Analysis
-
max time kernel
20s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
27/09/2024, 23:28
Static task
static1
Behavioral task
behavioral1
Sample
digital_clock_5-x64.msi
Resource
win11-20240802-en
windows11-21h2-x64
15 signatures
150 seconds
General
-
Target
digital_clock_5-x64.msi
-
Size
25.0MB
-
MD5
6d0678fbb1deef83f77db4dabb8b4ffc
-
SHA1
e10923c06c27e2db0d8832e3da1eb3e2ae39f2a8
-
SHA256
17ce23f597ad4e83dccc69577691da7ec075453e45dcf0f8fa9d74fdefbb3e02
-
SHA512
89f94951e535dd09d80b8fa7c07609fe551f44cd819d94915a6f1181f28d0f2e603965133b7844748379276fe9014983db7f9db37969d283aab483a6b4633c31
-
SSDEEP
393216:HGbzqalcxfoCGd6FEhJ0fgMg3CSDgrRN8h1T7+5naXSTKwaE+5wv416AgwZQeZ:HoqkcxgCcuKufg79qgm6STKwUp9Z5
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000\Software\Microsoft\Windows\CurrentVersion\Run\Digital Clock 5 = "C:\\Program Files\\Digital Clock 5\\DigitalClock5.exe" msiexec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Digital Clock 5\skins\numeric-dotted\6.svg msiexec.exe File created C:\Program Files\Digital Clock 5\plugins\imageformats\qtiff.dll msiexec.exe File created C:\Program Files\Digital Clock 5\skins\numeric-dotted\7.svg msiexec.exe File created C:\Program Files\Digital Clock 5\plugins\countdown_timer.dll msiexec.exe File created C:\Program Files\Digital Clock 5\skins\vintage_digits\7.svg msiexec.exe File created C:\Program Files\Digital Clock 5\skins\christmas_tree_r\Creative-Christmas-Tree-pm.webp msiexec.exe File created C:\Program Files\Digital Clock 5\plugins\tls\qcertonlybackend.dll msiexec.exe File created C:\Program Files\Digital Clock 5\skins\steel\Chrisdesign-Effect-Letters-alphabet-silver-32.svg msiexec.exe File created C:\Program Files\Digital Clock 5\skins\vintage_digits\s2.svg msiexec.exe File created C:\Program Files\Digital Clock 5\translations\qt_he.qm msiexec.exe File created C:\Program Files\Digital Clock 5\skins\floral_digits\1.svg msiexec.exe File created C:\Program Files\Digital Clock 5\dxcompiler.dll msiexec.exe File created C:\Program Files\Digital Clock 5\translations\qt_tr.qm msiexec.exe File created C:\Program Files\Digital Clock 5\skins\christmas_tree_b\Creative-Christmas-Tree-number-5.webp msiexec.exe File created C:\Program Files\Digital Clock 5\translations\qt_zh_CN.qm msiexec.exe File created C:\Program Files\Digital Clock 5\skins\rainbow_numbers\set_of_rainbow_numbers_elements_vector_524201.svg msiexec.exe File created C:\Program Files\Digital Clock 5\skins\vintage_digits\s1.svg msiexec.exe File created C:\Program Files\Digital Clock 5\skins\vintage_digits\9.svg msiexec.exe File created C:\Program Files\Digital Clock 5\DigitalClock5.exe msiexec.exe File created C:\Program Files\Digital Clock 5\skins\vintage_digits\0.svg msiexec.exe File created C:\Program Files\Digital Clock 5\skins\hearts-simple\s2.svg msiexec.exe File created C:\Program Files\Digital Clock 5\skins\origami_style\s1.png msiexec.exe File created C:\Program Files\Digital Clock 5\skins\origami_style\skin.ini msiexec.exe File created C:\Program Files\Digital Clock 5\skins\origami_style\4.png msiexec.exe File created C:\Program Files\Digital Clock 5\skins\electronic-italic\skin.ini msiexec.exe File created C:\Program Files\Digital Clock 5\skins\pattern-numbers\0.svg msiexec.exe File created C:\Program Files\Digital Clock 5\skins\christmas_tree_r\Creative-Christmas-Tree-number-3.webp msiexec.exe File created C:\Program Files\Digital Clock 5\skins\origami_style\8.png msiexec.exe File created C:\Program Files\Digital Clock 5\skins\numeric-dotted\2.svg msiexec.exe File created C:\Program Files\Digital Clock 5\skins\steel\Chrisdesign-Effect-Letters-alphabet-silver-am.svg msiexec.exe File created C:\Program Files\Digital Clock 5\skins\doodled-empty\2.svg msiexec.exe File created C:\Program Files\Digital Clock 5\skins\electronic-italic\e1-v1a.svg msiexec.exe File created C:\Program Files\Digital Clock 5\skins\hearts-simple\1.svg msiexec.exe File created C:\Program Files\Digital Clock 5\translations\qt_ar.qm msiexec.exe File created C:\Program Files\Digital Clock 5\skins\hearts-empty\5.svg