Overview
overview
10Static
static
5Download t...gs.vbs
windows7-x64
3Download t...gs.vbs
windows10-2004-x64
1Download t...ol.exe
windows7-x64
10Download t...ol.exe
windows10-2004-x64
5Download t...ub.exe
windows7-x64
10Download t...ub.exe
windows10-2004-x64
10Download t...64.exe
windows7-x64
10Download t...64.exe
windows10-2004-x64
10Download t...ll.bat
windows7-x64
7Download t...ll.bat
windows10-2004-x64
7Download t...64.exe
windows7-x64
7Download t...64.exe
windows10-2004-x64
7Download t...86.exe
windows7-x64
7Download t...86.exe
windows10-2004-x64
7Download t...64.exe
windows7-x64
7Download t...64.exe
windows10-2004-x64
7Download t...86.exe
windows7-x64
Download t...86.exe
windows10-2004-x64
Download t...64.exe
windows7-x64
7Download t...64.exe
windows10-2004-x64
7Download t...86.exe
windows7-x64
7Download t...86.exe
windows10-2004-x64
7Download t...64.exe
windows7-x64
7Download t...64.exe
windows10-2004-x64
7Download t...86.exe
windows7-x64
7Download t...86.exe
windows10-2004-x64
7Download t...64.exe
windows7-x64
7Download t...64.exe
windows10-2004-x64
7Download t...86.exe
windows7-x64
7Download t...86.exe
windows10-2004-x64
7Download t...64.exe
windows7-x64
4Download t...64.exe
windows10-2004-x64
4Analysis
-
max time kernel
87s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
05-01-2025 22:26
Behavioral task
behavioral1
Sample
Download these/01 - Sordum DControl/Defender_Settings.vbs
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral2
Sample
Download these/01 - Sordum DControl/Defender_Settings.vbs
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Download these/01 - Sordum DControl/dControl.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
Download these/01 - Sordum DControl/dControl.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Download these/02 - Windows Updates Blocker/Wub.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
Download these/02 - Windows Updates Blocker/Wub.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Download these/02 - Windows Updates Blocker/Wub_x64.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
Download these/02 - Windows Updates Blocker/Wub_x64.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Download these/03 - Visual-C-Runtimes-All-in-One-May-2024/install_all.bat
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
Download these/03 - Visual-C-Runtimes-All-in-One-May-2024/install_all.bat
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Download these/03 - Visual-C-Runtimes-All-in-One-May-2024/vcredist2005_x64.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
Download these/03 - Visual-C-Runtimes-All-in-One-May-2024/vcredist2005_x64.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Download these/03 - Visual-C-Runtimes-All-in-One-May-2024/vcredist2005_x86.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral14
Sample
Download these/03 - Visual-C-Runtimes-All-in-One-May-2024/vcredist2005_x86.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Download these/03 - Visual-C-Runtimes-All-in-One-May-2024/vcredist2008_x64.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral16
Sample
Download these/03 - Visual-C-Runtimes-All-in-One-May-2024/vcredist2008_x64.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
Download these/03 - Visual-C-Runtimes-All-in-One-May-2024/vcredist2008_x86.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral18
Sample
Download these/03 - Visual-C-Runtimes-All-in-One-May-2024/vcredist2008_x86.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
Download these/03 - Visual-C-Runtimes-All-in-One-May-2024/vcredist2010_x64.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral20
Sample
Download these/03 - Visual-C-Runtimes-All-in-One-May-2024/vcredist2010_x64.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
Download these/03 - Visual-C-Runtimes-All-in-One-May-2024/vcredist2010_x86.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral22
Sample
Download these/03 - Visual-C-Runtimes-All-in-One-May-2024/vcredist2010_x86.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
Download these/03 - Visual-C-Runtimes-All-in-One-May-2024/vcredist2012_x64.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral24
Sample
Download these/03 - Visual-C-Runtimes-All-in-One-May-2024/vcredist2012_x64.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
Download these/03 - Visual-C-Runtimes-All-in-One-May-2024/vcredist2012_x86.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral26
Sample
Download these/03 - Visual-C-Runtimes-All-in-One-May-2024/vcredist2012_x86.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
Download these/03 - Visual-C-Runtimes-All-in-One-May-2024/vcredist2013_x64.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral28
Sample
Download these/03 - Visual-C-Runtimes-All-in-One-May-2024/vcredist2013_x64.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
Download these/03 - Visual-C-Runtimes-All-in-One-May-2024/vcredist2013_x86.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral30
Sample
Download these/03 - Visual-C-Runtimes-All-in-One-May-2024/vcredist2013_x86.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
Download these/03 - Visual-C-Runtimes-All-in-One-May-2024/vcredist2015_2017_2019_2022_x64.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral32
