0aa00ca752764f9721879a56838d67777c008bef2c040d630d91b25e14687575

General

Target

Firefox_huohu-X64.msi
Size

58.1MB
MD5

85c102394508d381d9614de6c6d416bd
SHA1

b649cdb0ea2913bbc4ecc6f18bea092094b94a73
SHA256

0aa00ca752764f9721879a56838d67777c008bef2c040d630d91b25e14687575
SHA512

e635ae88563e1bf1714fb02c49cb4573026e808c224c67a22fd4e35010492f4c192b8c585550b30497eb07693316bbfcf71d1cb3a9fa79befee0c14aa0813f20
SSDEEP

1572864:zRJMEgqgbkD9c8WV/8EUuoVwIx7kZZFxw2eTy:gEgRbkJc8vEAVwQ2em

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

300 powershell.exe

pid	process
300	powershell.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Drops file in Program Files directory 17 IoCs

Processes:

maijEnyzzzNSfcTGbjNbJzJStElLTR.exemaijEnyzzzNSfcTGbjNbJzJStElLTR.exeiSeiWroKLIBt.exeMsiExec.exemsiexec.exe

description	ioc	process
File created	C:\Program Files\FacilitateLivelyTrader\VublDMXMdQDxkVcGJXeKmSKZaTZMsK	maijEnyzzzNSfcTGbjNbJzJStElLTR.exe
File opened for modification	C:\Program Files\FacilitateLivelyTrader\iSeiWroKLIBt	maijEnyzzzNSfcTGbjNbJzJStElLTR.exe
File opened for modification	C:\Program Files\FacilitateLivelyTrader\2_iSeiWroKLIBt.exe	maijEnyzzzNSfcTGbjNbJzJStElLTR.exe
File created	C:\Program Files\FacilitateLivelyTrader\2_iSeiWroKLIBt.exe	maijEnyzzzNSfcTGbjNbJzJStElLTR.exe
File created	C:\Program Files\FacilitateLivelyTrader\wMzzBEfykyNn.exe	maijEnyzzzNSfcTGbjNbJzJStElLTR.exe
File created	C:\Program Files\FacilitateLivelyTrader\iSeiWroKLIBt.vbs	iSeiWroKLIBt.exe
File opened for modification	C:\Program Files\FacilitateLivelyTrader\iSeiWroKLIBt.exe	MsiExec.exe
File created	C:\Program Files\FacilitateLivelyTrader\Firefox64_116.0.3.8627.exe	msiexec.exe
File created	C:\Program Files\FacilitateLivelyTrader\maijEnyzzzNSfcTGbjNbJzJStElLTR.exe	msiexec.exe
File created	C:\Program Files\FacilitateLivelyTrader\nCwFdlWQriESwgzBGBmGkKSUAZWlSU	msiexec.exe
File created	C:\Program Files\FacilitateLivelyTrader\valibclang2d.dll	msiexec.exe
File created	C:\Program Files\FacilitateLivelyTrader\iSeiWroKLIBt	maijEnyzzzNSfcTGbjNbJzJStElLTR.exe
File created	C:\Program Files\FacilitateLivelyTrader\wMzzBEfykyNn.xml	maijEnyzzzNSfcTGbjNbJzJStElLTR.exe
File opened for modification	C:\Program Files\FacilitateLivelyTrader\wMzzBEfykyNn.exe	maijEnyzzzNSfcTGbjNbJzJStElLTR.exe
File opened for modification	C:\Program Files\FacilitateLivelyTrader\VublDMXMdQDxkVcGJXeKmSKZaTZMsK	maijEnyzzzNSfcTGbjNbJzJStElLTR.exe
File opened for modification	C:\Program Files\FacilitateLivelyTrader\wMzzBEfykyNn.xml	maijEnyzzzNSfcTGbjNbJzJStElLTR.exe
File created	C:\Program Files\FacilitateLivelyTrader\iSeiWroKLIBt.exe	MsiExec.exe

Drops file in Windows directory 10 IoCs

Processes:

msiexec.exeDrvInst.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDEAC.tmp	msiexec.exe
File created	C:\Windows\Installer\f76dd96.msi	msiexec.exe
File created	C:\Windows\Installer\f76dd93.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f76dd93.msi	msiexec.exe
File created	C:\Windows\Installer\f76dd94.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\f76dd94.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe

Executes dropped EXE 5 IoCs

Processes:

maijEnyzzzNSfcTGbjNbJzJStElLTR.exemaijEnyzzzNSfcTGbjNbJzJStElLTR.exeiSeiWroKLIBt.exeFirefox64_116.0.3.8627.exesetup.exe

pid	process
1912	maijEnyzzzNSfcTGbjNbJzJStElLTR.exe
2812	maijEnyzzzNSfcTGbjNbJzJStElLTR.exe
3016	iSeiWroKLIBt.exe
1400	Firefox64_116.0.3.8627.exe
1920	setup.exe

Loads dropped DLL 2 IoCs

Processes:

Firefox64_116.0.3.8627.exesetup.exe

pid process

1400 Firefox64_116.0.3.8627.exe
1920 setup.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
persistence privilege_escalation

Installer Packages
T1546.016

Msiexec
T1218.007

Processes:

msiexec.exe

pid process

1840 msiexec.exe

pid	process
1400	Firefox64_116.0.3.8627.exe
1920	setup.exe

pid	process
1840	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

Firefox64_116.0.3.8627.exeiSeiWroKLIBt.exesetup.exemaijEnyzzzNSfcTGbjNbJzJStElLTR.exemaijEnyzzzNSfcTGbjNbJzJStElLTR.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Firefox64_116.0.3.8627.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iSeiWroKLIBt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	maijEnyzzzNSfcTGbjNbJzJStElLTR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	maijEnyzzzNSfcTGbjNbJzJStElLTR.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
discovery

Internet Connection Discovery
T1016.001

Processes:

cmd.exePING.EXE

pid process

1948 cmd.exe
1712 PING.EXE

pid	process
1948	cmd.exe
1712	PING.EXE

Modifies data under HKEY_USERS 48 IoCs

Processes:

DrvInst.exepowershell.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = c0b96b519e39db01	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe

Modifies registry class 22 IoCs

Processes:

msiexec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A4B62B8F0C0F5A4AA8F1E23F100F89A\SourceList\PackageName = "Firefox_huohu-X64.msi"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A4B62B8F0C0F5A4AA8F1E23F100F89A\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A4B62B8F0C0F5A4AA8F1E23F100F89A\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A4B62B8F0C0F5A4AA8F1E23F100F89A\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A4B62B8F0C0F5A4AA8F1E23F100F89A\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A4B62B8F0C0F5A4AA8F1E23F100F89A\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A4B62B8F0C0F5A4AA8F1E23F100F89A\PackageCode = "3627251E5EF768842A40F504531667A5"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A4B62B8F0C0F5A4AA8F1E23F100F89A\Version = "17367045"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\6B835E147A3D2814C844C173D567645D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\6B835E147A3D2814C844C173D567645D\5A4B62B8F0C0F5A4AA8F1E23F100F89A	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A4B62B8F0C0F5A4AA8F1E23F100F89A\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5A4B62B8F0C0F5A4AA8F1E23F100F89A	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A4B62B8F0C0F5A4AA8F1E23F100F89A\ProductName = "FacilitateLivelyTrader"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A4B62B8F0C0F5A4AA8F1E23F100F89A\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A4B62B8F0C0F5A4AA8F1E23F100F89A\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A4B62B8F0C0F5A4AA8F1E23F100F89A\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A4B62B8F0C0F5A4AA8F1E23F100F89A\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A4B62B8F0C0F5A4AA8F1E23F100F89A\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5A4B62B8F0C0F5A4AA8F1E23F100F89A\ProductFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A4B62B8F0C0F5A4AA8F1E23F100F89A	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A4B62B8F0C0F5A4AA8F1E23F100F89A\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A4B62B8F0C0F5A4AA8F1E23F100F89A\SourceList\Net	msiexec.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1712 PING.EXE
Suspicious behavior: CmdExeWriteProcessMemorySpam 2 IoCs

Processes:

maijEnyzzzNSfcTGbjNbJzJStElLTR.exemaijEnyzzzNSfcTGbjNbJzJStElLTR.exe

pid process

1912 maijEnyzzzNSfcTGbjNbJzJStElLTR.exe
2812 maijEnyzzzNSfcTGbjNbJzJStElLTR.exe

pid	process
1712	PING.EXE

Suspicious behavior: EnumeratesProcesses 53 IoCs

Processes:

msiexec.exepowershell.exeiSeiWroKLIBt.exe

pid	process
2088	msiexec.exe
2088	msiexec.exe
300	powershell.exe
3016	iSeiWroKLIBt.exe
3016	iSeiWroKLIBt.exe
3016	iSeiWroKLIBt.exe
3016	iSeiWroKLIBt.exe
3016	iSeiWroKLIBt.exe
3016	iSeiWroKLIBt.exe
3016	iSeiWroKLIBt.exe
3016	iSeiWroKLIBt.exe
3016	iSeiWroKLIBt.exe
3016	iSeiWroKLIBt.exe
3016	iSeiWroKLIBt.exe
3016	iSeiWroKLIBt.exe
3016	iSeiWroKLIBt.exe
3016	iSeiWroKLIBt.exe
3016	iSeiWroKLIBt.exe
3016	iSeiWroKLIBt.exe
3016	iSeiWroKLIBt.exe
3016	iSeiWroKLIBt.exe
3016	iSeiWroKLIBt.exe
3016	iSeiWroKLIBt.exe
3016	iSeiWroKLIBt.exe
3016	iSeiWroKLIBt.exe
3016	iSeiWroKLIBt.exe
3016	iSeiWroKLIBt.exe
3016	iSeiWroKLIBt.exe
3016	iSeiWroKLIBt.exe
3016	iSeiWroKLIBt.exe
3016	iSeiWroKLIBt.exe
3016	iSeiWroKLIBt.exe
3016	iSeiWroKLIBt.exe
3016	iSeiWroKLIBt.exe
3016	iSeiWroKLIBt.exe
3016	iSeiWroKLIBt.exe
3016	iSeiWroKLIBt.exe
3016	iSeiWroKLIBt.exe
3016	iSeiWroKLIBt.exe
3016	iSeiWroKLIBt.exe
3016	iSeiWroKLIBt.exe
3016	iSeiWroKLIBt.exe
3016	iSeiWroKLIBt.exe
3016	iSeiWroKLIBt.exe
3016	iSeiWroKLIBt.exe
3016	iSeiWroKLIBt.exe
3016	iSeiWroKLIBt.exe
3016	iSeiWroKLIBt.exe
3016	iSeiWroKLIBt.exe
3016	iSeiWroKLIBt.exe
3016	iSeiWroKLIBt.exe
3016	iSeiWroKLIBt.exe
3016	iSeiWroKLIBt.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

setup.exe

pid process

1920 setup.exe

pid	process
1920	setup.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exeDrvInst.exepowershell.exemaijEnyzzzNSfcTGbjNbJzJStElLTR.exemaijEnyzzzNSfcTGbjNbJzJStElLTR.exe

