Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
31/12/2024, 02:27
Static task
static1
Behavioral task
behavioral1
Sample
5a49f64634ac29f37b3e53f5a1e37b90e8f3a385683f24083c68aee092408314.msi
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
5a49f64634ac29f37b3e53f5a1e37b90e8f3a385683f24083c68aee092408314.msi
Resource
win10v2004-20241007-en
General
-
Target
5a49f64634ac29f37b3e53f5a1e37b90e8f3a385683f24083c68aee092408314.msi
-
Size
1.7MB
-
MD5
51dd5767de678bb6359cbb175319f0ec
-
SHA1
76ae487dda6cf3651a9b2b30614c0fefd1f3149c
-
SHA256
5a49f64634ac29f37b3e53f5a1e37b90e8f3a385683f24083c68aee092408314
-
SHA512
ffb798290e2f6840eb8f0587dc675e8654589bfd070b1c54e49c7984272aa94da3a493cbd28b1dddef1f6a44b09ad9fd8a14ec0d77b90f948dc85089f91cc8a0
-
SSDEEP
49152:+EJnsHyjtk2MYC5GDChloJfWJ255hpB14Rd:1nsmtk2arhlTJ23h
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
resource behavioral1/files/0x0005000000018731-100.dat -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MRIYKG.lnk ._cache_Synaptics.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" MSIDDC4.tmp Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\MRIYKG = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windata\\CHVALO.exe\"" ._cache_Synaptics.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe -
AutoIT Executable 9 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/1168-109-0x0000000000070000-0x0000000000274000-memory.dmp autoit_exe behavioral1/memory/1168-111-0x0000000000070000-0x0000000000274000-memory.dmp autoit_exe behavioral1/memory/1168-116-0x0000000000070000-0x0000000000274000-memory.dmp autoit_exe behavioral1/memory/1168-118-0x0000000000070000-0x0000000000274000-memory.dmp autoit_exe behavioral1/memory/1272-134-0x0000000001270000-0x0000000001474000-memory.dmp autoit_exe behavioral1/memory/1168-166-0x0000000000070000-0x0000000000274000-memory.dmp autoit_exe behavioral1/memory/1168-172-0x0000000000070000-0x0000000000274000-memory.dmp autoit_exe behavioral1/memory/1676-177-0x00000000003A0000-0x00000000005A4000-memory.dmp autoit_exe behavioral1/memory/1168-181-0x0000000000070000-0x0000000000274000-memory.dmp autoit_exe -
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\._cache_MSIDDC4.tmp MSIDDC4.tmp File opened for modification C:\Windows\SysWOW64\._cache_MSIDDC4.tmp MSIDDC4.tmp File created C:\Windows\SysWOW64\._cache_Synaptics.exe Synaptics.exe File opened for modification C:\Windows\SysWOW64\._cache_Synaptics.exe Synaptics.exe File opened for modification C:\Windows\SysWOW64\winmgmts:\localhost\root\SecurityCenter2 ._cache_Synaptics.exe -
resource yara_rule behavioral1/files/0x0009000000016cc5-46.dat upx behavioral1/memory/1168-54-0x0000000000070000-0x0000000000274000-memory.dmp upx behavioral1/memory/1920-53-0x0000000005AC0000-0x0000000005CC4000-memory.dmp upx behavioral1/memory/1168-109-0x0000000000070000-0x0000000000274000-memory.dmp upx behavioral1/memory/1168-111-0x0000000000070000-0x0000000000274000-memory.dmp upx behavioral1/memory/1168-116-0x0000000000070000-0x0000000000274000-memory.dmp upx behavioral1/memory/1168-118-0x0000000000070000-0x0000000000274000-memory.dmp upx behavioral1/memory/1272-133-0x0000000001270000-0x0000000001474000-memory.dmp upx behavioral1/memory/1272-134-0x0000000001270000-0x0000000001474000-memory.dmp upx behavioral1/memory/1168-166-0x0000000000070000-0x0000000000274000-memory.dmp upx behavioral1/memory/1168-172-0x0000000000070000-0x0000000000274000-memory.dmp upx behavioral1/memory/1676-176-0x00000000003A0000-0x00000000005A4000-memory.dmp upx behavioral1/memory/1676-177-0x00000000003A0000-0x00000000005A4000-memory.dmp upx behavioral1/memory/1168-181-0x0000000000070000-0x0000000000274000-memory.dmp upx -
Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\f76dcb8.msi msiexec.exe File created C:\Windows\Installer\f76dcbb.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIDD93.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIDDC4.tmp msiexec.exe File opened for modification C:\Windows\Installer\f76dcbb.ipi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\Installer\f76dcb8.msi msiexec.exe -
Executes dropped EXE 5 IoCs
pid Process 2648 MSIDDC4.tmp 1920 Synaptics.exe 1168 ._cache_Synaptics.exe 1272 CHVALO.exe 1676 CHVALO.exe -
Loads dropped DLL 5 IoCs
pid Process 2648 MSIDDC4.tmp 2648 MSIDDC4.tmp 1920 Synaptics.exe 1920 Synaptics.exe 1168 ._cache_Synaptics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2116 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CHVALO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CHVALO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSIDDC4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WSCript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1872 schtasks.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1264 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2268 msiexec.exe 2268 msiexec.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe 1168 ._cache_Synaptics.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1168 ._cache_Synaptics.exe -
Suspicious use of AdjustPrivilegeToken 61 IoCs
description pid Process Token: SeShutdownPrivilege 2116 msiexec.exe Token: SeIncreaseQuotaPrivilege 2116 msiexec.exe Token: SeRestorePrivilege 2268 msiexec.exe Token: SeTakeOwnershipPrivilege 2268 msiexec.exe Token: SeSecurityPrivilege 2268 msiexec.exe Token: SeCreateTokenPrivilege 2116 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2116 msiexec.exe Token: SeLockMemoryPrivilege 2116 msiexec.exe Token: SeIncreaseQuotaPrivilege 2116 msiexec.exe Token: SeMachineAccountPrivilege 2116 msiexec.exe Token: SeTcbPrivilege 2116 msiexec.exe Token: SeSecurityPrivilege 2116 msiexec.exe Token: SeTakeOwnershipPrivilege 2116 msiexec.exe Token: SeLoadDriverPrivilege 2116 msiexec.exe Token: SeSystemProfilePrivilege 2116 msiexec.exe Token: SeSystemtimePrivilege 2116 msiexec.exe Token: SeProfSingleProcessPrivilege 2116 msiexec.exe Token: SeIncBasePriorityPrivilege 2116 msiexec.exe Token: SeCreatePagefilePrivilege 2116 msiexec.exe Token: SeCreatePermanentPrivilege 2116 msiexec.exe Token: SeBackupPrivilege 2116 msiexec.exe Token: SeRestorePrivilege 2116 msiexec.exe Token: SeShutdownPrivilege 2116 msiexec.exe Token: SeDebugPrivilege 2116 msiexec.exe Token: SeAuditPrivilege 2116 msiexec.exe Token: SeSystemEnvironmentPrivilege 2116 msiexec.exe Token: SeChangeNotifyPrivilege 2116 msiexec.exe Token: SeRemoteShutdownPrivilege 2116 msiexec.exe Token: SeUndockPrivilege 2116 msiexec.exe Token: SeSyncAgentPrivilege 2116 msiexec.exe Token: SeEnableDelegationPrivilege 2116 msiexec.exe Token: SeManageVolumePrivilege 2116 msiexec.exe