Analysis
-
max time kernel
130s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27-11-2024 19:09
Static task
static1
Behavioral task
behavioral1
Sample
vvmchet-windovv.msi
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral2
Sample
vvmchet-windovv.msi
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
vvmchet-windovv.msi
-
Size
313.0MB
-
MD5
b433ac6a628665157c009834c3c41634
-
SHA1
567f922c4595d535e96b21741156f29ebb61341f
-
SHA256
6c77bf7ca5b7bb5ce7e926e8981600f7c9fda533bbbf5df1a544c37d892948bd
-
SHA512
06dff3810cf41bc72187aee8c0ca817a0590f5bec523db0adda2e64c3e45dc754762576b37b41c21d4b7e37da36aa75969d561809c2e233bff8adb3f299519bd
-
SSDEEP
6291456:68BnEZsQe41dIIdVAUnRYJHqxVHerMSlcF8aLPIY7hcU6T8V7:0M4zIWVAVkKraLIYr6AV7
Malware Config
Signatures
-
resource yara_rule behavioral2/files/0x0007000000023cb7-81.dat purplefox_rootkit behavioral2/memory/3676-87-0x000001BDA3A50000-0x000001BDA3D2D000-memory.dmp purplefox_rootkit -
Purplefox family
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3552 set thread context of 3676 3552 down.exe 104 -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\WeChatSetup\WeChatSetup\WeChatSetup\setup_gf-1.6.6.10622.exe msiexec.exe File created C:\Program Files (x86)\WeChatSetup\WeChatSetup\WeChatSetup\WeChatSetup.exe msiexec.exe -
Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e5803b4.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{D59B00F8-B730-45E2-9903-02A27DFDC243} msiexec.exe File opened for modification C:\Windows\Installer\MSIF9D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1887.tmp msiexec.exe File created C:\Windows\Installer\e5803b4.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI654.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6E2.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe -
Executes dropped EXE 2 IoCs
pid Process 3552 down.exe 3268 down.exe -
Loads dropped DLL 19 IoCs
pid Process 1820 MsiExec.exe 1820 MsiExec.exe 1820 MsiExec.exe 1820 MsiExec.exe 1820 MsiExec.exe 1820 MsiExec.exe 4108 MsiExec.exe 4108 MsiExec.exe 2736 MsiExec.exe 2736 MsiExec.exe 3552 down.exe 3552 down.exe 3552 down.exe 3552 down.exe 3552 down.exe 3268 down.exe 3268 down.exe 3268 down.exe 3268 down.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2820 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000001397c7f967de25740000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800001397c7f90000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809001397c7f9000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d1397c7f9000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000001397c7f900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1144 msiexec.exe 1144 msiexec.exe 2736 MsiExec.exe 2736 MsiExec.exe 2736 MsiExec.exe 2736 MsiExec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2820 msiexec.exe Token: SeIncreaseQuotaPrivilege 2820 msiexec.exe Token: SeSecurityPrivilege 1144 msiexec.exe Token: SeCreateTokenPrivilege 2820 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2820 msiexec.exe Token: SeLockMemoryPrivilege 2820 msiexec.exe Token: SeIncreaseQuotaPrivilege 2820 msiexec.exe Token: SeMachineAccountPrivilege 2820 msiexec.exe Token: SeTcbPrivilege 2820 msiexec.exe Token: SeSecurityPrivilege 2820 msiexec.exe Token: SeTakeOwnershipPrivilege 2820 msiexec.exe Token: SeLoadDriverPrivilege 2820 msiexec.exe Token: SeSystemProfilePrivilege 2820 msiexec.exe Token: SeSystemtimePrivilege 2820 msiexec.exe Token: SeProfSingleProcessPrivilege 2820 msiexec.exe Token: SeIncBasePriorityPrivilege 2820 msiexec.exe Token: SeCreatePagefilePrivilege 2820 msiexec.exe Token: SeCreatePermanentPrivilege 2820 msiexec.exe Token: SeBackupPrivilege 2820 msiexec.exe Token: SeRestorePrivilege 2820 msiexec.exe Token: SeShutdownPrivilege 2820 msiexec.exe Token: SeDebugPrivilege 2820 msiexec.exe Token: SeAuditPrivilege 2820 msiexec.exe Token: SeSystemEnvironmentPrivilege 2820 