Overview

overview

6

Static

static

1

setup64v6.9.7.msi

windows7-x64

6

setup64v6.9.7.msi

windows10-2004-x64

6

Analysis

  • max time kernel
    94s
  • max time network
    134s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/01/2025, 03:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    setup64v6.9.7.msi
  • Size 32.6MB
  • Sample250118-d1b4caskbr
  • SHA256 69296a4784cccf765797541b56bbc7368705b8823b0032b7a55d7465bc357f55
  • MD5 SHA1 SHA512 SSDEEP
Score
6/10
persistenceprivilege_escalation

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 9 IoCs
  • Loads dropped DLL 1 IoCs
  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 22 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\setup64v6.9.7.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4640
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:8
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:952
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding 4D518DAEAA27F6F838C1B626783A5A18 E Global\MSI0000
        2⤵
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Program Files directory
        • Loads dropped DLL
        PID:2896
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:3620

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e57ade4.rbs
          • Path C:\Config.Msi\e57ade4.rbs
          • Size 212KB
          • SHA256 c5b5e804f60c544adec94e4d855b56f7b6bce80da1be0adbccdb1157057edaba
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          build.dat
          • Path C:\Program Files (x86)\Windows NT\build.dat
          • Size 30.5MB
          • SHA256 0d7fc934012eb28b28d23da5aeff8e9453baec7622a1dee6994c82f8f9188afb
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MSIAFB9.tmp
          • Path C:\Windows\Installer\MSIAFB9.tmp
          • Size 205KB
          • SHA256 da5385fb09f55a8c13ad519be8e3d603fb6d60636e438ec4f60f09023c1f4460
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          e57ade3.msi
          • Path C:\Windows\Installer\e57ade3.msi
          • Size 32.6MB
          • SHA256 69296a4784cccf765797541b56bbc7368705b8823b0032b7a55d7465bc357f55
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          metadata-2
          • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
          • Size 24.1MB
          • SHA256 77bb968a89a4eb4da826ded943a2c396e963a9493af6765b8c0d0d3d8129c591
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          {6e4e0139-a352-4951-8666-5133430f2ddb}_OnDiskSnapshotProp
          • Path \??\Volume{625ed6c4-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{6e4e0139-a352-4951-8666-5133430f2ddb}_OnDiskSnapshotProp
          • Size 6KB
          • SHA256 5437aa9bc2a7d92b598790f9ac9de7eb3afc7f23777c58a01297f975ed90ae6f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          memory/2896-24-0x0000000140000000-0x0000000141E91000-memory.dmp
          Download

          memory/2896-25-0x0000000140000000-0x0000000141E91000-memory.dmp
          Download

          memory/2896-26-0x0000000140000000-0x0000000141E91000-memory.dmp
          Download