c39abdca1a31b20fe06969a36102c784df7f63847ec930dfaf8c4bd97b4558bf

General

Target

merd.msi
Size

2.0MB
MD5

309abcad11b67d2498cf87c4e10ff30f
SHA1

0d805a684b889846a7b00cecc0ee84c7cf93398d
SHA256

c39abdca1a31b20fe06969a36102c784df7f63847ec930dfaf8c4bd97b4558bf
SHA512

0f0c0f4a04ae65532a7f4c197ca22c371d904a5b3055e14bd537a3c092d8b4526a597564019395ed0b05d4ffbc6d9b450a8d267de3906f88ac2d320f9c75bdd9
SSDEEP

49152:ecS3YhW8zBQSc0ZnSKBZKumZr7AQkojSo0kzI8ZVE6VPbe:sYY0Zn3K/AQz3Tbx56

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Blocklisted process makes network request 5 IoCs

Processes:

rundll32.exe

flow pid process

27 68 rundll32.exe
43 68 rundll32.exe
45 68 rundll32.exe
57 68 rundll32.exe
60 68 rundll32.exe

flow	pid	process
27	68	rundll32.exe
43	68	rundll32.exe
45	68	rundll32.exe
57	68	rundll32.exe
60	68	rundll32.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe

Drops file in Windows directory 12 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Windows\Installer\e57da43.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57da43.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDC57.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDCD5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDCF5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDE00.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDAC0.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{F51335B5-861E-4317-91B1-6EA78A6DECF1}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDF1A.tmp	msiexec.exe

Executes dropped EXE 1 IoCs

Processes:

MSIDF1A.tmp

pid process

1932 MSIDF1A.tmp
Loads dropped DLL 6 IoCs

Processes:

MsiExec.exerundll32.exerundll32.exe

pid process

4424 MsiExec.exe
4424 MsiExec.exe
4424 MsiExec.exe
4424 MsiExec.exe
3004 rundll32.exe
68 rundll32.exe
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
persistence privilege_escalation

Installer Packages
T1546.016

Msiexec
T1218.007

Processes:

msiexec.exe

pid process

3480 msiexec.exe

pid	process
1932	MSIDF1A.tmp

pid	process
4424	MsiExec.exe
4424	MsiExec.exe
4424	MsiExec.exe
4424	MsiExec.exe
3004	rundll32.exe
68	rundll32.exe

pid	process
3480	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

MsiExec.exeMSIDF1A.tmprundll32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIDF1A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000038a6760542cf76680000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000038a676050000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090038a67605000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d38a67605000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000038a6760500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

msiexec.exerundll32.exe

pid process

4712 msiexec.exe
4712 msiexec.exe
68 rundll32.exe
68 rundll32.exe
68 rundll32.exe
68 rundll32.exe

pid	process
4712	msiexec.exe
4712	msiexec.exe
68	rundll32.exe
68	rundll32.exe
68	rundll32.exe
68	rundll32.exe

Suspicious use of AdjustPrivilegeToken 63 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exesrtasks.exe

