Overview

overview

10

Static

static

1

vrep.msi

windows7-x64

10

vrep.msi

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2024 01:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    vrep.msi

  • Size

    39.7MB

  • MD5

    87ef82757aba83e7eb63c7c35dbae97a

  • SHA1

    7418c4ddeecba68e253e89622ad9ca45597d9350

  • SHA256

    79040421b5a48dcc6e611dfe187b2f3e355791ad8511adb84f5c0948aa1d6c89

  • SHA512

    605495995a07d7dfaa5d8f09b9d5bde1e0281b5b6581923b9fbd7c103e5ca9f2bb8dcf8e1049c21bd90ac4d68759270d5453e0414c2f6e1eb3ef877eee1a5533

  • SSDEEP

    786432:5HqloPKB2RMErvURcUNnywXha1rc3fZ+L28IB1P77y059ze5aaSJJgV6UBXYKe:5HqGRME72cUNnywXg63fxB1P3y031aS1

Score
10/10
netsupportdiscoverypersistenceprivilege_escalationrat

Malware Config

Signatures

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport
  • Netsupport family
    netsupport
  • Drops file in Drivers directory 2 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Blocklisted process makes network request 2 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 1 IoCs
    persistence
  • Drops file in System32 directory 8 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 32 IoCs
  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 29 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 45 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\vrep.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4036
    • C:\Windows\system32\cmd.exe
      cmd.exe /c ATTRIB -R "C:\Users\Admin\AppData\Local\Temp\{CBB68368-7767-4CFF-B3E5-211488346702}\\nsm.lic"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:456
      • C:\Windows\SysWOW64\attrib.exe
        ATTRIB -R "C:\Users\Admin\AppData\Local\Temp\{CBB68368-7767-4CFF-B3E5-211488346702}\\nsm.lic"
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:2608
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1688
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 061876C18A02C386AD1FFAC508F4B647 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      PID:4752
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:4868
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 78720CD5F41CC622A93C71A33E83C16D
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:3024
      • C:\Windows\Installer\MSI6998.tmp
        "C:\Windows\Installer\MSI6998.tmp" /G"C:\Program Files (x86)\NetSupport\NetSupport Manager\" /EU
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4864
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding F66642907B44B34AFEC9CB0BF2EA3007 E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:1428
      • C:\Windows\Installer\MSI6F0E.tmp
        "C:\Windows\Installer\MSI6F0E.tmp" /G"C:\Program Files (x86)\NetSupport\NetSupport Manager\" /EU
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4108
      • C:\Program Files (x86)\NetSupport\NetSupport Manager\checkdvd.exe
        "C:\Program Files (x86)\NetSupport\NetSupport Manager\checkdvd.exe"
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3580
      • C:\Windows\Installer\MSI7588.tmp
        "C:\Windows\Installer\MSI7588.tmp" /G"C:\Program Files (x86)\NetSupport\NetSupport Manager\" /EV"NetSupport School" /EF".\Log Files" /EF".\Bookmarks" /EF".\Tests" /EF".\Store" /EF".\inv" /EF".\Resources" /EF".\Help" /EF".\Image" /EF".\Sound" /EF".\Video" /EA /EX /EC /Q /V /Q /I *
        2⤵
        • Sets service image path in registry
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4328
        • C:\Program Files (x86)\NetSupport\NetSupport Manager\winst64.exe
          winst64.exe /q /q /ex /i
          3⤵
          • Drops file in Drivers directory
          • Drops file in System32 directory
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies registry class
          PID:996
      • C:\Windows\Installer\MSI7C32.tmp
        "C:\Windows\Installer\MSI7C32.tmp" /G"C:\Program Files (x86)\NetSupport\NetSupport Manager\" /EI
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:612
      • C:\Program Files (x86)\NetSupport\NetSupport Manager\pcicfgui_client.exe
        "C:\Program Files (x86)\NetSupport\NetSupport Manager\pcicfgui_client.exe" /Q "C:\Program Files (x86)\NetSupport\NetSupport Manager\Client32.ini"
        2⤵
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Program Files directory
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:3240
        • C:\Program Files (x86)\NetSupport\NetSupport Manager\pcicfgui_client.exe
          "C:\Program Files (x86)\NetSupport\NetSupport Manager\pcicfgui_client.exe"
          3⤵
          • Executes dropped EXE
          PID:1792
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:1960
    • C:\Program Files (x86)\NetSupport\NetSupport Manager\client32.exe
      "C:\Program Files (x86)\NetSupport\NetSupport Manager\client32.exe" /* *
      1⤵
      • Drops file in System32 directory
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:372
      • C:\Program Files (x86)\NetSupport\NetSupport Manager\client32.exe
        "C:\Program Files (x86)\NetSupport\NetSupport Manager\client32.exe" * /VistaUI
        2⤵
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Checks SCSI registry key(s)
        • Checks processor information in registry
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:3188
        • C:\Windows\SysWOW64\cscript.exe
          "cscript.exe" C:\Windows\system32\Printing_Admin_Scripts\en-US\prnport.vbs -a -r NSM001 -h 127.0.0.1 -o raw -n 52764
          3⤵
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          PID:4308
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
      1⤵
      • Modifies data under HKEY_USERS
      PID:2220