Sample
Download these/03 - Visual-C-Runtimes-All-in-One-May-2024/vcredist2015_2017_2019_2022_x64.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
Download these/03 - Visual-C-Runtimes-All-in-One-May-2024/vcredist2005_x86.exe
-
Size
2.6MB
-
MD5
ce2922f83fb4b170affce0ea448b107b
-
SHA1
b8fab0bb7f62a24ddfe77b19cd9a1451abd7b847
-
SHA256
4ee4da0fe62d5fa1b5e80c6e6d88a4a2f8b3b140c35da51053d0d7b72a381d29
-
SHA512
e94b077e054bd8992374d359f3adc4d1d78d42118d878556715d77182f7d03635850b2b2f06c012ccb7c410e2b3c124cf6508473efe150d3c51a51857ce1c6b0
-
SSDEEP
49152:rqGRIgg2SirwkF9xdtb43lyGKCafpKkiwnaDahmPzpY4FPyaza:rxxLFfY/KCCpKk9aWMzZyau
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 1856 MsiExec.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" vcredist2005_x86.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia80.dll msiexec.exe -
Drops file in Windows directory 57 IoCs
description ioc Process File created C:\Windows\WinSxS\InstallTemp\20250105223059964.0\mfc80ESP.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223100074.0\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_452bf920.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223100074.0\vcomp.dll msiexec.exe File created C:\Windows\Installer\e57fb38.msi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223059777.0\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86.manifest msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20250105223059964.0 msiexec.exe File opened for modification C:\Windows\Installer\e57fb38.msi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223059777.0\msvcp80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223059855.0\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_150c9e8b.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223059964.0\mfc80ITA.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223059777.0\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223059777.0\msvcr80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223059855.0\mfc80u.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223100121.1\8.0.50727.6195.policy msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20250105223100121.1 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223059855.0\mfcm80u.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223059964.0\mfc80CHS.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223059964.0\mfc80ENU.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223100105.1\8.0.50727.6195.policy msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223100121.0\8.0.50727.6195.cat msiexec.exe File created C:\Windows\Installer\SourceHash{710f4c1c-cc18-4c49-8cbf-51240c89a1a2} msiexec.exe File opened for modification C:\Windows\Installer\MSI347.tmp msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223100105.0\8.0.50727.6195.policy msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20250105223059746.0 msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20250105223059855.0 msiexec.exe File opened for modification C:\Windows\Installer\MSIEE1.tmp msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223059964.0\mfc80KOR.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223100105.0\8.0.50727.6195.cat msiexec.exe File created C:\Windows\Installer\e57fb3c.msi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223059964.0\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_6a5bb789.cat msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20250105223100105.1 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223059855.0\mfc80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223059964.0\mfc80JPN.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223100121.0\8.0.50727.6195.policy msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223059964.0\mfc80CHT.dll msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20250105223059777.0 msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20250105223100089.0 msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223059746.0\ATL80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223059777.0\msvcm80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223059964.0\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_6a5bb789.manifest msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20250105223100074.0 msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223059746.0\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_a4c618fa.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223100074.0\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_452bf920.manifest msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20250105223100105.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223059855.0\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_150c9e8b.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223059855.0\mfcm80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223059964.0\mfc80FRA.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223100121.1\8.0.50727.6195.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223100089.0\8.0.50727.6195.policy msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223100105.1\8.0.50727.6195.cat msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223059746.0\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_a4c618fa.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223059964.0\mfc80DEU.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20250105223100089.0\8.0.50727.6195.cat msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20250105223100121.0 msiexec.exe -
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2496 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist2005_x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000f59c2d6185d8bf0c0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000f59c2d610000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900f59c2d61000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1df59c2d61000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000f59c2d6100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe -
Modifies registry class 45 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\c1c4f01781cc94c4c8fb1542c0981a2a msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\3 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\7 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFCLOC,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e006900450024005b004d00310025002e0064002700650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.OpenMP,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e00370030002d0054002400210028002a0026004e00650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\4 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\5 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\9 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\11 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFC,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e003d0024006b00600049004e005d00490038004300650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\c1c4f01781cc94c4c8fb1542c0981a2a\VC_Redist msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AA5D9C68C00F12943B2F6CA09FE28244 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AA5D9C68C00F12943B2F6CA09FE28244\c1c4f01781cc94c4c8fb1542c0981a2a msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\Clients = 3a0000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFC,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e0021004d00210026005a005a006300300025006e00650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\PackageName = "vcredist.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\2 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\6 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\DeploymentFlags = "3" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.CRT,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e0061005a004f002c0048002a004b00320060004500650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\c1c4f01781cc94c4c8fb1542c0981a2a\Servicing_Key msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\10 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.ATL,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e00700052005e007000580049006000510075006f00650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\Language = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\Version = "134278729" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\8 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.ATL,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e0036006b007d00700048004c004800240053004400650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.CRT,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e005f006a0030002c0059005d007300210053006f00650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFCLOC,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e006600720038005f006c0028006d0032004e004400650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\1 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\ProductName = "Microsoft Visual C++ 2005 Redistributable" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\PackageCode = "84067013B7B56744BA0F51892982BC09" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.OpenMP,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e0035006f00300068002c0070004d0076004e003d00650038004d006b0062004900640046007700550000000000 msiexec.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2788 msiexec.exe 2788 msiexec.exe 2788 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2496 msiexec.exe Token: SeIncreaseQuotaPrivilege 2496 msiexec.exe Token: SeSecurityPrivilege 2788 msiexec.exe Token: SeCreateTokenPrivilege 2496 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2496 msiexec.exe Token: SeLockMemoryPrivilege 2496 msiexec.exe Token: SeIncreaseQuotaPrivilege 2496 msiexec.exe Token: SeMachineAccountPrivilege 2496 msiexec.exe Token: SeTcbPrivilege 2496 msiexec.exe Token: SeSecurityPrivilege 2496 msiexec.exe Token: SeTakeOwnershipPrivilege 2496 msiexec.exe Token: SeLoadDriverPrivilege 2496 msiexec.exe Token: SeSystemProfilePrivilege 2496 msiexec.exe Token: SeSystemtimePrivilege 2496 msiexec.exe Token: SeProfSingleProcessPrivilege 2496 msiexec.exe Token: SeIncBasePriorityPrivilege 2496 msiexec.exe Token: SeCreatePagefilePrivilege 2496 msiexec.exe Token: SeCreatePermanentPrivilege 2496 msiexec.exe Token: SeBackupPrivilege 2496 msiexec.exe Token: SeRestorePrivilege 2496 msiexec.exe Token: SeShutdownPrivilege 2496 msiexec.exe Token: SeDebugPrivilege 2496 msiexec.exe Token: SeAuditPrivilege 2496 msiexec.exe Token: SeSystemEnvironmentPrivilege 2496 msiexec.exe Token: SeChangeNotifyPrivilege 2496 msiexec.exe Token: SeRemoteShutdownPrivilege 2496 msiexec.exe Token: SeUndockPrivilege 2496 msiexec.exe Token: SeSyncAgentPrivilege 2496 msiexec.exe Token: SeEnableDelegationPrivilege 2496 msiexec.exe Token: SeManageVolumePrivilege 2496 msiexec.exe Token: SeImpersonatePrivilege 2496 msiexec.exe Token: SeCreateGlobalPrivilege 2496 msiexec.exe Token: SeBackupPrivilege 2816 vssvc.exe Token: SeRestorePrivilege 2816 vssvc.exe Token: SeAuditPrivilege 2816 vssvc.exe Token: SeBackupPrivilege 2788 msiexec.exe Token: SeRestorePrivilege 2788 msiexec.exe Token: SeRestorePrivilege 2788 msiexec.exe Token: SeTakeOwnershipPrivilege 2788 msiexec.exe Token: SeBackupPrivilege 3444 srtasks.exe Token: SeRestorePrivilege 3444 srtasks.exe Token: SeSecurityPrivilege 3444 srtasks.exe Token: SeTakeOwnershipPrivilege 3444 srtasks.exe Token: SeBackupPrivilege 3444 srtasks.exe Token: SeRestorePrivilege 3444 srtasks.exe Token: SeSecurityPrivilege 3444 srtasks.exe Token: SeTakeOwnershipPrivilege 3444 srtasks.exe Token: SeRestorePrivilege 2788 msiexec.exe Token: SeTakeOwnershipPrivilege 2788 msiexec.exe Token: SeRestorePrivilege 2788 msiexec.exe Token: SeTakeOwnershipPrivilege 2788 msiexec.exe Token: SeRestorePrivilege 2788 msiexec.exe Token: SeTakeOwnershipPrivilege 2788 msiexec.exe Token: SeRestorePrivilege 2788 msiexec.exe Token: SeTakeOwnershipPrivilege 2788 msiexec.exe Token: SeRestorePrivilege 2788 msiexec.exe Token: SeTakeOwnershipPrivilege 2788 msiexec.exe Token: SeRestorePrivilege 2788 msiexec.exe Token: SeTakeOwnershipPrivilege 2788 msiexec.exe Token: SeRestorePrivilege 2788 msiexec.exe Token: SeTakeOwnershipPrivilege 2788 msiexec.exe Token: SeRestorePrivilege 2788 msiexec.exe Token: SeTakeOwnershipPrivilege 2788 msiexec.exe Token: SeRestorePrivilege 2788 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2496 msiexec.exe 2496 msiexec.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3228 wrote to memory of 2496 3228 vcredist2005_x86.exe 83 PID 3228 wrote to memory of 2496 3228 vcredist2005_x86.exe 83 PID 3228 wrote to memory of 2496 3228 vcredist2005_x86.exe 83 PID 2788 wrote to memory of 3444 2788 msiexec.exe 104 PID 2788 wrote to memory of 3444 2788 msiexec.exe 104 PID 2788 wrote to memory of 1856 2788 msiexec.exe 106 PID 2788 wrote to memory of 1856 2788 msiexec.exe 106 PID 2788 wrote to memory of 1856 2788 msiexec.exe 106 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Download these\03 - Visual-C-Runtimes-All-in-One-May-2024\vcredist2005_x86.exe"C:\Users\Admin\AppData\Local\Temp\Download these\03 - Visual-C-Runtimes-All-in-One-May-2024\vcredist2005_x86.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Windows\SysWOW64\msiexec.exemsiexec /i vcredist.msi2⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2496
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:3444
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B7112DBBF96943580076EF6F9B3CC19C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1856
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2816
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
73KB
MD548af0e37fa11e62b9bcd954c96f84faf
SHA1af5b9be368c453f77e8ab1d1cdb97f4b419b258a
SHA256bff1f8a5a4e5f08ae387f02280d1b25fdb5ea2fa24c5faa4d4d9fdd769f735d8
SHA5129516beb70852dfc5a9cb849ef76ac539ca5daa7b765a6f10fcf8abf71b3e40ec30c6f60473a54c282dca6bb253ec82106b6009752ca8fb8ea59e9f801ecf948e
-
Filesize
247KB
MD5cc064d4b81619991de8131a86ad77681
SHA188d80d86cc20c27d7d2a872af719300bd2bb73f9
SHA256913ee5a1cae3e5a1872b3a5efaaa00c58e4beb692492b138f76967da671b0477
SHA5125aff0eb26cfc187bf58721b2b6d73357d9f1e66d1ac5340ad9ddc08b40ad0eda27a144cb3b650604637a7476c282ded83ed890de98a73ccaf0cc021da3a9eb25
-
Filesize
2.6MB
MD5b20bbeb818222b657df49a9cfe4fed79
SHA13f6508e880b86502773a3275bc9527f046d45502
SHA25691bdd063f6c53126737791c9eccf0b2f4cf44927831527245bc89a0be06c0cb4
SHA512f534bc7bf1597e728940e6c3b77f864adfaa413bb1e080458326b692b0f96bddf4fbd294eeed36d7764a3578e6c8e919488bbf63b8fe2d4355ab3efd685424a4
-
Filesize
28KB
MD585221b3bcba8dbe4b4a46581aa49f760
SHA1746645c92594bfc739f77812d67cfd85f4b92474
SHA256f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f
SHA512060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d
-
Filesize
24.1MB
MD523d6d9e5b1078209218ab751d345984c
SHA1867cd48e57884df7041bab0a13b0b546442314e7
SHA256eb4a35bf59636b2eae2651c330f1e2bd4860542a07227ab9f6e24bd196dda694
SHA512147b1d85a1d43734596304cffa2e9a48d352473f6a10b7fe7152cea1eb8c4d58e4baf3da97bb3c3803ec27b80e8a2982b5fb7bde80e39cbff72ef7056001e4dd
-
\??\Volume{612d9cf5-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{842599d4-2af0-4dcb-b9a9-580d9b3c7fa4}_OnDiskSnapshotProp
Filesize6KB
MD55e5c1cfc822a7f3443ad7d491fb3501e
SHA1b4d2bfe667527b95d6834330c1afc2084d2abfd2
SHA256178439c5d47bc6357e03767d0b8a3b3e1f0565f5e1aaf4c5d81ea0232cff8093
SHA51228392f28d1f7120a8d96480dc78a90bf346023827516bf9e517aa1e139c2e2bb98fe614a1b0fe41c001bd7e4288bf7a0392f632a02cd854c3de8c07770fc3fcd