Token: SeImpersonatePrivilege 2116 msiexec.exe Token: SeCreateGlobalPrivilege 2116 msiexec.exe Token: SeBackupPrivilege 2096 vssvc.exe Token: SeRestorePrivilege 2096 vssvc.exe Token: SeAuditPrivilege 2096 vssvc.exe Token: SeBackupPrivilege 2268 msiexec.exe Token: SeRestorePrivilege 2268 msiexec.exe Token: SeRestorePrivilege 2440 DrvInst.exe Token: SeRestorePrivilege 2440 DrvInst.exe Token: SeRestorePrivilege 2440 DrvInst.exe Token: SeRestorePrivilege 2440 DrvInst.exe Token: SeRestorePrivilege 2440 DrvInst.exe Token: SeRestorePrivilege 2440 DrvInst.exe Token: SeRestorePrivilege 2440 DrvInst.exe Token: SeLoadDriverPrivilege 2440 DrvInst.exe Token: SeLoadDriverPrivilege 2440 DrvInst.exe Token: SeLoadDriverPrivilege 2440 DrvInst.exe Token: SeRestorePrivilege 2268 msiexec.exe Token: SeTakeOwnershipPrivilege 2268 msiexec.exe Token: SeRestorePrivilege 2268 msiexec.exe Token: SeTakeOwnershipPrivilege 2268 msiexec.exe Token: SeRestorePrivilege 2268 msiexec.exe Token: SeTakeOwnershipPrivilege 2268 msiexec.exe Token: SeRestorePrivilege 2268 msiexec.exe Token: SeTakeOwnershipPrivilege 2268 msiexec.exe Token: SeRestorePrivilege 2268 msiexec.exe Token: SeTakeOwnershipPrivilege 2268 msiexec.exe Token: SeRestorePrivilege 2268 msiexec.exe Token: SeTakeOwnershipPrivilege 2268 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2116 msiexec.exe 2116 msiexec.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1264 EXCEL.EXE -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 2268 wrote to memory of 2648 2268 msiexec.exe 35 PID 2268 wrote to memory of 2648 2268 msiexec.exe 35 PID 2268 wrote to memory of 2648 2268 msiexec.exe 35 PID 2268 wrote to memory of 2648 2268 msiexec.exe 35 PID 2648 wrote to memory of 1920 2648 MSIDDC4.tmp 36 PID 2648 wrote to memory of 1920 2648 MSIDDC4.tmp 36 PID 2648 wrote to memory of 1920 2648 MSIDDC4.tmp 36 PID 2648 wrote to memory of 1920 2648 MSIDDC4.tmp 36 PID 1920 wrote to memory of 1168 1920 Synaptics.exe 37 PID 1920 wrote to memory of 1168 1920 Synaptics.exe 37 PID 1920 wrote to memory of 1168 1920 Synaptics.exe 37 PID 1920 wrote to memory of 1168 1920 Synaptics.exe 37 PID 1168 wrote to memory of 2220 1168 ._cache_Synaptics.exe 38 PID 1168 wrote to memory of 2220 1168 ._cache_Synaptics.exe 38 PID 1168 wrote to memory of 2220 1168 ._cache_Synaptics.exe 38 PID 1168 wrote to memory of 2220 1168 ._cache_Synaptics.exe 38 PID 1168 wrote to memory of 2120 1168 ._cache_Synaptics.exe 40 PID 1168 wrote to memory of 2120 1168 ._cache_Synaptics.exe 40 PID 1168 wrote to memory of 2120 1168 ._cache_Synaptics.exe 40 PID 1168 wrote to memory of 2120 1168 ._cache_Synaptics.exe 40 PID 2220 wrote to memory of 1872 2220 cmd.exe 41 PID 2220 wrote to memory of 1872 2220 cmd.exe 41 PID 2220 wrote to memory of 1872 2220 cmd.exe 41 PID 2220 wrote to memory of 1872 2220 cmd.exe 41 PID 2832 wrote to memory of 1272 2832 taskeng.exe 46 PID 2832 wrote to memory of 1272 2832 taskeng.exe 46 PID 2832 wrote to memory of 1272 2832 taskeng.exe 46 PID 2832 wrote to memory of 1272 2832 taskeng.exe 46 PID 2832 wrote to memory of 1676 2832 taskeng.exe 47 PID 2832 wrote to memory of 1676 2832 taskeng.exe 47 PID 2832 wrote to memory of 1676 2832 taskeng.exe 47 PID 2832 wrote to memory of 1676 2832 taskeng.exe 47 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\5a49f64634ac29f37b3e53f5a1e37b90e8f3a385683f24083c68aee092408314.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2116
