Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21-09-2024 18:03
Static task
static1
Behavioral task
behavioral1
Sample
TwDush.msi
Resource
win7-20240903-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
TwDush.msi
Resource
win10v2004-20240802-en
windows10-2004-x64
19 signatures
150 seconds
General
-
Target
TwDush.msi
-
Size
66.4MB
-
MD5
9800a890a4819b574c5aa5ca9e063d96
-
SHA1
ede8c738d4e58c770f0ba7792e330756aaf28c7f
-
SHA256
ec40da7be23e50181fb692525cc62f6cd5f5caa74f653fabaf5d57df1201263b
-
SHA512
ae52316d3f17cab0370ce6a772861ae5ca5a556f140955c93edf91852695964b57b108c1b85a342d2c52ae8090a6c3d97e7fe5a1c4bd87435135572ab5ca12cf
-
SSDEEP
1572864:vXU1B6zASrGGq3ymZM4yLpQBoxFlfAwwsUZWOVH:vXU1B6ASrGGqCcM/DxFBDwhZzH
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4964-73-0x000000002C2E0000-0x000000002C49B000-memory.dmp purplefox_rootkit behavioral2/memory/4964-75-0x000000002C2E0000-0x000000002C49B000-memory.dmp purplefox_rootkit behavioral2/memory/4964-76-0x000000002C2E0000-0x000000002C49B000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 3 IoCs
resource yara_rule behavioral2/memory/4964-73-0x000000002C2E0000-0x000000002C49B000-memory.dmp family_gh0strat behavioral2/memory/4964-75-0x000000002C2E0000-0x000000002C49B000-memory.dmp family_gh0strat behavioral2/memory/4964-76-0x000000002C2E0000-0x000000002C49B000-memory.dmp family_gh0strat -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: PtsxcsyatT16.exe File opened (read-only) \??\R: PtsxcsyatT16.exe File opened (read-only) \??\X: PtsxcsyatT16.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: PtsxcsyatT16.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\H: PtsxcsyatT16.exe File opened (read-only) \??\B: PtsxcsyatT16.exe File opened (read-only) \??\N: PtsxcsyatT16.exe File opened (read-only) \??\S: PtsxcsyatT16.exe File opened (read-only) \??\V: PtsxcsyatT16.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: PtsxcsyatT16.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\K: PtsxcsyatT16.exe File opened (read-only) \??\W: PtsxcsyatT16.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\T: PtsxcsyatT16.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\J: PtsxcsyatT16.exe File opened (read-only) \??\P: PtsxcsyatT16.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: PtsxcsyatT16.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: PtsxcsyatT16.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: PtsxcsyatT16.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: PtsxcsyatT16.exe File opened (read-only) \??\Z: PtsxcsyatT16.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\G: PtsxcsyatT16.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\X: msiexec.exe -
Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification C:\Program Files\PlanAnalyzerOptimistic PtsxcsyatT16.exe File created C:\Program Files\PlanAnalyzerOptimistic\tADwcTndbYNd.xml mvlKSjKRHbPQ.exe File created C:\Program Files\PlanAnalyzerOptimistic\mvlKSjKRHbPQ.exe msiexec.exe File created C:\Program Files\PlanAnalyzerOptimistic\ToDesk.exe msiexec.exe File created C:\Program Files\PlanAnalyzerOptimistic\PtsxcsyatT16.exe mvlKSjKRHbPQ.exe File created C:\Program Files\PlanAnalyzerOptimistic\MOELauncherSetup_V0TKW.exe msiexec.exe File created C:\Program Files\PlanAnalyzerOptimistic\tADwcTndbYNd.exe mvlKSjKRHbPQ.exe File opened for modification C:\Program Files\PlanAnalyzerOptimistic\tADwcTndbYNd.exe mvlKSjKRHbPQ.exe File opened for modification C:\Program Files\PlanAnalyzerOptimistic\tADwcTndbYNd.wrapper.log tADwcTndbYNd.exe File opened for modification C:\Program Files\PlanAnalyzerOptimistic\tADwcTndbYNd.wrapper.log tADwcTndbYNd.exe File opened for modification C:\Program Files\PlanAnalyzerOptimistic\PtsxcsyatT16.exe mvlKSjKRHbPQ.exe File opened for modification C:\Program Files\PlanAnalyzerOptimistic\tADwcTndbYNd.xml mvlKSjKRHbPQ.exe File opened for modification C:\Program Files\PlanAnalyzerOptimistic\tADwcTndbYNd.wrapper.log tADwcTndbYNd.exe File created C:\Program Files\PlanAnalyzerOptimistic\VKWrWBaIcvTlXvwirqQe msiexec.exe -
Drops file in Windows directory 8 IoCs
description ioc Process File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{8D04A5E8-036B-4B69-AB3F-ADD10738C73E} msiexec.exe File opened for modification C:\Windows\Installer\MSIF194.tmp msiexec.exe File created C:\Windows\Installer\e57efd0.msi msiexec.exe File created C:\Windows\Installer\e57efce.msi msiexec.exe File opened for modification C:\Windows\Installer\e57efce.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe -
Executes dropped EXE 8 IoCs
pid Process 2376 mvlKSjKRHbPQ.exe 1540 PtsxcsyatT16.exe 2700 ToDesk.exe 4544 tADwcTndbYNd.exe 216 tADwcTndbYNd.exe 2536 tADwcTndbYNd.exe 2916 PtsxcsyatT16.exe 4964 PtsxcsyatT16.exe -
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4100 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PtsxcsyatT16.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PtsxcsyatT16.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mvlKSjKRHbPQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PtsxcsyatT16.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000c9aa8484b1ca68e90000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000c9aa84840000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900c9aa8484000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dc9aa8484000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000c9aa848400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 PtsxcsyatT16.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz PtsxcsyatT16.exe -
Modifies data under HKEY_USERS 13 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" PtsxcsyatT16.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E PtsxcsyatT16.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption" PtsxcsyatT16.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\JITDebug = "0" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe -
Modifies registry class 22 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E5A40D8B63096B4BAF3DA1D70837CE3\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E5A40D8B63096B4BAF3DA1D70837CE3 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E5A40D8B63096B4BAF3DA1D70837CE3\PackageCode = "B4C280FC3A938F442BA728B9CF74E9DC" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E5A40D8B63096B4BAF3DA1D70837CE3\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E5A40D8B63096B4BAF3DA1D70837CE3\SourceList\PackageName = "TwDush.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E5A40D8B63096B4BAF3DA1D70837CE3\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E5A40D8B63096B4BAF3DA1D70837CE3\SourceList\Media\1 = ";" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E5A40D8B63096B4BAF3DA1D70837CE3\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E5A40D8B63096B4BAF3DA1D70837CE3\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8E5A40D8B63096B4BAF3DA1D70837CE3 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E5A40D8B63096B4BAF3DA1D70837CE3\ProductName = "PlanAnalyzerOptimistic" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E5A40D8B63096B4BAF3DA1D70837CE3\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E5A40D8B63096B4BAF3DA1D70837CE3\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E5A40D8B63096B4BAF3DA1D70837CE3\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\376C3C4D8C5B1874EB9AE27A958B6EEA msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\376C3C4D8C5B1874EB9AE27A958B6EEA\8E5A40D8B63096B4BAF3DA1D70837CE3 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E5A40D8B63096B4BAF3DA1D70837CE3\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E5A40D8B63096B4BAF3DA1D70837CE3\Version = "134807556" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E5A40D8B63096B4BAF3DA1D70837CE3\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E5A40D8B63096B4BAF3DA1D70837CE3\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8E5A40D8B63096B4BAF3DA1D70837CE3\ProductFeature msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E5A40D8B63096B4BAF3DA1D70837CE3\DeploymentFlags = "3" msiexec.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2444 msiexec.exe 2444 msiexec.exe 1540 PtsxcsyatT16.exe 1540 PtsxcsyatT16.exe 2536 tADwcTndbYNd.exe 2916 PtsxcsyatT16.exe 2916 PtsxcsyatT16.exe 2916 PtsxcsyatT16.exe 2916 PtsxcsyatT16.exe 4964 PtsxcsyatT16.exe 4964 PtsxcsyatT16.exe 4964 PtsxcsyatT16.exe 4964 PtsxcsyatT16.exe 4964 PtsxcsyatT16.exe 4964 PtsxcsyatT16.exe 4964 PtsxcsyatT16.exe 4964 PtsxcsyatT16.exe 4964 PtsxcsyatT16.exe 4964 PtsxcsyatT16.exe 4964 PtsxcsyatT16.exe 4964 PtsxcsyatT16.exe 4964 PtsxcsyatT16.exe 4964 PtsxcsyatT16.exe 4964 PtsxcsyatT16.exe 4964 PtsxcsyatT16.exe 4964 PtsxcsyatT16.exe 4964 PtsxcsyatT16.exe 4964 PtsxcsyatT16.exe 4964 PtsxcsyatT16.exe 4964 PtsxcsyatT16.exe 4964 PtsxcsyatT16.exe 4964 PtsxcsyatT16.exe 4964 PtsxcsyatT16.exe 4964 PtsxcsyatT16.exe 4964 PtsxcsyatT16.exe 4964 PtsxcsyatT16.exe 4964 PtsxcsyatT16.exe 4964 PtsxcsyatT16.exe 4964 PtsxcsyatT16.exe 4964 PtsxcsyatT16.exe 4964 PtsxcsyatT16.exe 4964 PtsxcsyatT16.exe 4964 PtsxcsyatT16.exe 4964 PtsxcsyatT16.exe 4964 PtsxcsyatT16.exe 4964 PtsxcsyatT16.exe 4964 PtsxcsyatT16.exe 4964 PtsxcsyatT16.exe 4964 PtsxcsyatT16.exe 4964 PtsxcsyatT16.exe 4964 PtsxcsyatT16.exe 4964 PtsxcsyatT16.exe 4964 PtsxcsyatT16.exe 4964 PtsxcsyatT16.exe 4964 PtsxcsyatT16.exe 4964 PtsxcsyatT16.exe 4964 PtsxcsyatT16.exe 4964 PtsxcsyatT16.exe 4964 PtsxcsyatT16.exe 4964 PtsxcsyatT16.exe 4964 PtsxcsyatT16.exe 4964 PtsxcsyatT16.exe 4964 PtsxcsyatT16.exe 4964 PtsxcsyatT16.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4100 msiexec.exe Token: SeIncreaseQuotaPrivilege 4100 msiexec.exe Token: SeSecurityPrivilege 2444 msiexec.exe Token: SeCreateTokenPrivilege 4100 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4100 msiexec.exe Token: SeLockMemoryPrivilege 4100 msiexec.exe Token: SeIncreaseQuotaPrivilege 4100 msiexec.exe Token: SeMachineAccountPrivilege 4100 msiexec.exe Token: SeTcbPrivilege 4100 msiexec.exe Token: SeSecurityPrivilege 4100 msiexec.exe Token: SeTakeOwnershipPrivilege 4100 msiexec.exe Token: SeLoadDriverPrivilege 4100 msiexec.exe Token: SeSystemProfilePrivilege 4100 msiexec.exe Token: SeSystemtimePrivilege 4100 msiexec.exe Token: SeProfSingleProcessPrivilege 4100 msiexec.exe Token: SeIncBasePriorityPrivilege 4100 msiexec.exe Token: SeCreatePagefilePrivilege 4100 msiexec.exe Token: SeCreatePermanentPrivilege 4100 msiexec.exe Token: SeBackupPrivilege 4100 msiexec.exe Token: SeRestorePrivilege 4100 msiexec.exe Token: SeShutdownPrivilege 4100 msiexec.exe Token: SeDebugPrivilege 4100 msiexec.exe Token: SeAuditPrivilege 4100 msiexec.exe Token: SeSystemEnvironmentPrivilege 4100 msiexec.exe Token: SeChangeNotifyPrivilege 4100 msiexec.exe Token: SeRemoteShutdownPrivilege 4100 msiexec.exe Token: SeUndockPrivilege 4100 msiexec.exe Token: SeSyncAgentPrivilege 4100 msiexec.exe Token: SeEnableDelegationPrivilege 4100 msiexec.exe Token: SeManageVolumePrivilege 4100 msiexec.exe Token: SeImpersonatePrivilege 4100 msiexec.exe Token: SeCreateGlobalPrivilege 4100 msiexec.exe Token: SeBackupPrivilege 4716 vssvc.exe Token: SeRestorePrivilege 4716 vssvc.exe Token: SeAuditPrivilege 4716 vssvc.exe Token: SeBackupPrivilege 2444 msiexec.exe Token: SeRestorePrivilege 2444 msiexec.exe Token: SeRestorePrivilege 2444 msiexec.exe Token: SeTakeOwnershipPrivilege 2444 msiexec.exe Token: SeRestorePrivilege 2444 msiexec.exe Token: SeTakeOwnershipPrivilege 2444 msiexec.exe Token: SeBackupPrivilege 4124 srtasks.exe Token: SeRestorePrivilege 4124 srtasks.exe Token: SeSecurityPrivilege 4124 srtasks.exe Token: SeTakeOwnershipPrivilege 4124 srtasks.exe Token: SeBackupPrivilege 4124 srtasks.exe Token: SeRestorePrivilege 4124 srtasks.exe Token: SeSecurityPrivilege 4124 srtasks.exe Token: SeTakeOwnershipPrivilege 4124 srtasks.exe Token: SeRestorePrivilege 2444 msiexec.exe Token: SeTakeOwnershipPrivilege 2444 msiexec.exe Token: SeRestorePrivilege 2444 msiexec.exe Token: SeTakeOwnershipPrivilege 2444 msiexec.exe Token: SeRestorePrivilege 2444 msiexec.exe Token: SeTakeOwnershipPrivilege 2444 msiexec.exe Token: SeRestorePrivilege 2444 msiexec.exe Token: SeTakeOwnershipPrivilege 2444 msiexec.exe Token: SeRestorePrivilege 2444 msiexec.exe Token: SeTakeOwnershipPrivilege 2444 msiexec.exe Token: SeRestorePrivilege 2444 msiexec.exe Token: SeTakeOwnershipPrivilege 2444 msiexec.exe Token: SeRestorePrivilege 2444 msiexec.exe Token: SeTakeOwnershipPrivilege 2444 msiexec.exe Token: SeRestorePrivilege 2444 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4100 msiexec.exe 4100 msiexec.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 2444 wrote to memory of 4124 2444 msiexec.exe 94 PID 2444 wrote to memory of 4124 2444 msiexec.exe 94 PID 2444 wrote to memory of 3988 2444 msiexec.exe 96 PID 2444 wrote to memory of 3988 2444 msiexec.exe 96 PID 2444 wrote to memory of 3988 2444 msiexec.exe 96 PID 3988 wrote to memory of 2376 3988 MsiExec.exe 97 PID 3988 wrote to memory of 2376 3988 MsiExec.exe 97 PID 3988 wrote to memory of 2376 3988 MsiExec.exe 97 PID 3988 wrote to memory of 1540 3988 MsiExec.exe 99 PID 3988 wrote to memory of 1540 3988 MsiExec.exe 99 PID 3988 wrote to memory of 1540 3988 MsiExec.exe 99 PID 3988 wrote to memory of 2700 3988 MsiExec.exe 100 PID 3988 wrote to memory of 2700 3988 MsiExec.exe 100 PID 2536 wrote to memory of 2916 2536 tADwcTndbYNd.exe 106 PID 2536 wrote to memory of 2916 2536 tADwcTndbYNd.exe 106 PID 2536 wrote to memory of 2916 2536 tADwcTndbYNd.exe 106 PID 2916 wrote to memory of 4964 2916 PtsxcsyatT16.exe 107 PID 2916 wrote to memory of 4964 2916 PtsxcsyatT16.exe 107 PID 2916 wrote to memory of 4964 2916 PtsxcsyatT16.exe 107 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\TwDush.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4100
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:4124
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding BD8D66A1343BC3D5043AD56D60942914 E Global\MSI00002⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Program Files\PlanAnalyzerOptimistic\mvlKSjKRHbPQ.exe"C:\Program Files\PlanAnalyzerOptimistic\mvlKSjKRHbPQ.exe" x "C:\Program Files\PlanAnalyzerOptimistic\VKWrWBaIcvTlXvwirqQe" -o"C:\Program Files\PlanAnalyzerOptimistic\" -pyjlAFQsGZRtyUdVIXREr -y3⤵
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2376
-
-
C:\Program Files\PlanAnalyzerOptimistic\PtsxcsyatT16.exe"C:\Program Files\PlanAnalyzerOptimistic\PtsxcsyatT16.exe" -number 132 -file file3 -mode mode3 -flag flag33⤵
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1540
-
-
C:\Program Files\PlanAnalyzerOptimistic\ToDesk.exe"C:\Program Files\PlanAnalyzerOptimistic\ToDesk.exe"3⤵
- Executes dropped EXE
PID:2700
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4716
-
C:\Program Files\PlanAnalyzerOptimistic\tADwcTndbYNd.exe"C:\Program Files\PlanAnalyzerOptimistic\tADwcTndbYNd.exe" install1⤵
- Drops file in Program Files directory
- Executes dropped EXE
PID:4544
-
C:\Program Files\PlanAnalyzerOptimistic\tADwcTndbYNd.exe"C:\Program Files\PlanAnalyzerOptimistic\tADwcTndbYNd.exe" start1⤵
- Drops file in Program Files directory
- Executes dropped EXE
PID:216
-
C:\Program Files\PlanAnalyzerOptimistic\tADwcTndbYNd.exe"C:\Program Files\PlanAnalyzerOptimistic\tADwcTndbYNd.exe"1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Program Files\PlanAnalyzerOptimistic\PtsxcsyatT16.exe"C:\Program Files\PlanAnalyzerOptimistic\PtsxcsyatT16.exe" -number 157 -file file3 -mode mode3 -flag flag32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Program Files\PlanAnalyzerOptimistic\PtsxcsyatT16.exe"C:\Program Files\PlanAnalyzerOptimistic\PtsxcsyatT16.exe" -number 362 -file file3 -mode mode3 -flag flag33⤵
- Enumerates connected drives
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:4964
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD5099c071db3edb5faf1a59ee980f0dda7
SHA19d5e433d7f8e19f5e89533d3f3b441fe34607a70
SHA256c8743a84123a62cb8025e11d7fc38a2857a84df1f22ccc7b03e984739a13c83f
SHA5124a0221f3e3d2b533321297ab5455c2e9870f77dd7ffb17ae4f23d0c81b27d254245cf7e635276cb37448d9d8df8c2694f0b0ffd73c50546723c69eb6e0047115
-
Filesize
35.6MB
MD5f0b4afeb9a9582a84c04d33b4f9c93e5
SHA10b9229e8e3879fc4d1310ba493280894cac1f259
SHA256d71c5c27f6e68be09e40921321a2c6d3b95f65787c33dcc2d66e6939a798a3c9
SHA512d4c3593590a5574bbfc1270d3aca3b419ea5126735206b5e2104e42fda961844ba90073ebacd917b9b0152c103670d1a64b88c76b03b358feae73794418abe51
-
Filesize
2.9MB
MD5772375794abfe39763f2057e845ff14b
SHA108ada20435475025e8b22d4a7460725fdcb0c3d5
SHA256c31afb76379f0adaaa98d52f7a6dca18cd9f374672e1e85c6c4f7214080e2248
SHA512ab67f8af704b0bf8902120b23fd2d31a1b12f05dc64f17b0f5fafb1c96bbf93481d4e147967a891028c2f4f0c5dc0b1eb135c003a2bc33ca4e118c60b70a2ad2
-
Filesize
48.3MB
MD51193d280fe00a77b753b8c196969fddf
SHA12ba757374129b149823d67a99e907989732c31dc
SHA25656e4cbc58c71fbab44bef5bb191659e92fa6713b6e1834465464f4dea44498ad
SHA512dd62534de37eae14cce7e83ccdf2e9f1fd6d87ea104c25bb107af4826a128ee40507958ce37c3df937ea238f1370a5e3f3cdcf701d015f6e2d31e45d4c0d1327
-
Filesize
1.7MB
MD52b86a11112da3cafddcd7ee308cea7c9
SHA1994cce38475425226d857550c86f1651fcfdc2dc
SHA2565f80ac378a228c920d0dd85c05c986c06ef3bc05b0b98a85df03428a00c6f9e3
SHA512da141c69561b862dec313b23a636a34ce831c18973c71c1450372350b1aba9be8291b3ecaa909166bb25f4bfbbd0477c6ff2711bb7475ca8c333a9c677ad56a2
-
Filesize
574KB
MD542badc1d2f03a8b1e4875740d3d49336
SHA1cee178da1fb05f99af7a3547093122893bd1eb46
SHA256c136b1467d669a725478a6110ebaaab3cb88a3d389dfa688e06173c066b76fcf
SHA5126bc519a7368ee6bd8c8f69f2d634dd18799b4ca31fbc284d2580ba625f3a88b6a52d2bc17bea0e75e63ca11c10356c47ee00c2c500294abcb5141424fc5dc71c
-
Filesize
832KB
MD5d305d506c0095df8af223ac7d91ca327
SHA1679cb4c763c84e75ccb0fa3475bd6b7a36e81c4a
SHA256923111c7142b3dc783a3c722b19b8a21bcb78222d7a136ac33f0ca8a29f4cb66
SHA51294d369a4db88bff9556a1d7a7fb0188ed935c3592bae09335542c5502ec878e839177be63ac3ab4af75d4dc38a3a4f5d0fd423115ac72cf5dd710c59604db796
-
Filesize
280B
MD560160b749aa585632ff06d795ece18c0
SHA1ed3fe8c6513d72e9a14479f137edab589c8f2fcf
SHA2561bbe2f85ecfa090d61e8a7ec42f9aefe4d60f83ff91ecd7f50318e68465e29e6
SHA512a49f0d72a3179e2b69792eae902fbc25730ad0864079bd6dde5c15cf5950e0874acfce8ec8ff84b65f798d3002899cc35ecd8b7c8a2463a103a6db8396362667
-
Filesize
507B
MD5c5047c97118b26f7ea0770aafcebfc09
SHA1337752c5d3d203b80f7948d2e17652d4240fdb0b
SHA256158eeb17914adfda8d20ab5392ce07ecedaad5e56487a37d0f275c599e56b0ba
SHA5121cc17a58d819155e3433c95ec305bef03d60075e2dab03fe590e8111039e9611557aee1f9d38b5b658b542c1608e545f8962ddd26eeeb7711a69f98cb06791c2
-
Filesize
763B
MD590d5fb2300d837d4fd3b7364eb3b4684
SHA11ae5b6819178519fd1fb870cbdde82f324b4daff
SHA256fc7a54c2d6a59554eb814a199af2a5bc28e76093a2b4db83abd85956d0753585
SHA5123e64ddd8c455f35ee69c5bb90712b894d4b103166b2641ccc8289d541abfeee66cb18ddb060781a8378bd37ff44c2297b54bb8010b60dcef2ccdfd3228ba9552
-
Filesize
454B
MD50bb0372549d39db06d87992e2692c3ab
SHA1029139cb33bb4a91ce63860885e31e0539439418
SHA2561ebfb436d54c049d89e23306341097350e477de8b955146c3d69448ef4992b67
SHA51226d544bfe0b96b124ca36679f2c879b2db682a97c0ac4828cb101b9f292c90b34ef013a16e42f51319d2d15e3f81e408c6d4edfc9b24272397d2344b67a0b82b
-
Filesize
1KB
MD5122cf3c4f3452a55a92edee78316e071
SHA1f2caa36d483076c92d17224cf92e260516b3cbbf
SHA25642f5774d1ee4cae5d7a4e83970da42bb17e61ae93c312247211b5ee3535662e0
SHA512c98666fb86aaff6471c0a96f12f037b9a607579c5891c9d7ba8cd4e90506ca7aa5b5f6264081d25f703c88fb69d8e2cd87809d508e771770550d0c5d4d17d91c
-
Filesize
23.7MB
MD5fef412a9c2e4bc4a643d779212d1c3e8
SHA1ef84bc2b04e757065ca80bd42911bdd802427ff2
SHA256c2e5de65e95b62c1b636ab421af968771321552e102d3f329135c8669ab9263b
SHA5127b094318f352ef71c838dcb5abaa031899d7f28c4132374c0e2e865215e0ebf0f3ed93cf80005f7819bd43750976869ea1d18774741f6b797726b3331cea66e9
-
\??\Volume{8484aac9-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{c9c820d0-9219-4b73-9de4-aec652c0ea4d}_OnDiskSnapshotProp
Filesize6KB
MD50fd2c97a012a76ff7522cf301dcbdab6
SHA1c36f2b03424cb8627754ce48a19501ffe5f6e4da
SHA256a11384731f0e5100e9db288043647e2f04552e671a32470f9f0108ee64dfdf4e
SHA51297e27ac56d20d86d2376a13f32ece94b66695c10a4a3fa02884d20122dc46c60b46c262b9b88e46abe23d80b0bef23fc53abab032596f436e1fe91bc884e1cc2