description	pid	process
Token: SeShutdownPrivilege	3480	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3480	msiexec.exe
Token: SeSecurityPrivilege	4712	msiexec.exe
Token: SeCreateTokenPrivilege	3480	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3480	msiexec.exe
Token: SeLockMemoryPrivilege	3480	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3480	msiexec.exe
Token: SeMachineAccountPrivilege	3480	msiexec.exe
Token: SeTcbPrivilege	3480	msiexec.exe
Token: SeSecurityPrivilege	3480	msiexec.exe
Token: SeTakeOwnershipPrivilege	3480	msiexec.exe
Token: SeLoadDriverPrivilege	3480	msiexec.exe
Token: SeSystemProfilePrivilege	3480	msiexec.exe
Token: SeSystemtimePrivilege	3480	msiexec.exe
Token: SeProfSingleProcessPrivilege	3480	msiexec.exe
Token: SeIncBasePriorityPrivilege	3480	msiexec.exe
Token: SeCreatePagefilePrivilege	3480	msiexec.exe
Token: SeCreatePermanentPrivilege	3480	msiexec.exe
Token: SeBackupPrivilege	3480	msiexec.exe
Token: SeRestorePrivilege	3480	msiexec.exe
Token: SeShutdownPrivilege	3480	msiexec.exe
Token: SeDebugPrivilege	3480	msiexec.exe
Token: SeAuditPrivilege	3480	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3480	msiexec.exe
Token: SeChangeNotifyPrivilege	3480	msiexec.exe
Token: SeRemoteShutdownPrivilege	3480	msiexec.exe
Token: SeUndockPrivilege	3480	msiexec.exe
Token: SeSyncAgentPrivilege	3480	msiexec.exe
Token: SeEnableDelegationPrivilege	3480	msiexec.exe
Token: SeManageVolumePrivilege	3480	msiexec.exe
Token: SeImpersonatePrivilege	3480	msiexec.exe
Token: SeCreateGlobalPrivilege	3480	msiexec.exe
Token: SeBackupPrivilege	4232	vssvc.exe
Token: SeRestorePrivilege	4232	vssvc.exe
Token: SeAuditPrivilege	4232	vssvc.exe
Token: SeBackupPrivilege	4712	msiexec.exe
Token: SeRestorePrivilege	4712	msiexec.exe
Token: SeRestorePrivilege	4712	msiexec.exe
Token: SeTakeOwnershipPrivilege	4712	msiexec.exe
Token: SeRestorePrivilege	4712	msiexec.exe
Token: SeTakeOwnershipPrivilege	4712	msiexec.exe
Token: SeRestorePrivilege	4712	msiexec.exe
Token: SeTakeOwnershipPrivilege	4712	msiexec.exe
Token: SeRestorePrivilege	4712	msiexec.exe
Token: SeTakeOwnershipPrivilege	4712	msiexec.exe
Token: SeRestorePrivilege	4712	msiexec.exe
Token: SeTakeOwnershipPrivilege	4712	msiexec.exe
Token: SeRestorePrivilege	4712	msiexec.exe
Token: SeTakeOwnershipPrivilege	4712	msiexec.exe
Token: SeRestorePrivilege	4712	msiexec.exe
Token: SeTakeOwnershipPrivilege	4712	msiexec.exe
Token: SeRestorePrivilege	4712	msiexec.exe
Token: SeTakeOwnershipPrivilege	4712	msiexec.exe
Token: SeRestorePrivilege	4712	msiexec.exe
Token: SeTakeOwnershipPrivilege	4712	msiexec.exe
Token: SeBackupPrivilege	4996	srtasks.exe
Token: SeRestorePrivilege	4996	srtasks.exe
Token: SeSecurityPrivilege	4996	srtasks.exe
Token: SeTakeOwnershipPrivilege	4996	srtasks.exe
Token: SeBackupPrivilege	4996	srtasks.exe
Token: SeRestorePrivilege	4996	srtasks.exe
Token: SeSecurityPrivilege	4996	srtasks.exe
Token: SeTakeOwnershipPrivilege	4996	srtasks.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

3480 msiexec.exe
3480 msiexec.exe

pid	process
3480	msiexec.exe
3480	msiexec.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

msiexec.exerundll32.exe

description	pid	process	target process
PID 4712 wrote to memory of 4996	4712	msiexec.exe	srtasks.exe
PID 4712 wrote to memory of 4996	4712	msiexec.exe	srtasks.exe
PID 4712 wrote to memory of 4424	4712	msiexec.exe	MsiExec.exe
PID 4712 wrote to memory of 4424	4712	msiexec.exe	MsiExec.exe
PID 4712 wrote to memory of 4424	4712	msiexec.exe	MsiExec.exe
PID 4712 wrote to memory of 1932	4712	msiexec.exe	MSIDF1A.tmp
PID 4712 wrote to memory of 1932	4712	msiexec.exe	MSIDF1A.tmp
PID 4712 wrote to memory of 1932	4712	msiexec.exe	MSIDF1A.tmp
PID 3004 wrote to memory of 68	3004	rundll32.exe	rundll32.exe
PID 3004 wrote to memory of 68	3004	rundll32.exe	rundll32.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\merd.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3480