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Windows\Installer\MSIDDC4.tmp"C:\Windows\Installer\MSIDDC4.tmp"2⤵
- Adds Run key to start application
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate3⤵
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\SysWOW64\._cache_Synaptics.exe"C:\Windows\system32\._cache_Synaptics.exe" InjUpdate4⤵
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn MRIYKG.exe /tr C:\Users\Admin\AppData\Roaming\Windata\CHVALO.exe /sc minute /mo 15⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn MRIYKG.exe /tr C:\Users\Admin\AppData\Roaming\Windata\CHVALO.exe /sc minute /mo 16⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1872
-
-
-
C:\Windows\SysWOW64\WSCript.exeWSCript C:\Users\Admin\AppData\Local\Temp\MRIYKG.vbs5⤵
- System Location Discovery: System Language Discovery
PID:2120
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2096
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003BC" "00000000000003C4"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2440
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1264
-
C:\Windows\system32\taskeng.exetaskeng.exe {D0B294AB-25E5-4F51-A3DA-6F60C764AE51} S-1-5-21-4177215427-74451935-3209572229-1000:JSMURNPT\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Roaming\Windata\CHVALO.exeC:\Users\Admin\AppData\Roaming\Windata\CHVALO.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1272
-
-
C:\Users\Admin\AppData\Roaming\Windata\CHVALO.exeC:\Users\Admin\AppData\Roaming\Windata\CHVALO.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1676
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
681B
MD5d42d56679c5c92d3fd0232cf2d42a6ab
SHA1867819e2f60dbf9334af1b0004a31e4647e91dd6
SHA2567bc647f3e292f9aa7c25caa7ffae8d02d36efe66a1e79e76ab8bea0e71f31a23
SHA512cc64f2fe22edc4e56f0f8df8335284eecd808745d1dde2c46a8f8be13d1277ad904f625fde7d7fa7debd753db8e09502f2377147fcd6c98c85767ba60112dfa1
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
Filesize
24KB
MD5e2da73884428567bdc49edac0aaa5abd
SHA1394c2858e2734b2158b6d90552a13dfb52a1f31c
SHA256670eb480f480afa7481988b4a430869b878db9ffdc0e162f5bd69a464e6db6e1
SHA512bc907b410b840ed9a232a240bc3e37e0eee08756644ea420e42f6cbb497a8a1e99bc5dee30ab58ae71abaf88eb726dddfd12cb2bd8ea349c85ba8c96dab73d91
-
Filesize
840B
MD589137407cd4107effa2ff9f29a2a99ad
SHA199814ebc80118160841a2cf0f29eb578b57e4ac6
SHA256cbee270ed61982f063979c013888bb288d5db2720d2d69f86ee13263a26ffe36
SHA512d7f64023ef44e2f91195bd8950f211110f530ec751c39b4122925993e8da7c11e0c8bcd6b4286f67efb6df20cc1cde08ededbc241a8ddbde934b58a75592684b
-
Filesize
1.6MB
MD51d2237faf8e6198625010cb580280901
SHA1592449bddf763bb63c22f638cb42f71484f87f06
SHA25678643b903379276085c5ef0092afc5c10dee821c5754e01bc8ef835907b16ac4
SHA5128abe1ff967d92c663080caf54f315e534ea296c91474d66cd327dccc38a3aa8685101649bb120e28f1438011596dde4f2f83e8150c90d51529efce9906a5aa0b
-
Filesize
935KB
MD5a1d37a2a0a4cd5038e129946ee935868
SHA187042fbecf1558a2e974c6ad045584f23e1ac7c9
SHA2569988b0297ad8be4bd3c559437176eaca54cdc36593728967395c4dee21fc898c
SHA512eb6cfcc7b1c526c06737dc6187af4f65bdd178ffc951cf8bb13571b44cc2c3c0cd051c6e9b4930433f8e6830420a04e0b538d353dd86a1fefb0663032c37c03c