ee013d9ff7050f96c3ff91d49e90bb60f3a2fb4d41efd918e6cb8aac6cf94e47

Analysis

max time kernel
94s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-12-2024 01:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20AC0B78.msi
Size

1.4MB
MD5

9c84926dac4e5e7037747c49f58f1724
SHA1

f5695587523152a08eab8f5d11c7ab3251b107d1
SHA256

ee013d9ff7050f96c3ff91d49e90bb60f3a2fb4d41efd918e6cb8aac6cf94e47
SHA512

6b476538935d69362089d8505203dadca4330ba112252870ab5be529ed8b40cca3beff7d27a4e59587b20dd33ff19cd177a1945a7158758d3630578c75b8f17a
SSDEEP

24576:eruDXXh3j04BMeRocDP1Nxyq7KDOJjkDOk4TB4McL8dfbfr7KCN5nQ6BAMVUTH:e+Xx4i5ooIq7iOJwyZeL8dfv7jN5nQ6I

Score

6^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIB80A.tmp	msiexec.exe
File created	C:\Windows\Installer\e57b4c9.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB527.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB6FF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB74E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB68F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB6DE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{80395032-1630-4C4B-A997-0A7CCB72C75B}	msiexec.exe
File created	C:\Windows\dbcode21mk.log	msiexec.exe
File opened for modification	C:\Windows\Installer\e57b4c9.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\setupact64.log	msiexec.exe

Loads dropped DLL 5 IoCs

pid	Process
3184	MsiExec.exe
3184	MsiExec.exe
3184	MsiExec.exe
3184	MsiExec.exe
3184	MsiExec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2676	msiexec.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 36 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\JITDebug = "0"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3388	msiexec.exe
3388	msiexec.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2676	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2676	msiexec.exe
Token: SeSecurityPrivilege	3388	msiexec.exe
Token: SeCreateTokenPrivilege	2676	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2676	msiexec.exe
Token: SeLockMemoryPrivilege	2676	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2676	msiexec.exe
Token: SeMachineAccountPrivilege	2676	msiexec.exe
Token: SeTcbPrivilege	2676	msiexec.exe
Token: SeSecurityPrivilege	2676	msiexec.exe
Token: SeTakeOwnershipPrivilege	2676	msiexec.exe
Token: SeLoadDriverPrivilege	2676	msiexec.exe
Token: SeSystemProfilePrivilege	2676	msiexec.exe
Token: SeSystemtimePrivilege	2676	msiexec.exe
Token: SeProfSingleProcessPrivilege	2676	msiexec.exe
Token: SeIncBasePriorityPrivilege	2676	msiexec.exe
Token: SeCreatePagefilePrivilege	2676	msiexec.exe
Token: SeCreatePermanentPrivilege	2676	msiexec.exe
Token: SeBackupPrivilege	2676	msiexec.exe
Token: SeRestorePrivilege	2676	msiexec.exe
Token: SeShutdownPrivilege	2676	msiexec.exe
Token: SeDebugPrivilege	2676	msiexec.exe
Token: SeAuditPrivilege	2676	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2676	msiexec.exe
Token: SeChangeNotifyPrivilege	2676	msiexec.exe
Token: SeRemoteShutdownPrivilege	2676	msiexec.exe
Token: SeUndockPrivilege	2676	msiexec.exe
Token: SeSyncAgentPrivilege	2676	msiexec.exe
Token: SeEnableDelegationPrivilege	2676	msiexec.exe
Token: SeManageVolumePrivilege	2676	msiexec.exe
Token: SeImpersonatePrivilege	2676	msiexec.exe
Token: SeCreateGlobalPrivilege	2676	msiexec.exe
Token: SeRestorePrivilege	3388	msiexec.exe
Token: SeTakeOwnershipPrivilege	3388	msiexec.exe
Token: SeRestorePrivilege	3388	msiexec.exe
Token: SeTakeOwnershipPrivilege	3388	msiexec.exe
Token: SeRestorePrivilege	3388	msiexec.exe
Token: SeTakeOwnershipPrivilege	3388	msiexec.exe
Token: SeRestorePrivilege	3388	msiexec.exe
Token: SeTakeOwnershipPrivilege	3388	msiexec.exe
Token: SeRestorePrivilege	3388	msiexec.exe
Token: SeTakeOwnershipPrivilege	3388	msiexec.exe
Token: SeRestorePrivilege	3388	msiexec.exe
Token: SeTakeOwnershipPrivilege	3388	msiexec.exe
Token: SeRestorePrivilege	3388	msiexec.exe
Token: SeTakeOwnershipPrivilege	3388	msiexec.exe
Token: SeRestorePrivilege	3388	msiexec.exe
Token: SeTakeOwnershipPrivilege	3388	msiexec.exe
Token: SeRestorePrivilege	3388	msiexec.exe
Token: SeTakeOwnershipPrivilege	3388	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2676	msiexec.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3388 wrote to memory of 3184	3388	msiexec.exe	85
PID 3388 wrote to memory of 3184	3388	msiexec.exe	85
PID 3388 wrote to memory of 3184	3388	msiexec.exe	85
PID 3388 wrote to memory of 2156	3388	msiexec.exe	86
PID 3388 wrote to memory of 2156	3388	msiexec.exe	86
PID 3388 wrote to memory of 2156	3388	msiexec.exe	86
PID 2156 wrote to memory of 2728	2156	MsiExec.exe	87
PID 2156 wrote to memory of 2728	2156	MsiExec.exe	87
PID 2156 wrote to memory of 2728	2156	MsiExec.exe	87
PID 2156 wrote to memory of 3884	2156	MsiExec.exe	89
PID 2156 wrote to memory of 3884	2156	MsiExec.exe	89
PID 2156 wrote to memory of 3884	2156	MsiExec.exe	89
PID 2156 wrote to memory of 4588	2156	MsiExec.exe	91
PID 2156 wrote to memory of 4588	2156	MsiExec.exe	91
PID 2156 wrote to memory of 4588	2156	MsiExec.exe	91
PID 2156 wrote to memory of 4008	2156	MsiExec.exe	93
PID 2156 wrote to memory of 4008	2156	MsiExec.exe	93
PID 2156 wrote to memory of 4008	2156	MsiExec.exe	93
PID 2156 wrote to memory of 4820	2156	MsiExec.exe	96
PID 2156 wrote to memory of 4820	2156	MsiExec.exe	96
PID 2156 wrote to memory of 4820	2156	MsiExec.exe	96
PID 2156 wrote to memory of 2400	2156	MsiExec.exe	98
PID 2156 wrote to memory of 2400	2156	MsiExec.exe	98
PID 2156 wrote to memory of 2400	2156	MsiExec.exe	98
PID 2156 wrote to memory of 2420	2156	MsiExec.exe	100
PID 2156 wrote to memory of 2420	2156	MsiExec.exe	100
PID 2156 wrote to memory of 2420	2156	MsiExec.exe	100
PID 2156 wrote to memory of 4904	2156	MsiExec.exe	102
PID 2156 wrote to memory of 4904	2156	MsiExec.exe	102
PID 2156 wrote to memory of 4904	2156	MsiExec.exe	102
PID 2156 wrote to memory of 3304	2156	MsiExec.exe	104
PID 2156 wrote to memory of 3304	2156	MsiExec.exe	104
PID 2156 wrote to memory of 3304	2156	MsiExec.exe	104
PID 2156 wrote to memory of 3092	2156	MsiExec.exe	106
PID 2156 wrote to memory of 3092	2156	MsiExec.exe	106
PID 2156 wrote to memory of 3092	2156	MsiExec.exe	106
PID 2156 wrote to memory of 4616	2156	MsiExec.exe	108
PID 2156 wrote to memory of 4616	2156	MsiExec.exe	108
PID 2156 wrote to memory of 4616	2156	MsiExec.exe	108
PID 2156 wrote to memory of 2228	2156	MsiExec.exe	110
PID 2156 wrote to memory of 2228	2156	MsiExec.exe	110
PID 2156 wrote to memory of 2228	2156	MsiExec.exe	110

