Overview
overview
10Static
static
5Download t...gs.vbs
windows7-x64
3Download t...gs.vbs
windows10-2004-x64
1Download t...ol.exe
windows7-x64
10Download t...ol.exe
windows10-2004-x64
5Download t...ub.exe
windows7-x64
10Download t...ub.exe
windows10-2004-x64
10Download t...64.exe
windows7-x64
10Download t...64.exe
windows10-2004-x64
10Download t...ll.bat
windows7-x64
7Download t...ll.bat
windows10-2004-x64
7Download t...64.exe
windows7-x64
7Download t...64.exe
windows10-2004-x64
7Download t...86.exe
windows7-x64
7Download t...86.exe
windows10-2004-x64
7Download t...64.exe
windows7-x64
7Download t...64.exe
windows10-2004-x64
7Download t...86.exe
windows7-x64
Download t...86.exe
windows10-2004-x64
Download t...64.exe
windows7-x64
7Download t...64.exe
windows10-2004-x64
7Download t...86.exe
windows7-x64
7Download t...86.exe
windows10-2004-x64
7Download t...64.exe
windows7-x64
7Download t...64.exe
windows10-2004-x64
7Download t...86.exe
windows7-x64
7Download t...86.exe
windows10-2004-x64
7Download t...64.exe
windows7-x64
7Download t...64.exe
windows10-2004-x64
7Download t...86.exe
windows7-x64
7Download t...86.exe
windows10-2004-x64
7Download t...64.exe
windows7-x64
4Download t...64.exe
windows10-2004-x64
4Analysis
-
max time kernel
144s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
05-01-2025 22:26
Behavioral task
behavioral1
Sample
Download these/01 - Sordum DControl/Defender_Settings.vbs
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral2
Sample
Download these/01 - Sordum DControl/Defender_Settings.vbs
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Download these/01 - Sordum DControl/dControl.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
Download these/01 - Sordum DControl/dControl.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Download these/02 - Windows Updates Blocker/Wub.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
Download these/02 - Windows Updates Blocker/Wub.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Download these/02 - Windows Updates Blocker/Wub_x64.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
Download these/02 - Windows Updates Blocker/Wub_x64.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Download these/03 - Visual-C-Runtimes-All-in-One-May-2024/install_all.bat
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
Download these/03 - Visual-C-Runtimes-All-in-One-May-2024/install_all.bat
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Download these/03 - Visual-C-Runtimes-All-in-One-May-2024/vcredist2005_x64.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
Download these/03 - Visual-C-Runtimes-All-in-One-May-2024/vcredist2005_x64.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Download these/03 - Visual-C-Runtimes-All-in-One-May-2024/vcredist2005_x86.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral14
Sample
Download these/03 - Visual-C-Runtimes-All-in-One-May-2024/vcredist2005_x86.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Download these/03 - Visual-C-Runtimes-All-in-One-May-2024/vcredist2008_x64.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral16
Sample
Download these/03 - Visual-C-Runtimes-All-in-One-May-2024/vcredist2008_x64.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
Download these/03 - Visual-C-Runtimes-All-in-One-May-2024/vcredist2008_x86.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral18
Sample
Download these/03 - Visual-C-Runtimes-All-in-One-May-2024/vcredist2008_x86.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
Download these/03 - Visual-C-Runtimes-All-in-One-May-2024/vcredist2010_x64.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral20
Sample
Download these/03 - Visual-C-Runtimes-All-in-One-May-2024/vcredist2010_x64.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
Download these/03 - Visual-C-Runtimes-All-in-One-May-2024/vcredist2010_x86.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral22
Sample
Download these/03 - Visual-C-Runtimes-All-in-One-May-2024/vcredist2010_x86.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
Download these/03 - Visual-C-Runtimes-All-in-One-May-2024/vcredist2012_x64.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral24
Sample
Download these/03 - Visual-C-Runtimes-All-in-One-May-2024/vcredist2012_x64.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
Download these/03 - Visual-C-Runtimes-All-in-One-May-2024/vcredist2012_x86.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral26
Sample
Download these/03 - Visual-C-Runtimes-All-in-One-May-2024/vcredist2012_x86.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
Download these/03 - Visual-C-Runtimes-All-in-One-May-2024/vcredist2013_x64.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral28
Sample
Download these/03 - Visual-C-Runtimes-All-in-One-May-2024/vcredist2013_x64.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
Download these/03 - Visual-C-Runtimes-All-in-One-May-2024/vcredist2013_x86.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral30
Sample
Download these/03 - Visual-C-Runtimes-All-in-One-May-2024/vcredist2013_x86.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
Download these/03 - Visual-C-Runtimes-All-in-One-May-2024/vcredist2015_2017_2019_2022_x64.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral32
Sample
Download these/03 - Visual-C-Runtimes-All-in-One-May-2024/vcredist2015_2017_2019_2022_x64.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
Download these/03 - Visual-C-Runtimes-All-in-One-May-2024/vcredist2005_x64.exe
-
Size
3.0MB
-
MD5
56eaf4e1237c974f6984edc93972c123
-
SHA1
ee916012783024dac67fc606457377932c826f05
-
SHA256
0551a61c85b718e1fa015b0c3e3f4c4eea0637055536c00e7969286b4fa663e0
-
SHA512
f8e15363e34db5b5445c41eea4dd80b2f682642cb8f1046f30ea4fb5f4f51b0b604f7bcb3000a35a7d3ba1d1bcc07df9b25e4533170c65640b2d137c19916736
-
SSDEEP
49152:+r67+stI6RWGTAdyvlADUrpTmcOgohwJpEM5grO3oc1OXZViFeRyDErkLUMHzkRN:AM9l8pUr9m30L5grOQXZKAsErkbQRN
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 1544 MsiExec.exe 1544 MsiExec.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" vcredist2005_x64.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\Microsoft Shared\VC\amd64\msdia80.dll msiexec.exe -
Drops file in Windows directory 57 IoCs
description ioc Process File created C:\Windows\WinSxS\InstallTemp\20250105223021545.0\msvcm80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223021795.0\amd64_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_7735df00.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223021811.0\8.0.50727.6195.cat msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20250105223021608.0 msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223021686.0\mfc80CHS.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223021686.0\mfc80KOR.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223021686.0\amd64_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_9c659d69.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223021795.0\vcomp.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223021811.0\8.0.50727.6195.policy msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20250105223021530.0 msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20250105223021826.1 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223021608.0\mfcm80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223021608.0\amd64_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_4716846b.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223021530.0\ATL80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223021842.0\8.0.50727.6195.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223021530.0\amd64_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_d6cffeda.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223021545.0\amd64_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_76301166.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223021608.0\mfc80.dll msiexec.exe File created C:\Windows\Installer\e57debb.msi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223021530.0\amd64_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_d6cffeda.manifest msiexec.exe File opened for modification C:\Windows\Installer\MSIE8EA.tmp msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223021795.0\amd64_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_7735df00.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223021826.1\8.0.50727.6195.cat msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20250105223021686.0 msiexec.exe File created C:\Windows\Installer\e57deb7.msi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223021686.0\mfc80ENU.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223021686.0\mfc80DEU.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223021842.1\8.0.50727.6195.policy msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20250105223021826.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223021608.0\mfc80u.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223021826.0\8.0.50727.6195.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223021842.0\8.0.50727.6195.policy msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223021686.0\amd64_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_9c659d69.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223021686.0\mfc80JPN.dll msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20250105223021811.0 msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20250105223021842.1 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223021608.0\mfcm80u.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223021686.0\mfc80ITA.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223021842.1\8.0.50727.6195.cat msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20250105223021842.0 msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223021826.0\8.0.50727.6195.policy msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223021686.0\mfc80CHT.dll msiexec.exe File opened for modification C:\Windows\Installer\MSIE2EE.tmp msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223021545.0\msvcr80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223021545.0\msvcp80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223021826.1\8.0.50727.6195.policy msiexec.exe File created C:\Windows\Installer\SourceHash{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028} msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223021686.0\mfc80ESP.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223021686.0\mfc80FRA.dll msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20250105223021545.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223021608.0\amd64_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_4716846b.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223021545.0\amd64_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_76301166.cat msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20250105223021795.0 msiexec.exe File opened for modification C:\Windows\Installer\e57deb7.msi msiexec.exe -