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4996
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding EF191DE7710306628FBA351E400B1F9B
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4424
- C:\Windows\Installer\MSIDF1A.tmp
  "C:\Windows\Installer\MSIDF1A.tmp" /DontWait C:/Windows/SysWOW64/rundll32.exe C:\Users\Admin\AppData\Roaming\sqx.dll, GetDbInterface
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1932

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4232

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\SysWOW64\rundll32.exe" C:\Users\Admin\AppData\Roaming\sqx.dll, GetDbInterface
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\system32\rundll32.exe
  "C:\Windows\SysWOW64\rundll32.exe" C:\Users\Admin\AppData\Roaming\sqx.dll, GetDbInterface
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:68

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

Installer Packages

1

T1546.016

Privilege Escalation

Event Triggered Execution

1

T1546

Installer Packages

1

T1546.016

Defense Evasion

System Binary Proxy Execution

1

T1218

Msiexec

1

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57da46.rbs

Filesize
1KB

MD5
5a7f81b1e14eb1baa9cdf5594a4899a9

SHA1
40bd3ef4c366714c5616a6739dc823c3501c10f3

SHA256
69cd9635b84b554fa1481679816ad5291e998f914127d4b389ea3b2afca856aa

SHA512
e9a12cef900792776fd771b9c9acf432b1e8cf0a8340162215a10c24299b4dc03a5777c23e314523a79fa37143072b11de879d1260fb75f9ab5e77e2b32f81ac

Download Submit
C:\Users\Admin\AppData\Roaming\sqx.dll

Filesize
1.3MB

MD5
dd862590d9e4ea1791df147912ae4c8f

SHA1
852d7a9ea4db5ff4cd51a92447a8d5701cfb322b

SHA256
14ffcbbfb305287ea15264df3363567f36a26917ae2018af0f40e2009b8a7184

SHA512
3e9222d8bd91d3e53f5e378318a78a7c5aa12011272031f7c0d8c36c5b255db1d0a168cc02e1159eb021dd18206352dd6dcb857fefc2222937c467350dc6d568

Download Submit
C:\Windows\Installer\MSIDAC0.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSIDF1A.tmp

Filesize
389KB

MD5
b9545ed17695a32face8c3408a6a3553

SHA1
f6c31c9cd832ae2aebcd88e7b2fa6803ae93fc83

SHA256
1e0e63b446eecf6c9781c7d1cae1f46a3bb31654a70612f71f31538fb4f4729a

SHA512
f6d6dc40dcba5ff091452d7cc257427dcb7ce2a21816b4fec2ee249e63246b64667f5c4095220623533243103876433ef8c12c9b612c0e95fdfffe41d1504e04

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.1MB

MD5
ffa649e9053bac10b697baa49c67af0e

SHA1
5ca76811d4bdce818fed0a7bed3955d7bf66d163

SHA256
0ebc607b5580ce1332b28ae3af0f53bb563ddf68eaded307865945c025f362d7

SHA512
79917c9564748da5b69dfe58ac2d0c62901e85f102d113eb751b1957d802084f4cd6c136ba9b042b269031b1fa6cc432acd1cce1a6c4bf3de2035e2e392fb7d1

Download Submit
\??\Volume{0576a638-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{a28d4e2d-56c3-47cf-b1cc-b961a2df8c21}_OnDiskSnapshotProp

Filesize
6KB

MD5
825e6fc9ed0ee85372455517c8953a31

SHA1
d1c14f30a2c579db59d3aca8ac3b704872735e26

SHA256
e83457958878d31eacc5ba70dcade68ea728d01145715a2bb4cf4814deff0ad7

SHA512
9cbf0b5b69e5368c1376a00941b02ae6c690182c2461b14d59e6845129a181dfd28b6abaa00bb907e0fec3e58cd6d1ef219a8ee639e307ccbb1c5e2ec57196f0

Download Submit
memory/68-45-0x0000024401BF0000-0x0000024401C3C000-memory.dmp

Filesize
304KB

Download
memory/68-65-0x0000024401BF0000-0x0000024401C3C000-memory.dmp

Filesize
304KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads