Analysis
-
max time kernel
1798s -
max time network
1800s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
27-09-2024 00:36
Static task
static1
Behavioral task
behavioral1
Sample
dsa.msi
Resource
win10v2004-20240802-en
windows10-2004-x64
13 signatures
1800 seconds
Behavioral task
behavioral2
Sample
dsa.msi
Resource
win11-20240802-en
windows11-21h2-x64
15 signatures
1800 seconds
General
-
Target
dsa.msi
-
Size
1.6MB
-
MD5
9775cb36162fab5d8dbe372cd5910ba7
-
SHA1
a06d73422ecb931b6b6ae9f2af5f08f50b3d52dc
-
SHA256
29549b75a198ad3aee4f8b9ea328bc9a73eb0e0d07e36775438bbe7268d453f9
-
SHA512
42cc3d3746fc416097b7de340cf1782febe957ee45e17b5c368f6509bb5112cfdd808d223283ef424b5ee1aab0dddc78562a778f196f7962c3f27839f4f60564
-
SSDEEP
49152:gfj3YhW8zBQSc0ZnSKSZKumZr7AlFBBdtM:cYY0ZnQK/AlprM
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 64 IoCs
flow pid Process 28 3580 rundll32.exe 30 3580 rundll32.exe 33 3580 rundll32.exe 38 3580 rundll32.exe 41 3580 rundll32.exe 44 3580 rundll32.exe 46 3580 rundll32.exe 48 3580 rundll32.exe 49 3580 rundll32.exe 57 3580 rundll32.exe 59 3580 rundll32.exe 65 3580 rundll32.exe 69 3580 rundll32.exe 70 3580 rundll32.exe 71 3580 rundll32.exe 72 3580 rundll32.exe 73 3580 rundll32.exe 74 3580 rundll32.exe 75 3580 rundll32.exe 77 3580 rundll32.exe 80 3580 rundll32.exe 81 3580 rundll32.exe 82 3580 rundll32.exe 85 3580 rundll32.exe 87 3580 rundll32.exe 88 3580 rundll32.exe 89 3580 rundll32.exe 90 3580 rundll32.exe 91 3580 rundll32.exe 94 3580 rundll32.exe 96 3580 rundll32.exe 97 3580 rundll32.exe 98 3580 rundll32.exe 99 3580 rundll32.exe 100 3580 rundll32.exe 101 3580 rundll32.exe 102 3580 rundll32.exe 103 3580 rundll32.exe 104 3580 rundll32.exe 105 3580 rundll32.exe 106 3580 rundll32.exe 107 3580 rundll32.exe 108 3580 rundll32.exe 109 3580 rundll32.exe 110 3580 rundll32.exe 111 3580 rundll32.exe 112 3580 rundll32.exe 113 3580 rundll32.exe 114 3580 rundll32.exe 115 3580 rundll32.exe 116 3580 rundll32.exe 117 3580 rundll32.exe 118 3580 rundll32.exe 119 3580 rundll32.exe 120 3580 rundll32.exe 121 3580 rundll32.exe 122 3580 rundll32.exe 123 3580 rundll32.exe 124 3580 rundll32.exe 125 3580 rundll32.exe 126 3580 rundll32.exe 127 3580 rundll32.exe 128 3580 rundll32.exe 129 3580 rundll32.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\P: msiexec.exe -
Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\Installer\e57c6f9.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIC747.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC8FF.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC93E.tmp msiexec.exe File opened for modification C:\Windows\Installer\e57c6f9.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIC871.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{61449C75-AB36-4299-A465-A142FC439D7F} msiexec.exe File opened for modification C:\Windows\Installer\MSIC9CC.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSICA89.tmp msiexec.exe -
Executes dropped EXE 1 IoCs
pid Process 4768 MSICA89.tmp -
Loads dropped DLL 6 IoCs
pid Process 2512 MsiExec.exe 2512 MsiExec.exe 2512 MsiExec.exe 2512 MsiExec.exe 2164 rundll32.exe 3580 rundll32.exe -