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 3904 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist2005_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000a47b29fbd6f9c3720000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000a47b29fb0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900a47b29fb000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1da47b29fb000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000a47b29fb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe -
Modifies registry class 45 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFC,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e0069002a0048004e00530057007d0024007e005500650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.ATL,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e007b004c0046003d0042004900620074004f002800650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1af2a8da7e60d0b429d7e6453b3d0182\VC_Redist msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\8 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\11 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\Version = "134278728" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\3 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\7 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\9 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFCLOC,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e00530021004900240047002e004f005f0078006800650038004d006b0062004900640046007700550000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1af2a8da7e60d0b429d7e6453b3d0182 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\ProductName = "Microsoft Visual C++ 2005 Redistributable (x64)" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\10 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.CRT,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e0049004c005400540052005900320074004f005700650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.OpenMP,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e007a0050005400310026006e0073004b0064007a00650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.OpenMP,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e007e0078002d00360076007a0045007a007e003200650038004d006b0062004900640046007700550000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\92091D8AC5E822E408118470F0E997E6\1af2a8da7e60d0b429d7e6453b3d0182 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFCLOC,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e00500054005d002700660025002b0027004b002800650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\Language = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\1 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\6 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\PackageCode = "C558A51006735C645AEE5A0FC6A310C9" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\PackageName = "vcredist.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\5 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.ATL,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e005a00310021003d00520046007900460072005700650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1af2a8da7e60d0b429d7e6453b3d0182\Servicing_Key msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\2 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\4 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\Clients = 3a0000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.CRT,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e004b0039007000540041002700650026005d002900650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFC,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e00240062003000290043004b0076003d0035002700650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\92091D8AC5E822E408118470F0E997E6 msiexec.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3968 msiexec.exe 3968 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3904 msiexec.exe Token: SeIncreaseQuotaPrivilege 3904 msiexec.exe Token: SeSecurityPrivilege 3968 msiexec.exe Token: SeCreateTokenPrivilege 3904 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3904 msiexec.exe Token: SeLockMemoryPrivilege 3904 msiexec.exe Token: SeIncreaseQuotaPrivilege 3904 msiexec.exe Token: SeMachineAccountPrivilege 3904 msiexec.exe Token: SeTcbPrivilege 3904 msiexec.exe Token: SeSecurityPrivilege 3904 msiexec.exe Token: SeTakeOwnershipPrivilege 3904 msiexec.exe Token: SeLoadDriverPrivilege 3904 msiexec.exe Token: SeSystemProfilePrivilege 3904 msiexec.exe Token: SeSystemtimePrivilege 3904 msiexec.exe Token: SeProfSingleProcessPrivilege 3904 msiexec.exe Token: SeIncBasePriorityPrivilege 3904 msiexec.exe Token: SeCreatePagefilePrivilege 3904 msiexec.exe Token: SeCreatePermanentPrivilege 