description	pid	process
Token: SeShutdownPrivilege	1840	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1840	msiexec.exe
Token: SeRestorePrivilege	2088	msiexec.exe
Token: SeTakeOwnershipPrivilege	2088	msiexec.exe
Token: SeSecurityPrivilege	2088	msiexec.exe
Token: SeCreateTokenPrivilege	1840	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1840	msiexec.exe
Token: SeLockMemoryPrivilege	1840	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1840	msiexec.exe
Token: SeMachineAccountPrivilege	1840	msiexec.exe
Token: SeTcbPrivilege	1840	msiexec.exe
Token: SeSecurityPrivilege	1840	msiexec.exe
Token: SeTakeOwnershipPrivilege	1840	msiexec.exe
Token: SeLoadDriverPrivilege	1840	msiexec.exe
Token: SeSystemProfilePrivilege	1840	msiexec.exe
Token: SeSystemtimePrivilege	1840	msiexec.exe
Token: SeProfSingleProcessPrivilege	1840	msiexec.exe
Token: SeIncBasePriorityPrivilege	1840	msiexec.exe
Token: SeCreatePagefilePrivilege	1840	msiexec.exe
Token: SeCreatePermanentPrivilege	1840	msiexec.exe
Token: SeBackupPrivilege	1840	msiexec.exe
Token: SeRestorePrivilege	1840	msiexec.exe
Token: SeShutdownPrivilege	1840	msiexec.exe
Token: SeDebugPrivilege	1840	msiexec.exe
Token: SeAuditPrivilege	1840	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1840	msiexec.exe
Token: SeChangeNotifyPrivilege	1840	msiexec.exe
Token: SeRemoteShutdownPrivilege	1840	msiexec.exe
Token: SeUndockPrivilege	1840	msiexec.exe
Token: SeSyncAgentPrivilege	1840	msiexec.exe
Token: SeEnableDelegationPrivilege	1840	msiexec.exe
Token: SeManageVolumePrivilege	1840	msiexec.exe
Token: SeImpersonatePrivilege	1840	msiexec.exe
Token: SeCreateGlobalPrivilege	1840	msiexec.exe
Token: SeBackupPrivilege	1848	vssvc.exe
Token: SeRestorePrivilege	1848	vssvc.exe
Token: SeAuditPrivilege	1848	vssvc.exe
Token: SeBackupPrivilege	2088	msiexec.exe
Token: SeRestorePrivilege	2088	msiexec.exe
Token: SeRestorePrivilege	2748	DrvInst.exe
Token: SeRestorePrivilege	2748	DrvInst.exe
Token: SeRestorePrivilege	2748	DrvInst.exe
Token: SeRestorePrivilege	2748	DrvInst.exe
Token: SeRestorePrivilege	2748	DrvInst.exe
Token: SeRestorePrivilege	2748	DrvInst.exe
Token: SeRestorePrivilege	2748	DrvInst.exe
Token: SeLoadDriverPrivilege	2748	DrvInst.exe
Token: SeLoadDriverPrivilege	2748	DrvInst.exe
Token: SeLoadDriverPrivilege	2748	DrvInst.exe
Token: SeRestorePrivilege	2088	msiexec.exe
Token: SeTakeOwnershipPrivilege	2088	msiexec.exe
Token: SeRestorePrivilege	2088	msiexec.exe
Token: SeTakeOwnershipPrivilege	2088	msiexec.exe
Token: SeRestorePrivilege	2088	msiexec.exe
Token: SeTakeOwnershipPrivilege	2088	msiexec.exe
Token: SeDebugPrivilege	300	powershell.exe
Token: SeRestorePrivilege	1912	maijEnyzzzNSfcTGbjNbJzJStElLTR.exe
Token: 35	1912	maijEnyzzzNSfcTGbjNbJzJStElLTR.exe
Token: SeSecurityPrivilege	1912	maijEnyzzzNSfcTGbjNbJzJStElLTR.exe
Token: SeSecurityPrivilege	1912	maijEnyzzzNSfcTGbjNbJzJStElLTR.exe
Token: SeRestorePrivilege	2812	maijEnyzzzNSfcTGbjNbJzJStElLTR.exe
Token: 35	2812	maijEnyzzzNSfcTGbjNbJzJStElLTR.exe
Token: SeSecurityPrivilege	2812	maijEnyzzzNSfcTGbjNbJzJStElLTR.exe
Token: SeSecurityPrivilege	2812	maijEnyzzzNSfcTGbjNbJzJStElLTR.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

1840 msiexec.exe
1840 msiexec.exe

pid	process
1840	msiexec.exe
1840	msiexec.exe

Suspicious use of WriteProcessMemory 37 IoCs

Processes:

msiexec.exeMsiExec.execmd.exeFirefox64_116.0.3.8627.exe

description	pid	process	target process
PID 2088 wrote to memory of 1876	2088	msiexec.exe	MsiExec.exe
PID 2088 wrote to memory of 1876	2088	msiexec.exe	MsiExec.exe
PID 2088 wrote to memory of 1876	2088	msiexec.exe	MsiExec.exe
PID 2088 wrote to memory of 1876	2088	msiexec.exe	MsiExec.exe
PID 2088 wrote to memory of 1876	2088	msiexec.exe	MsiExec.exe
PID 1876 wrote to memory of 300	1876	MsiExec.exe	powershell.exe
PID 1876 wrote to memory of 300	1876	MsiExec.exe	powershell.exe
PID 1876 wrote to memory of 300	1876	MsiExec.exe	powershell.exe
PID 1876 wrote to memory of 1948	1876	MsiExec.exe	cmd.exe
PID 1876 wrote to memory of 1948	1876	MsiExec.exe	cmd.exe
PID 1876 wrote to memory of 1948	1876	MsiExec.exe	cmd.exe
PID 1948 wrote to memory of 1912	1948	cmd.exe	maijEnyzzzNSfcTGbjNbJzJStElLTR.exe
PID 1948 wrote to memory of 1912	1948	cmd.exe	maijEnyzzzNSfcTGbjNbJzJStElLTR.exe
PID 1948 wrote to memory of 1912	1948	cmd.exe	maijEnyzzzNSfcTGbjNbJzJStElLTR.exe
PID 1948 wrote to memory of 1912	1948	cmd.exe	maijEnyzzzNSfcTGbjNbJzJStElLTR.exe
PID 1948 wrote to memory of 1712	1948	cmd.exe	PING.EXE
PID 1948 wrote to memory of 1712	1948	cmd.exe	PING.EXE
PID 1948 wrote to memory of 1712	1948	cmd.exe	PING.EXE
PID 1948 wrote to memory of 2812	1948	cmd.exe	maijEnyzzzNSfcTGbjNbJzJStElLTR.exe
PID 1948 wrote to memory of 2812	1948	cmd.exe	maijEnyzzzNSfcTGbjNbJzJStElLTR.exe
PID 1948 wrote to memory of 2812	1948	cmd.exe	maijEnyzzzNSfcTGbjNbJzJStElLTR.exe
PID 1948 wrote to memory of 2812	1948	cmd.exe	maijEnyzzzNSfcTGbjNbJzJStElLTR.exe
PID 1876 wrote to memory of 3016	1876	MsiExec.exe	iSeiWroKLIBt.exe
PID 1876 wrote to memory of 3016	1876	MsiExec.exe	iSeiWroKLIBt.exe
PID 1876 wrote to memory of 3016	1876	MsiExec.exe	iSeiWroKLIBt.exe
PID 1876 wrote to memory of 3016	1876	MsiExec.exe	iSeiWroKLIBt.exe
PID 1876 wrote to memory of 1400	1876	MsiExec.exe	Firefox64_116.0.3.8627.exe
PID 1876 wrote to memory of 1400	1876	MsiExec.exe	Firefox64_116.0.3.8627.exe
PID 1876 wrote to memory of 1400	1876	MsiExec.exe	Firefox64_116.0.3.8627.exe
PID 1876 wrote to memory of 1400	1876	MsiExec.exe	Firefox64_116.0.3.8627.exe
PID 1400 wrote to memory of 1920	1400	Firefox64_116.0.3.8627.exe	setup.exe
PID 1400 wrote to memory of 1920	1400	Firefox64_116.0.3.8627.exe	setup.exe
PID 1400 wrote to memory of 1920	1400	Firefox64_116.0.3.8627.exe	setup.exe
PID 1400 wrote to memory of 1920	1400	Firefox64_116.0.3.8627.exe	setup.exe
PID 1400 wrote to memory of 1920	1400	Firefox64_116.0.3.8627.exe	setup.exe
PID 1400 wrote to memory of 1920	1400	Firefox64_116.0.3.8627.exe	setup.exe
PID 1400 wrote to memory of 1920	1400	Firefox64_116.0.3.8627.exe	setup.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Firefox_huohu-X64.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1840