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2436 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSICA89.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000a2808484d8f468e90000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000a28084840000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900a2808484000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1da2808484000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000a280848400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3000 msiexec.exe 3000 msiexec.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe 3580 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2436 msiexec.exe Token: SeIncreaseQuotaPrivilege 2436 msiexec.exe Token: SeSecurityPrivilege 3000 msiexec.exe Token: SeCreateTokenPrivilege 2436 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2436 msiexec.exe Token: SeLockMemoryPrivilege 2436 msiexec.exe Token: SeIncreaseQuotaPrivilege 2436 msiexec.exe Token: SeMachineAccountPrivilege 2436 msiexec.exe Token: SeTcbPrivilege 2436 msiexec.exe Token: SeSecurityPrivilege 2436 msiexec.exe Token: SeTakeOwnershipPrivilege 2436 msiexec.exe Token: SeLoadDriverPrivilege 2436 msiexec.exe Token: SeSystemProfilePrivilege 2436 msiexec.exe Token: SeSystemtimePrivilege 2436 msiexec.exe Token: SeProfSingleProcessPrivilege 2436 msiexec.exe Token: SeIncBasePriorityPrivilege 2436 msiexec.exe Token: SeCreatePagefilePrivilege 2436 msiexec.exe Token: SeCreatePermanentPrivilege 2436 msiexec.exe Token: SeBackupPrivilege 2436 msiexec.exe Token: SeRestorePrivilege 2436 msiexec.exe Token: SeShutdownPrivilege 2436 msiexec.exe Token: SeDebugPrivilege 2436 msiexec.exe Token: SeAuditPrivilege 2436 msiexec.exe Token: SeSystemEnvironmentPrivilege 2436 msiexec.exe Token: SeChangeNotifyPrivilege 2436 msiexec.exe Token: SeRemoteShutdownPrivilege 2436 msiexec.exe Token: SeUndockPrivilege 2436 msiexec.exe Token: SeSyncAgentPrivilege 2436 msiexec.exe Token: SeEnableDelegationPrivilege 2436 msiexec.exe Token: SeManageVolumePrivilege 2436 msiexec.exe Token: SeImpersonatePrivilege 2436 msiexec.exe Token: SeCreateGlobalPrivilege 2436 msiexec.exe Token: SeBackupPrivilege 844 vssvc.exe Token: SeRestorePrivilege 844 vssvc.exe Token: SeAuditPrivilege 844 vssvc.exe Token: SeBackupPrivilege 3000 msiexec.exe Token: SeRestorePrivilege 3000 msiexec.exe Token: SeRestorePrivilege 3000 msiexec.exe Token: SeTakeOwnershipPrivilege 3000 msiexec.exe Token: SeRestorePrivilege 3000 msiexec.exe Token: SeTakeOwnershipPrivilege 3000 msiexec.exe Token: SeRestorePrivilege 3000 msiexec.exe Token: SeTakeOwnershipPrivilege 3000 msiexec.exe Token: SeRestorePrivilege 3000 msiexec.exe Token: SeTakeOwnershipPrivilege 3000 msiexec.exe Token: SeRestorePrivilege 3000 msiexec.exe Token: SeTakeOwnershipPrivilege 3000 msiexec.exe Token: SeRestorePrivilege 3000 msiexec.exe Token: SeTakeOwnershipPrivilege 3000 msiexec.exe Token: SeRestorePrivilege 3000 msiexec.exe Token: SeTakeOwnershipPrivilege 3000 msiexec.exe Token: SeRestorePrivilege 3000 msiexec.exe Token: SeTakeOwnershipPrivilege 3000 msiexec.exe Token: SeRestorePrivilege 3000 msiexec.exe Token: SeTakeOwnershipPrivilege 3000 msiexec.exe Token: SeBackupPrivilege 540 srtasks.exe Token: SeRestorePrivilege 540 srtasks.exe Token: SeSecurityPrivilege 540 srtasks.exe Token: SeTakeOwnershipPrivilege 540 srtasks.exe Token: SeBackupPrivilege 540 srtasks.exe Token: SeRestorePrivilege 540 srtasks.exe Token: SeSecurityPrivilege 540 srtasks.exe Token: SeTakeOwnershipPrivilege 540 srtasks.exe Token: SeShutdownPrivilege 3480 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2436 msiexec.exe 2436 msiexec.