8e599267e624e8865dc1377d533cbbed11a53d18cb3de3946e62e5887b06b641

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-09-2024 04:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

wpsupdate.msi
Size

26.2MB
MD5

6172dbd24d1ccc413437ee5d9f38a750
SHA1

4c24165e5d375ecaf5b5c49d831e48f70833bcfa
SHA256

8e599267e624e8865dc1377d533cbbed11a53d18cb3de3946e62e5887b06b641
SHA512

362432449d23d40fa0d2ccf27e608e063b083d23da9fa1c3ad10cf3772763421859fa91bf2c3bbd257f1a8e8ef723930dd758d009ff0cfbaf4be96316dd0fc0d
SSDEEP

786432:HURQ1YYrOtsAdzpQof4c01tYhGYrmeGY3TT5:H2sRzeI8iCT5

Score

6^/10

bootkit discovery persistence privilege_escalation

Malware Config

Signatures

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	wpsupdate.exe

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\GuidePortalRapid\tTKiMHhNtqSk.exe	FFGLWmUerQTM.exe
File created	C:\Program Files\GuidePortalRapid\Aspose.Pdf.dll	msiexec.exe
File created	C:\Program Files\GuidePortalRapid\wpsupdate.exe	msiexec.exe
File created	C:\Program Files\GuidePortalRapid\tTKiMHhNtqSk.xml	FFGLWmUerQTM.exe
File opened for modification	C:\Program Files\GuidePortalRapid\tTKiMHhNtqSk.xml	FFGLWmUerQTM.exe
File opened for modification	C:\Program Files\GuidePortalRapid\TpuaDVwAtO28.exe	FFGLWmUerQTM.exe
File created	C:\Program Files\GuidePortalRapid\FFGLWmUerQTM.exe	msiexec.exe
File created	C:\Program Files\GuidePortalRapid\wLzlKRWUCYQcfFYfQuoA	msiexec.exe
File created	C:\Program Files\GuidePortalRapid\TpuaDVwAtO28.exe	FFGLWmUerQTM.exe
File created	C:\Program Files\GuidePortalRapid\tTKiMHhNtqSk.exe	FFGLWmUerQTM.exe
File opened for modification	C:\Program Files\GuidePortalRapid	TpuaDVwAtO28.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\f76ec62.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\f76ec65.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f76ec62.msi	msiexec.exe
File created	C:\Windows\Installer\f76ec63.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIED0D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f76ec63.ipi	msiexec.exe

Executes dropped EXE 3 IoCs

pid	Process
1144	FFGLWmUerQTM.exe
1600	TpuaDVwAtO28.exe
2928	wpsupdate.exe

Loads dropped DLL 9 IoCs

pid	Process
752	MsiExec.exe
752	MsiExec.exe
752	MsiExec.exe
752	MsiExec.exe
752	MsiExec.exe
1600	TpuaDVwAtO28.exe
1600	TpuaDVwAtO28.exe
1600	TpuaDVwAtO28.exe
1600	TpuaDVwAtO28.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2520	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TpuaDVwAtO28.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wpsupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FFGLWmUerQTM.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	TpuaDVwAtO28.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Kingsoft\Office\6.0\Common\InfoHD3t = "20"	wpsupdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Kingsoft\Office\6.0\Common\khdinfo\InfoCurHardInfo = "29a56b8a14940c3acb7a4a6443907c56\|b7980de447cdf66d60354e00d4d562d2"	wpsupdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\system32\p2pcollab.dll,-8042 = "Peer to Peer Trust"	TpuaDVwAtO28.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Kingsoft\Office\6.0\Common\InfoHDt = "20"	wpsupdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	TpuaDVwAtO28.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Kingsoft\Office\6.0	wpsupdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Kingsoft\Office\6.0\Common\khdinfo\InfoLastHardInfo	wpsupdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Kingsoft\Office\6.0\Common\InfoHD3_C = "9da3ed1c30b5dba729ced35b61df1232"	wpsupdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	wpsupdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Kingsoft\Office\6.0\Common	wpsupdate.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Kingsoft\Office	wpsupdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Kingsoft\Office\6.0\Common\InfoHD = "9da3ed1c30b5dba729ced35b61df1232"	wpsupdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Kingsoft\Office\6.0\Common	wpsupdate.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Kingsoft\Office\6.0\Common\InfoHD3Verify_C = 32003000320034002d0039002d00320030007c00570044004300200032002e0035002b00320033003200310033003800380030003400310036003500200020002000200020002000200020007c00440036002d00380036002d00310039002d00360041002d00430032002d00430030000000	wpsupdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	wpsupdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Kingsoft\Office\6.0\Common\khdinfo\InfoHDModifiedType = "hdidRecalByOldHdidFromRegIsEmpty\|2024-9-20"	wpsupdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	wpsupdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e\52C64B7E	TpuaDVwAtO28.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Kingsoft\Office\6.0\Common\khdinfo	wpsupdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe

Modifies registry class 22 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63CB1F3280B6DD043AA27EAB137F73D9\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63CB1F3280B6DD043AA27EAB137F73D9\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63CB1F3280B6DD043AA27EAB137F73D9\SourceList\PackageName = "wpsupdate.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63CB1F3280B6DD043AA27EAB137F73D9\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63CB1F3280B6DD043AA27EAB137F73D9\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63CB1F3280B6DD043AA27EAB137F73D9\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\63CB1F3280B6DD043AA27EAB137F73D9\ProductFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63CB1F3280B6DD043AA27EAB137F73D9\ProductName = "GuidePortalRapid"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63CB1F3280B6DD043AA27EAB137F73D9\Version = "33751044"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9255E7775B746E544994284282C6D9E4\63CB1F3280B6DD043AA27EAB137F73D9	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63CB1F3280B6DD043AA27EAB137F73D9\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63CB1F3280B6DD043AA27EAB137F73D9\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63CB1F3280B6DD043AA27EAB137F73D9	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63CB1F3280B6DD043AA27EAB137F73D9\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63CB1F3280B6DD043AA27EAB137F73D9\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9255E7775B746E544994284282C6D9E4	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63CB1F3280B6DD043AA27EAB137F73D9\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\63CB1F3280B6DD043AA27EAB137F73D9	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63CB1F3280B6DD043AA27EAB137F73D9\PackageCode = "32B8F39D4469AE64A860107226DE41EF"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63CB1F3280B6DD043AA27EAB137F73D9\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63CB1F3280B6DD043AA27EAB137F73D9\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63CB1F3280B6DD043AA27EAB137F73D9\SourceList	msiexec.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2348	msiexec.exe
2348	msiexec.exe
2928	wpsupdate.exe
2928	wpsupdate.exe
1600	TpuaDVwAtO28.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2520	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2520	msiexec.exe
Token: SeRestorePrivilege	2348	msiexec.exe
Token: SeTakeOwnershipPrivilege	2348	msiexec.exe
Token: SeSecurityPrivilege	2348	msiexec.exe
Token: SeCreateTokenPrivilege	2520	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2520	msiexec.exe
Token: SeLockMemoryPrivilege	2520	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2520	msiexec.exe
Token: SeMachineAccountPrivilege	2520	msiexec.exe
Token: SeTcbPrivilege	2520	msiexec.exe
Token: SeSecurityPrivilege	2520	msiexec.exe
Token: SeTakeOwnershipPrivilege	2520	msiexec.exe
Token: SeLoadDriverPrivilege	2520	msiexec.exe
Token: SeSystemProfilePrivilege	2520	msiexec.exe
Token: SeSystemtimePrivilege	2520	msiexec.exe
Token: SeProfSingleProcessPrivilege	2520	msiexec.exe
Token: SeIncBasePriorityPrivilege	2520	msiexec.exe
Token: SeCreatePagefilePrivilege	2520	msiexec.exe
Token: SeCreatePermanentPrivilege	2520	msiexec.exe
Token: SeBackupPrivilege	2520	msiexec.exe
Token: SeRestorePrivilege	2520	msiexec.exe
Token: SeShutdownPrivilege	2520	msiexec.exe
Token: SeDebugPrivilege	2520	msiexec.exe
Token: SeAuditPrivilege	2520	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2520	msiexec.exe
Token: SeChangeNotifyPrivilege	2520	msiexec.exe
Token: SeRemoteShutdownPrivilege	2520	msiexec.exe
Token: SeUndockPrivilege	2520	msiexec.exe
Token: SeSyncAgentPrivilege	2520	msiexec.exe
Token: SeEnableDelegationPrivilege	2520	msiexec.exe
Token: SeManageVolumePrivilege	2520	msiexec.exe
Token: SeImpersonatePrivilege	2520	msiexec.exe
Token: SeCreateGlobalPrivilege	2520	msiexec.exe
Token: SeBackupPrivilege	2040	vssvc.exe
Token: SeRestorePrivilege	2040	vssvc.exe
Token: SeAuditPrivilege	2040	vssvc.exe
Token: SeBackupPrivilege	2348	msiexec.exe
Token: SeRestorePrivilege	2348	msiexec.exe
Token: SeRestorePrivilege	2812	DrvInst.exe
Token: SeRestorePrivilege	2812	DrvInst.exe
Token: SeRestorePrivilege	2812	DrvInst.exe
Token: SeRestorePrivilege	2812	DrvInst.exe
Token: SeRestorePrivilege	2812	DrvInst.exe
Token: SeRestorePrivilege	2812	DrvInst.exe
Token: SeRestorePrivilege	2812	DrvInst.exe
Token: SeLoadDriverPrivilege	2812	DrvInst.exe
Token: SeLoadDriverPrivilege	2812	DrvInst.exe
Token: SeLoadDriverPrivilege	2812	DrvInst.exe
Token: SeRestorePrivilege	2348	msiexec.exe
Token: SeTakeOwnershipPrivilege	2348	msiexec.exe
Token: SeRestorePrivilege	2348	msiexec.exe
Token: SeTakeOwnershipPrivilege	2348	msiexec.exe
Token: SeRestorePrivilege	2348	msiexec.exe
Token: SeTakeOwnershipPrivilege	2348	msiexec.exe
Token: SeRestorePrivilege	2348	msiexec.exe
Token: SeTakeOwnershipPrivilege	2348	msiexec.exe
Token: SeRestorePrivilege	2348	msiexec.exe
Token: SeTakeOwnershipPrivilege	2348	msiexec.exe
Token: SeRestorePrivilege	2348	msiexec.exe
Token: SeTakeOwnershipPrivilege	2348	msiexec.exe
Token: SeRestorePrivilege	2348	msiexec.exe
Token: SeTakeOwnershipPrivilege	2348	msiexec.exe
Token: SeRestorePrivilege	2348	msiexec.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
2520	msiexec.exe
2520	msiexec.exe
2928	wpsupdate.exe
2928	wpsupdate.exe
2928	wpsupdate.exe
2928	wpsupdate.exe
2928	wpsupdate.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
2928	wpsupdate.exe
2928	wpsupdate.exe
2928	wpsupdate.exe
2928	wpsupdate.exe
2928	wpsupdate.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 752	2348	msiexec.exe	35
PID 2348 wrote to memory of 752	2348	msiexec.exe	35
PID 2348 wrote to memory of 752	2348	msiexec.exe	35
PID 2348 wrote to memory of 752	2348	msiexec.exe	35
PID 2348 wrote to memory of 752	2348	msiexec.exe	35
PID 2348 wrote to memory of 752	2348	msiexec.exe	35
PID 2348 wrote to memory of 752	2348	msiexec.exe	35
PID 752 wrote to memory of 1144	752	MsiExec.exe	36
PID 752 wrote to memory of 1144	752	MsiExec.exe	36
PID 752 wrote to memory of 1144	752	MsiExec.exe	36
PID 752 wrote to memory of 1144	752	MsiExec.exe	36
PID 752 wrote to memory of 1600	752	MsiExec.exe	38
PID 752 wrote to memory of 1600	752	MsiExec.exe	38
PID 752 wrote to memory of 1600	752	MsiExec.exe	38
PID 752 wrote to memory of 1600	752	MsiExec.exe	38
PID 752 wrote to memory of 2928	752	MsiExec.exe	39
PID 752 wrote to memory of 2928	752	MsiExec.exe	39
PID 752 wrote to memory of 2928	752	MsiExec.exe	39
PID 752 wrote to memory of 2928	752	MsiExec.exe	39
PID 752 wrote to memory of 2928	752	MsiExec.exe	39
PID 752 wrote to memory of 2928	752	MsiExec.exe	39
PID 752 wrote to memory of 2928	752	MsiExec.exe	39

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\wpsupdate.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2520

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 89C0FC6E4754E946C7ADCC2EB753D3DE M Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:752
- - C:\Program Files\GuidePortalRapid\FFGLWmUerQTM.exe
    "C:\Program Files\GuidePortalRapid\FFGLWmUerQTM.exe" x "C:\Program Files\GuidePortalRapid\wLzlKRWUCYQcfFYfQuoA" -o"C:\Program Files\GuidePortalRapid\" -pzKdAioNbrgsvnIwrocNm -y
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1144
- - C:\Program Files\GuidePortalRapid\TpuaDVwAtO28.exe
    "C:\Program Files\GuidePortalRapid\TpuaDVwAtO28.exe" -number 123 -file file3 -mode mode3 -flag flag3
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:1600
- - C:\Program Files\GuidePortalRapid\wpsupdate.exe
    "C:\Program Files\GuidePortalRapid\wpsupdate.exe"
    3⤵
    - Writes to the Master Boot Record (MBR)
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2928

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2040

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005CC" "0000000000000564"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f76ec64.rbs

Filesize
7KB

MD5
9f916c0e78c987c27f61d574829ef101

SHA1
e021c4324fc7c5c3fc0e16f7a7107fb926788536

SHA256
f98fca4322c63a4b3d0fddea2d14db9a00857be03231f80a13272e3f8c06c53f

SHA512
70c6d40a611eff882daed09db7979644af0ea862d85d67f25d8c354e06948b88e1f043b14a0fa96de77c8dc73a52ad85e902bcda918d1c38c2c3ffd1f0c83604

