metasploit | b52c47e114f8e8523dfb634146a4bf8bb54d639d3e733d7b3afe7cfb623208cc

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
12/12/2024, 02:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-12-12_0178d22ec86dd92c1cd8e0ba2ac223e5_avoslocker_hijackloader_luca-stealer_magniber.exe
Size

22.7MB
MD5

0178d22ec86dd92c1cd8e0ba2ac223e5
SHA1

30025465a07d50a21b8dda66b4591f545c35989d
SHA256

b52c47e114f8e8523dfb634146a4bf8bb54d639d3e733d7b3afe7cfb623208cc
SHA512

0c2075ac382e3c31eaac831e6225bc5cf96e4971d0779e636215fce16b2acecd6d6fb7722877e2139190331e6c4443c92a16bf51816748a6a1e322263dd9c9bf
SSDEEP

196608:49uXVejN2DaVCjRgo5wwDScTLKdJ4R2zJXTO0yVejN2DaVCjRgo5wwDScTLKdJ4I:49pWH5/+dBJXTzrWH5/+dBJXTz

Score

10^/10

metasploit backdoor discovery trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Extracted

Family

metasploit

Version

windows/reverse_tcp

192.168.1.26:443

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Metasploit family
metasploit

Loads dropped DLL 2 IoCs

pid	Process
2804	msiexec.exe
640	MsiExec.exe

Blocklisted process makes network request 2 IoCs

flow	pid	Process
4	2392	msiexec.exe
11	2804	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\RealVNC\VNC Viewer\logmessages.dll	msiexec.exe
File created	C:\Program Files\RealVNC\VNC Viewer\vncviewer.exe	msiexec.exe
File created	C:\Program Files\RealVNC\VNC Viewer\SetupCache\VNC-Viewer-7.13.0-Windows-64bit.msiKey	msiexec.exe
File created	C:\Program Files\RealVNC\VNC Viewer\SetupCache\VNC-Viewer-7.13.0-Windows-64bit.msi	msiexec.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\f7737f3.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI3AA2.tmp	msiexec.exe
File created	C:\Windows\Installer\{2B49B292-3014-4700-9EDD-A730D38BEB4F}\IconViewer.exe	msiexec.exe
File created	C:\Windows\Installer\f7737f5.msi	msiexec.exe
File created	C:\Windows\Installer\f7737f2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f7737f2.msi	msiexec.exe
File created	C:\Windows\Installer\f7737f3.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\{2B49B292-3014-4700-9EDD-A730D38BEB4F}\IconViewer.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3D43.tmp	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-12-12_0178d22ec86dd92c1cd8e0ba2ac223e5_avoslocker_hijackloader_luca-stealer_magniber.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

Modifies data under HKEY_USERS 46 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe

Modifies registry class 46 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\VNC.ConnectionInfo	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\com.realvnc.vncviewer.connect\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\292B94B241030074E9DD7A033DB8BEF4\PackageCode = "704BF67F6954F744EB47E218809A2761"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\292B94B241030074E9DD7A033DB8BEF4\ProductIcon = "C:\\Windows\\Installer\\{2B49B292-3014-4700-9EDD-A730D38BEB4F}\\IconViewer.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\292B94B241030074E9DD7A033DB8BEF4\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\292B94B241030074E9DD7A033DB8BEF4\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\46C1C5FF63EE1764B8F8C49444CD3C03\292B94B241030074E9DD7A033DB8BEF4	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\292B94B241030074E9DD7A033DB8BEF4\SourceList\PackageName = "vnc64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vnc\ = "VNC.ConnectionInfo"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\com.realvnc.vncviewer.connect\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\292B94B241030074E9DD7A033DB8BEF4\FeatureViewer	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\292B94B241030074E9DD7A033DB8BEF4\ProductName = "RealVNC Viewer 7.13.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.vnc	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\com.realvnc.vncviewer.connect\ = "URL:com.realvnc.vncviewer.connect"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\292B94B241030074E9DD7A033DB8BEF4\SourceList	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\292B94B241030074E9DD7A033DB8BEF4\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\292B94B241030074E9DD7A033DB8BEF4\Version = "118292480"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\292B94B241030074E9DD7A033DB8BEF4\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\292B94B241030074E9DD7A033DB8BEF4\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\VNC.ConnectionInfo\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VNC.ConnectionInfo	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VNC.ConnectionInfo\ = "RealVNC Viewer Connection Shortcut"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\com.realvnc.vncviewer.connect\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\292B94B241030074E9DD7A033DB8BEF4\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\292B94B241030074E9DD7A033DB8BEF4\SourceList\Net\2 = "C:\\Program Files\\RealVNC\\VNC Viewer\\SetupCache\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\com.realvnc.vncviewer.connect	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\292B94B241030074E9DD7A033DB8BEF4	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\292B94B241030074E9DD7A033DB8BEF4\FeatureDesktopShortcut = "\x06FeatureViewer"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\292B94B241030074E9DD7A033DB8BEF4\SourceList\PackageName = "VNC-Viewer-7.13.0-Windows-64bit.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\292B94B241030074E9DD7A033DB8BEF4\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\292B94B241030074E9DD7A033DB8BEF4\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\VNC.ConnectionInfo\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\com.realvnc.vncviewer.connect\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\com.realvnc.vncviewer.connect\shell\open\command\ = "C:\\Program Files\\RealVNC\\VNC Viewer\\vncviewer.exe -uri \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\292B94B241030074E9DD7A033DB8BEF4	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VNC.ConnectionInfo\shell\open\command\ = "\"C:\\Program Files\\RealVNC\\VNC Viewer\\vncviewer.exe\" -config \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\com.realvnc.vncviewer.connect	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\292B94B241030074E9DD7A033DB8BEF4\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\46C1C5FF63EE1764B8F8C49444CD3C03	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\292B94B241030074E9DD7A033DB8BEF4\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\292B94B241030074E9DD7A033DB8BEF4\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\292B94B241030074E9DD7A033DB8BEF4\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VNC.ConnectionInfo\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VNC.ConnectionInfo\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VNC.ConnectionInfo\shell\open\ = "Open"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\com.realvnc.vncviewer.connect\URL Protocol	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2804	msiexec.exe
2804	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2392	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2392	msiexec.exe
Token: SeRestorePrivilege	2804	msiexec.exe
Token: SeTakeOwnershipPrivilege	2804	msiexec.exe
Token: SeSecurityPrivilege	2804	msiexec.exe
Token: SeCreateTokenPrivilege	2392	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2392	msiexec.exe
Token: SeLockMemoryPrivilege	2392	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2392	msiexec.exe
Token: SeMachineAccountPrivilege	2392	msiexec.exe
Token: SeTcbPrivilege	2392	msiexec.exe
Token: SeSecurityPrivilege	2392	msiexec.exe
Token: SeTakeOwnershipPrivilege	2392	msiexec.exe
Token: SeLoadDriverPrivilege	2392	msiexec.exe
Token: SeSystemProfilePrivilege	2392	msiexec.exe
Token: SeSystemtimePrivilege	2392	msiexec.exe
Token: SeProfSingleProcessPrivilege	2392	msiexec.exe
Token: SeIncBasePriorityPrivilege	2392	msiexec.exe
Token: SeCreatePagefilePrivilege	2392	msiexec.exe
Token: SeCreatePermanentPrivilege	2392	msiexec.exe
Token: SeBackupPrivilege	2392	msiexec.exe
Token: SeRestorePrivilege	2392	msiexec.exe
Token: SeShutdownPrivilege	2392	msiexec.exe
Token: SeDebugPrivilege	2392	msiexec.exe
Token: SeAuditPrivilege	2392	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2392	msiexec.exe
Token: SeChangeNotifyPrivilege	2392	msiexec.exe
Token: SeRemoteShutdownPrivilege	2392	msiexec.exe
Token: SeUndockPrivilege	2392	msiexec.exe
Token: SeSyncAgentPrivilege	2392	msiexec.exe
Token: SeEnableDelegationPrivilege	2392	msiexec.exe
Token: SeManageVolumePrivilege	2392	msiexec.exe
Token: SeImpersonatePrivilege	2392	msiexec.exe
Token: SeCreateGlobalPrivilege	2392	msiexec.exe
Token: SeBackupPrivilege	2512	vssvc.exe
Token: SeRestorePrivilege	2512	vssvc.exe
Token: SeAuditPrivilege	2512	vssvc.exe
Token: SeBackupPrivilege	2804	msiexec.exe
Token: SeRestorePrivilege	2804	msiexec.exe
Token: SeRestorePrivilege	2420	DrvInst.exe
Token: SeRestorePrivilege	2420	DrvInst.exe
Token: SeRestorePrivilege	2420	DrvInst.exe
Token: SeRestorePrivilege	2420	DrvInst.exe
Token: SeRestorePrivilege	2420	DrvInst.exe
Token: SeRestorePrivilege	2420	DrvInst.exe
Token: SeRestorePrivilege	2420	DrvInst.exe
Token: SeLoadDriverPrivilege	2420	DrvInst.exe
Token: SeLoadDriverPrivilege	2420	DrvInst.exe
Token: SeLoadDriverPrivilege	2420	DrvInst.exe
Token: SeRestorePrivilege	2804	msiexec.exe
Token: SeTakeOwnershipPrivilege	2804	msiexec.exe
Token: SeRestorePrivilege	2804	msiexec.exe
Token: SeTakeOwnershipPrivilege	2804	msiexec.exe
Token: SeRestorePrivilege	2804	msiexec.exe
Token: SeTakeOwnershipPrivilege	2804	msiexec.exe
Token: SeRestorePrivilege	2804	msiexec.exe
Token: SeTakeOwnershipPrivilege	2804	msiexec.exe
Token: SeRestorePrivilege	2804	msiexec.exe
Token: SeTakeOwnershipPrivilege	2804	msiexec.exe
Token: SeRestorePrivilege	2804	msiexec.exe
Token: SeTakeOwnershipPrivilege	2804	msiexec.exe
Token: SeRestorePrivilege	2804	msiexec.exe
Token: SeTakeOwnershipPrivilege	2804	msiexec.exe
Token: SeRestorePrivilege	2804	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2392	msiexec.exe
2392	msiexec.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 2392	2604	2024-12-12_0178d22ec86dd92c1cd8e0ba2ac223e5_avoslocker_hijackloader_luca-stealer_magniber.exe	30
PID 2604 wrote to memory of 2392	2604	2024-12-12_0178d22ec86dd92c1cd8e0ba2ac223e5_avoslocker_hijackloader_luca-stealer_magniber.exe	30
PID 2604 wrote to memory of 2392	2604	2024-12-12_0178d22ec86dd92c1cd8e0ba2ac223e5_avoslocker_hijackloader_luca-stealer_magniber.exe	30
PID 2604 wrote to memory of 2392	2604	2024-12-12_0178d22ec86dd92c1cd8e0ba2ac223e5_avoslocker_hijackloader_luca-stealer_magniber.exe	30
PID 2604 wrote to memory of 2392	2604	2024-12-12_0178d22ec86dd92c1cd8e0ba2ac223e5_avoslocker_hijackloader_luca-stealer_magniber.exe	30
PID 2604 wrote to memory of 2392	2604	2024-12-12_0178d22ec86dd92c1cd8e0ba2ac223e5_avoslocker_hijackloader_luca-stealer_magniber.exe	30
PID 2604 wrote to memory of 2392	2604	2024-12-12_0178d22ec86dd92c1cd8e0ba2ac223e5_avoslocker_hijackloader_luca-stealer_magniber.exe	30
PID 2804 wrote to memory of 640	2804	msiexec.exe	36
PID 2804 wrote to memory of 640	2804	msiexec.exe	36
PID 2804 wrote to memory of 640	2804	msiexec.exe	36
PID 2804 wrote to memory of 640	2804	msiexec.exe	36
PID 2804 wrote to memory of 640	2804	msiexec.exe	36

