Analysis
-
max time kernel
134s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
29-10-2024 07:28
General
-
Target
Koalageddon-2.0.1.msi
-
Size
46.4MB
-
MD5
155295f8dbaae190dd34adadecfb302e
-
SHA1
c720229eb480dadd40649a2447b3e618a83d568c
-
SHA256
793a6b5980872bc0c16c53ee550f860b90e8955fbbf2f0bd15734e05e9b4c3b8
-
SHA512
cd6d4405bf387faa538426a2cfefdecd4c7f3a649f4cfce1eab85cea22a345f304525d222a48785528b7e19f83b76a536a1895e3f32ea8153d93ddae29850dd7
-
SSDEEP
786432:EdQiEpqgLHk81Ywf/9gK7rhd8cHcSQAw8Luh1CKGSsKN4PgGagUiNaLFRB3p/n4U:GXEvE81vCjSE8yhAc1TgUiNaLFRdlx0e
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 13 IoCs
-
Loads dropped DLL 3 IoCs
-
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 3 IoCs
-
Modifies registry class 23 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Koalageddon-2.0.1.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding E89E1BA75BCED028310FDE04DA4C6EBD C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding F6ACF243DF499EF5FDADA1E1CD14E072 C2⤵
- Loads dropped DLL
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D99D14A8B313F9D71338A415DF586AAB2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
MD56cc7b5f9934222667a33320dff252687
SHA10bcf814bd326a66da6b6c4109db3c757c4fa9ce9
SHA2562b335c0fa9489e097064fa6e42e1a0de10fe91b901650c05de1201b43d07c9b9
SHA51291939aae253ff4ec9eac486926427487c20ee937117240099e63d670c8058c04ce6f1de772fb6073c8e9612265c7638ca2d84d4b6ea8dd358e3abf5eb8bc4f73
-
Filesize
448KB
MD5f3fee249c9335225e3af98f11d805f34
SHA11d5065a559c156c11caf81ebfa9f3366caba76b2
SHA256edfc0e68e302b33410c0bcddca6bd2112f0816861cc9360e22b80c0004852e24
SHA512f0652631f55e2530ff6e4b5462a48df7109a1969f14af8c9778b413fea84a0113e30c9281ff772921a981d45e8dcb9150d141cbc9b33d0fb98d3fec7a62e4896
-
Filesize
33B
MD516989bab922811e28b64ac30449a5d05
SHA151ab20e8c19ee570bf6c496ec7346b7cf17bd04a
SHA25686e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
SHA51286571f127a6755a7339a9ed06e458c8dc5898e528de89e369a13c183711831af0646474986bae6573bc5155058d5f38348d6bfdeb3fd9318e98e0bf7916e6608
-
Filesize
35B
MD54586c3797f538d41b7b2e30e8afebbc9
SHA13419ebac878fa53a9f0ff1617045ddaafb43dce0
SHA2567afb3a2dc57cb16223dddc970e0b464311e5311484c793abf9327a19ef629018
SHA512f2c722ae80d2c0dcdb30a6993864eb90b85be5311261012d4585c6595579582d1b37323613f5417d189adcd096fa948e0378c1e6c59761bf94d65c0a5c2f2fd3
-
Filesize
113KB
MD54fdd16752561cf585fed1506914d73e0
SHA1f00023b9ae3c8ce5b7bb92f25011eaebe6f9d424
SHA256aecd2d2fe766f6d439acc2bbf1346930ecc535012cf5ad7b3273d2875237b7e7
SHA5123695e7eb1e35ec959243a91ab5b4454eb59aeef0f2699aa5de8e03de8fbb89f756a89130526da5c08815408cb700284a17936522ad2cad594c3e6e9d18a3f600
-
Filesize
104KB
MD5e76ab52d50197baddbc0d921e1d8eea5
SHA13789e237ad3b07ef43f4014e99099a0b43b1392d
SHA2566e3dae02524f00ee37f33123f7fac943ed2a8617988ec4a667fcddb7764c634c
SHA512f21b9b45a3b8b079c26568962559d56377fe0cbefde287f4fb763c8fd85df72220858bca598dcbaaa47c0fa23ea9c4ed90375a40d6a55ca062dc373cfbe80c6e
-
Filesize
211KB
MD5a3ae5d86ecf38db9427359ea37a5f646
SHA1eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
SHA256c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
SHA51296ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0
-
Filesize
46.4MB
MD5155295f8dbaae190dd34adadecfb302e
SHA1c720229eb480dadd40649a2447b3e618a83d568c
SHA256793a6b5980872bc0c16c53ee550f860b90e8955fbbf2f0bd15734e05e9b4c3b8
SHA512cd6d4405bf387faa538426a2cfefdecd4c7f3a649f4cfce1eab85cea22a345f304525d222a48785528b7e19f83b76a536a1895e3f32ea8153d93ddae29850dd7
-
Filesize
24.1MB
MD53fca7e2ac8c7ca56ce91edd9aa560d08
SHA105952459be8848bccf8e8a2b6fdb87d84b6828f3
SHA256d411ee3745826f51815226fed38c2fb4029ee12db46c87d73bad27eda5907c10
SHA512cc8024d43bbea441f0091cb0a576028eb9ed208aec52f2e3e265cf02b1d22437d86986d413bd10c1153a43b2aec6e76ba79f956e6423b088bdafaed74d66d01e
-
Filesize
6KB
MD583f88802be5028f01d87de46a470405c
SHA1722f67485f7a9787ec2e116e5d9aa36702f3325c
SHA2569064378b517d48b370d1dbb4c200fe52f8268a5e9b223c42ad0e89d95ee09a82
SHA51232cfad974b4cc09e5560093d37d72765428d48d7ac619837614cb8730645e6d61e7c981c11e162a38b6b279dedaf30b82ccb5a0de705d36e24d2d9c85d15c05e