tmp" /DontWait "C:\Users\Admin\AppData\Roaming\Sogou.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4524
- C:\Windows\Installer\MSIAAD6.tmp
  "C:\Windows\Installer\MSIAAD6.tmp" /DontWait "C:\ProgramData\Microsoft\MF\thelper.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3840

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:116

C:\ProgramData\Microsoft\MF\thelper.exe
"C:\ProgramData\Microsoft\MF\thelper.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4164
- C:\Users\Admin\AppData\Local\thelper.exe
  "C:\Users\Admin\AppData\Local\thelper.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:4344

C:\Users\Admin\AppData\Roaming\Sogou.exe
"C:\Users\Admin\AppData\Roaming\Sogou.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e579f21.rbs

Filesize
377KB

MD5
0855277acc51ebf01a71f271cc77249b

SHA1
3458d09ac1ac1f4461fe04ee5b25d842a101357e

SHA256
eeebe1682c44d6432813460617d47b413fa8f24411297709b891f64485938aa5

SHA512
931bd0895684614c10bf804f879a5d886ac49768116298b6889a151a2dbae005849b6ab3c45d9decef73fbe5f998917ba22fe8a086de4da2ab9852d78bb53a10

Download Submit
C:\ProgramData\Microsoft\MF\Mi.jpg

Filesize
199KB

MD5
6623c712226ec7da02b7a6d2e636f93b

SHA1
ca7cc067795d66d9592f40e7b7f7be2fb8d2381a

SHA256
27550491d63f83141fa86cd048434c4c3990dc215a1d77d2ae6395cea3b0d996

SHA512
b5503e7af6d094a4c5741d621e1ea99eef8bf2a6d77cc994975c2629ebab2b0317a1ad51ce7ddcd44dafaa7461f032ae5d45d79e4537504846989e1b9bb0170b

Download Submit
C:\ProgramData\Microsoft\MF\XLFSIO.dll

Filesize
900KB

MD5
a06090c5f2d3df2cedc51cc99e19e821

SHA1
701ac97c2fd140464b234f666a0453d058c9fabf

SHA256
64ffdffb82fc649e6847b3c4f8678d9cca0d5117fa54c9abbb746625d3feef89

SHA512
541804db74a25fc5f50801f23b4d9f2be788d3c95d3d23dd8098f4c8888d1fc808e6eb6959c458965c639ea28b594a87dff7f3a89c4750c109b29b573c4535cf

Download Submit
C:\ProgramData\Microsoft\MF\XLFSIO2.dll

Filesize
209KB

MD5
1bc7af7a8512cf79d4f0efc5cb138ce3

SHA1
68fd202d9380cacd2f8e0ce06d8df1c03c791c5b

SHA256
ef474b18f89310c067a859d55abd4e4f42fdac732e49eafe4246545e36872a62

SHA512
84de4d193d22a305be2ba28fc67bd1cccf83616cead721e57347f1b2e0736d351fef1abf168f7914caa1bcc7a72db43769991016673cd4646def544802ee8960

Download Submit
C:\ProgramData\Microsoft\MF\XLGraphic.dll

Filesize
730KB

MD5
74c75ae5b97ad708dbe6f69d3a602430

SHA1
a02764d99b44ce4b1d199ef0f8ce73431d094a6a

SHA256
89fbb6b1ca9168a452e803dbdc6343db7c661ad70860a245d76b3b08830156e2

SHA512
52c5f7e00dffb1c0719d18184da2cc8ec2ad178b222775f167b87320f0683a3c2846e30190bc506f12d14c07fa45896935b3d4ac396baa14d7564996e35c2ada

Download Submit
C:\ProgramData\Microsoft\MF\XLLuaRuntime.dll

Filesize
249KB

MD5
5362cb2efe55c6d6e9b51849ec0706b2

SHA1
d91acbe95dedc3bcac7ec0051c04ddddd5652778

SHA256
1d7519acca9c8a013c31af2064fbc599a0b14cfd1dfb793a345fab14045fed40

SHA512
dbd591c3d0b9847d9cef59277c03ec89e246db0e54b58fbbe9d492b75cdcb32d75444012cdfb1c77376d15db7fde1f74e694d2487c481ce29a2133342b91e1f5

Download Submit
C:\ProgramData\Microsoft\MF\XLUE.dll

Filesize
2.4MB

MD5
0abbe96e1f7a254e23a80f06a1018c69

SHA1
0b83322fd5e18c9da8c013a0ed952cffa34381ae

SHA256
10f099f68741c179d5ad60b226d15233bb02d73f84ce51a5bbbbc4eb6a08e9d4

SHA512
2924e1e11e11bd655f27eb0243f87002a50a2d4b80e0b0e3ad6fd4c3d75c44222fab426fcaa695881b0093babf544e8aeee50a065ea92274145b0f88b1db0c58

Download Submit
C:\ProgramData\Microsoft\MF\ic.dll

Filesize
1.6MB

MD5
bb1197bea58b158554fa3fa25866d1ea

SHA1
cae7f395ed42fa2dd3362f4c816fb678072feb49

SHA256
20a04729fdd8e02e2fb5be79af130c364d0f3ce85e49478a6819a0a2020ae844

SHA512
f80b7669da861400a5b5add8148b85cc62994819e3a3a2220475d7ec2fc31f70bc3c683d5a5d6043b319b428a0ac47b9b41201aee7aba5d5cc927a8556dd7b73

Download Submit
C:\ProgramData\Microsoft\MF\libexpat.dll

Filesize
668KB

MD5
5ff790879aab8078884eaac71affeb4a

SHA1
59352663fdcf24bb01c1f219410e49c15b51d5c5

SHA256
cceca70f34bbcec861a02c3700de79ea17d80c0a7b9f33d7edd1357a714e0f2f

SHA512
34fbaffc48912e3d3fa2d224e001121e8b36f5be7284a33eb31d306b9a5c00de6e23a9fdc1a17a61fb1371768f0b0e30b9c6e899a08c735fc70482d5aa8ea824

Download Submit
C:\ProgramData\Microsoft\MF\libpng13.dll

Filesize
157KB

MD5
bb1922dfbdd99e0b89bec66c30c31b73

SHA1
f7a561619c101ba9b335c0b3d318f965b8fc1dfb

SHA256
76457f38cbbdd3dce078a40d42d9ac0dc26ae1c4bb68ab9c880eb7ffb400fd99

SHA512
3054574dd645feb1468cee53db2fd456e4f923eaf5fd686557a01c72c0572b19d70f3885d47fe42e97cdf7ccc2c674a6e966ff19668907cf7828e0a943cf474a

Download Submit
C:\ProgramData\Microsoft\MF\mt.dll

Filesize
1.5MB

MD5
9ded3fdffb0ff7f62e6a0a7f996c0caf

SHA1
fcc959b28a32923ccdb1ca4e304c74a31dede929

SHA256
87aab1db611adb132f503c08c32dc4efc23c9216d97e918f7279f86920701c93

SHA512
a7e7cb96a78827b01e71c595ca0d106eaf7afe35d4a548e5beccf0b009cc02d33274822958dca4998a427d8b4027eaefe99b40b3648e24730c81df34eab32ba0

Download Submit
C:\ProgramData\Microsoft\MF\thelper.exe

Filesize
226KB

MD5
17749f66292f190ef93652eb512c5ab7

SHA1
e2f651aa9d37404063ffc79e920787c9d3e71fdb

SHA256
0aa17ee66b8dae520e82a94388b1a1d603ec2aed20c464d6cac9a521d4167f24

SHA512
2ef192a191dc40a16c9b8768e749175c1a57319ab896809691effcc5de61c4a38fd8a8388b8907a1985e505907a8529f4d10990e362831092c75dafb8900b13e

Download Submit
C:\ProgramData\Microsoft\MF\zlib1.dll

Filesize
62KB

MD5
37163aacc5534fbab012fb505be8d647

SHA1
73de6343e52180a24c74f4629e38a62ed8ad5f81

SHA256
0a6357a8852daaafe7aed300e2f7e69d993cac4156e882baa8a3a56b583255ba

SHA512
c3bed1c9bc58652ed16b162ed16a93cf7479a0492db7e6ea577001dbe859affc0b20387d93d23e06e73f49f395e4c9a5a07680f000ebb82d32269742c16a5242

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\30069012ED3CF5DB92F9F4FC78D55E2D_16AA5B9B040CB195ADDB70661F18F3C5

Filesize
1KB

MD5
1c8943253f9700110fb9fd36975ad420

SHA1
d8d39918d303f2f19f3249f8be457cc9b9300ecd

SHA256
5728fbbf8faa2a1362c4461b72efd975e92b820955880bb8d8707462f9438732

SHA512
1e3ee16b06ee165e36a192bbb40ee7ceffca54365181f394b7b4881dc8d4760123d99f43715eafc50565c1b71c9df4de6b5342bcfd2031ea2fa9c7da8dcfd1f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B03113490075047F519A3F760F0FF379_F891537EEBBDBB955ED6C40DCF761C31

Filesize
2KB

MD5
0c5431032953056dac378788db5b58d2

SHA1
677652449486655937d08cc7c3d967762d225524

SHA256
14da6ed88c8222683c2b90eaba5d4cc7b60ae86d5fc4ff3713164113a6867fb3

SHA512
dabc36a1f1845c35d170148ea417eb159db4664282bbe18214fea78714cf0bbdd133dbdeec74ad7b9061f582fa40c099077f8dd582e50b0187bcc7b3b8b01f41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\30069012ED3CF5DB92F9F4FC78D55E2D_16AA5B9B040CB195ADDB70661F18F3C5

Filesize
412B

MD5
edd6d470a1f0a886b8a5d0289b20155e

SHA1
569c55808a4efed85a4dfdad9074d1ee4ec14ac2

SHA256
2471fb58281925b7b52fb4b2bbbcd897da4798d76981b4d07148d51bd152dd54

SHA512
ab4a1981561f0e0e79117c3f6ffb6bb93022f2ab40d85c97c8d165d7b996790e1c21331dd55e137c160ec3ed6665c5d0a3d641a844fed00b9716e0aa2dce947e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B03113490075047F519A3F760F0FF379_F891537EEBBDBB955ED6C40DCF761C31

Filesize
428B

MD5
1a24d350c6f283e620fb172bdc1eec88

SHA1
fec994475650feffd1da648e91fd1ab97de375e4

SHA256
5a6b8a7d7158a52e7d22e4ac7a16dd0be3119f4b2c6588d2b2aa5a83933618dc

SHA512
0a342f884726f0faaf17e9e730f857ebc339a72357c9afe29a3fb3bdb9f769b66967811aab53478574cd6d916a45d2b3082838bbff549e632eef8fe058cef0b8

Download Submit
C:\Users\Admin\AppData\Local\AdvinstAnalytics\6696c89e2ff508bfba81eedd\74.24.63\tracking.ini

Filesize
84B

MD5
94fbf9b34d1c13ae08bef0f741946109

SHA1
464fbf4559f6e51bc9f30614b460ae31113975e8

SHA256
1adbc75ce833185b8d477bd625ac8747f5883608c8d40b3f110f66665e12c9a8

SHA512
639c0c130429bee2a763dfb40f78d3e35790184e13bd8d2bc0cb97836aeaab7ea9a589c26c8047e521dc390b79addea3e2e38f10d805f20a481c045ac6939cc1

Download Submit
C:\Users\Admin\AppData\Local\AdvinstAnalytics\6696c89e2ff508bfba81eedd\74.24.63\{2414DB56-64EB-4369-A228-1CE91174C6FC}.session

Filesize
4KB

MD5
3f5c477b3276a06dec648ff93c335c7c

SHA1
9d0d16befcaa19bd26762170193668ff10644671

SHA256
88da05e8ed0271118dbd8ee9c9b7e2b2336e63e9c9ac8bccced603e9abcdf131

SHA512
66e9d38c4b70db7afb3510991e9e54f59337ca530243cfcb304de91b66fb8e86f7e36af4021cd5133dca6e340189201d54172c6dd0c4d73f8e112145fda16ec9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nscB344.tmp\HWSignature.dll

Filesize
82KB

MD5
0c4dd80545d113d33edcd16cfe92c44a

SHA1
7dabdd84e24f0b8947f9e83339d21ca0cfa8dbe9

SHA256
1fd6c12b48a08dd19af04f763f27786e55a58747968bea17ae51198f49c02478

SHA512
20dd4ad7682264f35416413edaef953a8a5cbd4a0920ec790bbda06147cdd2faa0ab1702e93ee12cf4fe5fb525576a13e5307c3882fbc71de92e9a5fba2952fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nscB344.tmp\InstallOptions.dll

Filesize
15KB

MD5
67d8f4d5acdb722e9cb7a99570b3ded1

SHA1
f4a729ba77332325ea4dbdeea98b579f501fd26f

SHA256
fa8de036b1d9bb06be383a82041966c73473fc8382d041fb5c1758f991afeae7

SHA512
03999cc26a76b0de6f7e4e8a45137ee4d9c250366ac5a458110f00f7962158311eea5f22d3ee4f32f85aa6969eb143bdb8f03ca989568764ed2bc488c89b4b7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nscB344.tmp\SetupLib.dll

Filesize
2.5MB

MD5
96e5de7481ab4c69be46bc2055b8c0b3

SHA1
26854a0b1a0e4c08d0fda1fbb2b430c7a5aa1183

SHA256
c9cb61c290140cf63e8fcfcecb4bc6edd43d9d9b5ff0df93f8f71b26c5cd21dc

SHA512
e419b2d4f751b8dbb8c4e9ffcb3bf6ec0bbf69e488e144ea7188d8b1d3574567c559346d941068fa341286342c8ce75f57d074db6cd959d0fdb1d96eb9b4719e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nscB344.tmp\System.dll

Filesize
11KB

MD5
959ea64598b9a3e494c00e8fa793be7e

SHA1
40f284a3b92c2f04b1038def79579d4b3d066ee0

SHA256
03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b

SHA512
5e765e090f712beffce40c5264674f430b08719940d66e3a4d4a516fd4ade859f7853f614d9d6bbb602780de54e11110d66dbb0f9ca20ef6096ede531f9f6d64

Download Submit
C:\Users\Admin\AppData\Local\Temp\nscB344.tmp\ioSpecial.ini

Filesize
954B

MD5
06ffdceaeb2545e469dbf4c6059d5029

SHA1
d482f5e320043e9fc21d794d16621cde8cb14dfb

SHA256
bcd76040e54e0d056dc65588d9a5149fb8068253204d58c4d730b5ce3e05f396

SHA512
f4085af76e0b0ded618c715851c7a888e725e76e8a4cdef932b04e000c93fc57b950bde90e134bc2d5c5002ef087176d97872cff422126e7ccb1925e5081f44e

Download Submit
C:\Windows\Installer\MSIA0C4.tmp

Filesize
770KB

MD5
356fc2c181cc37e3f8ae4d6b855ebfcb

SHA1
2ead1e69f14099ae33a3216a9312c88007b73cd1

SHA256
c92b2d9623f19f8acfeac5fd894346515631ebb590e68f22c40a35fbacbef03c

SHA512
74ea73d3206ba1c6f1963caa4866589fe86636f68815c74733644ad6c4913de3f1399770f6095a48c9d94a7d934072d8d8b409a393de644265f6e456455dcebd

Download Submit
C:\Windows\Installer\MSIA1EE.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSIA443.tmp

Filesize
897KB

MD5
6189cdcb92ab9ddbffd95facd0b631fa

SHA1
b74c72cefcb5808e2c9ae4ba976fa916ba57190d

SHA256
519f7ac72beba9d5d7dcf71fcac15546f5cfd3bcfc37a5129e63b4e0be91a783

SHA512
ee9ce27628e7a07849cd9717609688ca4229d47579b69e3d3b5b2e7c2433369de9557ef6a13fa59964f57fb213cd8ca205b35f5791ea126bde5a4e00f6a11caf

Download Submit
C:\Windows\Installer\MSIA8CE.tmp

Filesize
187KB

MD5
f11e8ec00dfd2d1344d8a222e65fea09

SHA1
235ed90cc729c50eb6b8a36ebcd2cf044a2d8b20

SHA256
775037d6d7de214796f2f5850440257ae7f04952b73538da2b55db45f3b26e93

SHA512
6163dd8fd18b4520d7fda0986a80f2e424fe55f5d65d67f5a3519a366e53049f902a08164ea5669476100b71bb2f0c085327b7c362174cb7a051d268f10872d3

Download Submit
C:\Windows\Installer\MSIAAD6.tmp

Filesize
389KB

MD5
b9545ed17695a32face8c3408a6a3553

SHA1
f6c31c9cd832ae2aebcd88e7b2fa6803ae93fc83

SHA256
1e0e63b446eecf6c9781c7d1cae1f46a3bb31654a70612f71f31538fb4f4729a

SHA512
f6d6dc40dcba5ff091452d7cc257427dcb7ce2a21816b4fec2ee249e63246b64667f5c4095220623533243103876433ef8c12c9b612c0e95fdfffe41d1504e04

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.7MB

MD5
6c1d37bc3da85bdaf76ba3d72848a737

SHA1
f7bfbc96ca90dac3c10aa2e61e1d196aae8d5a45

SHA256
80ba25957a73468d83976dc4025c56bbb25918e1479ca79a9798ef288a79f985

SHA512
887f8180d27d2e9281e64dd5f70abc1712bc0f8f5ac945373106f7154cd375d3e55c6d4f67a2f3932e7dc93b41c61ff24d7c3ef188068a58ce3c7da8166eadcf

Download Submit
\??\Volume{f171a6e7-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{2e5bd3d8-429c-4d3a-823d-7e4e92f3dd61}_OnDiskSnapshotProp

Filesize
6KB

MD5
50dd17fe59e267744df02d9c9d52e97e

SHA1
5da354f4a7de8440a976e2b086c2ec3cf103902d

SHA256
f71f10e99677f6ef76cd13a0eef35222d4223fccfb45f5103e7fe15626233856

SHA512
11b5e25e53a181d50ef2e8f461c14dc7426309bf9b9d0ae03fc7ae9a0ab1ff71d617ed4e1498c13ee4419575b61b57101a358da896ce71372aa39a334639d416

Download Submit
memory/1448-425-0x00000000750B0000-0x000000007514F000-memory.dmp

Filesize
636KB

Download
memory/1448-320-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1448-328-0x0000000003560000-0x0000000003579000-memory.dmp

Filesize
100KB

Download
memory/1448-426-0x0000000072CA0000-0x00000000730F0000-memory.dmp

Filesize
4.3MB

Download
memory/4164-282-0x0000000071BD0000-0x0000000071DE7000-memory.dmp

Filesize
2.1MB

Download
memory/4164-259-0x0000000071BD0000-0x0000000071DE7000-memory.dmp

Filesize
2.1MB

Download
memory/4164-262-0x0000000002A50000-0x0000000002A81000-memory.dmp

Filesize
196KB

Download
memory/4164-253-0x0000000000FD0000-0x0000000001005000-memory.dmp

Filesize
212KB

Download
memory/4164-250-0x0000000021C90000-0x0000000021D7F000-memory.dmp

Filesize
956KB

Download
memory/4164-246-0x0000000000F90000-0x0000000000FCF000-memory.dmp

Filesize
252KB

Download
memory/4164-281-0x0000000021C90000-0x0000000021D7F000-memory.dmp

Filesize
956KB

Download
memory/4164-283-0x0000000071990000-0x0000000071BC4000-memory.dmp

Filesize
2.2MB

Download
memory/4164-241-0x0000000000D10000-0x0000000000F86000-memory.dmp

Filesize
2.5MB

Download
memory/4164-260-0x0000000071990000-0x0000000071BC4000-memory.dmp

Filesize
2.2MB

Download
memory/4164-266-0x0000000002A90000-0x0000000002ABA000-memory.dmp

Filesize
168KB

Download
memory/4344-289-0x0000000001760000-0x0000000001795000-memory.dmp

Filesize
212KB

Download
memory/4344-292-0x0000000071BD0000-0x0000000071DE7000-memory.dmp

Filesize
2.1MB

Download
memory/4344-293-0x0000000071990000-0x0000000071BC4000-memory.dmp

Filesize
2.2MB

Download
memory/4344-298-0x0000000003230000-0x000000000325A000-memory.dmp

Filesize
168KB

Download
memory/4344-294-0x00000000031F0000-0x0000000003221000-memory.dmp

Filesize
196KB

Download
memory/4344-291-0x0000000021C90000-0x0000000021D7F000-memory.dmp

Filesize
956KB

Download
memory/4344-422-0x0000000021C90000-0x0000000021D7F000-memory.dmp

Filesize
956KB

Download
memory/4344-424-0x0000000071990000-0x0000000071BC4000-memory.dmp

Filesize
2.2MB

Download
memory/4344-423-0x0000000071BD0000-0x0000000071DE7000-memory.dmp

Filesize
2.1MB

Download
memory/4344-287-0x0000000001300000-0x000000000133F000-memory.dmp

Filesize
252KB

Download
memory/4344-285-0x0000000001640000-0x0000000001748000-memory.dmp

Filesize
1.0MB

Download