Analysis
-
max time kernel
149s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20/11/2024, 00:19
General
-
Target
Obsidium64Setup.msi
-
Size
15.9MB
-
MD5
b22bf4d75aea2ec6a0868f197b20f128
-
SHA1
925d722642fdbf2b7b9d70fefbd25efb3005531d
-
SHA256
1f5d87d2c996b5e6dcfac2ebfe3f24a70817fada79ca3e16c8eee8f3497c2bfb
-
SHA512
5feebff9e884af8f65e824bf4f52126c01d63154dbc44027a61b5e4510328bb1329883b6316f4e920fe27c017e69add48d921e536a4f5945348d41187901b574
-
SSDEEP
393216:laoik24KCni1T2NK7/39AHUGN+wIbfae8xAlxCvhSYo6:laGwCYT2Ur3uh+wIz9CvhK6
Malware Config
Signatures
-
Blocklisted process makes network request 5 IoCs
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 11 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 3 IoCs
-
Modifies registry class 47 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Obsidium64Setup.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 48BFD5DE55B9B96A499E79BA8660BAD32⤵
- Loads dropped DLL
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A1A91E6FFDA2FEF2657CA5639D7D08FD C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Obsidium Software\Obsidium x64\Obsidium.exe"C:\Program Files\Obsidium Software\Obsidium x64\Obsidium.exe"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Obsidium Software\Obsidium x64\obsi_server.exeobsi_server.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
27KB
MD59a7eacb9bbdae9c61f9af3105a2239b8
SHA1f381e9ccbf712a9431463923b2c4be8f905673c0
SHA256f682c2ad651ddf3b5d9e35c94fc0766f2af0ac30d53e2e837b7e01b062b855da
SHA512e5278210c81929deea79222e34aa4e60f91438ce8a0c18ab834bdbe40c06eae6b27f4f9e8fdc97d0f2d99daa02b1eecb8976b7bc6a2d42a75b05cdb6e012dd87
-
Filesize
7.6MB
MD5e90776ae67f5b47bef06ea117f80e938
SHA17cfb0399daaee2bb858a0540ee11a8a02f712145
SHA256f9c91b609f46b72492dc9c7913dbb946e75ad2e1f732ac08674805dbb23e452b
SHA512b92002e4212c8f7d2be8fa221deafdf033fd70f949fc5e3c6efeaa12dcc0510cc9a0746d97e819ead8583d5cf60867f3409930b85486fab20945a9e7da9f5df7
-
Filesize
24KB
MD5beb4d15b474409b03eb6e2543b2cce90
SHA137ecf1c340d645704c4f2422e3322e8c353ea92f
SHA2567afd6daaf24255046ebe2aebc1760e54f7e40fd4413b533ee734a650842a2751
SHA51259cc94524b220ed1077e7d68ec0f13e6661eace088fb8345c8f93b88080da45b8876bb59ee1aec81df64798b4c64b9d6d8b69277872e6ad5813dd1f23f7a6e37
-
Filesize
25KB
MD52a6c679181b7d911be07d04504c61908
SHA17df9e8437182b4b02cf1c94e3b1eeac215595005
SHA2566d128d694abf960cec7189864e403f33739ba1bd928ba256bb6b682c6d2531b6
SHA512b0ea586f24a1776a3a8e4e1f7c464d464d4181ce0a4ce47430c07f1b28ad60c988d637d45c31c83c2d278a254ba594f0aeb11748b3607f13a8a98e70fff3ae5e
-
Filesize
20KB
MD5296fe59f6b2d000bad11c4ebefa78632
SHA1a33e93bce4fc485ff43eaaa5d1e538eeaa54c5f3
SHA25638fb0e71a2572d7724c3904f003430ff61adc035ac2d717763460ac814129102
SHA512be4999595cfc206e6d28f45bd679a6951aa01c9d71f38c48327c29ff29fc53d93eb5e816d3c4ede423626ca9581cd1a4975f50b8fe24b490362c73315215c713
-
Filesize
29KB
MD553664359bc9322731d28f6cf67622840
SHA1b648e099b5dea752b2b5a2a3002e54de233d77db
SHA2565be38277b5cd3dc4737aad58eae9329dc952f223d3481370498ce220fff5504a
