Analysis
-
max time kernel
95s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12-09-2024 19:46
Static task
static1
Behavioral task
behavioral1
Sample
vfs.msi
Resource
win7-20240903-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
vfs.msi
Resource
win10v2004-20240802-en
windows10-2004-x64
15 signatures
150 seconds
General
-
Target
vfs.msi
-
Size
1.9MB
-
MD5
c017277279dada1b9653bc6838019952
-
SHA1
4d66580dade368ea823c2afc602ad3686c20d4d1
-
SHA256
f60c7e2cd7078584e1fb2eacd6270c314f1e23f76a4cd78c5d13eec215f0e41c
-
SHA512
cd9fea4bfa73987fb95e4e15ee6fa5c489842b79f8a497ea7dd65ec355db9df6d4af786612e6d9f43e7293723a91841465368728fb1b5361716a9297008adfa2
-
SSDEEP
49152:QGN3YhW8zBQSc0ZnSKBZKumZr7ANpTdzZfVSlaMBOno:3YY0Zn3K/ANPzbSlaBno
Malware Config
Signatures
-
Detects Latrodectus 4 IoCs
Detects Latrodectus v1.4.
Processes:
resource yara_rule behavioral2/memory/5068-44-0x000001A3C4CD0000-0x000001A3C4CE6000-memory.dmp family_latrodectus_1_4 behavioral2/memory/5068-46-0x000001A3C4CD0000-0x000001A3C4CE6000-memory.dmp family_latrodectus_1_4 behavioral2/memory/1440-50-0x000001831A6C0000-0x000001831A6D6000-memory.dmp family_latrodectus_1_4 behavioral2/memory/1440-51-0x000001831A6C0000-0x000001831A6D6000-memory.dmp family_latrodectus_1_4 -
Latrodectus loader
Latrodectus is a loader written in C++.
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc Process File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe -
Drops file in Windows directory 12 IoCs
Processes:
msiexec.exedescription ioc Process File opened for modification C:\Windows\Installer\MSI9CC2.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI9A0E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9A8C.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{72A77E3B-B705-4CCF-8F7A-0CB540D0E61A} msiexec.exe File opened for modification C:\Windows\Installer\MSI9BD6.tmp msiexec.exe File created C:\Windows\Installer\e579887.msi msiexec.exe File opened for modification C:\Windows\Installer\e579887.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI98C5.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9B0A.tmp msiexec.exe -
Executes dropped EXE 1 IoCs
Processes:
MSI9CC2.tmppid Process 4320 MSI9CC2.tmp -
Loads dropped DLL 6 IoCs
Processes:
MsiExec.exerundll32.exerundll32.exepid Process 636 MsiExec.exe 636 MsiExec.exe 636 MsiExec.exe 636 MsiExec.exe 5068 rundll32.exe 1440 rundll32.exe -
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
MSI9CC2.tmpMsiExec.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSI9CC2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
vssvc.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000c9aa8484b1ca68e90000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000c9aa84840000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900c9aa8484000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dc9aa8484000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000c9aa848400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
msiexec.exepid Process 2572 msiexec.exe 2572 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 63 IoCs
Processes:
msiexec.exemsiexec.exevssvc.exesrtasks.exedescription pid Process Token: SeShutdownPrivilege 4328 msiexec.exe Token: SeIncreaseQuotaPrivilege 4328 msiexec.exe Token: SeSecurityPrivilege 2572 msiexec.exe Token: SeCreateTokenPrivilege 4328 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4328 msiexec.exe Token: SeLockMemoryPrivilege 4328 msiexec.exe Token: SeIncreaseQuotaPrivilege 4328 msiexec.exe Token: SeMachineAccountPrivilege 4328 msiexec.exe Token: SeTcbPrivilege 4328 msiexec.exe Token: SeSecurityPrivilege 4328 msiexec.exe Token: SeTakeOwnershipPrivilege 4328 msiexec.exe Token: SeLoadDriverPrivilege 4328 msiexec.exe Token: SeSystemProfilePrivilege 4328 msiexec.exe Token: SeSystemtimePrivilege 4328 msiexec.exe Token: SeProfSingleProcessPrivilege 4328 msiexec.exe Token: SeIncBasePriorityPrivilege 4328 msiexec.exe Token: SeCreatePagefilePrivilege 4328 msiexec.exe Token: SeCreatePermanentPrivilege 4328 msiexec.exe Token: SeBackupPrivilege 4328 msiexec.exe Token: SeRestorePrivilege 4328 msiexec.exe Token: SeShutdownPrivilege 4328 msiexec.exe Token: SeDebugPrivilege 4328 msiexec.exe Token: SeAuditPrivilege 4328 msiexec.exe Token: SeSystemEnvironmentPrivilege 4328 msiexec.exe Token: SeChangeNotifyPrivilege 4328 msiexec.exe Token: SeRemoteShutdownPrivilege 4328 msiexec.exe Token: SeUndockPrivilege 4328 msiexec.exe Token: SeSyncAgentPrivilege 4328 msiexec.exe Token: SeEnableDelegationPrivilege 4328 msiexec.exe Token: SeManageVolumePrivilege 4328 msiexec.exe Token: SeImpersonatePrivilege 4328 msiexec.exe Token: SeCreateGlobalPrivilege 4328 msiexec.exe Token: SeBackupPrivilege 4028 vssvc.exe Token: SeRestorePrivilege 4028 vssvc.exe Token: SeAuditPrivilege 4028 vssvc.exe Token: SeBackupPrivilege 2572 msiexec.exe Token: SeRestorePrivilege 2572 msiexec.exe Token: SeRestorePrivilege 2572 msiexec.exe Token: SeTakeOwnershipPrivilege 2572 msiexec.exe Token: SeRestorePrivilege 2572 msiexec.exe Token: SeTakeOwnershipPrivilege 2572 msiexec.exe Token: SeRestorePrivilege 2572 msiexec.exe Token: SeTakeOwnershipPrivilege 2572 msiexec.exe Token: SeRestorePrivilege 2572 msiexec.exe Token: SeTakeOwnershipPrivilege 2572 msiexec.exe Token: SeRestorePrivilege 2572 msiexec.exe Token: SeTakeOwnershipPrivilege 2572 msiexec.exe Token: SeRestorePrivilege 2572 msiexec.exe Token: SeTakeOwnershipPrivilege 2572 msiexec.exe Token: SeRestorePrivilege 2572 msiexec.exe Token: SeTakeOwnershipPrivilege 2572 msiexec.exe Token: SeRestorePrivilege 2572 msiexec.exe Token: SeTakeOwnershipPrivilege 2572 msiexec.exe Token: SeRestorePrivilege 2572 msiexec.exe Token: SeTakeOwnershipPrivilege 2572 msiexec.exe Token: SeBackupPrivilege 1604 srtasks.exe Token: SeRestorePrivilege 1604 srtasks.exe Token: SeSecurityPrivilege 1604 srtasks.exe Token: SeTakeOwnershipPrivilege 1604 srtasks.exe Token: SeBackupPrivilege 1604 srtasks.exe Token: SeRestorePrivilege 1604 srtasks.exe Token: SeSecurityPrivilege 1604 srtasks.exe Token: SeTakeOwnershipPrivilege 1604 srtasks.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
msiexec.exepid Process 4328 msiexec.exe 4328 msiexec.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