Download Submit
C:\Program Files\GuidePortalRapid\FFGLWmUerQTM.exe

Filesize
574KB

MD5
42badc1d2f03a8b1e4875740d3d49336

SHA1
cee178da1fb05f99af7a3547093122893bd1eb46

SHA256
c136b1467d669a725478a6110ebaaab3cb88a3d389dfa688e06173c066b76fcf

SHA512
6bc519a7368ee6bd8c8f69f2d634dd18799b4ca31fbc284d2580ba625f3a88b6a52d2bc17bea0e75e63ca11c10356c47ee00c2c500294abcb5141424fc5dc71c

Download Submit
C:\Program Files\GuidePortalRapid\TpuaDVwAtO28.exe

Filesize
3.1MB

MD5
cab83f4897ba305ccf1b3811d0d46b46

SHA1
f9b0a859ccfd545ca4794d2e37f0fe92e7469c88

SHA256
45265ec03d03272fbda8eca896bdc2f72f8ac0ab862d41f7a97cd823525c0a9c

SHA512
e018957a52075c203d48a59b2e049ed0d6980fefe467bd1b49bdd2a9b7aa5efb2d0d84a2b9e24f9b3ce680d424da137a2a7c3bc14f060960fba4cfbd900431ac

Download Submit
C:\Program Files\GuidePortalRapid\tTKiMHhNtqSk.exe

Filesize
832KB

MD5
d305d506c0095df8af223ac7d91ca327

SHA1
679cb4c763c84e75ccb0fa3475bd6b7a36e81c4a

SHA256
923111c7142b3dc783a3c722b19b8a21bcb78222d7a136ac33f0ca8a29f4cb66

SHA512
94d369a4db88bff9556a1d7a7fb0188ed935c3592bae09335542c5502ec878e839177be63ac3ab4af75d4dc38a3a4f5d0fd423115ac72cf5dd710c59604db796

Download Submit
C:\Program Files\GuidePortalRapid\wLzlKRWUCYQcfFYfQuoA

Filesize
1.9MB

MD5
45dcc34b4184b6b0900686a5b1337e7d

SHA1
fcc2985d00fe937abca356d114ecf050a8853aed

SHA256
83cda810e9e4ae8bc95bd820e27dc26a86ef38f388164ba0d807bdffc4880346

SHA512
527eabefecf23c0a6e4bee2b52cb3dfaa4a7ff36c99808cf82e99e691c3a4c5b1f905fb0c0edbebe9e241888db37f73861a7ad798f8667202eb99d2e6a66777d

Download Submit
C:\Program Files\GuidePortalRapid\wpsupdate.exe

Filesize
6.0MB

MD5
57dadd6a929f64c2b1efe2d52c1c4985

SHA1
962cb227f81f885f23826c3e040aa9dbc97659cf

SHA256
996b5d59cce7955b4374bd00d83c422d3a1d9ffebba59c66074c37ab28cfaeb5

SHA512
3f64c35e72698ea6a7e708a4367277f3ab62c27f0652e0c55bab6e02239ee37c4f0a21503c0688301fb77bbf8e59e3c5c8aa2df8d62a4ab8a9b9cdf6f0a775cf

Download Submit
C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\update\wpsupdate_2024_09_20.log

Filesize
2KB

MD5
ab611ae57475d019e329effa6272cbf5

SHA1
724560d023c019180b4d8d84c3e589cd78aa6449

SHA256
bc0d816d540fb514f8d0afbee953e6f7f51f948c029cd5b5783e13473c49c9f4

SHA512
c7cbd298ab4569244ff759f3d98d4c1ae51d5f6309d9435b41035e8c4ca626faf7326606b54be550bf447518a6f951ca509b60d49143a207fa62fdf423b08be2

Download Submit
C:\Windows\Installer\f76ec62.msi

Filesize
26.2MB

MD5
6172dbd24d1ccc413437ee5d9f38a750

SHA1
4c24165e5d375ecaf5b5c49d831e48f70833bcfa

SHA256
8e599267e624e8865dc1377d533cbbed11a53d18cb3de3946e62e5887b06b641

SHA512
362432449d23d40fa0d2ccf27e608e063b083d23da9fa1c3ad10cf3772763421859fa91bf2c3bbd257f1a8e8ef723930dd758d009ff0cfbaf4be96316dd0fc0d

Download Submit
memory/752-12-0x0000000000260000-0x0000000000262000-memory.dmp

Filesize
8KB

Download
memory/1600-46-0x00000000007D0000-0x00000000007FA000-memory.dmp

Filesize
168KB

Download