SHA512f8fc07d9e892efa94ba737603237b55ce07f1e40786aa1bdfa8997e38abf822e8a26488477beaa21f55d64e8483cdd7de48ce4789cd5b1b863011f949b774a67
-
Filesize
33KB
MD548e9b915ccd4ec5418aa6ce87a1ec80e
SHA143356ab28e77884a22cbfee6cc084cf618820e8c
SHA256e2b639aff65e878faf9a29462fb8fc42e27a2169e4d4ce97e5ed2533dfa7aa27
SHA512392e9a823d2299064a44bcafcd12a15e214bf650100d1dad823c2189f8121402a69ce9167837fc92666a4ad1ebaccf01bc10fe6a0053af2fa428075b7cf30cb2
-
Filesize
16KB
MD594f984833b6b374acac4dda7672334e3
SHA1636e3f1ff4cee778c7f58214aaaf8682ba377acf
SHA256f81ae3e06546df5f6099c8338a35d4d28bbb55b78a42e4c30761a4b032d65774
SHA51288740048a7d236b9dfc5fcc501de95540605407ae9ec928c19fa4627b93cb0c2f1dee958c4ceb600095ef61662d875d77d71bedf71aa6a277e569b4b23232649
-
Filesize
20KB
MD55a3a7ce3f9a98f9c3c4bd46acbadef81
SHA1dd2d0eca38d8ecefbc1b8345085b91779fd928b2
SHA25651736fb1d60f3e23dcd788af97ca49d32800e346a9fe91a1d9140c467af2141d
SHA5129c0148809d6abb6a6a226375b67910a86cb481dd0bf0b0879dc5440d70ad0b300c736ad65f150549883f1ee978224d7a2a89546f5407407052c366637f4b3270
-
Filesize
37KB
MD54a140bd38541c888572e00e2618a6d37
SHA1c154178a0369f21ba4bb535a21de1cae5be831da
SHA256ef0dae8d0c8a630173fe6740f3a2c7b7092b8ee46dc155c02034241aa17cced9
SHA512d2ce3f43e167e7ac4b23d64c77a3d3414a843390fc31e3b2d60aa1465f6198912dbfc7e4bedcd4dfe72ec5c03fbe2bac242d1e89f4f31dc2a0c128f244e6ffd9
-
Filesize
17KB
MD54463aa5b6606b4190a6002e8a4fb6c05
SHA1a4043ce9ba86923678d3fe707b83c1ca63b2b625
SHA2567c369214c87a4795b7a1e2bf06a175dde42abb1027b3ba71480e13b1f5ba7bf6
SHA51278a6104a53d99ebdd4eb13fcf053706fd6b1902d5e263f002d92e4a0c795e095ff446484c0583fd4f4149f67963b68d8f5ce0f2826b0492ad726db4b369253df
-
Filesize
1.8MB
MD53ab3bb1e988a8de5ebf5c02fd750e8ec
SHA1b610a2132330a1bf858dbe6eafd70db698fb71dd
SHA2568f76a96e32548a79493d6b9cc4129b5d2fc2899b398b13c1915f0b37de13306c
SHA512a2bac41541fae3a7352cd33edc4b99cd1ac08dc22771bc0866d7123a7175a79286650710816a8cb9382b30da25779b0b520f02d5a05ca5ee0e3364e6c515445b
-
Filesize
2KB
MD5aaf2a85d011883480d54ea8194b4d950
SHA11387c53c2effc6209a1669a4ae2b969c2d4fb8f2
SHA256568db501936a27458da92dea13193b61b871a89c761e945e4c0b4c4a4abe7d23
SHA5126fd9e9642d4ac3d45f308922eab9ac6a2aa69f4a70d22bf88075745bb64124f1abcabf87a20eb4063044dfbac814a78c6afa0c3ffcef87fe145be3d5183013ab
-
Filesize
1KB
MD501e7519cfc7a7f8078386dad88727fd0
SHA14d2f5c5d846490a87b0c4e2217e8413fff208b5d
SHA2569236556c2e982a8ce635d68300a4855e5a008e29642f0571e9059ec60d5ef3c0
SHA5126f211c5a89a366c8a34540cc0422c48c2899924164ed58773b5059fa60fd470ec908858d7ced887e02c6d295676a67dd7c4b71f39a7426512c68a7f484b3ceff
-
Filesize
510B
MD52147a2ddb1984314222cf960d0618b24
SHA17588d3527fd7ced412050049e6870f445b366f32
SHA256bf1b2aa522f4454dd138d5cddf05ae0881ff2b93517d1db90d267b85e53c9a15
SHA51257faf3266a26238caad03ab30fbc31c255d9ec72905695a326cab68765bb20d7e5f55a37febaf8a18eb6f9bcbda713d6dc4638aa6193040653f4d0d437c81ff9
-
Filesize
488B
MD548120e1716d86ce11f75c6a798dce381
SHA141a7fe7b929ba9208e76949068685a53bc2f0b9a
SHA25683e091b0a324dc3c6160fc4ec7952464a6748b841a110ee7cd0157a4a7771b2e
SHA5128cc7295ca4862dfd78556ab0e7c66e8a5453a1251084c6a745dd88fe64911dc3e816005eb54755fca42eb9fbaae9e3d4177c40c8764f020207741bd264ad1f9a
-
Filesize
482B
MD578660b0953771f0a3c77ac340da92ad0
SHA1d65646e08dfc63c82ea546401de707383fced3ad
SHA2563af2c845c789beb64f47ca5793e5ccb6f0efe7b5c2d1e08a6cb90420ddea69c0
SHA5125d5753420967f3cf4b28a9480db20bfcf168bcb9b1253b7fc108984ec377dac269aece6cc1cf48b5fe5c8cef1f921b78c9de6730168e9e0e1291c971603e13b4
-
Filesize
476B
MD5ab90c0f0c597518ba08abca880b765e8
SHA18942e2c613ef1e05b1cae2d623a62ea6d78e77ef
SHA2563b385e54c47ec308ff9d4f5a15b955c5b2db3a179b8bc98be5fcb5cf64b24302
SHA51265eca69313b474cf666645b045e2b01de46182fd7bb66c1dfce7bb7f65b57e169e1c806fa3d022eda0cba45f4215b4af3a46ff4a8d091cd087b127637f6762c7
-
Filesize
214KB
MD57228b731dab6dc982945a8ea5ebcfa72
SHA198bcf19711da328ff7debac3f7355d6bdb0710c2
SHA256c1426415488d278cea90702e184a250b2cce7caadd318c352abf21af33598875
SHA5122e12918098d550a3f58b3266cd0bde316c086156cf6eea6779077129c8adc77db36b6d100e20e30a22acf9bd554d7e2db8a553b64b6be33d86cf8337eb5d1689
-
Filesize
896B
MD53809b8785a0648960e6b0384ef361bef
SHA1706a5fd2a76ec49455e8f9148dcf1350f6461734
SHA256fa18be1f3b40af630b83475674fd06f3dd5c64940a732a126ce10befacbd33de
SHA512d47833a798e79083f313e4c1b58f01036f99f83c0145bf4de65502ac766a23e1b828ae0008fea748c32658af5633aa5dcde7590391a03abbfd1cbebcd3d7af24
-
Filesize
269KB
MD58e3b20dac385a60b7c0121020af6b0c8
SHA1e2a8ddc8fc6f51738dcb98f598e46e3f2246e951
SHA25689e82153f768ac5102cecd36a01c560623766ead9a2a42a31a37fb9f73b01db3
SHA51234a22a01863a08d89d15c86a2e1eb91f569521835beec9105fd02e042398da267a89269e74ad25f5145a00ab08105de2b4bc89364c7f7dcb50e26feedecba449
-
Filesize
15.9MB
MD5b22bf4d75aea2ec6a0868f197b20f128
SHA1925d722642fdbf2b7b9d70fefbd25efb3005531d
SHA2561f5d87d2c996b5e6dcfac2ebfe3f24a70817fada79ca3e16c8eee8f3497c2bfb
SHA5125feebff9e884af8f65e824bf4f52126c01d63154dbc44027a61b5e4510328bb1329883b6316f4e920fe27c017e69add48d921e536a4f5945348d41187901b574
-
Filesize
24.1MB
MD5b51b305aede0c65dacebaf6c5c862d29
SHA12ac56f8afec60bec6f5d1042a1c79d5454a4f9c3
SHA25620f447905ea86e238aafa8e668acd0ba13e587a8ac05acfecaaf4d553349d65b
SHA512390af8b6319b8d00e67f63e35fb35b780bea7ff996301c5ce5ae6f003cc9e1b668c1f2c7279a40d3f2cfb70418942d9239aab5419f1ecf3e7adb11cdc836e11a
-
Filesize
6KB
MD5ac57e43afa15f1ab24bd46fecd7a7b07
SHA19267d76c1514fca1a1f7ee004bbe6cb481b47c8c
SHA256aa2828563c889ab2ca5759d0790f2703ab24f1cceda3c6841e16a10c6097cd91
SHA512f1220fe2ac9a2907089f8142cc5b486597c81ddcb00167094e51971d7a7fe51190ac5a0f9f6b3b7938d0d1dd4c05ef0d5efb3635e8ca23cefedf021889c346f1
-
Filesize
18.9MB
-
Filesize
18.9MB
-
Filesize
18.9MB
-
Filesize
18.9MB
-
Filesize
18.9MB
-
Filesize
18.9MB
-
Filesize
18.9MB
-
Filesize
18.9MB
-
Filesize
18.9MB
-
Filesize
18.9MB
-
Filesize
18.9MB
-
Filesize
944KB
-
Filesize
18.9MB
-
Filesize
16KB
-
Filesize
18.9MB
-
Filesize
18.9MB
-
Filesize
18.9MB
-
Filesize
18.9MB
-
Filesize
18.9MB
-
Filesize
18.9MB
-
Filesize
18.9MB
-
Filesize
18.9MB
-
Filesize
18.9MB
-
Filesize
18.9MB
-
Filesize
18.9MB
-
Filesize
18.9MB
-
Filesize
18.9MB
-
Filesize
18.9MB
-
Filesize
18.9MB
-
Filesize
3.9MB
-
Filesize
8KB
-
Filesize
804KB
-
Filesize
3.9MB
-
Filesize
4KB
-
Filesize
276KB