Analysis
-
max time kernel
109s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
12-09-2024 18:05
General
-
Target
vcredist2005_x86.exe
-
Size
2.6MB
-
MD5
ce2922f83fb4b170affce0ea448b107b
-
SHA1
b8fab0bb7f62a24ddfe77b19cd9a1451abd7b847
-
SHA256
4ee4da0fe62d5fa1b5e80c6e6d88a4a2f8b3b140c35da51053d0d7b72a381d29
-
SHA512
e94b077e054bd8992374d359f3adc4d1d78d42118d878556715d77182f7d03635850b2b2f06c012ccb7c410e2b3c124cf6508473efe150d3c51a51857ce1c6b0
-
SSDEEP
49152:rqGRIgg2SirwkF9xdtb43lyGKCafpKkiwnaDahmPzpY4FPyaza:rxxLFfY/KCCpKk9aWMzZyau
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 1 IoCs
-
Drops file in Windows directory 57 IoCs
-
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 3 IoCs
-
Modifies registry class 45 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\vcredist2005_x86.exe"C:\Users\Admin\AppData\Local\Temp\vcredist2005_x86.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec /i vcredist.msi2⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 79ECFC6A79E182BE5BC3E858AB4A111D2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
73KB
MD566547b9e220d925ed0a93e5daa93afc6
SHA1383c52df564ed205bc0f0a60693c0d428d4d5dcf
SHA256d3d82af5f648cd24309184a0a00480872605c6cc0e5fb8708f7633eabc065f52
SHA512758150990ed3867c207de20a72772dfaf0c7d3ff4602c07e5b7e368ab17070e359da65233f00ff27dcffee58e9fe5874bad4c25919855c3d494e62ae6eb6c1ca
-
Filesize
247KB
MD5cc064d4b81619991de8131a86ad77681
SHA188d80d86cc20c27d7d2a872af719300bd2bb73f9
SHA256913ee5a1cae3e5a1872b3a5efaaa00c58e4beb692492b138f76967da671b0477
SHA5125aff0eb26cfc187bf58721b2b6d73357d9f1e66d1ac5340ad9ddc08b40ad0eda27a144cb3b650604637a7476c282ded83ed890de98a73ccaf0cc021da3a9eb25
-
Filesize
2.6MB
MD5b20bbeb818222b657df49a9cfe4fed79
SHA13f6508e880b86502773a3275bc9527f046d45502
SHA25691bdd063f6c53126737791c9eccf0b2f4cf44927831527245bc89a0be06c0cb4
SHA512f534bc7bf1597e728940e6c3b77f864adfaa413bb1e080458326b692b0f96bddf4fbd294eeed36d7764a3578e6c8e919488bbf63b8fe2d4355ab3efd685424a4
-
Filesize
28KB
MD585221b3bcba8dbe4b4a46581aa49f760
SHA1746645c92594bfc739f77812d67cfd85f4b92474
SHA256f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f
SHA512060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d
-
Filesize
23.7MB
MD52435455b423156cfa7cde1a31fc4e3d6
SHA1e158c6fa391e5d11ab0e0a5866f1e5b5fa1146e9
SHA2565264895c88e8c97cf76987a1062bc0e84ae1000782f1b8de88c614ec0ee1012f
SHA5127f98883a6a495da1ce21772ab5d10a08f19381787c00f6919c8ed32c86d95018b0dc8098075182022697785ffe73d5b2086256176d1f891774a3a0c977c82f78
-
Filesize
6KB
MD53096a9b2f696abae17b246962d87b754
SHA10374e0115a3a110b47e9bff42bc5efc41a5c5c23
SHA256b7122c421ec78f847449419db34a82a45c2d8e0c28b9c8f445986aa58a50a3ce
SHA5124c38223dee10032ed72035ff855c7ce51daa4c62d778dac9054272bfcd1ccc2f7d47ba3d0cdda1d898b36c5ccc17475a1b4465a7cfe1096d84c17da98798dd13