Overview

overview

10

Static

static

1

010367d9fc...f2.msi

windows7-x64

8

010367d9fc...f2.msi

windows10-2004-x64

10

Analysis

  • max time kernel
    121s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    16-12-2024 04:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    010367d9fc0fdd9de68af62a4e56a5e311a7c8c9d76b706cae59ea8a38f7d9f2.msi

  • Size

    96.3MB

  • MD5

    cc9cd8ad9a22acb8305eb14d0a8bfcd1

  • SHA1

    a097850d43b2a7c094069ac758c8cdc6565af8e5

  • SHA256

    010367d9fc0fdd9de68af62a4e56a5e311a7c8c9d76b706cae59ea8a38f7d9f2

  • SHA512

    9a529b79c727474f45f55093972885503103a8ca7437600562adf4c5f0112e7113ff892726d1e67edce4655a910d5e49337543dac4db7d381aa725a544aa7f8d

  • SSDEEP

    3145728:N+LEmAi0QDF3gzILlHgytL79ORBow2zanEL+X:NonQchHNP9EgBL

Score
8/10
discoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 16 IoCs
  • Drops file in Windows directory 11 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 22 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\010367d9fc0fdd9de68af62a4e56a5e311a7c8c9d76b706cae59ea8a38f7d9f2.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2420
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1652
    • C:\Windows\system32\MsiExec.exe
      C:\Windows\system32\MsiExec.exe -Embedding ADC0A4FC15E15EB138A7F16371174E0F M Global\MSI0000
      2⤵
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:2500
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\LogDisplayAPI','C:\Program Files','C:\Program Files'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1728
      • C:\Program Files\LogDisplayAPI\AgVKOCOPgZUKZaE.exe
        "C:\Program Files\LogDisplayAPI\AgVKOCOPgZUKZaE.exe" x "C:\Program Files\LogDisplayAPI\TsuNgNucABNGLKF." "C:\Program Files\LogDisplayAPI\" -p"82172xEZ9}JD}HyN3N}." -y
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:484
      • C:\Program Files\LogDisplayAPI\AgVKOCOPgZUKZaE.exe
        "C:\Program Files\LogDisplayAPI\AgVKOCOPgZUKZaE.exe" x "C:\Program Files\LogDisplayAPI\qiJlRUmNGLOJIQR." -x"1_nzUbVPvBzDwZ.exe" -x"sss" -x"1_ZEtMZROjFEXUunp.exe" -x"1_" -x"1_" -x"sa" "C:\Program Files\LogDisplayAPI\" -p"540768fgP}GcRPOdgPox" -y
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2568
      • C:\Program Files\LogDisplayAPI\nzUbVPvBzDwZ.exe
        "C:\Program Files\LogDisplayAPI\nzUbVPvBzDwZ.exe" -nbg 274
        3⤵
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        PID:2840
      • C:\Program Files\LogDisplayAPI\win32quickq.exe
        "C:\Program Files\LogDisplayAPI\win32quickq.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        PID:3012
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2112
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003A8" "00000000000005C8"
    1⤵
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    PID:2592

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Config.Msi\f76e1ba.rbs
    Filesize

    7KB

    MD5

    24038d1b8f4395cefbb55c3a6ea96a2a

    SHA1

    8afc2a0652f3f50f386f77fa6d86dbaf507bb8da

    SHA256

    6ca9b9397e5abded3f18de4640c24de42ac0616b240631a4bab2a680a0880955

    SHA512

    d3b33ca2b8440aeae3e6daab430935fd3b66adc03db439dd98dffda45746bd18e66f7cff032920b24a9c4f25a9a4ba9e5aa3a2fb4b22d08a17bcd9341c49f193

    Download Submit

  • C:\Program Files\LogDisplayAPI\2_nzUbVPvBzDwZ.exe
    Filesize

    5.4MB

    MD5

    3edc4a0a0e0cecf47293ee1afdd4f026

    SHA1

    463a23a83411274b844f3a0a2432736e08ec83cd

    SHA256

    a61c490dc3731726b04044e473e3d72874815dd98243486c1703796631f66865

    SHA512

    6fa20e4806bb0b15d989df16abbd7084c2609cc1408791f2a154ef59d840122a8f01e1c6d05f1258f6621c6dc3812d76a27493ec86cdf29e9bd2496458cb59f0

    Download Submit

  • C:\Program Files\LogDisplayAPI\AgVKOCOPgZUKZaE.exe
    Filesize

    752KB

    MD5

    9b08fd1d59cb47aa7bf456e6d388f6c2

    SHA1

    31923271d11a2f8d2aaf758e00fc2029a3614335

    SHA256

    0a88d153334d6865273920593d947bb3b6f9af945f7d479865b1e9f3354042b5

    SHA512

    0a35c61dda6b0d8d307a87a024bf7390690de83aee938f2b53e56768f466dd872237dc638fbab5a427c44221331236f1350b38292cb763fd5a65967317063457