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding 71C0BA746EC233511C15AD0E4271CFDB M Global\MSI0000
  2⤵
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:1876
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\FacilitateLivelyTrader'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:300
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start /min "" "C:\Program Files\FacilitateLivelyTrader\maijEnyzzzNSfcTGbjNbJzJStElLTR.exe" x "C:\Program Files\FacilitateLivelyTrader\nCwFdlWQriESwgzBGBmGkKSUAZWlSU" -o"C:\Program Files\FacilitateLivelyTrader\" -p"36908^{A*neaZ}Bl.=vm" -y & ping 127.0.0.1 -n 2 & start /min "" "C:\Program Files\FacilitateLivelyTrader\maijEnyzzzNSfcTGbjNbJzJStElLTR.exe" x "C:\Program Files\FacilitateLivelyTrader\VublDMXMdQDxkVcGJXeKmSKZaTZMsK" -x!1_iSeiWroKLIBt.exe -o"C:\Program Files\FacilitateLivelyTrader\" -p"66052?wI56S:MGE)D:q}" -y
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:1948
  - - C:\Program Files\FacilitateLivelyTrader\maijEnyzzzNSfcTGbjNbJzJStElLTR.exe
      "C:\Program Files\FacilitateLivelyTrader\maijEnyzzzNSfcTGbjNbJzJStElLTR.exe" x "C:\Program Files\FacilitateLivelyTrader\nCwFdlWQriESwgzBGBmGkKSUAZWlSU" -o"C:\Program Files\FacilitateLivelyTrader\" -p"36908^{A*neaZ}Bl.=vm" -y
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: CmdExeWriteProcessMemorySpam
      Suspicious use of AdjustPrivilegeToken
      PID:1912
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1712
  - - C:\Program Files\FacilitateLivelyTrader\maijEnyzzzNSfcTGbjNbJzJStElLTR.exe
      "C:\Program Files\FacilitateLivelyTrader\maijEnyzzzNSfcTGbjNbJzJStElLTR.exe" x "C:\Program Files\FacilitateLivelyTrader\VublDMXMdQDxkVcGJXeKmSKZaTZMsK" -x!1_iSeiWroKLIBt.exe -o"C:\Program Files\FacilitateLivelyTrader\" -p"66052?wI56S:MGE)D:q}" -y
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: CmdExeWriteProcessMemorySpam
      Suspicious use of AdjustPrivilegeToken
      PID:2812
- - C:\Program Files\FacilitateLivelyTrader\iSeiWroKLIBt.exe
    "C:\Program Files\FacilitateLivelyTrader\iSeiWroKLIBt.exe" -number 182 -file file3 -mode mode3
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3016
- - C:\Program Files\FacilitateLivelyTrader\Firefox64_116.0.3.8627.exe
    "C:\Program Files\FacilitateLivelyTrader\Firefox64_116.0.3.8627.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1400
  - - C:\Users\Admin\AppData\Local\Temp\7zS8755D4F6\setup.exe
      .\setup.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: GetForegroundWindowSpam
      PID:1920

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1848

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "000000000000059C" "00000000000003B8"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Event Triggered Execution

1

T1546

Installer Packages

1

T1546.016

Privilege Escalation

Event Triggered Execution

1

T1546

Installer Packages

1

T1546.016

Defense Evasion

System Binary Proxy Execution

1

T1218

Msiexec

1

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f76dd95.rbs

Filesize
7KB

MD5
62deba2123ab38a00f1c17e35efd87a0

SHA1
8ce541e56937ef21c37531540380ea4400139426

SHA256
9e5dba0b7f1900762448ad9417a73451a23d84c755914a0e65006eb13a2c278c

SHA512
2c63b70dc7f42fa89140d380ba11139bd04d129bfbc5346a36244f6966d4567919a88359e8923aa6201254fe8b347587624b098eaa4c863611c0492d223acc3d

Download Submit
C:\Program Files\FacilitateLivelyTrader\2_iSeiWroKLIBt.exe

Filesize
2.1MB

MD5
11ca5e4f6a371395d45aad01aee5a439

SHA1
5f090f754164cdad4f5416d0c5a0310da609f407

SHA256
d7f9881401ac68cdfb410ec8be47bdc698d1215144f9d51bfec5f9d085166e21

SHA512
15292f5c94e1ecb0d3534759b97d5124cf3916ba52c12b97ef8f5e58c33be3006bd5e1981f233c8d69f9a07fd470fdcc073b7653cc4438c39282120ac387128c

Download Submit
C:\Program Files\FacilitateLivelyTrader\VublDMXMdQDxkVcGJXeKmSKZaTZMsK

Filesize
1.5MB

MD5
962fd52d66d725f2050c39d645df3a7a

SHA1
25fdb580cbd6f272d5eff3534d0b30d6812f2612

SHA256
ca5b528d55cb88ca9579a4bb4e548b5b5b5c246a95c477ca77e01c427b400cab

SHA512
cf966c612f06ed468d4313c5b925b22b72039aeef7949c896d5ddc7f05c4818aa2d49836d40a6bf8e0de5519566124c329bcc4e0846f55ee097bf15187c19588

Download Submit
C:\Program Files\FacilitateLivelyTrader\maijEnyzzzNSfcTGbjNbJzJStElLTR.exe

Filesize
577KB

MD5
c31c4b04558396c6fabab64dcf366534

SHA1
fa836d92edc577d6a17ded47641ba1938589b09a

SHA256
9d182f421381429fd77598feb609fefb54dcaef722ddbf5aa611b68a706c10d3

SHA512
814dcbc1d43bc037dadc2f3f67856dd790b15fc1b0c50fa74a169c8cc02cdc79d44f1f10e200ef662eee20cd6b5ca646ec4e77673e3fe3cb7dfb7649243f6e99

Download Submit
C:\Program Files\FacilitateLivelyTrader\nCwFdlWQriESwgzBGBmGkKSUAZWlSU

Filesize
1.5MB

MD5
5ce7742a647a882a26bd7abcbd61e5b5

SHA1
19255ad462c274c9d308f1deedc1fa36876ded66

SHA256
3e2a3e66e710dcdc1ec4f1709fcc6d707d8eb80b1e264a37463b243b9cb0bfbe

SHA512
ee506fcfb7c340cf931743a21452353038f94a1b752b8003352b4b34bc85bae80bbf97d1adcd6d53bd7f65512352e93f86e8de1bebcab808ba0f8f903c18401c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8755D4F6\core\distribution\setup.ini

Filesize
944B

MD5
f4a91ae38239ad45b535a0abe3a5a8d8

SHA1
81c2d123964a2d344e20d363722bd89fdea89a96

SHA256
63a573475810f03ab2c6eb8af2a767ed13ed0ff2b6ea66cb72f43b6f3fbe7567

SHA512
75e9cc2c826c6965c00dceb8c6e4e9b12636efc2c9a9814e29143885ebdb805180f1188907257fb8013a53091708d4f260c241d284a6182a865668c6b05e3d7e

Download Submit
\Users\Admin\AppData\Local\Temp\7zS8755D4F6\setup.exe

Filesize
936KB

MD5
a550c0d09394744b4ea1da92f82884c1

SHA1
6dc4acc070467f73461a50bd37666999ff612dac

SHA256
f4fa18a1f310f124430844d276c3f0fa46f69582b67ec50aa2fa0cd2860208ed

SHA512
0ac11bbc5efe3a734176f1b990e7c473251994203595612e6ff1354b0204153e3e762d2b3ad5d936ca294341d022639f1120633f54bf200ae15bed8c5edbb233

Download Submit
\Users\Admin\AppData\Local\Temp\nst8C8.tmp\System.dll

Filesize
22KB

MD5
b361682fa5e6a1906e754cfa08aa8d90

SHA1
c6701aee0c866565de1b7c1f81fd88da56b395d3

SHA256
b711c4f17690421c9dc8ddb9ed5a9ddc539b3a28f11e19c851e25dcfc7701c04

SHA512
2778f91c9bcf83277d26c71118a1ccb0fb3ce50e89729f14f4915bc65dd48503a77b1e5118ce774dea72f5ce3cc8681eb9ca3c55cf90e9f61a177101ba192ae9

Download Submit
memory/300-17-0x000000001B570000-0x000000001B852000-memory.dmp

Filesize
2.9MB

Download
memory/300-18-0x0000000002300000-0x0000000002308000-memory.dmp

Filesize
32KB

Download
memory/1876-12-0x0000000000200000-0x0000000000210000-memory.dmp

Filesize
64KB

Download
memory/3016-122-0x0000000000710000-0x000000000073F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads