Overview

overview

10

Static

static

1

92553e176d...df.msi

windows7-x64

8

92553e176d...df.msi

windows10-2004-x64

10

Resubmissions

09-11-2024 15:52

241109-ta7ekawngt 10

09-11-2024 15:17

241109-spgxsaxbmq 10

Analysis

  • max time kernel
    141s
  • max time network
    132s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    09-11-2024 15:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    92553e176daf1cc411113c65eeec0fb2327100fc43356352787844ae85b78fdf.msi

  • Size

    44.6MB

  • MD5

    7ba3fd79c3ccfdb9f1a311a3f05a7d94

  • SHA1

    c4115a8d08ce102bcb14ed00dad86e52e163c81c

  • SHA256

    92553e176daf1cc411113c65eeec0fb2327100fc43356352787844ae85b78fdf

  • SHA512

    f491a16cc375d6756e2debed08e76f01c090ae52b16e7b3eeed2930e0eb8e47e56aada96b54a6dfaa212354d66ca92955a4fc39434a378429f54416f5043048c

  • SSDEEP

    786432:YIRRSEiH0Anyv1JSEyexVA6mcdbTUReEhVzC136g9lceVzgOXTBAaWTAsLBrYuJC:Y+RSnyXSNWvUReEOQg9meVkOXpWXfmMZ

Score
8/10
discoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 7 IoCs
  • Drops file in Program Files directory 19 IoCs
  • Drops file in Windows directory 10 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 22 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 55 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\92553e176daf1cc411113c65eeec0fb2327100fc43356352787844ae85b78fdf.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2592
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1332
    • C:\Windows\system32\MsiExec.exe
      C:\Windows\system32\MsiExec.exe -Embedding 9629F5D0995E5F15862E05B252C1310E M Global\MSI0000
      2⤵
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:1288
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\SustainSleekTutor','C:\Program Files','C:\Program Files'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2964
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c start /min "" "C:\Program Files\SustainSleekTutor\xPrAcumKTQSTxOmHKUhvPkgyTZQeAF.exe" x "C:\Program Files\SustainSleekTutor\lBktGjuuaOaTazRwJvXXhRyefRHhOg" -o"C:\Program Files\SustainSleekTutor\" -p"10551gtm0S(>Gf#qrEw>" -y & ping 127.0.0.1 -n 2 & start /min "" "C:\Program Files\SustainSleekTutor\xPrAcumKTQSTxOmHKUhvPkgyTZQeAF.exe" x "C:\Program Files\SustainSleekTutor\NMnDkvvmlBOPWlKYckpqMpfXmIsbMf" -x!1_bFchqPntlegL.exe -x!sss -x!1_ZyhMwXBzCIJsXiZOsvVNAbbXEpqwBz.exe -x!1_ -x!1_ -x!sa -o"C:\Program Files\SustainSleekTutor\" -p"98858uC(.?=^~2>PRa?!" -y
        3⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:2160
        • C:\Program Files\SustainSleekTutor\xPrAcumKTQSTxOmHKUhvPkgyTZQeAF.exe
          "C:\Program Files\SustainSleekTutor\xPrAcumKTQSTxOmHKUhvPkgyTZQeAF.exe" x "C:\Program Files\SustainSleekTutor\lBktGjuuaOaTazRwJvXXhRyefRHhOg" -o"C:\Program Files\SustainSleekTutor\" -p"10551gtm0S(>Gf#qrEw>" -y
          4⤵
          • Drops file in Program Files directory
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: CmdExeWriteProcessMemorySpam
          • Suspicious use of AdjustPrivilegeToken
          PID:2132
        • C:\Windows\system32\PING.EXE
          ping 127.0.0.1 -n 2
          4⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:992
        • C:\Program Files\SustainSleekTutor\xPrAcumKTQSTxOmHKUhvPkgyTZQeAF.exe
          "C:\Program Files\SustainSleekTutor\xPrAcumKTQSTxOmHKUhvPkgyTZQeAF.exe" x "C:\Program Files\SustainSleekTutor\NMnDkvvmlBOPWlKYckpqMpfXmIsbMf" -x!1_bFchqPntlegL.exe -x!sss -x!1_ZyhMwXBzCIJsXiZOsvVNAbbXEpqwBz.exe -x!1_ -x!1_ -x!sa -o"C:\Program Files\SustainSleekTutor\" -p"98858uC(.?=^~2>PRa?!" -y
          4⤵
          • Drops file in Program Files directory
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: CmdExeWriteProcessMemorySpam
          • Suspicious use of AdjustPrivilegeToken
          PID:3036
      • C:\Program Files\SustainSleekTutor\bFchqPntlegL.exe
        "C:\Program Files\SustainSleekTutor\bFchqPntlegL.exe" -number 127 -file file3 -mode mode3
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2136
      • C:\Program Files\SustainSleekTutor\tsetup.exe
        "C:\Program Files\SustainSleekTutor\tsetup.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:640
        • C:\Users\Admin\AppData\Local\Temp\is-E0J9U.tmp\tsetup.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-E0J9U.tmp\tsetup.tmp" /SL5="$801FC,44246395,814592,C:\Program Files\SustainSleekTutor\tsetup.exe"
          4⤵
          • Drops file in System32 directory
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:848
          • C:\Users\Admin\AppData\Roaming\Telegram Desktop\Telegram.exe
            "C:\Users\Admin\AppData\Roaming\Telegram Desktop\Telegram.exe"
            5⤵
            • Drops file in System32 directory
            • Executes dropped EXE
            • Loads dropped DLL
            • Enumerates system info in registry
            • Modifies data under HKEY_USERS
            • Suspicious behavior: AddClipboardFormatListener
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:2960
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2396
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003D0" "00000000000004C4"
    1⤵
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    PID:2912

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Config.Msi\f76d2bc.rbs
    Filesize

    7KB

    MD5

    ed46bb3d75d948aeb94df3f780265460

    SHA1

    c1d2151fd876707c69a7747cfebc07320398fcbb

    SHA256

    c9fe3c4ee09313f239dc71fd3d105544edd6b6bc2512ee6b02195177fb9ff7fe

    SHA512

    78209494c1f2fcf99cae3498de87807975fe32023d7773ef0de1de13a61fd0776701589f2be0d55c2970339105052cec27cf42779fbab1ec5aa0352a6a1956dd

    Download Submit

  • C:\Program Files\SustainSleekTutor\2_bFchqPntlegL.exe
    Filesize

    2.1MB

    MD5

    90134a5b913cd5d9d993f6f58601740e

    SHA1

    c6fc923eae06097227dab095633a0c47beba327a

    SHA256

    8462d6b3f1a8037f6f60412d3f4e0ecad89aaed3c10915ffa1e602c5ae8b0942

    SHA512

    7385ebcce7e33efb3a9b26d9690d8a2a221bc05071bc499f313de2de8d31935dd0cdd366ac7baccd4004d9e1eb27a0471328785ad1acf325054fd036d4b9dd61

    Download Submit

  • C:\Program Files\SustainSleekTutor\NMnDkvvmlBOPWlKYckpqMpfXmIsbMf
    Filesize

    1.5MB

    MD5

    17f3ece27717fa4a5ad13f06e6c2846e

    SHA1

    47b8230c0f0dd0b8a451bd378203a0ec0aaa13f6

    SHA256

    f0217b72add9c431299fda7983e8a7c592f6b4cd5a1df5118208c19dc7251c86

    SHA512

    998dcba619566edba18b2dcaefd8e86d1d6c09340c8004cf487d6944bb2a90b75231f2d3140162bcf0a161321d5febccf7d947d4752451424082f3cd06de9b7b

    Download Submit

  • C:\Program Files\SustainSleekTutor\lBktGjuuaOaTazRwJvXXhRyefRHhOg
    Filesize

    1.5MB

    MD5

    86e0062ac9e3c38a69470a57bb619533

    SHA1

    7d04a283f51e145724e20a5925ee811a4645e5d9

    SHA256

    42a64f04499a0836946073eb7bfc1cb67a98faa58d65eeb09fb6ac8fccc7f547

    SHA512

    aefc23fcf566748b60de0e95268f834cef3e4cfb1754b18e9ea2e1a867a764d027d43c68aad2b7c3f4520b3232fd50430c2b7fb4494dee223ac340a8c1e67794

    Download Submit

  • C:\Program Files\SustainSleekTutor\tsetup.exe
    Filesize

    43.1MB

    MD5

    8a53cf72375f6899082463c36422d411

    SHA1

    161d9d3b21bf0d9a9790b92013ec76c6d839af06

    SHA256

    1b31e3758c4b158143dc41c7c4617984d958760d8d7718e1e38492c67f6bbf65

    SHA512

    daadba04fb90002a2cb8e44c1b98d6bf702b9cfe33d3b6dc981c877e0a77c620f2538a2748f2fb4e88493e326cc45764c54dad659d8d2d018b74b24fd727a190

    Download Submit

  • C:\Program Files\SustainSleekTutor\xPrAcumKTQSTxOmHKUhvPkgyTZQeAF.exe
    Filesize

    577KB

    MD5

    c31c4b04558396c6fabab64dcf366534

    SHA1

    fa836d92edc577d6a17ded47641ba1938589b09a

    SHA256

    9d182f421381429fd77598feb609fefb54dcaef722ddbf5aa611b68a706c10d3

    SHA512

    814dcbc1d43bc037dadc2f3f67856dd790b15fc1b0c50fa74a169c8cc02cdc79d44f1f10e200ef662eee20cd6b5ca646ec4e77673e3fe3cb7dfb7649243f6e99

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Cab850A.tmp
    Filesize

    29KB

    MD5

    d59a6b36c5a94916241a3ead50222b6f

    SHA1

    e274e9486d318c383bc4b9812844ba56f0cff3c6

    SHA256

    a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53

    SHA512

    17012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Telegram Desktop\modules\x64\d3d\d3dcompiler_47.dll
    Filesize

    4.7MB

    MD5

    a7349236212b0e5cec2978f2cfa49a1a

    SHA1

    5abb08949162fd1985b89ffad40aaf5fc769017e

    SHA256

    a05d04a270f68c8c6d6ea2d23bebf8cd1d5453b26b5442fa54965f90f1c62082

    SHA512

    c7ff4f9146fefedc199360aa04236294349c881b3865ebc58c5646ad6b3f83fca309de1173f5ebf823a14ba65e5ada77b46f20286d1ea62c37e17adbc9a82d02

    Download Submit

  • C:\Windows\Installer\f76d2ba.msi
    Filesize

    44.6MB

    MD5

    7ba3fd79c3ccfdb9f1a311a3f05a7d94

    SHA1

    c4115a8d08ce102bcb14ed00dad86e52e163c81c

    SHA256

    92553e176daf1cc411113c65eeec0fb2327100fc43356352787844ae85b78fdf

    SHA512

    f491a16cc375d6756e2debed08e76f01c090ae52b16e7b3eeed2930e0eb8e47e56aada96b54a6dfaa212354d66ca92955a4fc39434a378429f54416f5043048c

    Download Submit

  • C:\Windows\SysWOW64\config\systemprofile\Saved Games\desktop.ini
    Filesize

    282B

    MD5

    b441cf59b5a64f74ac3bed45be9fadfc

    SHA1

    3da72a52e451a26ca9a35611fa8716044a7c0bbc

    SHA256

    e6fdf8ed07b19b2a3b8eff05de7bc71152c85b377b9226f126dc54b58b930311

    SHA512

    fdc26609a674d36f5307fa3f1c212da1f87a5c4cd463d861ce1bd2e614533f07d943510abed0c2edeb07a55f1dccff37db7e1f5456705372d5da8e12d83f0bb3

    Download Submit

  • \Users\Admin\AppData\Local\Temp\is-E0J9U.tmp\tsetup.tmp
    Filesize

    3.0MB

    MD5

    d90927477dbf0725af0a10e151c184c4

    SHA1

    4cd69b23ee9c1efe9bd539f0fef841a09a4a773e

    SHA256

    43182a0ae7e22cc7f9b8028dc71e82826c80e9ac265f8d2dfa08876bb41b7029

    SHA512

    bfbd62482e99127c1bf621a135b464b5f96b86adfcb9064660c0dc1052099643ea9485e1358a758ab466f19c97042dafccb781e157203ea51e43956e4b6f4f98

    Download Submit

  • memory/640-78-0x0000000000400000-0x00000000004D4000-memory.dmp

    Filesize

    848KB

    Download

  • memory/640-48-0x0000000000400000-0x00000000004D4000-memory.dmp

    Filesize

    848KB

    Download

  • memory/640-122-0x0000000000400000-0x00000000004D4000-memory.dmp

    Filesize

    848KB

    Download

  • memory/848-79-0x0000000000400000-0x0000000000710000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/848-81-0x0000000000400000-0x0000000000710000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/848-102-0x0000000000400000-0x0000000000710000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/848-119-0x0000000000400000-0x0000000000710000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/1288-12-0x0000000000210000-0x0000000000220000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2136-65-0x000000002B0F0000-0x000000002B11F000-memory.dmp

    Filesize

    188KB

    Download

  • memory/2960-114-0x00000000002B0000-0x00000000002BA000-memory.dmp

    Filesize

    40KB

    Download

  • memory/2960-115-0x00000000002B0000-0x00000000002BA000-memory.dmp

    Filesize

    40KB

    Download

  • memory/2960-135-0x0000000000310000-0x000000000031A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/2960-134-0x0000000000310000-0x000000000031A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/2960-193-0x00000000002B0000-0x00000000002BA000-memory.dmp

    Filesize

    40KB

    Download

  • memory/2960-192-0x00000000002B0000-0x00000000002BA000-memory.dmp

    Filesize

    40KB

    Download

  • memory/2960-198-0x0000000000310000-0x000000000031A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/2960-199-0x0000000000310000-0x000000000031A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/2960-213-0x0000000000310000-0x000000000031A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/2964-18-0x0000000002040000-0x0000000002048000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2964-17-0x000000001B450000-0x000000001B732000-memory.dmp

    Filesize

    2.9MB

    Download