msiexec.exe Token: SeChangeNotifyPrivilege 2820 msiexec.exe Token: SeRemoteShutdownPrivilege 2820 msiexec.exe Token: SeUndockPrivilege 2820 msiexec.exe Token: SeSyncAgentPrivilege 2820 msiexec.exe Token: SeEnableDelegationPrivilege 2820 msiexec.exe Token: SeManageVolumePrivilege 2820 msiexec.exe Token: SeImpersonatePrivilege 2820 msiexec.exe Token: SeCreateGlobalPrivilege 2820 msiexec.exe Token: SeCreateTokenPrivilege 2820 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2820 msiexec.exe Token: SeLockMemoryPrivilege 2820 msiexec.exe Token: SeIncreaseQuotaPrivilege 2820 msiexec.exe Token: SeMachineAccountPrivilege 2820 msiexec.exe Token: SeTcbPrivilege 2820 msiexec.exe Token: SeSecurityPrivilege 2820 msiexec.exe Token: SeTakeOwnershipPrivilege 2820 msiexec.exe Token: SeLoadDriverPrivilege 2820 msiexec.exe Token: SeSystemProfilePrivilege 2820 msiexec.exe Token: SeSystemtimePrivilege 2820 msiexec.exe Token: SeProfSingleProcessPrivilege 2820 msiexec.exe Token: SeIncBasePriorityPrivilege 2820 msiexec.exe Token: SeCreatePagefilePrivilege 2820 msiexec.exe Token: SeCreatePermanentPrivilege 2820 msiexec.exe Token: SeBackupPrivilege 2820 msiexec.exe Token: SeRestorePrivilege 2820 msiexec.exe Token: SeShutdownPrivilege 2820 msiexec.exe Token: SeDebugPrivilege 2820 msiexec.exe Token: SeAuditPrivilege 2820 msiexec.exe Token: SeSystemEnvironmentPrivilege 2820 msiexec.exe Token: SeChangeNotifyPrivilege 2820 msiexec.exe Token: SeRemoteShutdownPrivilege 2820 msiexec.exe Token: SeUndockPrivilege 2820 msiexec.exe Token: SeSyncAgentPrivilege 2820 msiexec.exe Token: SeEnableDelegationPrivilege 2820 msiexec.exe Token: SeManageVolumePrivilege 2820 msiexec.exe Token: SeImpersonatePrivilege 2820 msiexec.exe Token: SeCreateGlobalPrivilege 2820 msiexec.exe Token: SeCreateTokenPrivilege 2820 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2820 msiexec.exe Token: SeLockMemoryPrivilege 2820 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2820 msiexec.exe 2820 msiexec.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1144 wrote to memory of 1820 1144 msiexec.exe 86 PID 1144 wrote to memory of 1820 1144 msiexec.exe 86 PID 1144 wrote to memory of 1820 1144 msiexec.exe 86 PID 1144 wrote to memory of 2488 1144 msiexec.exe 98 PID 1144 wrote to memory of 2488 1144 msiexec.exe 98 PID 1144 wrote to memory of 4108 1144 msiexec.exe 100 PID 1144 wrote to memory of 4108 1144 msiexec.exe 100 PID 1144 wrote to memory of 4108 1144 msiexec.exe 100 PID 1144 wrote to memory of 2736 1144 msiexec.exe 101 PID 1144 wrote to memory of 2736 1144 msiexec.exe 101 PID 2736 wrote to memory of 3552 2736 MsiExec.exe 102 PID 2736 wrote to memory of 3552 2736 MsiExec.exe 102 PID 3552 wrote to memory of 3268 3552 down.exe 103 PID 3552 wrote to memory of 3268 3552 down.exe 103 PID 3552 wrote to memory of 3676 3552 down.exe 104 PID 3552 wrote to memory of 3676 3552 down.exe 104 PID 3552 wrote to memory of 3676 3552 down.exe 104 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\vvmchet-windovv.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2820
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 552D38F44CF1D9471C7DED4ADA04BF27 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1820
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:2488
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5756D1445C8EAC3DF9CD73056F6CEA182⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4108
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding B87F62BC75919B945412DC847EBB2DA22⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\E07446A1-968F-4A26-9E9C-000023B8B575\down.exeC:\Users\Admin\E07446A1-968F-4A26-9E9C-000023B8B575\\down.exe3⤵
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\E07446A1-968F-4A26-9E9C-000023B8B575\down.exeC:\Users\Admin\E07446A1-968F-4A26-9E9C-000023B8B575\down.exe /aut4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3268
-
-