msiexec.exe File created C:\Program Files\Digital Clock 5\skins\floral_digits\5.svg msiexec.exe File created C:\Program Files\Digital Clock 5\skins\vintage_digits\8.svg msiexec.exe File created C:\Program Files\Digital Clock 5\skins\christmas_tree_r\Creative-Christmas-Tree-number-6.webp msiexec.exe File created C:\Program Files\Digital Clock 5\skins\numeric-dotted\1.svg msiexec.exe File created C:\Program Files\Digital Clock 5\skins\grass_numbers-hd\grass-number-0.png msiexec.exe File created C:\Program Files\Digital Clock 5\skins\pattern-numbers\pm.svg msiexec.exe File created C:\Program Files\Digital Clock 5\skins\doodled-empty\geometry.ini msiexec.exe File created C:\Program Files\Digital Clock 5\skins\doodled-empty\8.svg msiexec.exe File created C:\Program Files\Digital Clock 5\translations\qt_hr.qm msiexec.exe File created C:\Program Files\Digital Clock 5\skins\hearts-simple\4.svg msiexec.exe File created C:\Program Files\Digital Clock 5\skins\christmas_tree_b\Creative-Christmas-Tree-number-1.webp msiexec.exe File created C:\Program Files\Digital Clock 5\translations\qt_lv.qm msiexec.exe File created C:\Program Files\Digital Clock 5\skins\pattern-numbers\geometry.ini msiexec.exe File created C:\Program Files\Digital Clock 5\skins\electronic-italic\ed-v1a.svg msiexec.exe File created C:\Program Files\Digital Clock 5\plugins\imageformats\qsvg.dll msiexec.exe File created C:\Program Files\Digital Clock 5\skins\floral_digits\pm.svg msiexec.exe File created C:\Program Files\Digital Clock 5\skins\christmas_tree_r\Creative-Christmas-Tree-number-8.webp msiexec.exe File created C:\Program Files\Digital Clock 5\skins\electronic-italic\e9-v1a.svg msiexec.exe File created C:\Program Files\Digital Clock 5\skins\hearts-simple\8.svg msiexec.exe File created C:\Program Files\Digital Clock 5\skins\electronic-italic\e7-v1a.svg msiexec.exe File created C:\Program Files\Digital Clock 5\translations\qt_en.qm msiexec.exe File created C:\Program Files\Digital Clock 5\skins\hearts-empty\s2.svg msiexec.exe File created C:\Program Files\Digital Clock 5\skins\hearts-simple\0.svg msiexec.exe File created C:\Program Files\Digital Clock 5\skins\vintage_digits\skin.ini msiexec.exe File created C:\Program Files\Digital Clock 5\skins\christmas_tree_b\Creative-Christmas-Tree-am.webp msiexec.exe File created C:\Program Files\Digital Clock 5\skins\doodled-empty\9.svg msiexec.exe File created C:\Program Files\Digital Clock 5\skins\floral_digits\0.svg msiexec.exe File created C:\Program Files\Digital Clock 5\translations\qt_pt_BR.qm msiexec.exe File created C:\Program Files\Digital Clock 5\skins\grass_numbers-hd\grass-number-2.png msiexec.exe -
Drops file in Windows directory 15 IoCs
description ioc Process File created C:\Windows\SystemTemp\~DFC749F8A4C09BE813.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSID0BD.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID8CD.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF37DA8A3101DFB140.TMP msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{DF41512D-C0E3-4B44-962E-5EAF268258CD} msiexec.exe File created C:\Windows\SystemTemp\~DFAD8524139B0F1DA6.TMP msiexec.exe File opened for modification C:\Windows\Installer\{DF41512D-C0E3-4B44-962E-5EAF268258CD}\app_icon.ico msiexec.exe File created C:\Windows\Installer\e57cf19.msi msiexec.exe File created C:\Windows\SystemTemp\~DF87BA61EA65BBC71B.TMP msiexec.exe File opened for modification C:\Windows\Installer\e57cf17.msi msiexec.exe File created C:\Windows\Installer\e57cf17.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\{DF41512D-C0E3-4B44-962E-5EAF268258CD}\app_icon.ico msiexec.exe -
Loads dropped DLL 1 IoCs
pid Process 2884 MsiExec.exe -
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 1284 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000908a982beaea54420000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000908a982b0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900908a982b000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d908a982b000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000908a982b00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E msiexec.exe -