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3000 wrote to memory of 540 3000 msiexec.exe 89 PID 3000 wrote to memory of 540 3000 msiexec.exe 89 PID 3000 wrote to memory of 2512 3000 msiexec.exe 92 PID 3000 wrote to memory of 2512 3000 msiexec.exe 92 PID 3000 wrote to memory of 2512 3000 msiexec.exe 92 PID 3000 wrote to memory of 4768 3000 msiexec.exe 94 PID 3000 wrote to memory of 4768 3000 msiexec.exe 94 PID 3000 wrote to memory of 4768 3000 msiexec.exe 94 PID 2164 wrote to memory of 3580 2164 rundll32.exe 96 PID 2164 wrote to memory of 3580 2164 rundll32.exe 96 PID 3580 wrote to memory of 3480 3580 rundll32.exe 56 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3480 -
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\dsa.msi2⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2436
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" C:\Users\Admin\AppData\Roaming\vierm_soft_x64.dll, GetDeepDVCState2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\system32\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" C:\Users\Admin\AppData\Roaming\vierm_soft_x64.dll, GetDeepDVCState3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3580
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:540
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 8173E61F4EF1069FAFE2A72F26D789202⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2512
-
-
C:\Windows\Installer\MSICA89.tmp"C:\Windows\Installer\MSICA89.tmp" /DontWait C:/Windows/SysWOW64/rundll32.exe C:\Users\Admin\AppData\Roaming\vierm_soft_x64.dll, GetDeepDVCState2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4768
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:844
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD580989ccf091b84f9d0f7d31e1c264f26
SHA1595a1963217f8145ff697c8ab02471f0a54c189c
SHA2564e81011535bbc91b7ec30e3390312ba1f843ac0b6a777c4bbc8a7a7fef5c06e0
SHA5126f08b4a2a5394e37ea2a8328937ba9966a68aa739307d1b70b309720e3d025635e05d2e34ff9c6288d77d4872f1a557f8a9fd92f24df4deb3a5de565e65a1c8e
-
Filesize
666KB
MD5877c8b214d984656143d7576f832d935
SHA126bedae9e05afbff75ede2efc7777a376e362b6a
SHA25628f5e949ecad3606c430cea5a34d0f3e7218f239bcfa758a834dceb649e78abc
SHA512f07ac6795f4d8de38ac7f92a5ae308d2bdc30e29cebdf93b7fdee958c04bb83b1a28c4e6ac4e6a770b6d207af2a886cc93028b26e8850327f55391118f2d621a
-
Filesize
436KB
MD5475d20c0ea477a35660e3f67ecf0a1df
SHA167340739f51e1134ae8f0ffc5ae9dd710e8e3a08
SHA256426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
SHA51299525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
-
Filesize
389KB
MD5b9545ed17695a32face8c3408a6a3553
SHA1f6c31c9cd832ae2aebcd88e7b2fa6803ae93fc83
SHA2561e0e63b446eecf6c9781c7d1cae1f46a3bb31654a70612f71f31538fb4f4729a
SHA512f6d6dc40dcba5ff091452d7cc257427dcb7ce2a21816b4fec2ee249e63246b64667f5c4095220623533243103876433ef8c12c9b612c0e95fdfffe41d1504e04
-
Filesize
23.7MB
MD5ec45839a4696527a3fc9142a8587b806
SHA14d21c85ebafec3b2dbc88641d8adcbb058f5742f
SHA25607214eb2d410af50090ac81ba2dc209da11a1ab9e6a306ca2d46c2da82fdd04c
SHA51273d4bb0c8d5dcb8b57d0522af5d835dfa38390e2b02bbb3ee687be574e15c1a8e145247bd7de548aae85098769d56094088897ce8cb4944c491b7a9808b6191c
-
\??\Volume{848480a2-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{0be47e68-66af-4185-86e2-6bb6feba2bcf}_OnDiskSnapshotProp
Filesize6KB
MD5d7856f2af37cdd04a868ee823f6bd407
SHA1f286e7b2bffec7ff12e988663b1e3b752cf78bab
SHA256c8cc884dcd7c2981ca2b45efb40279c1c446b7cea3fd3836ac34c8084efd6767
SHA51277759dfc271b2161fdfa271b0691b6685342bce672376f1f272f3c3d7fc0cf9402d86e74c3041b9eb3533de4de0433c173ecfcc62fe2d8ae277bc4a52bed0c5e