3904 msiexec.exe Token: SeBackupPrivilege 3904 msiexec.exe Token: SeRestorePrivilege 3904 msiexec.exe Token: SeShutdownPrivilege 3904 msiexec.exe Token: SeDebugPrivilege 3904 msiexec.exe Token: SeAuditPrivilege 3904 msiexec.exe Token: SeSystemEnvironmentPrivilege 3904 msiexec.exe Token: SeChangeNotifyPrivilege 3904 msiexec.exe Token: SeRemoteShutdownPrivilege 3904 msiexec.exe Token: SeUndockPrivilege 3904 msiexec.exe Token: SeSyncAgentPrivilege 3904 msiexec.exe Token: SeEnableDelegationPrivilege 3904 msiexec.exe Token: SeManageVolumePrivilege 3904 msiexec.exe Token: SeImpersonatePrivilege 3904 msiexec.exe Token: SeCreateGlobalPrivilege 3904 msiexec.exe Token: SeBackupPrivilege 3012 vssvc.exe Token: SeRestorePrivilege 3012 vssvc.exe Token: SeAuditPrivilege 3012 vssvc.exe Token: SeBackupPrivilege 3968 msiexec.exe Token: SeRestorePrivilege 3968 msiexec.exe Token: SeRestorePrivilege 3968 msiexec.exe Token: SeTakeOwnershipPrivilege 3968 msiexec.exe Token: SeRestorePrivilege 3968 msiexec.exe Token: SeTakeOwnershipPrivilege 3968 msiexec.exe Token: SeRestorePrivilege 3968 msiexec.exe Token: SeTakeOwnershipPrivilege 3968 msiexec.exe Token: SeRestorePrivilege 3968 msiexec.exe Token: SeTakeOwnershipPrivilege 3968 msiexec.exe Token: SeRestorePrivilege 3968 msiexec.exe Token: SeTakeOwnershipPrivilege 3968 msiexec.exe Token: SeRestorePrivilege 3968 msiexec.exe Token: SeTakeOwnershipPrivilege 3968 msiexec.exe Token: SeRestorePrivilege 3968 msiexec.exe Token: SeTakeOwnershipPrivilege 3968 msiexec.exe Token: SeRestorePrivilege 3968 msiexec.exe Token: SeTakeOwnershipPrivilege 3968 msiexec.exe Token: SeRestorePrivilege 3968 msiexec.exe Token: SeTakeOwnershipPrivilege 3968 msiexec.exe Token: SeRestorePrivilege 3968 msiexec.exe Token: SeTakeOwnershipPrivilege 3968 msiexec.exe Token: SeRestorePrivilege 3968 msiexec.exe Token: SeTakeOwnershipPrivilege 3968 msiexec.exe Token: SeRestorePrivilege 3968 msiexec.exe Token: SeTakeOwnershipPrivilege 3968 msiexec.exe Token: SeRestorePrivilege 3968 msiexec.exe Token: SeTakeOwnershipPrivilege 3968 msiexec.exe Token: SeRestorePrivilege 3968 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3904 msiexec.exe 3904 msiexec.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3628 wrote to memory of 3904 3628 vcredist2005_x64.exe 85 PID 3628 wrote to memory of 3904 3628 vcredist2005_x64.exe 85 PID 3628 wrote to memory of 3904 3628 vcredist2005_x64.exe 85 PID 3968 wrote to memory of 2500 3968 msiexec.exe 102 PID 3968 wrote to memory of 2500 3968 msiexec.exe 102 PID 3968 wrote to memory of 1544 3968 msiexec.exe 104 PID 3968 wrote to memory of 1544 3968 msiexec.exe 104 PID 3968 wrote to memory of 1544 3968 msiexec.exe 104 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Download these\03 - Visual-C-Runtimes-All-in-One-May-2024\vcredist2005_x64.exe"C:\Users\Admin\AppData\Local\Temp\Download these\03 - Visual-C-Runtimes-All-in-One-May-2024\vcredist2005_x64.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Windows\SysWOW64\msiexec.exemsiexec /i vcredist.msi2⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3904
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:2500
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1BCD30D1F357CFD7CC4AA32300B699E42⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1544
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3012
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
73KB
MD5c353ce6517e140ef78bf49f611eb9bef
SHA17684299cacc572a12067de62fa10e9fb5c9fb68f
SHA256b02103188ad84e51ad2d602cc7cc2934d02c65d3daa7b31e73cfe0aa2a0ea307
SHA5122d621b47b9d0c50ce1d14001a72ecf05d666b4f7d055200753c6a960404f0d86f3b49c8174bcecd18043610ce2cd81f424318107e9fbc83aee6b4719b1d8315e
-
Filesize
312KB
MD577a9bff5af149160775741e204734d47
SHA17b5126af69b5a79593f39db94180f1ff11b0e39d
SHA25620a26ed9a1edf7763a9b515522c5e29720048a482c7fbc8b7ff6bbdd27e61038
SHA512bb0440f58f07e113bddd9a0afb5aab8af6493218784fe5fa6f4032e3a37088f91b7e766dee87cec4a9ea11d425d27b3b536430de3a52222e8bca3e0247d81e3b
-
Filesize
3.0MB
MD56dbdf338a0a25cdb236d43ea3ca2395e
SHA1685b6ea61e574e628392eaac8b10aff4309f1081
SHA256200fef5d4994523a02c4daa00060db28eb289b99d47fc6c1305183101e72bdeb
SHA5126b5b31c55cf72ab92b17fb6074b3901a1e6afe0796ef9bc831e4dfb97450376d2889cd24b1cf3fce60eb3c1bcd1b31254b5cfa3ef6107974dfa0b35c233daf5a
-
Filesize
28KB
MD585221b3bcba8dbe4b4a46581aa49f760
SHA1746645c92594bfc739f77812d67cfd85f4b92474
SHA256f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f
SHA512060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d
-
Filesize
24.1MB
MD593c594ca572326a26ee1df8d963bdbc1
SHA180f78456d935349f682509dd40e3c688263f9005
SHA256ac94f11050556a8baa583a1158d67bc0f8039654e6cb963cc8b6d01d4159e3be
SHA5127dbd71e32051a04248da10398c2c40ebe021cb805d9be0701ce571c3a55f684e7386507e8cce998f09a7d1ab5324ce7b35945e21314470c60f75cebc91394e4d
-
\??\Volume{fb297ba4-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{b15c4d70-5ce9-432b-bf17-773e2afdeccf}_OnDiskSnapshotProp
Filesize6KB
MD5f6d9af0087c7774699c56ffa31472206
SHA15d953474dfedaf63f59ec8d2cd1ad9ca5eb47471
SHA2561d0fdedc9c053e877e33e0ec50b30b6c8c12fc8e7f0bd0098ee792516b974cb3
SHA51266c968c38f453f42cce0f4693c20e3155e675fe863847a40d724cae082cbea2ccbf5aff275027c452c321c8427e6bafbebaf3e695ad49093f9bfdff12acdc1f3