C:\Windows\system32\colorcpl.execolorcpl.exe4⤵PID:3676
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:4872
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
27KB
MD5628a6a2e7f26c2d56e0254c40ab79eff
SHA10ad53fb39c6f071c4ec155a2c15b2aff90cf6679
SHA2569d1b427cbf60b7c0c805d48ad846dc8496ffcd0657a7940b9e94a0266278da1c
SHA51255b6ebde6082d253ca9bc49f5ec3a3773d560d5c1129b15bf0dbe6402a14e3fa543400782104dc70ea6e062fff3c54b741ee2fffef5e75594527829e21dae3b2
-
Filesize
557KB
MD5db7612f0fd6408d664185cfc81bef0cb
SHA119a6334ec00365b4f4e57d387ed885b32aa7c9aa
SHA256e9e426b679b3efb233f03c696e997e2da3402f16a321e954b54454317fceb240
SHA51225e129cb22aaabc68c42ecf10bb650ac4d0609b12c08703c780572bac7ecf4559fcc49cd595c56ea48cf55260a984cfa333c08307ffb7c62268b03fbecc724b9
-
Filesize
613KB
MD5c1b066f9e3e2f3a6785161a8c7e0346a
SHA18b3b943e79c40bc81fdac1e038a276d034bbe812
SHA25699e3e25cda404283fbd96b25b7683a8d213e7954674adefa2279123a8d0701fd
SHA51236f9e6c86afbd80375295238b67e4f472eb86fcb84a590d8dba928d4e7a502d4f903971827fdc331353e5b3d06616664450759432fdc8d304a56e7dacb84b728
-
Filesize
116KB
MD5e9b690fbe5c4b96871214379659dd928
SHA1c199a4beac341abc218257080b741ada0fadecaf
SHA256a06c9ea4f815dac75d2c99684d433fbfc782010fae887837a03f085a29a217e8
SHA51200cf9b22af6ebbc20d1b9c22fc4261394b7d98ccad4823abc5ca6fdac537b43a00db5b3829c304a85738be5107927c0761c8276d6cb7f80e90f0a2c991dbcd8c
-
Filesize
48KB
MD5eb49c1d33b41eb49dfed58aafa9b9a8f
SHA161786eb9f3f996d85a5f5eea4c555093dd0daab6
SHA2566d3a6cde6fc4d3c79aabf785c04d2736a3e2fd9b0366c9b741f054a13ecd939e
SHA512d15905a3d7203b00181609f47ce6e4b9591a629f2bf26ff33bf964f320371e06d535912fda13987610b76a85c65c659adac62f6b3176dbca91a01374178cd5c6
-
Filesize
1.3MB
MD551698f9d781f9ba83b9d1896f047b666
SHA15e28f766d10af39ec28f46f20a8d047474135923
SHA256300776a76cf4faaa2ef0d0928adf0bb9621ae486e316f81af8d71719d9f413cb
SHA512cee9cb3c89b0a7defdc5cc61acc479f94a3e29556c9fec5ede12997cee8b67e780af443fae1f81399274e0602ac9102521e6389422ec9ede49e23647a256e952
-
Filesize
1.2MB
MD5524b5640571507a6440ad71d9ba74742
SHA1ac4e6c573b079abdd824b87d61f2c39d81c43afb
SHA256e0a6674160fb7d16d76a75c8cc17e867c28cd0767d696a814c1d1b70740392f4
SHA5124e21c02fb6323821c76c9bfab550f30864e594b96040be9139e87cfc53e38f3a8ffbea98e06757db22492d8a68f5d7f6c8aec74d41e449c3dab73add3184b251
-
Filesize
2.5MB
MD516feaeba569c71a83a099bcdbc3da361
SHA1907314e8b8a9b8a61e7eea9af1c466a0e60abb97
SHA256ddf4875f5190ee8f64bf0851675df3ce6c5fb4580422187d704823f762fd733a
SHA512318259c5b317972f1a17cf4717d3d332fd380cecb393312a04f4829b18b90362ec097b13fd3901788440d800dc7f26d30777ed5f418572aa2d39534478cd00c4
-
Filesize
25KB
MD581902d13c01fd8a187f3a7f2b72d5dd0
SHA10ac01518c5588eb2788730c78f0c581f79cf2ed4
SHA256eef31e9195cfacde7b4e7eb7384c8178d8811063b375fd4a28ae897cc180c6a6
SHA51204d6e2e937328477803084e0ef9da2c3636cdc9d34af74e2d1871d7190be21cbb2771ae835175e104e24eccba52add1ba6f58407bfd522ef82b81d76e977f24c
-
Filesize
2.5MB
MD530bcd4bbebd8869e3c9d45ab6ccc569b
SHA161d6f3c40bf0e79c9014fcd56b9fa15f815ff0b2
SHA256603842b9178b255b621e0b0983d6223c94594732544396c3db695c9e26628ed2
SHA512660213e9178b4856e7c985e8f4e73f20d7de5bd5480ae0c587ffb8cc6172e1ea7e325b8844816f91a235e5ad83cd501d6bc9b0d76d1e9f8352d0b8856d126765
-
Filesize
24.1MB
MD5d3c49bdcd3fd377d7f030786fe2f8262
SHA158eb70d52fdbacc09682711fd92c143d538a48cb
SHA256365b89d511512de12ac13a61b3c3f57dc5845957f76d73e3f36504c47ce93e9b
SHA51291299dd077b971245e90c02208220238c3fbd8571cc91c664ef2c7204896e740c2c82cb049ff84534e485bfab3b4c7b594691350918a41d171fb982abeb05fa9
-
\??\Volume{f9c79713-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{be0c490b-ecc9-4cde-95c2-6a1a08b73790}_OnDiskSnapshotProp
Filesize6KB
MD5fb4c7a53556fd56e5d12106f402aadb5
SHA12fce8b2b28251a744c277eb1895ce811f3f31bbf
SHA256c6ba61c24cfe8b6bee9dada6a5ab3db58114e1c6aeed5390d5a5ce1414591957
SHA5126e17a62f9f5e003b93ca234927be87cc2433ed512a69f0da35d917f435b11e85214d7058fa652ffac523209247dd3c8e5129389dece20917fd0137ef62dd8637
