f6b23380267c21f4f82efee4573c1eae7d89c69ab293e10f58aa45478c1bf1b2

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22/09/2024, 11:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

wpsupdate.msi
Size

39.8MB
MD5

0c200d7664b0e178560f7f974e6aff63
SHA1

f3ed74c5aa91de36a4a978d949b8b76752c853b3
SHA256

f6b23380267c21f4f82efee4573c1eae7d89c69ab293e10f58aa45478c1bf1b2
SHA512

b26c8dada559121f48ac6f3f15511e26c465c60b9d7b9a9ead4b175e32f32e7a6adbb77ed8cca269a88081a043efc7413b7c1a008e39bf41a36b6a2cbf698920
SSDEEP

786432:dHB67xVCEOhHxvCIEL2qf38CW9M4OGEuU/mH+ng2yI/9b+sKf:/KC9hm7/AXOBuU/mH+g/2y5

Score

6^/10

bootkit discovery persistence privilege_escalation

Malware Config

Signatures

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	wpsupdate.exe

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File created	C:\Program Files\IntegrateAdvisorVibrant\pQDfBqzqcAmCwxhiPfMj	msiexec.exe
File created	C:\Program Files\IntegrateAdvisorVibrant\wpsupdate.exe	msiexec.exe
File created	C:\Program Files\IntegrateAdvisorVibrant\qzeybRpnzInL.exe	bYqyfBgulGkj.exe
File opened for modification	C:\Program Files\IntegrateAdvisorVibrant\qzeybRpnzInL.exe	bYqyfBgulGkj.exe
File opened for modification	C:\Program Files\IntegrateAdvisorVibrant	TpuaDVwAtO16.exe
File created	C:\Program Files\IntegrateAdvisorVibrant\bYqyfBgulGkj.exe	msiexec.exe
File created	C:\Program Files\IntegrateAdvisorVibrant\MOELauncherSetup_V0TKW.exe	msiexec.exe
File created	C:\Program Files\IntegrateAdvisorVibrant\qzeybRpnzInL.xml	bYqyfBgulGkj.exe
File opened for modification	C:\Program Files\IntegrateAdvisorVibrant\qzeybRpnzInL.xml	bYqyfBgulGkj.exe
File created	C:\Program Files\IntegrateAdvisorVibrant\TpuaDVwAtO16.exe	bYqyfBgulGkj.exe
File opened for modification	C:\Program Files\IntegrateAdvisorVibrant\TpuaDVwAtO16.exe	bYqyfBgulGkj.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\f76dbed.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDCE7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f76dbed.msi	msiexec.exe
File created	C:\Windows\Installer\f76dbee.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\f76dbf0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f76dbee.ipi	msiexec.exe

Executes dropped EXE 3 IoCs

pid	Process
2892	bYqyfBgulGkj.exe
2024	TpuaDVwAtO16.exe
2004	wpsupdate.exe

Loads dropped DLL 11 IoCs

pid	Process
2452	MsiExec.exe
2452	MsiExec.exe
2452	MsiExec.exe
2452	MsiExec.exe
2452	MsiExec.exe
2024	TpuaDVwAtO16.exe
2024	TpuaDVwAtO16.exe
2024	TpuaDVwAtO16.exe
2024	TpuaDVwAtO16.exe
2024	TpuaDVwAtO16.exe
2024	TpuaDVwAtO16.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
1560	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bYqyfBgulGkj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TpuaDVwAtO16.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wpsupdate.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Kingsoft\Office	wpsupdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	wpsupdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Kingsoft\Office\6.0\Common\khdinfo\InfoHDModifiedType = "hdidRecalByOldHdidFromRegIsEmpty\|2024-9-22"	wpsupdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Kingsoft\Office\6.0\Common\InfoHDt = "22"	wpsupdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	TpuaDVwAtO16.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Kingsoft\Office\6.0\Common\InfoHD = "5b3d279183555bc51d8f01a3076beb4c"	wpsupdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Kingsoft\Office\6.0\Common	wpsupdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Kingsoft\Office\6.0\Common\InfoHD3Verify_C = 32003000320034002d0039002d00320032007c00440041004400590032002e0035002b00440044003000300030003100330020002000200020002000200020002000200020002000200020007c00440045002d00430043002d00340034002d00450030002d00460046002d00390032000000	wpsupdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Kingsoft\Office\6.0	wpsupdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	wpsupdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Kingsoft\Office\6.0\Common\InfoHD3_C = "5b3d279183555bc51d8f01a3076beb4c"	wpsupdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	wpsupdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Kingsoft\Office\6.0\Common\khdinfo	wpsupdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	wpsupdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Kingsoft\Office\6.0\Common	wpsupdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Kingsoft\Office\6.0\Common\khdinfo\InfoLastHardInfo	wpsupdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Kingsoft\Office\6.0\Common\khdinfo\InfoCurHardInfo = "e6239cd86fb39ae5da51e4e14e91fdb8\|f69ab5c68d1790a5f08d15bb42cbbe03"	wpsupdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Kingsoft\Office\6.0\Common\InfoHD3t = "22"	wpsupdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe

Modifies registry class 22 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D96FDCBEAE17384CB2011DF7F369457\SourceList\PackageName = "wpsupdate.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D96FDCBEAE17384CB2011DF7F369457\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D96FDCBEAE17384CB2011DF7F369457\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D96FDCBEAE17384CB2011DF7F369457\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5D96FDCBEAE17384CB2011DF7F369457\ProductFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D96FDCBEAE17384CB2011DF7F369457	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D96FDCBEAE17384CB2011DF7F369457\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D96FDCBEAE17384CB2011DF7F369457\InstanceType = "0"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D96FDCBEAE17384CB2011DF7F369457\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D96FDCBEAE17384CB2011DF7F369457\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D96FDCBEAE17384CB2011DF7F369457\ProductName = "IntegrateAdvisorVibrant"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D96FDCBEAE17384CB2011DF7F369457\PackageCode = "FEF599A3F1DEFE84B9E7C80AEEBFA710"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D96FDCBEAE17384CB2011DF7F369457\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D96FDCBEAE17384CB2011DF7F369457\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5D96FDCBEAE17384CB2011DF7F369457	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D96FDCBEAE17384CB2011DF7F369457\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B5AC0212DF0BDEC44B3DF387D448EF64	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D96FDCBEAE17384CB2011DF7F369457\SourceList	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D96FDCBEAE17384CB2011DF7F369457\Version = "67305477"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D96FDCBEAE17384CB2011DF7F369457\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D96FDCBEAE17384CB2011DF7F369457\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B5AC0212DF0BDEC44B3DF387D448EF64\5D96FDCBEAE17384CB2011DF7F369457	msiexec.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1732	msiexec.exe
1732	msiexec.exe
2024	TpuaDVwAtO16.exe
2004	wpsupdate.exe
2004	wpsupdate.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1560	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1560	msiexec.exe
Token: SeRestorePrivilege	1732	msiexec.exe
Token: SeTakeOwnershipPrivilege	1732	msiexec.exe
Token: SeSecurityPrivilege	1732	msiexec.exe
Token: SeCreateTokenPrivilege	1560	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1560	msiexec.exe
Token: SeLockMemoryPrivilege	1560	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1560	msiexec.exe
Token: SeMachineAccountPrivilege	1560	msiexec.exe
Token: SeTcbPrivilege	1560	msiexec.exe
Token: SeSecurityPrivilege	1560	msiexec.exe
Token: SeTakeOwnershipPrivilege	1560	msiexec.exe
Token: SeLoadDriverPrivilege	1560	msiexec.exe
Token: SeSystemProfilePrivilege	1560	msiexec.exe
Token: SeSystemtimePrivilege	1560	msiexec.exe
Token: SeProfSingleProcessPrivilege	1560	msiexec.exe
Token: SeIncBasePriorityPrivilege	1560	msiexec.exe
Token: SeCreatePagefilePrivilege	1560	msiexec.exe
Token: SeCreatePermanentPrivilege	1560	msiexec.exe
Token: SeBackupPrivilege	1560	msiexec.exe
Token: SeRestorePrivilege	1560	msiexec.exe
Token: SeShutdownPrivilege	1560	msiexec.exe
Token: SeDebugPrivilege	1560	msiexec.exe
Token: SeAuditPrivilege	1560	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1560	msiexec.exe
Token: SeChangeNotifyPrivilege	1560	msiexec.exe
Token: SeRemoteShutdownPrivilege	1560	msiexec.exe
Token: SeUndockPrivilege	1560	msiexec.exe
Token: SeSyncAgentPrivilege	1560	msiexec.exe
Token: SeEnableDelegationPrivilege	1560	msiexec.exe
Token: SeManageVolumePrivilege	1560	msiexec.exe
Token: SeImpersonatePrivilege	1560	msiexec.exe
Token: SeCreateGlobalPrivilege	1560	msiexec.exe
Token: SeBackupPrivilege	2320	vssvc.exe
Token: SeRestorePrivilege	2320	vssvc.exe
Token: SeAuditPrivilege	2320	vssvc.exe
Token: SeBackupPrivilege	1732	msiexec.exe
Token: SeRestorePrivilege	1732	msiexec.exe
Token: SeRestorePrivilege	2744	DrvInst.exe
Token: SeRestorePrivilege	2744	DrvInst.exe
Token: SeRestorePrivilege	2744	DrvInst.exe
Token: SeRestorePrivilege	2744	DrvInst.exe
Token: SeRestorePrivilege	2744	DrvInst.exe
Token: SeRestorePrivilege	2744	DrvInst.exe
Token: SeRestorePrivilege	2744	DrvInst.exe
Token: SeLoadDriverPrivilege	2744	DrvInst.exe
Token: SeLoadDriverPrivilege	2744	DrvInst.exe
Token: SeLoadDriverPrivilege	2744	DrvInst.exe
Token: SeRestorePrivilege	1732	msiexec.exe
Token: SeTakeOwnershipPrivilege	1732	msiexec.exe
Token: SeRestorePrivilege	1732	msiexec.exe
Token: SeTakeOwnershipPrivilege	1732	msiexec.exe
Token: SeRestorePrivilege	1732	msiexec.exe
Token: SeTakeOwnershipPrivilege	1732	msiexec.exe
Token: SeRestorePrivilege	1732	msiexec.exe
Token: SeTakeOwnershipPrivilege	1732	msiexec.exe
Token: SeRestorePrivilege	1732	msiexec.exe
Token: SeTakeOwnershipPrivilege	1732	msiexec.exe
Token: SeRestorePrivilege	1732	msiexec.exe
Token: SeTakeOwnershipPrivilege	1732	msiexec.exe
Token: SeRestorePrivilege	1732	msiexec.exe
Token: SeTakeOwnershipPrivilege	1732	msiexec.exe
Token: SeRestorePrivilege	1732	msiexec.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
1560	msiexec.exe
1560	msiexec.exe
2004	wpsupdate.exe
2004	wpsupdate.exe
2004	wpsupdate.exe
2004	wpsupdate.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
2004	wpsupdate.exe
2004	wpsupdate.exe
2004	wpsupdate.exe
2004	wpsupdate.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2452	1732	msiexec.exe	35
PID 1732 wrote to memory of 2452	1732	msiexec.exe	35
PID 1732 wrote to memory of 2452	1732	msiexec.exe	35
PID 1732 wrote to memory of 2452	1732	msiexec.exe	35
PID 1732 wrote to memory of 2452	1732	msiexec.exe	35
PID 1732 wrote to memory of 2452	1732	msiexec.exe	35
PID 1732 wrote to memory of 2452	1732	msiexec.exe	35
PID 2452 wrote to memory of 2892	2452	MsiExec.exe	36
PID 2452 wrote to memory of 2892	2452	MsiExec.exe	36
PID 2452 wrote to memory of 2892	2452	MsiExec.exe	36
PID 2452 wrote to memory of 2892	2452	MsiExec.exe	36
PID 2452 wrote to memory of 2024	2452	MsiExec.exe	38
PID 2452 wrote to memory of 2024	2452	MsiExec.exe	38
PID 2452 wrote to memory of 2024	2452	MsiExec.exe	38
PID 2452 wrote to memory of 2024	2452	MsiExec.exe	38
PID 2452 wrote to memory of 2004	2452	MsiExec.exe	39
PID 2452 wrote to memory of 2004	2452	MsiExec.exe	39
PID 2452 wrote to memory of 2004	2452	MsiExec.exe	39
PID 2452 wrote to memory of 2004	2452	MsiExec.exe	39
PID 2452 wrote to memory of 2004	2452	MsiExec.exe	39
PID 2452 wrote to memory of 2004	2452	MsiExec.exe	39
PID 2452 wrote to memory of 2004	2452	MsiExec.exe	39

