f6b23380267c21f4f82efee4573c1eae7d89c69ab293e10f58aa45478c1bf1b2

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-09-2024 14:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

wpsupdate.msi
Size

39.8MB
MD5

0c200d7664b0e178560f7f974e6aff63
SHA1

f3ed74c5aa91de36a4a978d949b8b76752c853b3
SHA256

f6b23380267c21f4f82efee4573c1eae7d89c69ab293e10f58aa45478c1bf1b2
SHA512

b26c8dada559121f48ac6f3f15511e26c465c60b9d7b9a9ead4b175e32f32e7a6adbb77ed8cca269a88081a043efc7413b7c1a008e39bf41a36b6a2cbf698920
SSDEEP

786432:dHB67xVCEOhHxvCIEL2qf38CW9M4OGEuU/mH+ng2yI/9b+sKf:/KC9hm7/AXOBuU/mH+g/2y5

Score

6^/10

bootkit discovery persistence privilege_escalation

Malware Config

Signatures

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	wpsupdate.exe

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File created	C:\Program Files\IntegrateAdvisorVibrant\MOELauncherSetup_V0TKW.exe	msiexec.exe
File created	C:\Program Files\IntegrateAdvisorVibrant\pQDfBqzqcAmCwxhiPfMj	msiexec.exe
File created	C:\Program Files\IntegrateAdvisorVibrant\wpsupdate.exe	msiexec.exe
File created	C:\Program Files\IntegrateAdvisorVibrant\qzeybRpnzInL.xml	bYqyfBgulGkj.exe
File opened for modification	C:\Program Files\IntegrateAdvisorVibrant\qzeybRpnzInL.exe	bYqyfBgulGkj.exe
File opened for modification	C:\Program Files\IntegrateAdvisorVibrant\TpuaDVwAtO16.exe	bYqyfBgulGkj.exe
File opened for modification	C:\Program Files\IntegrateAdvisorVibrant	TpuaDVwAtO16.exe
File created	C:\Program Files\IntegrateAdvisorVibrant\bYqyfBgulGkj.exe	msiexec.exe
File opened for modification	C:\Program Files\IntegrateAdvisorVibrant\qzeybRpnzInL.xml	bYqyfBgulGkj.exe
File created	C:\Program Files\IntegrateAdvisorVibrant\qzeybRpnzInL.exe	bYqyfBgulGkj.exe
File created	C:\Program Files\IntegrateAdvisorVibrant\TpuaDVwAtO16.exe	bYqyfBgulGkj.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File created	C:\Windows\Installer\f76c34f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f76c34f.msi	msiexec.exe
File created	C:\Windows\Installer\f76c350.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\f76c352.msi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIC40A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f76c350.ipi	msiexec.exe