    Network

    MITRE ATT&CK Enterprise v15

    Reconnaissance

    Resource Development

    Initial Access

    Execution

    Persistence

    Boot or Logon Autostart Execution

    2
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Winlogon Helper DLL

    1
    T1547.004

    Event Triggered Execution

    2
    T1546

    Component Object Model Hijacking

    1
    T1546.015

    Installer Packages

    1
    T1546.016

    Privilege Escalation

    Boot or Logon Autostart Execution

    2
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Winlogon Helper DLL

    1
    T1547.004

    Event Triggered Execution

    2
    T1546

    Component Object Model Hijacking

    1
    T1546.015

    Installer Packages

    1
    T1546.016

    Defense Evasion

    Hide Artifacts

    1
    T1564

    Hidden Files and Directories

    1
    T1564.001

    Modify Registry

    2
    T1112

    System Binary Proxy Execution

    1
    T1218

    Msiexec

    1
    T1218.007

    Credential Access

    Discovery

    Peripheral Device Discovery

    2
    T1120

    Query Registry

    3
    T1012

    System Information Discovery

    4
    T1082

    System Location Discovery

    1
    T1614

    System Language Discovery

    1
    T1614.001

    Lateral Movement

    Collection

    Command and Control

    Exfiltration

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Config.Msi\e5862dd.rbs
      Filesize

      41KB

      MD5

      a4b1564fcec5548db5c832b009053550

      SHA1

      03970efcacfcee326965b8499b467e7124b895ff

      SHA256

      39e76a6ed40a2a2a154eda2632b99b25498805467d803e490685d91a95f233d1

      SHA512

      a2842ffca7a9c05c8e7ea9fe37ce789e0defe85938e550dcd3df0821666c2e5ac3bead95ed9009cdba5ddac62c83148d4d96599187d339589106c5b12f361a4a

      Download Submit

    • C:\Program Files (x86)\NetSupport\NetSupport Manager\WINSTALL.EXE
      Filesize

      745KB

      MD5

      0fcf65c63e08e77732224b2d5d959f13

      SHA1

      5419b79fe14e21d1d5b51fe8187f7b86ec20de74

      SHA256

      f3e587f94a79c46a603b39286e93b17fabc895c6b71b26b0fc5d812cf155b7e5

      SHA512

      7c289aaf3ac1b998c8ca9593a58c8aa3a9aa9f41852c1ed4192b908e0ad51871400d585b4fe508d49368bdfc7378807d289971914870a7a47b0410a946e5e381

      Download Submit

    • C:\Program Files (x86)\NetSupport\NetSupport Manager\product.dat
      Filesize

      506B

      MD5

      ff7c0d2dbb9195083bbabaff482d5ed6

      SHA1

      5c2efbf855c376ce1b93e681c54a367a407495dc

      SHA256

      065d817596d710d5a06060241acc207b82b844530cc56ff842ff53d8ff92a075

      SHA512

      ea226b3a55fc59175136f104df497ebf5055624fb1c1c8073b249dfc5e1ed5818a6feee995aa82cf9ed050f1adc7a62994c90b1af03569dfe0d4551ee2bc70c9

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\DLL_{CBB68368-7767-4CFF-B3E5-211488346702}.ini
      Filesize

