Analysis
-
max time kernel
134s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/11/2024, 12:55
Static task
static1
Behavioral task
behavioral1
Sample
软件安装包u5.2.6.msi
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
软件安装包u5.2.6.msi
Resource
win10v2004-20241007-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
软件安装包u5.2.6.msi
-
Size
12.3MB
-
MD5
f128e0366847f75148a914540c8d43fc
-
SHA1
d94a75e313329d7787aeac6c6010cce8c6368bdd
-
SHA256
570c265082d625f99c178ac6565c18798f614e97d1edbeff6fd5acbdfcafdc9a
-
SHA512
08875de029a89d5005203883820391695355cffdb0caa819b418bea0bfe4733926a4268684b8bb8ca65777b4b448ca8c47d5028fbbefd9fcc1f0e100fe5e9d75
-
SSDEEP
393216:e49ccZUpj4f7eUFVg9UwfegD8ZVCrnRji:VKJpEfqqVg9dfegDCVCrnRG
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2724 MsiExec.exe 2724 MsiExec.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files (x86)\Windows NT\7za.bin msiexec.exe File created C:\Program Files (x86)\Windows NT\data.bin msiexec.exe File created C:\Program Files (x86)\Windows NT\Update.png MsiExec.exe File opened for modification C:\Program Files (x86)\Windows NT\Update.png MsiExec.exe -
Drops file in Windows directory 9 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI79C.tmp msiexec.exe File created C:\Windows\Installer\e5806b4.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI8A7.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\e5806b2.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{58214776-30AA-476C-BBA2-E8F1995A19FB} msiexec.exe File created C:\Windows\Installer\e5806b2.msi msiexec.exe -
Loads dropped DLL 1 IoCs
pid Process 2724 MsiExec.exe -
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4100 msiexec.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000f914d34881601a250000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000f914d3480000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900f914d348000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1df914d348000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000f914d34800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe -
Modifies registry class 22 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67741285AA03C674BB2A8E1F99A591BF\ProductName = "Setup" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67741285AA03C674BB2A8E1F99A591BF\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\67741285AA03C674BB2A8E1F99A591BF msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67741285AA03C674BB2A8E1F99A591BF\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67741285AA03C674BB2A8E1F99A591BF\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67741285AA03C674BB2A8E1F99A591BF\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67741285AA03C674BB2A8E1F99A591BF msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67741285AA03C674BB2A8E1F99A591BF\Version = "16973828" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67741285AA03C674BB2A8E1F99A591BF\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67741285AA03C674BB2A8E1F99A591BF\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\ABCBC521D000113428DCA4ABCB7D434C msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\ABCBC521D000113428DCA4ABCB7D434C\67741285AA03C674BB2A8E1F99A591BF msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67741285AA03C674BB2A8E1F99A591BF\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\67741285AA03C674BB2A8E1F99A591BF\ProdFeature msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67741285AA03C674BB2A8E1F99A591BF\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67741285AA03C674BB2A8E1F99A591BF\SourceList\Media msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67741285AA03C674BB2A8E1F99A591BF\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67741285AA03C674BB2A8E1F99A591BF\AuthorizedLUAApp = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67741285AA03C674BB2A8E1F99A591BF\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67741285AA03C674BB2A8E1F99A591BF\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67741285AA03C674BB2A8E1F99A591BF\SourceList\PackageName = "软件安装包u5.2.6.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67741285AA03C674BB2A8E1F99A591BF\PackageCode = "6FB9EEAA2B76EFD4A980BA0024B9CD86" msiexec.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4816 msiexec.exe 4816 msiexec.exe 2724 MsiExec.exe 2724 MsiExec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4100 msiexec.exe Token: SeIncreaseQuotaPrivilege 4100 msiexec.exe Token: SeSecurityPrivilege 4816 msiexec.exe Token: SeCreateTokenPrivilege 4100 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4100 msiexec.exe Token: SeLockMemoryPrivilege 4100 msiexec.exe Token: SeIncreaseQuotaPrivilege 4100 msiexec.exe Token: SeMachineAccountPrivilege 4100 msiexec.exe Token: SeTcbPrivilege 4100 msiexec.exe Token: SeSecurityPrivilege 4100 msiexec.exe Token: SeTakeOwnershipPrivilege 4100 msiexec.exe Token: SeLoadDriverPrivilege 4100 msiexec.exe Token: SeSystemProfilePrivilege 4100 msiexec.exe Token: SeSystemtimePrivilege 4100 msiexec.exe Token: SeProfSingleProcessPrivilege 4100 msiexec.exe Token: SeIncBasePriorityPrivilege 4100 msiexec.exe Token: SeCreatePagefilePrivilege 4100 msiexec.exe Token: SeCreatePermanentPrivilege 4100 msiexec.exe Token: SeBackupPrivilege 4100 msiexec.exe Token: SeRestorePrivilege 4100 msiexec.exe Token: SeShutdownPrivilege 4100 msiexec.exe Token: SeDebugPrivilege 4100 msiexec.exe Token: SeAuditPrivilege 4100 msiexec.exe Token: SeSystemEnvironmentPrivilege 4100 msiexec.exe Token: SeChangeNotifyPrivilege 4100 msiexec.exe Token: SeRemoteShutdownPrivilege 4100 msiexec.exe Token: SeUndockPrivilege 4100 msiexec.exe Token: SeSyncAgentPrivilege 4100 msiexec.exe Token: SeEnableDelegationPrivilege 4100 msiexec.exe Token: SeManageVolumePrivilege 4100 msiexec.exe Token: SeImpersonatePrivilege 4100 msiexec.exe Token: SeCreateGlobalPrivilege 4100 msiexec.exe Token: SeBackupPrivilege 2816 vssvc.exe Token: SeRestorePrivilege 2816 vssvc.exe Token: SeAuditPrivilege 2816 vssvc.exe Token: SeBackupPrivilege 4816 msiexec.exe Token: SeRestorePrivilege 4816 msiexec.exe Token: SeRestorePrivilege 4816 msiexec.exe Token: SeTakeOwnershipPrivilege 4816 msiexec.exe Token: SeRestorePrivilege 4816 msiexec.exe Token: SeTakeOwnershipPrivilege 4816 msiexec.exe Token: SeRestorePrivilege 4816 msiexec.exe Token: SeTakeOwnershipPrivilege 4816 msiexec.exe Token: SeRestorePrivilege 4816 msiexec.exe Token: SeTakeOwnershipPrivilege 4816 msiexec.exe Token: SeRestorePrivilege 4816 msiexec.exe Token: SeTakeOwnershipPrivilege 4816 msiexec.exe Token: SeRestorePrivilege 4816 msiexec.exe Token: SeTakeOwnershipPrivilege 4816 msiexec.exe Token: SeRestorePrivilege 4816 msiexec.exe Token: SeTakeOwnershipPrivilege 4816 msiexec.exe Token: SeRestorePrivilege 4816 msiexec.exe Token: SeTakeOwnershipPrivilege 4816 msiexec.exe Token: SeRestorePrivilege 4816 msiexec.exe Token: SeTakeOwnershipPrivilege 4816 msiexec.exe Token: SeRestorePrivilege 4816 msiexec.exe Token: SeTakeOwnershipPrivilege 4816 msiexec.exe Token: SeRestorePrivilege 4816 msiexec.exe Token: SeTakeOwnershipPrivilege 4816 msiexec.exe Token: SeRestorePrivilege 4816 msiexec.exe Token: SeTakeOwnershipPrivilege 4816 msiexec.exe Token: SeRestorePrivilege 4816 msiexec.exe Token: SeTakeOwnershipPrivilege 4816 msiexec.exe Token: SeRestorePrivilege 4816 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4100 msiexec.exe 4100 msiexec.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4816 wrote to memory of 2096 4816 msiexec.exe 105 PID 4816 wrote to memory of 2096 4816 msiexec.exe 105 PID 4816 wrote to memory of 2724 4816 msiexec.exe 107 PID 4816 wrote to memory of 2724 4816 msiexec.exe 107 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\软件安装包u5.2.6.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4100
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:2096
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding D2BC65FB8E428C8D5D1E36426A75473B E Global\MSI00002⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2724
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2816
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11.8MB
MD5bd7b64d11aef1046c1fc8061737485cc
SHA1ecccf5638fa29175f093745567985266a87bef9c
SHA25626b50aeeb48db3a167c56a1e60ea2a52dd729e2fc5223cd5fb1328cb11fe5674
SHA512e5974557db68b3b64f24b735b72e0f7fd306569f95358ddf554fdb0e343036eb467f2f66421043beef5f375db64c1dd328573e9a20c550899d7494777db7cb98
-
Filesize
11.8MB
MD5dfb8e9e024e2137c56f4869070994068
SHA1b954b321ce72829a8cb14bbb5fdfe8c3d0c451be
SHA25675c51971b8fc6c8f9303c7ba3c26c89b9cfea20025758a782dab122ebae62147
SHA512dba2ae510fa3780d8d988e2b564de2c60f6824abc3284793bee5ea785f6b951addccadb686c51e14a5b7ed54f13f5a3d29f3fc0324c8ece6c8ed01fbb9dc83a7
-
Filesize
12.3MB
MD5f128e0366847f75148a914540c8d43fc
SHA1d94a75e313329d7787aeac6c6010cce8c6368bdd
SHA256570c265082d625f99c178ac6565c18798f614e97d1edbeff6fd5acbdfcafdc9a
SHA51208875de029a89d5005203883820391695355cffdb0caa819b418bea0bfe4733926a4268684b8bb8ca65777b4b448ca8c47d5028fbbefd9fcc1f0e100fe5e9d75
-
Filesize
24.1MB
MD58724c261b54855c710ffef07705b606d
SHA15856253211e9451749040597258e4f3dc3ed4079
SHA2569aa76fd56d0bd887dddf535b51d8e81fb9ab1cbc7d59bf65f98c532b2970550d
SHA512a29066df491ddc5e07daecfe8611797f007dd64eef10734333096b5ae7e950abd1417487b5c7589ea4896f007b8b67c9abe84ba4bd762bdbf575bc75bc9e3698
-
\??\Volume{48d314f9-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{0b99a1c0-ff7b-4696-8cf2-dec812455666}_OnDiskSnapshotProp
Filesize6KB
MD539795529b20ab2fcb9a9321315773068
SHA11c4fceff713afb7280c6ab08b31343a5168ab966
SHA2562906945e8d1bde2effa71cc4a4a50c56228da2d2f8d355e672287e17193ab3a4
SHA512ae6cc86f711e88cf158651790f5bab768183128b5a5b9319e7165f83e9b552890cb86ac486cb1ed047c452c67d48ed8596240ba6ba85b1817fddbc87b6c00d4f