Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
15-02-2025 18:36
Static task
static1
Behavioral task
behavioral1
Sample
network_fix.msi
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
network_fix.msi
Resource
win10v2004-20250207-en
windows10-2004-x64
General
-
Target
network_fix.msi
-
Size
20.9MB
-
MD5
2e857aab406f072738ef04bd18e8fc05
-
SHA1
73e60b1a9ca549ff643301b91faa53c67fea7529
-
SHA256
11a2c6854f88e833ac2fc1d4ddfe0b1ec64368a53ab3a60fe6f81e8ede764712
-
SHA512
0672b64e53686f1cf53e9ab67e428a1afe9ba25de67996be098dcf5325b47c6d077cb7f5a40e4d6378e24bec32eb8f3b95ccff479e69116447b430f2b35c74f9
-
SSDEEP
393216:bMabaNaYZEXw2rvHiNXvxDCjfxxeuBM7yLXgqjx6OeFJovR1zQz4lqsNCG/:IsYv27CNXifK7yrg9F2vR12s5/
Malware Config
Signatures
-
Blocklisted process makes network request 3 IoCs
flow pid Process 3 2452 msiexec.exe 5 2452 msiexec.exe 6 2716 msiexec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe -
Drops file in Windows directory 10 IoCs
description ioc Process File created C:\Windows\Installer\f7706c4.msi msiexec.exe File created C:\Windows\Installer\f7706c5.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI3824.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\f7706c4.msi msiexec.exe File created C:\Windows\Installer\f7706c7.msi msiexec.exe File opened for modification C:\Windows\Installer\f7706c5.ipi msiexec.exe -
Executes dropped EXE 1 IoCs
pid Process 2752 datamodeler.exe -
Loads dropped DLL 2 IoCs
pid Process 2752 datamodeler.exe 2752 datamodeler.exe -
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2452 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language datamodeler.exe -
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2716 msiexec.exe 2716 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2452 msiexec.exe Token: SeIncreaseQuotaPrivilege 2452 msiexec.exe Token: SeRestorePrivilege 2716 msiexec.exe Token: SeTakeOwnershipPrivilege 2716 msiexec.exe Token: SeSecurityPrivilege 2716 msiexec.exe Token: SeCreateTokenPrivilege 2452 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2452 msiexec.exe Token: SeLockMemoryPrivilege 2452 msiexec.exe Token: SeIncreaseQuotaPrivilege 2452 msiexec.exe Token: SeMachineAccountPrivilege 2452 msiexec.exe Token: SeTcbPrivilege 2452 msiexec.exe Token: SeSecurityPrivilege 2452 msiexec.exe Token: SeTakeOwnershipPrivilege 2452 msiexec.exe Token: SeLoadDriverPrivilege 2452 msiexec.exe Token: SeSystemProfilePrivilege 2452 msiexec.exe Token: SeSystemtimePrivilege 2452 msiexec.exe Token: SeProfSingleProcessPrivilege 2452 msiexec.exe Token: SeIncBasePriorityPrivilege 2452 msiexec.exe Token: SeCreatePagefilePrivilege 2452 msiexec.exe Token: SeCreatePermanentPrivilege 2452 msiexec.exe Token: SeBackupPrivilege 2452 msiexec.exe Token: SeRestorePrivilege 2452 msiexec.exe Token: SeShutdownPrivilege 2452 msiexec.exe Token: SeDebugPrivilege 2452 msiexec.exe Token: SeAuditPrivilege 2452 msiexec.exe Token: SeSystemEnvironmentPrivilege 2452 msiexec.exe Token: SeChangeNotifyPrivilege 2452 msiexec.exe Token: SeRemoteShutdownPrivilege 2452 msiexec.exe Token: SeUndockPrivilege 2452 msiexec.exe Token: SeSyncAgentPrivilege 2452 msiexec.exe Token: SeEnableDelegationPrivilege 2452 msiexec.exe Token: SeManageVolumePrivilege 2452 msiexec.exe Token: SeImpersonatePrivilege 2452 msiexec.exe Token: SeCreateGlobalPrivilege 2452 msiexec.exe Token: SeBackupPrivilege 2144 vssvc.exe Token: SeRestorePrivilege 2144 vssvc.exe Token: SeAuditPrivilege 2144 vssvc.exe Token: SeBackupPrivilege 2716 msiexec.exe Token: SeRestorePrivilege 2716 msiexec.exe Token: SeRestorePrivilege 1940 DrvInst.exe Token: SeRestorePrivilege 1940 DrvInst.exe Token: SeRestorePrivilege 1940 DrvInst.exe Token: SeRestorePrivilege 1940 DrvInst.exe Token: SeRestorePrivilege 1940 DrvInst.exe Token: SeRestorePrivilege 1940 DrvInst.exe Token: SeRestorePrivilege 1940 DrvInst.exe Token: SeLoadDriverPrivilege 1940 DrvInst.exe Token: SeLoadDriverPrivilege 1940 DrvInst.exe Token: SeLoadDriverPrivilege 1940 DrvInst.exe Token: SeRestorePrivilege 2716 msiexec.exe Token: SeTakeOwnershipPrivilege 2716 msiexec.exe Token: SeRestorePrivilege 