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-12-12_0178d22ec86dd92c1cd8e0ba2ac223e5_avoslocker_hijackloader_luca-stealer_magniber.exe
"C:\Users\Admin\AppData\Local\Temp\2024-12-12_0178d22ec86dd92c1cd8e0ba2ac223e5_avoslocker_hijackloader_luca-stealer_magniber.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Windows\SysWOW64\msiexec.exe
  C:\Windows\system32\msiexec.exe /i C:\Users\Admin\AppData\Local\Temp\vnc64.msi ProductLanguage=1033
  2⤵
  - Blocklisted process makes network request
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2392

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Loads dropped DLL
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding 56B6D0C903915EBBA005B685DCA781C0 M Global\MSI0000
  2⤵
  - Loads dropped DLL
  PID:640

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2512

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000060" "00000000000003EC"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f7737f4.rbs

Filesize
1.0MB

MD5
49dbe1f77751eb316abb70c393ca9e73

SHA1
724b5ff6cebd907d6552d56837b30ae1f7144ad6

SHA256
53ee8a3678f5447cacc0913477ed1d97fc65bcc752656e5444217c1ef1987dd5

SHA512
e20d63f38c164c79f28170ecb87b66e7cf7252f4e78a5af82a9b907306d7845c9f0acd6504040dc5e2374e5ae85d1f58b5e7396d18e02202677f0eb0a8eff70f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
471B

MD5
4a9aa6a614556e086a26fd3799e56ddd

SHA1
f20b660dfaba446060f0c074a511cb931adc1129

SHA256
1f26a246511a771e468f21ebf16ebc65771824106b0cdf4ac4d7686a0e33f9ec

SHA512
417fe3d13064b688bc432a363bb8ffcbb5236b0481eb804889ffe836f3796d5e96634f1685c4f36588c067a05cb15b50795bf6363f1ded5c23533faecb15ad47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_F59623AEE3E6048CCD92ADA564422513