Executes dropped EXE 3 IoCs

pid	Process
1860	bYqyfBgulGkj.exe
1684	TpuaDVwAtO16.exe
1316	wpsupdate.exe

Loads dropped DLL 11 IoCs

pid	Process
2892	MsiExec.exe
2892	MsiExec.exe
2892	MsiExec.exe
2892	MsiExec.exe
2892	MsiExec.exe
1684	TpuaDVwAtO16.exe
1684	TpuaDVwAtO16.exe
1684	TpuaDVwAtO16.exe
1684	TpuaDVwAtO16.exe
1684	TpuaDVwAtO16.exe
1684	TpuaDVwAtO16.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3064	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wpsupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bYqyfBgulGkj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TpuaDVwAtO16.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Kingsoft\Office\6.0\Common\khdinfo\InfoHDModifiedType = "hdidRecalByOldHdidFromRegIsEmpty\|2024-9-22"	wpsupdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	wpsupdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Kingsoft\Office	wpsupdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Kingsoft\Office\6.0	wpsupdate.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Kingsoft\Office\6.0\Common\InfoHD3Verify_C = 32003000320034002d0039002d00320032007c00570044004300200032002e0035002b00320033003200310033003800380030003400310036003500200020002000200020002000200020007c00350045002d00450030002d00310042002d00410046002d00450030002d00370033000000	wpsupdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	TpuaDVwAtO16.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Kingsoft\Office\6.0\Common\khdinfo	wpsupdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Kingsoft\Office\6.0\Common\InfoHD3_C = "8048dffc6d5521fc5edfa975223b687f"	wpsupdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e\52C64B7E	TpuaDVwAtO16.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Kingsoft\Office\6.0\Common	wpsupdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Kingsoft\Office\6.0\Common\InfoHD3t = "22"	wpsupdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	wpsupdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	TpuaDVwAtO16.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Kingsoft\Office\6.0\Common	wpsupdate.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	wpsupdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Kingsoft\Office\6.0\Common\InfoHD = "8048dffc6d5521fc5edfa975223b687f"	wpsupdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Kingsoft\Office\6.0\Common\khdinfo\InfoLastHardInfo	wpsupdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\system32\p2pcollab.dll,-8042 = "Peer to Peer Trust"	TpuaDVwAtO16.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Kingsoft\Office\6.0\Common\khdinfo\InfoCurHardInfo = "29a56b8a14940c3acb7a4a6443907c56\|564722713149a3e17a1ba6e57398f4b4"	wpsupdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Kingsoft	wpsupdate.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe

Modifies registry class 22 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D96FDCBEAE17384CB2011DF7F369457\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D96FDCBEAE17384CB2011DF7F369457\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D96FDCBEAE17384CB2011DF7F369457\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5D96FDCBEAE17384CB2011DF7F369457	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D96FDCBEAE17384CB2011DF7F369457\ProductName = "IntegrateAdvisorVibrant"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D96FDCBEAE17384CB2011DF7F369457\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B5AC0212DF0BDEC44B3DF387D448EF64	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D96FDCBEAE17384CB2011DF7F369457\SourceList	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D96FDCBEAE17384CB2011DF7F369457\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D96FDCBEAE17384CB2011DF7F369457\SourceList\PackageName = "wpsupdate.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D96FDCBEAE17384CB2011DF7F369457\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5D96FDCBEAE17384CB2011DF7F369457\ProductFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D96FDCBEAE17384CB2011DF7F369457	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D96FDCBEAE17384CB2011DF7F369457\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D96FDCBEAE17384CB2011DF7F369457\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D96FDCBEAE17384CB2011DF7F369457\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D96FDCBEAE17384CB2011DF7F369457\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D96FDCBEAE17384CB2011DF7F369457\PackageCode = "FEF599A3F1DEFE84B9E7C80AEEBFA710"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D96FDCBEAE17384CB2011DF7F369457\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D96FDCBEAE17384CB2011DF7F369457\Version = "67305477"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B5AC0212DF0BDEC44B3DF387D448EF64\5D96FDCBEAE17384CB2011DF7F369457	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D96FDCBEAE17384CB2011DF7F369457\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1524	msiexec.exe
1524	msiexec.exe
1316	wpsupdate.exe
1316	wpsupdate.exe
1684	TpuaDVwAtO16.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3064	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3064	msiexec.exe
Token: SeRestorePrivilege	1524	msiexec.exe
Token: SeTakeOwnershipPrivilege	1524	msiexec.exe
Token: SeSecurityPrivilege	1524	msiexec.exe
Token: SeCreateTokenPrivilege	3064	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3064	msiexec.exe
Token: SeLockMemoryPrivilege	3064	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3064	msiexec.exe
Token: SeMachineAccountPrivilege	3064	msiexec.exe
Token: SeTcbPrivilege	3064	msiexec.exe
Token: SeSecurityPrivilege	3064	msiexec.exe
Token: SeTakeOwnershipPrivilege	3064	msiexec.exe
Token: SeLoadDriverPrivilege	3064	msiexec.exe
Token: SeSystemProfilePrivilege	3064	msiexec.exe
Token: SeSystemtimePrivilege	3064	msiexec.exe
Token: SeProfSingleProcessPrivilege	3064	msiexec.exe
Token: SeIncBasePriorityPrivilege	3064	msiexec.exe
Token: SeCreatePagefilePrivilege	3064	msiexec.exe
Token: SeCreatePermanentPrivilege	3064	msiexec.exe
Token: SeBackupPrivilege	3064	msiexec.exe
Token: SeRestorePrivilege	3064	msiexec.exe
Token: SeShutdownPrivilege	3064	msiexec.exe
Token: SeDebugPrivilege	3064	msiexec.exe
Token: SeAuditPrivilege	3064	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3064	msiexec.exe
Token: SeChangeNotifyPrivilege	3064	msiexec.exe
Token: SeRemoteShutdownPrivilege	3064	msiexec.exe
Token: SeUndockPrivilege	3064	msiexec.exe
Token: SeSyncAgentPrivilege	3064	msiexec.exe
Token: SeEnableDelegationPrivilege	3064	msiexec.exe
Token: SeManageVolumePrivilege	3064	msiexec.exe
Token: SeImpersonatePrivilege	3064	msiexec.exe
Token: SeCreateGlobalPrivilege	3064	msiexec.exe
Token: SeBackupPrivilege	2160	vssvc.exe
Token: SeRestorePrivilege	2160	vssvc.exe
Token: SeAuditPrivilege	2160	vssvc.exe
Token: SeBackupPrivilege	1524	msiexec.exe
Token: SeRestorePrivilege	1524	msiexec.exe
Token: SeRestorePrivilege	2884	DrvInst.exe
Token: SeRestorePrivilege	2884	DrvInst.exe
Token: SeRestorePrivilege	2884	DrvInst.exe
Token: SeRestorePrivilege	2884	DrvInst.exe
Token: SeRestorePrivilege	2884	DrvInst.exe
Token: SeRestorePrivilege	2884	DrvInst.exe
Token: SeRestorePrivilege	2884	DrvInst.exe
Token: SeLoadDriverPrivilege	2884	DrvInst.exe
Token: SeLoadDriverPrivilege	2884	DrvInst.exe
Token: SeLoadDriverPrivilege	2884	DrvInst.exe
Token: SeRestorePrivilege	1524	msiexec.exe
Token: SeTakeOwnershipPrivilege	1524	msiexec.exe
Token: SeRestorePrivilege	1524	msiexec.exe
Token: SeTakeOwnershipPrivilege	1524	msiexec.exe
Token: SeRestorePrivilege	1524	msiexec.exe
Token: SeTakeOwnershipPrivilege	1524	msiexec.exe
Token: SeRestorePrivilege	1524	msiexec.exe
Token: SeTakeOwnershipPrivilege	1524	msiexec.exe
Token: SeRestorePrivilege	1524	msiexec.exe
Token: SeTakeOwnershipPrivilege	1524	msiexec.exe
Token: SeRestorePrivilege	1524	msiexec.exe
Token: SeTakeOwnershipPrivilege	1524	msiexec.exe
Token: SeRestorePrivilege	1524	msiexec.exe
Token: SeTakeOwnershipPrivilege	1524	msiexec.exe
Token: SeRestorePrivilege	1524	msiexec.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
3064	msiexec.exe
3064	msiexec.exe
1316	wpsupdate.exe
1316	wpsupdate.exe
1316	wpsupdate.exe
1316	wpsupdate.exe
1316	wpsupdate.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
1316	wpsupdate.exe
1316	wpsupdate.exe
1316	wpsupdate.exe
1316	wpsupdate.exe
1316	wpsupdate.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 2892	1524	msiexec.exe	34
PID 1524 wrote to memory of 2892	1524	msiexec.exe	34
PID 1524 wrote to memory of 2892	1524	msiexec.exe	34
PID 1524 wrote to memory of 2892	1524	msiexec.exe	34
PID 1524 wrote to memory of 2892	1524	msiexec.exe	34
PID 1524 wrote to memory of 2892	1524	msiexec.exe	34
PID 1524 wrote to memory of 2892	1524	msiexec.exe	34
PID 2892 wrote to memory of 1860	2892	MsiExec.exe	35
PID 2892 wrote to memory of 1860	2892	MsiExec.exe	35
PID 2892 wrote to memory of 1860	2892	MsiExec.exe	35
PID 2892 wrote to memory of 1860	2892	MsiExec.exe	35
PID 2892 wrote to memory of 1684	2892	MsiExec.exe	37
PID 2892 wrote to memory of 1684	2892	MsiExec.exe	37
PID 2892 wrote to memory of 1684	2892	MsiExec.exe	37
PID 2892 wrote to memory of 1684	2892	MsiExec.exe	37
PID 2892 wrote to memory of 1316	2892	MsiExec.exe	38
PID 2892 wrote to memory of 1316	2892	MsiExec.exe	38
PID 2892 wrote to memory of 1316	2892	MsiExec.exe	38
PID 2892 wrote to memory of 1316	2892	MsiExec.exe	38
PID 2892 wrote to memory of 1316	2892	MsiExec.exe	38
PID 2892 wrote to memory of 1316	2892	MsiExec.exe	38
PID 2892 wrote to memory of 1316	2892	MsiExec.exe	38

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\wpsupdate.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3064

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D03CDBF3E118348E27ADA85F298905AB M Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Program Files\IntegrateAdvisorVibrant\bYqyfBgulGkj.exe
    "C:\Program Files\IntegrateAdvisorVibrant\bYqyfBgulGkj.exe" x "C:\Program Files\IntegrateAdvisorVibrant\pQDfBqzqcAmCwxhiPfMj" -o"C:\Program Files\IntegrateAdvisorVibrant\" -pcwgpBxJASqrNthJgehkM -y
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1860
- - C:\Program Files\IntegrateAdvisorVibrant\TpuaDVwAtO16.exe
    "C:\Program Files\IntegrateAdvisorVibrant\TpuaDVwAtO16.exe" -number 262 -file file3 -mode mode3 -flag flag3
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:1684
- - C:\Program Files\IntegrateAdvisorVibrant\wpsupdate.exe
    "C:\Program Files\IntegrateAdvisorVibrant\wpsupdate.exe"
    3⤵
    - Writes to the Master Boot Record (MBR)
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:1316

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2160

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000004D0" "0000000000000590"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f76c351.rbs

Filesize
7KB

MD5
2aeaf155f4f04143026559b05eda7759

SHA1
e38b9f16c0f4d641931bd2fa19eded34d0c11d54

SHA256
4637e7d93f464ec7b865c4f7d29da132f3328cb8054656cb2fa74279323aaba7

SHA512
9609c5931afd1f75cd49fcb2136343c7fbcffbea6973dd336ffd4c79cfeb538c98814fa8bba7096494fc8d7758ebfe8051491112abe3b5cd882336df8e6d9838

Download Submit
C:\Program Files\IntegrateAdvisorVibrant\TpuaDVwAtO16.exe

Filesize
2.9MB

MD5
57d2f881bb7b9cf36a6c0ea46173c927

SHA1
2f12e389f828b77f93922b3643c2d8697bf64f0c

SHA256
4c9394ae6e91f94c57f904cd1ccd8df55566cff95b9a99fa7cd5ab9657e981a6

SHA512
84099bae1544e90418882d1da8d34f79c995623f8479558f621a89c7f04984f3ef99d56add81d9d240b3a3411ad671fc0bf9b24fb3cd8e030e36c12eb745e568

Download Submit
C:\Program Files\IntegrateAdvisorVibrant\bYqyfBgulGkj.exe

Filesize
574KB

MD5
42badc1d2f03a8b1e4875740d3d49336

SHA1
cee178da1fb05f99af7a3547093122893bd1eb46

SHA256
c136b1467d669a725478a6110ebaaab3cb88a3d389dfa688e06173c066b76fcf

SHA512
6bc519a7368ee6bd8c8f69f2d634dd18799b4ca31fbc284d2580ba625f3a88b6a52d2bc17bea0e75e63ca11c10356c47ee00c2c500294abcb5141424fc5dc71c

Download Submit
C:\Program Files\IntegrateAdvisorVibrant\pQDfBqzqcAmCwxhiPfMj

Filesize
1.7MB

MD5
166813a640fbff9bc9c5a8829b77d604

SHA1
9a6439822765bb23d6b6b6926855f8cde67fa213

SHA256
6b2ca55715af12bca876efb3509ed93d79a220da577f72b7f0b03d413a41841b

SHA512
320eb8181155330c85782037f9530ae16c8a5b5e20cd8beab7b5c62ed9539350165bdfcad5f862256818d39cd9a6667326a2ecb5d01be0083b40ca98b69dfd75

Download Submit
C:\Program Files\IntegrateAdvisorVibrant\wpsupdate.exe

Filesize
6.0MB

MD5
57dadd6a929f64c2b1efe2d52c1c4985

SHA1
962cb227f81f885f23826c3e040aa9dbc97659cf

SHA256
996b5d59cce7955b4374bd00d83c422d3a1d9ffebba59c66074c37ab28cfaeb5

SHA512
3f64c35e72698ea6a7e708a4367277f3ab62c27f0652e0c55bab6e02239ee37c4f0a21503c0688301fb77bbf8e59e3c5c8aa2df8d62a4ab8a9b9cdf6f0a775cf

Download Submit
C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\update\wpsupdate_2024_09_22.log

Filesize
2KB

MD5
68114efe9b25a7c2c0e3ed9f2be7c130

SHA1
8f1f4af3614277c486935194ff357e72909122c4

SHA256
34be697765ee3ca0f2b4108684327b04b8560e601030155c4c0e7334fd00b8bf

SHA512
7f09ef49cae85dd05d6ee3c007417bedda6e8ae712ea7802c6583e93c409ff849544c5ed28d6afcd22fc0df32074dbc11894e8a583f9ece54cc5e08fe807dbda

Download Submit
C:\Windows\Installer\f76c34f.msi

Filesize
39.8MB

MD5
0c200d7664b0e178560f7f974e6aff63

SHA1
f3ed74c5aa91de36a4a978d949b8b76752c853b3

SHA256
f6b23380267c21f4f82efee4573c1eae7d89c69ab293e10f58aa45478c1bf1b2

SHA512
b26c8dada559121f48ac6f3f15511e26c465c60b9d7b9a9ead4b175e32f32e7a6adbb77ed8cca269a88081a043efc7413b7c1a008e39bf41a36b6a2cbf698920

Download Submit
\Program Files\IntegrateAdvisorVibrant\MOELauncherSetup_V0TKW.exe

Filesize
35.6MB

MD5
f0b4afeb9a9582a84c04d33b4f9c93e5

SHA1
0b9229e8e3879fc4d1310ba493280894cac1f259

SHA256
d71c5c27f6e68be09e40921321a2c6d3b95f65787c33dcc2d66e6939a798a3c9

SHA512
d4c3593590a5574bbfc1270d3aca3b419ea5126735206b5e2104e42fda961844ba90073ebacd917b9b0152c103670d1a64b88c76b03b358feae73794418abe51

Download Submit
\Program Files\IntegrateAdvisorVibrant\qzeybRpnzInL.exe

Filesize
832KB

MD5
d305d506c0095df8af223ac7d91ca327

SHA1
679cb4c763c84e75ccb0fa3475bd6b7a36e81c4a

SHA256
923111c7142b3dc783a3c722b19b8a21bcb78222d7a136ac33f0ca8a29f4cb66

SHA512
94d369a4db88bff9556a1d7a7fb0188ed935c3592bae09335542c5502ec878e839177be63ac3ab4af75d4dc38a3a4f5d0fd423115ac72cf5dd710c59604db796

Download Submit
memory/1684-46-0x000000000A7D0000-0x000000000A7FA000-memory.dmp

Filesize
168KB

Download
memory/2892-12-0x00000000007B0000-0x00000000007B2000-memory.dmp

Filesize
8KB

Download