Modifies registry class 24 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D21514FD3E0C44B469E2E5FA622885DC\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D21514FD3E0C44B469E2E5FA622885DC\ProductIcon = "C:\\Windows\\Installer\\{DF41512D-C0E3-4B44-962E-5EAF268258CD}\\app_icon.ico" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\491C354C62F72724D85BC9EB039F6655 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D21514FD3E0C44B469E2E5FA622885DC\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D21514FD3E0C44B469E2E5FA622885DC\SourceList\PackageName = "digital_clock_5-x64.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D21514FD3E0C44B469E2E5FA622885DC\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D21514FD3E0C44B469E2E5FA622885DC\Complete msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D21514FD3E0C44B469E2E5FA622885DC\Version = "83886082" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D21514FD3E0C44B469E2E5FA622885DC\Clients = 3a0000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D21514FD3E0C44B469E2E5FA622885DC\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D21514FD3E0C44B469E2E5FA622885DC\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D21514FD3E0C44B469E2E5FA622885DC\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D21514FD3E0C44B469E2E5FA622885DC\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D21514FD3E0C44B469E2E5FA622885DC msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D21514FD3E0C44B469E2E5FA622885DC\Language = "1033" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D21514FD3E0C44B469E2E5FA622885DC\ProductName = "Digital Clock 5" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D21514FD3E0C44B469E2E5FA622885DC\DeploymentFlags = "3" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D21514FD3E0C44B469E2E5FA622885DC\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\491C354C62F72724D85BC9EB039F6655\D21514FD3E0C44B469E2E5FA622885DC msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D21514FD3E0C44B469E2E5FA622885DC\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D21514FD3E0C44B469E2E5FA622885DC\SourceList\Media\DiskPrompt = "Digital Clock 5 Installation [1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D21514FD3E0C44B469E2E5FA622885DC\SourceList\Media\1 = ";CD-ROM #1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D21514FD3E0C44B469E2E5FA622885DC msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D21514FD3E0C44B469E2E5FA622885DC\PackageCode = "31673D8D9830CFA4799BABC631204635" msiexec.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2348 msiexec.exe 2348 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1284 msiexec.exe Token: SeIncreaseQuotaPrivilege 1284 msiexec.exe Token: SeSecurityPrivilege 2348 msiexec.exe Token: SeCreateTokenPrivilege 1284 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1284 msiexec.exe Token: SeLockMemoryPrivilege 1284 msiexec.exe Token: SeIncreaseQuotaPrivilege 1284 msiexec.exe Token: SeMachineAccountPrivilege 1284 msiexec.exe Token: SeTcbPrivilege 1284 msiexec.exe Token: SeSecurityPrivilege 1284 msiexec.exe Token: SeTakeOwnershipPrivilege 1284 msiexec.exe Token: SeLoadDriverPrivilege 1284 msiexec.exe Token: SeSystemProfilePrivilege 1284 msiexec.exe Token: SeSystemtimePrivilege 1284 msiexec.exe Token: SeProfSingleProcessPrivilege 1284 msiexec.exe Token: SeIncBasePriorityPrivilege 1284 msiexec.exe Token: SeCreatePagefilePrivilege 1284 msiexec.exe Token: SeCreatePermanentPrivilege 1284 msiexec.exe Token: SeBackupPrivilege 1284 msiexec.exe Token: SeRestorePrivilege 1284 msiexec.exe Token: SeShutdownPrivilege 1284 msiexec.exe Token: SeDebugPrivilege 1284 msiexec.exe Token: SeAuditPrivilege 1284 msiexec.exe Token: SeSystemEnvironmentPrivilege 1284 msiexec.exe Token: SeChangeNotifyPrivilege 1284 msiexec.exe Token: SeRemoteShutdownPrivilege 1284 msiexec.exe Token: SeUndockPrivilege 1284 msiexec.exe Token: SeSyncAgentPrivilege 1284 msiexec.exe Token: SeEnableDelegationPrivilege 