Overview

overview

10

Static

static

1

WPSOffice1...33.msi

windows7-x64

6

WPSOffice1...33.msi

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    22-09-2024 13:55

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    WPSOffice10469357401533.msi

  • Size

    41.1MB

  • MD5

    27ba48360e40e33e30f22f9258ca8aec

  • SHA1

    f86f07a4fde054f77591c7c42a751f4fa566cdd5

  • SHA256

    593c2deaacb09860822ec349224494c5aa35ebac3ff8836b43f63ad41d168d60

  • SHA512

    0ba2009808c661cc9780bdf437f2ca47cfb99daa080f95428f3631752d2f49f6fce1ec747ef9228e49e3df00db61b67d4f52c4411d76cb6551fb6f50eaf90497

  • SSDEEP

    786432:bz9YO2wwhIk3QM8g4fzggu4Pm7WJn8tKFodQrzRIwio026V:Fa3Qg4fzgh4fn8tKFeQr9tiod6V

Score
6/10
discoverypersistenceprivilege_escalation

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 11 IoCs
  • Drops file in Windows directory 10 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 6 IoCs
  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 22 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\WPSOffice10469357401533.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:3028
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2736
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 8927A8332E8C27DF8654CFC4FCADD9F3 M Global\MSI0000
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1032
      • C:\Program Files\SecureSponsorGenerous\hqUsxQVokjCH.exe
        "C:\Program Files\SecureSponsorGenerous\hqUsxQVokjCH.exe" x "C:\Program Files\SecureSponsorGenerous\OUvlZvvsRHvvVPzWjGvr" -o"C:\Program Files\SecureSponsorGenerous\" -pBtrCoSaelPTuXoCAcEwA -y
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1624
      • C:\Program Files\SecureSponsorGenerous\EiAuPIYhFE4.exe
        "C:\Program Files\SecureSponsorGenerous\EiAuPIYhFE4.exe" -number 242 -file file3 -mode mode3 -flag flag3
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1420
      • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
        "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde
        3⤵
        • System Location Discovery: System Language Discovery
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        PID:776
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2636
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005AC" "0000000000000598"
    1⤵
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    PID:912

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Config.Msi\f77b4ff.rbs
    Filesize

    7KB

    MD5

    ac13bcb315f920f265bddf62158e7a3a

    SHA1

    992bdbe42bd895a19d09d658ddcda9714a2b7d76

    SHA256

    8c5e0b6b5b82a0e210bfc52e5054d23f4750c516768a92b74bc8e6c7aab0c487

    SHA512

    0d1863b7da48ed5a40b3403a225786c328521dd9f1611cf0e688cb4200422d1ace59f211519a05daf6a629321d5744b34a8b37a64762ad2692f0f881ab40bf80

    Download Submit

  • C:\Program Files\SecureSponsorGenerous\EiAuPIYhFE4.exe
    Filesize

    3.2MB

    MD5

    1c3d835b334c146196997f99df3c6f8e

    SHA1

    0027a83539881abaf1f5cb3a2cc0cd6ba528d000

    SHA256

    dcd7d379effc6f28e3fc43bdeebc3c39c933a93b09d9dc6691fb64392c432b3f

    SHA512

    f4da23997640cad08e9c3cc605472bb3b112e01406cc18789bd78d1f735790029cede3cd784d5d66882d571d6d515666a2017463ab5be454df50ddc4498d6042

    Download Submit

  • C:\Program Files\SecureSponsorGenerous\OUvlZvvsRHvvVPzWjGvr
    Filesize

    2.0MB

    MD5

    d076e5e2afedcdbd328b5a3f0222b408

    SHA1

    8d8407cf4006934271fbd1f0c251fb5e91786997

    SHA256

    7a275f7f2ccf99a65eb4bd5f8cbd944041473b6c804487daf03b720700b760ea

    SHA512

    1f58ffe864710bc35f790510284b39337e8caaf0cf434517afcf0e894dd99c737aba22da27ddd6ee93ce7791407c7338ad2433b4310815f3f644fc72a212b2d9

    Download Submit

  • C:\Program Files\SecureSponsorGenerous\bgHAdnVGRnVK.exe
    Filesize

    832KB

    MD5

    d305d506c0095df8af223ac7d91ca327

    SHA1

    679cb4c763c84e75ccb0fa3475bd6b7a36e81c4a

    SHA256

    923111c7142b3dc783a3c722b19b8a21bcb78222d7a136ac33f0ca8a29f4cb66

    SHA512

    94d369a4db88bff9556a1d7a7fb0188ed935c3592bae09335542c5502ec878e839177be63ac3ab4af75d4dc38a3a4f5d0fd423115ac72cf5dd710c59604db796

    Download Submit

  • C:\Program Files\SecureSponsorGenerous\hqUsxQVokjCH.exe
    Filesize

    574KB

    MD5

    42badc1d2f03a8b1e4875740d3d49336

    SHA1

    cee178da1fb05f99af7a3547093122893bd1eb46

    SHA256

    c136b1467d669a725478a6110ebaaab3cb88a3d389dfa688e06173c066b76fcf

    SHA512

    6bc519a7368ee6bd8c8f69f2d634dd18799b4ca31fbc284d2580ba625f3a88b6a52d2bc17bea0e75e63ca11c10356c47ee00c2c500294abcb5141424fc5dc71c

    Download Submit

  • C:\Windows\Installer\f77b4fd.msi
    Filesize

    41.1MB

    MD5

    27ba48360e40e33e30f22f9258ca8aec

    SHA1

    f86f07a4fde054f77591c7c42a751f4fa566cdd5

    SHA256

    593c2deaacb09860822ec349224494c5aa35ebac3ff8836b43f63ad41d168d60

    SHA512

    0ba2009808c661cc9780bdf437f2ca47cfb99daa080f95428f3631752d2f49f6fce1ec747ef9228e49e3df00db61b67d4f52c4411d76cb6551fb6f50eaf90497

    Download Submit

  • memory/776-31-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1032-12-0x0000000000240000-0x0000000000242000-memory.dmp

    Filesize

    8KB

    Download