Filesize
727B

MD5
2720763d3d6e1af588241a850d29db71

SHA1
5304cfecb54632e1824150f2db0d69ff1fa5a686

SHA256
aaf83b6a0722f145f3b5a85052e44b6c59689ffb03189d68a44b24cb0b5fd364

SHA512
64d2b84bc11e36de9aec359523e628636874e8c5ebe76f46134dd01ddd8bfa1c1666af0fae865268c464b4a83eba2ecc4c93f386cd101f988be07593bd014cf0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
727B

MD5
144166bcdd73de6bc88826b56a505cf7

SHA1
ec02bf36ee81da1c0b9092337a054956480ea26a

SHA256
d7ed6d87057832f9a9d0476cc4f287cfd161453d978088bac3504428709a7523

SHA512
f56bbc0ed83c96aac239356e0664ac511b7c4c651017843f9fadf189e9a5dc0bc9f0eba3cb95179383d69c076feb966c2fd9bf00ef976e2c925ae8cbada4e463

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
400B

MD5
ffb9a2f580e5c34f741ba5600a973ec3

SHA1
9315f3f9935a0748c0eb6ff2117a53a9bd38e8fb

SHA256
e054c70021988a6cdec21bec86d77e47f06217a1a760ae53b7e325636371f53a

SHA512
58df2adeeb79b26505ff486dbd0d0e9fec6ecdb106d1f35d2e0279639ddf521811269c900f55920e627db9e9ab375c21aa381b036c25c2f38e8f35201448abad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_F59623AEE3E6048CCD92ADA564422513

Filesize
408B

MD5
be57ecd0e6750798a027d76227791aa2

SHA1
d1cc2e3a4150dbc607d8bc5a7052ffcb64cdfddc

SHA256
ec8fd8552a39ca841115da7c27ad44cdd175556f21954ef95dfed026f25ee8c3

SHA512
bb1d780b74c04707c2eda61f6baa808b0d6ef0360f33507e47805075d5be99b9ddf0735ef9297dc10dcd86d5b652f2b7680a208a052535bf00f16864baab2cb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
412B

MD5
1a7fc50e0efda8620b5da9f41e160ba8

SHA1
3c0af634377b7cf199583e8dfaa3a20a4ecc39c4

SHA256
19125a62ddcdec9a336081395a66a417366fe3bba6ab023f66c132668f46d676

SHA512
bd8713225b31877ef62fedf1297ad24d4ae130d4a88b08ab78424ef1953d9d1e4d3646060431052fe534bb4c079b86b0c2ced0c646c96cfcbca3d81a6798e65c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB415.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB58E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\vnc64.msi

Filesize
5.6MB

MD5
5b24d1c6b28984bf3a307a217ae862b4

SHA1
4db2cb295343977d1c4b1a6f0c8890f47aab6271

SHA256
14c5a337888158e635ea9d5c6d608ad5e9fb6af0b5f125d20b38bb03e26ffd6b

SHA512
1e30c593a2542099372dd0e6dc14f25a4cfeb5d4aa95a3981da4def8942db9ed0603e64f9c5d8040ca21f3894c7fe705fff62bb47dfe6ff9ccb7a84516f014a8

Download Submit
C:\Windows\Installer\MSI3D43.tmp

Filesize
1.0MB

MD5
55d3dcd4008adcfef3e0cb44fb0f229b

SHA1
6f828fa6e759b1cae266954670448f8bc6c6316f

SHA256
96fad74bb3630a31b8793887f394ba45a251b4b292c37225db05f47785c7dcf7

SHA512
19fc3c4b83392734a30019e08408ba4865ba483fd2ab701c630aad67b70bc9d0785aa70f737692b1955357a9a7e702ad868e48f6d6f03e5639126481f3319634

Download Submit
\Program Files\RealVNC\VNC Viewer\vncviewer.exe

Filesize
11.3MB

MD5
13074501a8d7b61da2845bb4c509ba56

SHA1
c2faf654ba721d435fc44eebd5f61f5f119f3f9f

SHA256
6b6287b1e4a93b01124f7d091aec49b3d286b7aff625b3520b531fee3c6a324a

SHA512
95556fae5921523c5122edd73dcdb54aebc4289d57cae99cc67984a51c8ccb8198fdfb58c5fac31a65e13b5247e658770dcb6aceffc4a4c1458260d294b37895

Download Submit
memory/2604-0-0x0000000000400000-0x0000000001AB5AEC-memory.dmp

Filesize
22.7MB

Download
memory/2604-84-0x0000000000400000-0x0000000001AB5AEC-memory.dmp

Filesize
22.7MB

Download