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\wpsupdate.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1560

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F3292E0342F8F489C0D7BFDF969F5452 M Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2452
- - C:\Program Files\IntegrateAdvisorVibrant\bYqyfBgulGkj.exe
    "C:\Program Files\IntegrateAdvisorVibrant\bYqyfBgulGkj.exe" x "C:\Program Files\IntegrateAdvisorVibrant\pQDfBqzqcAmCwxhiPfMj" -o"C:\Program Files\IntegrateAdvisorVibrant\" -pcwgpBxJASqrNthJgehkM -y
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2892
- - C:\Program Files\IntegrateAdvisorVibrant\TpuaDVwAtO16.exe
    "C:\Program Files\IntegrateAdvisorVibrant\TpuaDVwAtO16.exe" -number 262 -file file3 -mode mode3 -flag flag3
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:2024
- - C:\Program Files\IntegrateAdvisorVibrant\wpsupdate.exe
    "C:\Program Files\IntegrateAdvisorVibrant\wpsupdate.exe"
    3⤵
    - Writes to the Master Boot Record (MBR)
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2004

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2320

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000002B4" "000000000000057C"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f76dbef.rbs

Filesize
7KB

MD5
684b43f294fda0460a5b694bb28ae3cb

SHA1
98e71b6e5fecba3aedf8cc6e30e7dfc450f7ae6c

SHA256
3cd43f8143922ef4f7de5b253b1e89f738f273871e368feedb4ad650366f1911

SHA512
be0a13cd750717a7379226de2745a3da929a067e41b2d33839a60a3df6c8efc5a8c97f99c2b1451ecb241b8c5dc3df17fd9005c60f7dc79b0da748dd6f7f0213

Download Submit
C:\Program Files\IntegrateAdvisorVibrant\TpuaDVwAtO16.exe

Filesize
2.9MB

MD5
57d2f881bb7b9cf36a6c0ea46173c927

SHA1
2f12e389f828b77f93922b3643c2d8697bf64f0c

SHA256
4c9394ae6e91f94c57f904cd1ccd8df55566cff95b9a99fa7cd5ab9657e981a6

SHA512
84099bae1544e90418882d1da8d34f79c995623f8479558f621a89c7f04984f3ef99d56add81d9d240b3a3411ad671fc0bf9b24fb3cd8e030e36c12eb745e568

Download Submit
C:\Program Files\IntegrateAdvisorVibrant\bYqyfBgulGkj.exe

Filesize
574KB

MD5
42badc1d2f03a8b1e4875740d3d49336

SHA1
cee178da1fb05f99af7a3547093122893bd1eb46

SHA256
c136b1467d669a725478a6110ebaaab3cb88a3d389dfa688e06173c066b76fcf

SHA512
6bc519a7368ee6bd8c8f69f2d634dd18799b4ca31fbc284d2580ba625f3a88b6a52d2bc17bea0e75e63ca11c10356c47ee00c2c500294abcb5141424fc5dc71c