    Download Submit

  • C:\Program Files\LogDisplayAPI\TsuNgNucABNGLKF
    Filesize

    2.5MB

    MD5

    f244487106eb4e1ba09ff94195324f59

    SHA1

    77610e900c07e850cf5b17eac50a4ea54934b748

    SHA256

    381f110fae77625187f631e8314f0fca826c3cb4e1b6a8e8c96ab0d4e9c6b689

    SHA512

    3efac761e1221b55f73ff71ebad3d40591c9aeef3790934171e7d69db7b7b260f827f8d0c81469d7dfe12d9c40a8d1ebae06bc95384a71ec83257640fe663c4a

    Download Submit

  • C:\Program Files\LogDisplayAPI\qiJlRUmNGLOJIQR
    Filesize

    2.4MB

    MD5

    4a15a9b8be8cb41729a6dc744e4eed59

    SHA1

    b5db15960baac1297674808b8fd2b6f260f7a8aa

    SHA256

    1ac597850a81d21740528aea1740a9b32c23816a53717d61118cd93e6860a9ba

    SHA512

    3d754ea574be11a206cce86e9d1ed47eadc86582a3c3aecae445fbcf27bd7bb82d18ed5676aa52ba3f2156e74593f28f69d92d47e0322d863f3949a0957ec9a0

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsjF9EA.tmp\ioSpecial.ini
    Filesize

    679B

    MD5

    2adae36efa4e81bb52e654ef7a24d248

    SHA1

    69d30c4649c329898a0ea7d2399c5476b541a7e3

    SHA256

    67d41bdb7daa601abba05daa5078cb230b2288deda24b236b7f6b9e244a53a62

    SHA512

    3a711c80673dfde316b4d7f48f77d2723736e309891dd95668aef41910280193bdac1c8f30c9e9c7b383c52d4bc6eedca384ead541852bc5de2a5e74f9bed155

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsjF9EA.tmp\ioSpecial.ini
    Filesize

    718B

    MD5

    ccea7f77bd39488ccb183c033c73cf86

    SHA1

    87e807a69074a728e97839ef8b81215c00a2172f

    SHA256

    3be9db4c8dfd30e3aeccf8004abe3e496304ec63d7ffc814ce9627c461ab616e

    SHA512

    7607f40f96a31b653a18a55b5f16f74f889632615ad6e5499b5cc239b70a8b8eec30e12e515dd7b3be7836949698443eeffbabc53c92ca1258ff35ef2182531f

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsjF9EA.tmp\InstallOptions.dll
    Filesize

    14KB

    MD5

    8d5a5529462a9ba1ac068ee0502578c7

    SHA1

    875e651e302ce0bfc8893f341cf19171fee25ea5

    SHA256

    e625dcd0188594b1289891b64debddeb5159aca182b83a12675427b320bf7790

    SHA512

    101da2c33f47bd85b8934318e0f0b72f820afc928a2a21e2c7823875e3a0e830f7c67f42b4c2f30596eaa073617790c89700c0d95b7949ec617e52800b61d462

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsjF9EA.tmp\LangDLL.dll
    Filesize

    5KB

    MD5

    77ff758c10c66937de6d86c388aa431c

    SHA1

    14bd5628eaf8a12b55cd38f9560c839cb21ce77a

    SHA256

    6a033e367714ec0d13fca0589c165bdbf4d1dac459fa7ec7415815223fa3c008

    SHA512

    319837951be276a179ead69efcd24bd7566061abc7997ea782af50bd4b0d69e5ec1a6e4cdeb2825bafedf87edf03380396b7bcf58682b6a3a824c8dc4b966bda

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsjF9EA.tmp\System.dll
    Filesize

    11KB

    MD5

    b0c77267f13b2f87c084fd86ef51ccfc

    SHA1

    f7543f9e9b4f04386dfbf33c38cbed1bf205afb3

    SHA256

    a0cac4cf4852895619bc7743ebeb89f9e4927ccdb9e66b1bcd92a4136d0f9c77

    SHA512

    f2b57a2eea00f52a3c7080f4b5f2bb85a7a9b9f16d12da8f8ff673824556c62a0f742b72be0fd82a2612a4b6dbd7e0fdc27065212da703c2f7e28d199696f66e

    Download Submit

  • memory/1728-18-0x0000000002280000-0x0000000002288000-memory.dmp

    Filesize

    32KB

    Download

  • memory/1728-17-0x000000001B5E0000-0x000000001B8C2000-memory.dmp

    Filesize

    2.9MB

    Download

  • memory/2500-12-0x00000000003F0000-0x0000000000400000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2840-153-0x000000002B6B0000-0x000000002B6DA000-memory.dmp

    Filesize

    168KB

    Download