msiexec.exerundll32.exedescription pid Process procid_target PID 2572 wrote to memory of 1604 2572 msiexec.exe 99 PID 2572 wrote to memory of 1604 2572 msiexec.exe 99 PID 2572 wrote to memory of 636 2572 msiexec.exe 101 PID 2572 wrote to memory of 636 2572 msiexec.exe 101 PID 2572 wrote to memory of 636 2572 msiexec.exe 101 PID 2572 wrote to memory of 4320 2572 msiexec.exe 102 PID 2572 wrote to memory of 4320 2572 msiexec.exe 102 PID 2572 wrote to memory of 4320 2572 msiexec.exe 102 PID 5068 wrote to memory of 1440 5068 rundll32.exe 104 PID 5068 wrote to memory of 1440 5068 rundll32.exe 104 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\vfs.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4328
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:1604
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding E41E5D14E263CE2B0C43D4EA8DA9055E2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:636
-
-
C:\Windows\Installer\MSI9CC2.tmp"C:\Windows\Installer\MSI9CC2.tmp" /DontWait C:/Windows/System32/rundll32.exe C:\Users\Admin\AppData\Roaming\true.dll, NvPluginGetInfo2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4320
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4028
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\true.dll, NvPluginGetInfo1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Windows\System32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Roaming\Custom_update\Update_6c821f5.dll", NvPluginGetInfo2⤵
- Loads dropped DLL
PID:1440
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5870ecec6366c375f81d226764a3a75df
SHA1b97c2e6ce03d2e5e18cfbe64b95cec7e360e8cdb
SHA2565205d017ff37c34ca7730e4b73eb7125055f9b981e75518f9b9484febe0c65a0
SHA5127ce5b4aa70c7608f1d04fed5f80cd30414254695e65883e3c8726526d306f4e41f72239d276441a32697d91425259da99032dadee05f5f64121f517aeb1698af
-
Filesize
1.8MB
MD56dc0d350d735fd1acc8219cfa5d02b9b
SHA17ba0708a4404715fb21a23acfbd88a25b7245ef1
SHA2562333dd858fc40899a1bff3fb39fbc0b4e65a864bfd4eb73c26b48aaddcca7061
SHA51299c9b6310363ce3a7d9ff680c4a0ae976553fc4789b12f9b60d9f629608d90cf4d64b4c8a037264f8aaa48fba69ae397236ef4c32c2eb6779fb5d9e0b3b0d52f
-
Filesize
436KB
MD5475d20c0ea477a35660e3f67ecf0a1df
SHA167340739f51e1134ae8f0ffc5ae9dd710e8e3a08
SHA256426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
SHA51299525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
-
Filesize
389KB
MD5b9545ed17695a32face8c3408a6a3553
SHA1f6c31c9cd832ae2aebcd88e7b2fa6803ae93fc83
SHA2561e0e63b446eecf6c9781c7d1cae1f46a3bb31654a70612f71f31538fb4f4729a
SHA512f6d6dc40dcba5ff091452d7cc257427dcb7ce2a21816b4fec2ee249e63246b64667f5c4095220623533243103876433ef8c12c9b612c0e95fdfffe41d1504e04
-
Filesize
23.7MB
MD58ae8888d7892a63a768c3d302f5929d6
SHA13302f6ddbfe5ae0f8544c45e45f3b57ec2152a94
SHA2566d0fe542398144e824e2b795f48f25ec68a7846bc11e46fd290ebb6ad497db18
SHA512063e9f4326bf9b5ff94c250460771504daebde2bcd93f3f3018af90f2efd99d9a7c1d387063e0dad0e014bf75c71bd2ca88b345084bd5b3122e8b9f57dc34c70
-
\??\Volume{8484aac9-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{7d3b1d92-1afc-40f2-bdc1-c66ac44cd246}_OnDiskSnapshotProp
Filesize6KB
MD5775842b9b9adea28d487cd95bdb2bc91
SHA1674a64845f6bf737698fad75f4900f6737eaade0
SHA2561c463bd11fea7c92cf49b2fc7fa0c9058261fb907ec030428a30326ca72e3f59
SHA5128ce149af4799e064639ab044dfcf9ce26d62a81f1c2f9fc369814c9150d69942ddd27f26edeb02ec5b9aea83eda22ba6ad89fb060addd4ec28fd2b4bd5f5eafb