2716 msiexec.exe Token: SeTakeOwnershipPrivilege 2716 msiexec.exe Token: SeRestorePrivilege 2716 msiexec.exe Token: SeTakeOwnershipPrivilege 2716 msiexec.exe Token: SeRestorePrivilege 2716 msiexec.exe Token: SeTakeOwnershipPrivilege 2716 msiexec.exe Token: SeRestorePrivilege 2716 msiexec.exe Token: SeTakeOwnershipPrivilege 2716 msiexec.exe Token: SeRestorePrivilege 2716 msiexec.exe Token: SeTakeOwnershipPrivilege 2716 msiexec.exe Token: SeRestorePrivilege 2716 msiexec.exe Token: SeTakeOwnershipPrivilege 2716 msiexec.exe Token: SeRestorePrivilege 2716 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2452 msiexec.exe 2452 msiexec.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2716 wrote to memory of 2752 2716 msiexec.exe 35 PID 2716 wrote to memory of 2752 2716 msiexec.exe 35 PID 2716 wrote to memory of 2752 2716 msiexec.exe 35 PID 2716 wrote to memory of 2752 2716 msiexec.exe 35 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\network_fix.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2452
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Programs\Network Training Manager - Enterprise Controller\datamodeler.exe"C:\Users\Admin\AppData\Local\Programs\Network Training Manager - Enterprise Controller\datamodeler.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2752
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2144
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000490" "000000000000048C"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1940
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
111KB
MD5ee2133ea81468332712dbc4a7c51b674
SHA1e82e01530d4351dfbd29bf0b32164eabf3b6ae82
SHA2567f52b218b97639ffbe35150db1790c70a150c99e82f28c8982aeee8327d21d08
SHA51237f23851ef2178ff10315de9cc97e825e2fff43cbcbf8566150cd6e43adf4c2809e9782d530fda509488937fdbfeabd18a9fdee21d3028f651f68fc95e835533
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD569f720e6236c90d45427837b1bc80df1
SHA1aceb3a1e1fe6fcda808f25feac2329a2f1e9fee1
SHA256418b9606c92b951963c9c2165fe4b96ae03b2604736be19cd7a684f93882d028
SHA51285cc2bba620e76a6dfc634b134e78164574c0c502a7283f8d3c8c1d4db2810d758e84fbe1f31bd759155fdd6932e3dc21a6f2416abf1fdd003a7f769467b0b1d
-
C:\Users\Admin\AppData\Local\Programs\Network Training Manager - Enterprise Controller\datamodeler.exe
Filesize76KB
MD5b7086063ee0e4728d5d9223a489aa56a
SHA17b4ea5aa7c4a9255f03944c43b12a99e08ea1420
SHA256ffcb14e5fe21a67a794a09851a01ba89ff4f186ac97af59a9c09d7bfe8b4f2f6
SHA512d1c63d8f47d5bc03618c3c3c585a95ebcd366d060d323886947c0a42994e470df5af965d939ae126a6c19f6b6ed7368b359a3dc02d84e6cd72fc7c16501789a5
-
C:\Users\Admin\AppData\Local\Programs\Network Training Manager - Enterprise Controller\ide\bin\launcher.dll
Filesize143KB
MD5b7db7bb175e4d858031fc8611da6ea89
SHA15da46f4256c4091fc6214418ec0e600ba487dfe9
SHA256001d524d231f8a65b6e5df50d11009475659236496f4b9e2227be482457d801e
SHA512aca63a938dd2503933d325b0c674ad8cabaaf249f1d727ac633fd635533e5852f4432e4e7fd8dfdbef2497eecaff39e0b7fef30f3b2e066eaa77433654f6e5a9
-
C:\Users\Admin\AppData\Local\Programs\Network Training Manager - Enterprise Controller\samples\Running Dog Screensaver.sfpc
Filesize79KB
MD5b21c92a2ecf467192590fbd6436e50d9
SHA17c28d57a7fcbcc66d3c166e4cecb0e40f50d5b19
SHA256574edb5fe9e3de32c17179d361a445c91b68e2287e2d8d80a18db98120cdeec7
SHA5127bcaf0edf83c3df5768a3f0bc026c4b8475dc726cde7ad963b59b411f9bda30caa20e985e4fb92639bfca9a5ebcdff697f4008f0b129ded49df8d4b63ca589c8
-
Filesize
22.7MB
MD58ce7015598ead0bc8db7a505aeb4d6a2
SHA1bc86df3d4a668c3f4a82bc8c322304db17b4653b
SHA256f9b4cedc5659a48f495840e853f265a0e3560365210afff37ae76e1e2b063d95
SHA5129bbd8d45f36784b070b044f8da24dd1e2f7dfda61ac86193cc80e6c2e63187aa98caa06770a9ee4cf1bed14e52de253f5aef0f4c742daa744bac2bf3a63a0bc5
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
20.9MB
MD52e857aab406f072738ef04bd18e8fc05
SHA173e60b1a9ca549ff643301b91faa53c67fea7529
SHA25611a2c6854f88e833ac2fc1d4ddfe0b1ec64368a53ab3a60fe6f81e8ede764712
SHA5120672b64e53686f1cf53e9ab67e428a1afe9ba25de67996be098dcf5325b47c6d077cb7f5a40e4d6378e24bec32eb8f3b95ccff479e69116447b430f2b35c74f9