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\20AC0B78.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2676

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3388
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 90DE11378E83CC2353B726CAF00ACA06
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3184
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 639786F626E7FBC97792FE7A6EC77E3A E Global\MSI0000
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:2156
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\SysWOW64\netsh.exe" interface ipv6 install
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2728
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\SysWOW64\netsh.exe" ipsec static add policy name=qianye
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:3884
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\SysWOW64\netsh.exe" ipsec static add filterlist name=Filter1
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:4588
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=TCP
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:4008
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=TCP
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:4820
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=TCP
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2400
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=UDP
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2420
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=UDP
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:4904
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=UDP
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:3304
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\SysWOW64\netsh.exe" ipsec static add filteraction name=FilteraAtion1 action=block
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:3092
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\SysWOW64\netsh.exe" ipsec static add rule name=Rule1 policy=qianye filterlist=Filter1 filteraction=FilteraAtion1
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:4616
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\SysWOW64\netsh.exe" ipsec static set policy name=qianye assign=y
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Netsh Helper DLL

T1546.007

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57b4cc.rbs

Filesize
2KB

MD5
f454fb132a927c19c51259cc7d2f8a64

SHA1
f30dc934d01743f21258fd9c78273dfd3f33b586

SHA256
ca6e411b130783e48cf2ca039036453573db409e31b42bf074b4fa7ffb55cca2

SHA512
dff0cacbc1d3b3ac388a5aa24965ab41f1cf532400e402eec505ce95ba8aa6d86966dce80f1310ac15506dfc7b3fce5de4222edddfbdad1f10bf73acc0048486

Download Submit
C:\Windows\Installer\MSIB527.tmp

Filesize
141KB

MD5
4ba8ef50ce73395ad623c770c10e35a7

SHA1
63600584c296c0cbe1775a759c34ab384e1bbf76

SHA256
6094c813ca4bd0c647b950ba286bd338ef3623fa953b3bcf1a359b88f7296e55

SHA512
0730585476d8ded7b363afa486733c6c234704de5cf65f1171ec727f1b826c8a228c0ff5f6f6c219a220ea1794c4c462ab1d45ca48cb62e5eea94dd850ae4206

Download Submit
C:\Windows\Installer\MSIB6FF.tmp

Filesize
118KB

MD5
4b49c57cbefa1d2773da1f95338e294d

SHA1
108ea90d8a42cf31f7d8d7710b5fd713ca048ef9

SHA256
68c66657b569cad9cc6e1f5adf0795b5df444ec9945c0d86c62c5abc8aaddc08

SHA512
42c61f24196c2682343309cbcdcea185a4100603c649e053c11e2efadef8983c411ef4c61ca71025460baf3d4155157242b2f4ce02a88b6ca2d1922651036165

Download Submit
memory/3184-6-0x0000000074810000-0x0000000074875000-memory.dmp

Filesize
404KB

Download
memory/3184-15-0x0000000074810000-0x0000000074875000-memory.dmp

Filesize
404KB

Download
memory/3184-20-0x0000000074830000-0x0000000074880000-memory.dmp

Filesize
320KB

Download
memory/3184-25-0x0000000074810000-0x0000000074875000-memory.dmp

Filesize
404KB

Download