1284 msiexec.exe Token: SeManageVolumePrivilege 1284 msiexec.exe Token: SeImpersonatePrivilege 1284 msiexec.exe Token: SeCreateGlobalPrivilege 1284 msiexec.exe Token: SeBackupPrivilege 5056 vssvc.exe Token: SeRestorePrivilege 5056 vssvc.exe Token: SeAuditPrivilege 5056 vssvc.exe Token: SeBackupPrivilege 2348 msiexec.exe Token: SeRestorePrivilege 2348 msiexec.exe Token: SeRestorePrivilege 2348 msiexec.exe Token: SeTakeOwnershipPrivilege 2348 msiexec.exe Token: SeRestorePrivilege 2348 msiexec.exe Token: SeTakeOwnershipPrivilege 2348 msiexec.exe Token: SeRestorePrivilege 2348 msiexec.exe Token: SeTakeOwnershipPrivilege 2348 msiexec.exe Token: SeRestorePrivilege 2348 msiexec.exe Token: SeTakeOwnershipPrivilege 2348 msiexec.exe Token: SeRestorePrivilege 2348 msiexec.exe Token: SeTakeOwnershipPrivilege 2348 msiexec.exe Token: SeRestorePrivilege 2348 msiexec.exe Token: SeTakeOwnershipPrivilege 2348 msiexec.exe Token: SeRestorePrivilege 2348 msiexec.exe Token: SeTakeOwnershipPrivilege 2348 msiexec.exe Token: SeRestorePrivilege 2348 msiexec.exe Token: SeTakeOwnershipPrivilege 2348 msiexec.exe Token: SeRestorePrivilege 2348 msiexec.exe Token: SeTakeOwnershipPrivilege 2348 msiexec.exe Token: SeRestorePrivilege 2348 msiexec.exe Token: SeTakeOwnershipPrivilege 2348 msiexec.exe Token: SeRestorePrivilege 2348 msiexec.exe Token: SeTakeOwnershipPrivilege 2348 msiexec.exe Token: SeRestorePrivilege 2348 msiexec.exe Token: SeTakeOwnershipPrivilege 2348 msiexec.exe Token: SeRestorePrivilege 2348 msiexec.exe Token: SeTakeOwnershipPrivilege 2348 msiexec.exe Token: SeRestorePrivilege 2348 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1284 msiexec.exe 1284 msiexec.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2348 wrote to memory of 1768 2348 msiexec.exe 86 PID 2348 wrote to memory of 1768 2348 msiexec.exe 86 PID 2348 wrote to memory of 2884 2348 msiexec.exe 88 PID 2348 wrote to memory of 2884 2348 msiexec.exe 88 PID 2348 wrote to memory of 2884 2348 msiexec.exe 88 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\digital_clock_5-x64.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1284
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:1768
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 42EDD782215EA70B5F9FFA989CA366382⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2884
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5056
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
76KB
MD52502d35e7159bc97f56b64fccd9d9f92
SHA1a34fc5d24b197ee654d2c49af82f90d5a6f07c58
SHA256592d0fdcedc6d1b9017445152379e75e7bb4f9bff0da633754f345a7c5d2a0b5
SHA51211a2354036ce5cc49e1bdbf73208fc836f49ec89a09db985f5a827ba5c6e9521e64dc773d566fcc9d053371848d7e967f7bfd6a3698254262ba04b9fbaeea5d5
-
Filesize
234KB
MD58edc1557e9fc7f25f89ad384d01bcec4
SHA198e64d7f92b8254fe3f258e3238b9e0f033b5a9c
SHA25678860e15e474cc2af7ad6e499a8971b6b8197afb8e49a1b9eaaa392e4378f3a5
SHA512d26c9dce3c3d17583ffb5dbcd3989f93b096a7f64a37a2701a474c1bf4b8c8b1e922c352d33f24e411f1c793e1b4af11a3aec1de489087d481b1b636df2050cd
-
Filesize
25.0MB
MD56d0678fbb1deef83f77db4dabb8b4ffc
SHA1e10923c06c27e2db0d8832e3da1eb3e2ae39f2a8
SHA25617ce23f597ad4e83dccc69577691da7ec075453e45dcf0f8fa9d74fdefbb3e02
SHA51289f94951e535dd09d80b8fa7c07609fe551f44cd819d94915a6f1181f28d0f2e603965133b7844748379276fe9014983db7f9db37969d283aab483a6b4633c31
-
Filesize
12.8MB
MD52a6fc7fc8cdfee2027c7844efb368a07
SHA117dfb7f4e368645eb0e6ed05cf3cfd38bdc412de
SHA256adde7aee0ac6d210cfebac7bd5fd8028a6ca05d5db47adaada1f4ad04c491626
SHA5121328f26b8506c041a2f3f749e7fffa01406b26154907873e68a97b0274e18a376c7b8c3f89fedc595044c4a978e7659090c761d5715765d189dbe8b571cdb7cc
-
\??\Volume{2b988a90-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{88156a5e-0ba9-47c0-bf67-a9af4dbcd7d9}_OnDiskSnapshotProp
Filesize6KB
MD5e49759cc17b6b6a13737edc02772ca80
SHA1b3331e9178306ce2a84c7c69ce04f15162bc65b6
SHA256a4ab0da4020caa4ab82c8cdeea13c97d8f7c761d6a444723dda50550fc75d4a4
SHA512cbca29eda95eb7b7cc608469ed5e6a0d153f7c684db625fb04b137bbcaf1da89158e752047451311c747e7f29ddc9ae8d1c36b87b75c049e5572259ffe69a5fc