      7KB

      MD5

      22f45873596ad2bd83427a223702c818

      SHA1

      37b2b3a552de3f10f85e6025258eaa35e8a22844

      SHA256

      5cffe2331df1926deb0f7d5debd3bac80202ca314f97a62e9adefad1825c2599

      SHA512

      f9facdf64ccff6a54e752e07ab0580ebe45700f7cf237ea5b7f6d27c1b7655f2d4bba14698c6b6e8e75de2ac04741d1e47770fbfa16d8e9d5b71371c51d5b062

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\MSIC043.tmp
      Filesize

      169KB

      MD5

      0e6fda2b8425c9513c774cf29a1bc72d

      SHA1

      a79ffa24cb5956398ded44da24793a2067b85dd0

      SHA256

      e946b2fae0b36c43064463a8c16a2774adac30c4188c5af90e9338b903c501c9

      SHA512

      285bb7759a1214abed36162ac8be2d48df17a05278c4de97562448e20fd43b635563a6819f37e23d92a5f5ed0205a68bffe43dac0d3a67513bd0303b4e7f89aa

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\MSIC1CA.tmp
      Filesize

      511KB

      MD5

      d524b639a3a088155981b9b4efa55631

      SHA1

      39d8eea673c02c1522b110829b93d61310555b98

      SHA256

      03d91c8cd20b846625a092a3dae6a12369930c65d6216a455a00449ebb0dc289

      SHA512

      84f8ab54122f93a40da08fd83bca767ab49eb0f73c4ab274d9bda11dd09224134df011fa02e5a3abbafcc6fbef6a60673dd48feabdf829a1e22c85a2a759b7ac

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\MSIC20A.tmp
      Filesize

      153KB

      MD5

      a1b7850763af9593b66ee459a081bddf

      SHA1

      6e45955fae2b2494902a1b55a3873e542f0f5ce4

      SHA256

      41b8e92deba5206c78817236ed7f44df95636ca748d95fab05f032f5aec186af

      SHA512

      a87a302a9a0d19d7ce293b42f5e7bc09664b21307a5321f226157fcc57eb2df2b59c6651878cb23969a182c82b55e8671ff00f8462194b81a907974a49cb25b1

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\MSIC541.tmp
      Filesize

      487KB

      MD5

      3085d62326cc1ae4ab21489576973621

      SHA1

      e3c847dee0ecc7176c1168d6d1df9b9e98b19936

      SHA256

      d2dc425f47d8c80abd8cadbcd8aa53516e7754c371bd3bad3907294a6ca57c5c

      SHA512

      f993e4e04b348f7eb346d2f3d00fdaed2212f28ba885bbe50c1959737c5b6cab9cfbe17c4aba992521aa0ecdcf5216fa9e6c36a47746077307d32170223a9a97

      Download Submit

    • C:\Windows\Installer\MSI7B46.tmp
      Filesize

      244KB

      MD5

      c4ca339bc85aae8999e4b101556239dd

      SHA1

      d090fc385e0002e35db276960a360c67c4fc85cd

      SHA256

      4ab23609cdc64d10b97c9ccb285ed7100f55d54d983cd50762da25ecac4357f9

      SHA512

      9185ec32545fc838d7fef6c9e4dd222dd02114c661b0b344f16287d55e6571bfe7a4233a852acc579d07bcdbab18c5c034c465b1f4bb78535ed51c3499087fe0

      Download Submit

    • C:\Windows\Installer\e5862dc.msi
      Filesize

      39.7MB

      MD5

      87ef82757aba83e7eb63c7c35dbae97a

      SHA1

      7418c4ddeecba68e253e89622ad9ca45597d9350

      SHA256

      79040421b5a48dcc6e611dfe187b2f3e355791ad8511adb84f5c0948aa1d6c89

      SHA512

      605495995a07d7dfaa5d8f09b9d5bde1e0281b5b6581923b9fbd7c103e5ca9f2bb8dcf8e1049c21bd90ac4d68759270d5453e0414c2f6e1eb3ef877eee1a5533

      Download Submit

    • memory/3188-427-0x0000000006420000-0x0000000006544000-memory.dmp

      Filesize

      1.1MB

      Download

    • memory/3240-421-0x0000000002CD0000-0x0000000002E73000-memory.dmp

      Filesize

      1.6MB

      Download