Download Submit
C:\Program Files\IntegrateAdvisorVibrant\pQDfBqzqcAmCwxhiPfMj

Filesize
1.7MB

MD5
166813a640fbff9bc9c5a8829b77d604

SHA1
9a6439822765bb23d6b6b6926855f8cde67fa213

SHA256
6b2ca55715af12bca876efb3509ed93d79a220da577f72b7f0b03d413a41841b

SHA512
320eb8181155330c85782037f9530ae16c8a5b5e20cd8beab7b5c62ed9539350165bdfcad5f862256818d39cd9a6667326a2ecb5d01be0083b40ca98b69dfd75

Download Submit
C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\update\wpsupdate_2024_09_22.log

Filesize
2KB

MD5
8b27f6c088cf09d5f790307e51b76a6d

SHA1
4b209ae22467e78ead6841cced151bf3b75372a3

SHA256
0b99772e18f576ada1d3f220d9c011e3026fbd2aa4c1fb4e17d3c6f6db37bcc1

SHA512
93b51a80fa74de4317b8baf4c49853f412f40a1e7b81e38708a95f331e497aa478ee5a832551f039e93712a14ba644be3e5a5381e91e9150fe8d78b883e9c73b

Download Submit
C:\Windows\Installer\f76dbed.msi

Filesize
39.8MB

MD5
0c200d7664b0e178560f7f974e6aff63

SHA1
f3ed74c5aa91de36a4a978d949b8b76752c853b3

SHA256
f6b23380267c21f4f82efee4573c1eae7d89c69ab293e10f58aa45478c1bf1b2

SHA512
b26c8dada559121f48ac6f3f15511e26c465c60b9d7b9a9ead4b175e32f32e7a6adbb77ed8cca269a88081a043efc7413b7c1a008e39bf41a36b6a2cbf698920

Download Submit
\Program Files\IntegrateAdvisorVibrant\MOELauncherSetup_V0TKW.exe

Filesize
35.6MB

MD5
f0b4afeb9a9582a84c04d33b4f9c93e5

SHA1
0b9229e8e3879fc4d1310ba493280894cac1f259

SHA256
d71c5c27f6e68be09e40921321a2c6d3b95f65787c33dcc2d66e6939a798a3c9

SHA512
d4c3593590a5574bbfc1270d3aca3b419ea5126735206b5e2104e42fda961844ba90073ebacd917b9b0152c103670d1a64b88c76b03b358feae73794418abe51

Download Submit
\Program Files\IntegrateAdvisorVibrant\qzeybRpnzInL.exe

Filesize
832KB

MD5
d305d506c0095df8af223ac7d91ca327

SHA1
679cb4c763c84e75ccb0fa3475bd6b7a36e81c4a

SHA256
923111c7142b3dc783a3c722b19b8a21bcb78222d7a136ac33f0ca8a29f4cb66

SHA512
94d369a4db88bff9556a1d7a7fb0188ed935c3592bae09335542c5502ec878e839177be63ac3ab4af75d4dc38a3a4f5d0fd423115ac72cf5dd710c59604db796

Download Submit
\Program Files\IntegrateAdvisorVibrant\wpsupdate.exe

Filesize
6.0MB

MD5
57dadd6a929f64c2b1efe2d52c1c4985

SHA1
962cb227f81f885f23826c3e040aa9dbc97659cf

SHA256
996b5d59cce7955b4374bd00d83c422d3a1d9ffebba59c66074c37ab28cfaeb5

SHA512
3f64c35e72698ea6a7e708a4367277f3ab62c27f0652e0c55bab6e02239ee37c4f0a21503c0688301fb77bbf8e59e3c5c8aa2df8d62a4ab8a9b9cdf6f0a775cf

Download Submit
memory/2024-30-0x000000002AFE0000-0x000000002B00A000-memory.dmp

Filesize
168KB

Download
memory/2452-12-0x00000000001A0000-0x00000000001A2000-memory.dmp

Filesize
8KB

Download