Analysis
-
max time kernel
74s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
18-02-2025 08:21
Static task
static1
Behavioral task
behavioral1
Sample
plugdata-Win64.msi
Resource
win7-20241010-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
plugdata-Win64.msi
Resource
win10v2004-20250217-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
plugdata-Win64.msi
-
Size
360.1MB
-
MD5
e5042cbe2eca84c535159f256852dedb
-
SHA1
c966835e4e4e3caec69ade0dbb40a4eead8876a9
-
SHA256
7c97f1aabb8a88cf934ec9341038c2d53c1cfbd655c5f76e4f0d1345325491ed
-
SHA512
7171eebeff0c9d3b0a8110ad0b8cd206eab35af5b4c84a8a0791faef6352c4cd872bbcd67b3d4b15c66ef31b29a93dcd5265769354f4d2a0d5c78536892f3400
-
SSDEEP
6291456:HnFbhczsO1HryMIde16W/Iuho59O281SquBbVDNkYw/7JBRWZEpbZgSoC:lKLyMm4JYE2mSNbX6vu0E
Score
8/10
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 2368 powershell.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Program Files\Common Files\VST3\plugdata.vst3\desktop.ini msiexec.exe File created C:\Program Files\Common Files\VST3\plugdata-fx.vst3\desktop.ini msiexec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe -
Drops file in Program Files directory 20 IoCs
description ioc Process File created C:\Program Files\Common Files\VST3\plugdata-fx.vst3\Contents\x86_64-win\plugdata-fx.vst3 msiexec.exe File created C:\Program Files\Common Files\CLAP\plugdata-fx.clap msiexec.exe File created C:\Program Files\Common Files\LV2\plugdata.lv2\manifest.ttl msiexec.exe File created C:\Program Files\Common Files\VST3\plugdata.vst3\desktop.ini msiexec.exe File created C:\Program Files\Common Files\LV2\plugdata.lv2\ui.ttl msiexec.exe File created C:\Program Files\Common Files\VST3\plugdata-fx.vst3\Plugin.ico msiexec.exe File created C:\Program Files\Common Files\LV2\plugdata.lv2\dsp.ttl msiexec.exe File created C:\Program Files\Common Files\LV2\plugdata-fx.lv2\plugdata-fx.dll msiexec.exe File created C:\Program Files\Common Files\LV2\plugdata.lv2\plugdata.dll msiexec.exe File created C:\Program Files\Common Files\LV2\plugdata-fx.lv2\ui.ttl msiexec.exe File created C:\Program Files\plugdata\Pd.dll msiexec.exe File created C:\Program Files\plugdata\plugdata.exe msiexec.exe File created C:\Program Files\Common Files\VST3\plugdata.vst3\Contents\x86_64-win\plugdata.vst3 msiexec.exe File created C:\Program Files\Common Files\CLAP\plugdata.clap msiexec.exe File created C:\Program Files\Common Files\LV2\plugdata-fx.lv2\dsp.ttl msiexec.exe File created C:\Program Files\Common Files\LV2\plugdata-fx.lv2\manifest.ttl msiexec.exe File created C:\Program Files\Common Files\VST3\plugdata.vst3\moduleinfo.json msiexec.exe File created C:\Program Files\Common Files\VST3\plugdata-fx.vst3\desktop.ini msiexec.exe File created C:\Program Files\Common Files\VST3\plugdata-fx.vst3\moduleinfo.json msiexec.exe File created C:\Program Files\Common Files\VST3\plugdata.vst3\Plugin.ico msiexec.exe -
Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File created C:\Windows\Installer\f783e19.msi msiexec.exe File opened for modification C:\Windows\Installer\f783e19.msi msiexec.exe File created C:\Windows\Installer\f783e1a.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\f783e1c.msi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\Installer\MSI5EB3.tmp msiexec.exe File opened for modification C:\Windows\Installer\f783e1a.ipi msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe -
Loads dropped DLL 1 IoCs
pid Process 2036 msiexec.exe -
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2564 msiexec.exe -
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2036 msiexec.exe 2036 msiexec.exe 2368 powershell.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2564 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2564 msiexec.exe Token: SeIncreaseQuotaPrivilege 2564 msiexec.exe Token: SeRestorePrivilege 2036 msiexec.exe Token: SeTakeOwnershipPrivilege 2036 msiexec.exe Token: SeSecurityPrivilege 2036 msiexec.exe Token: SeCreateTokenPrivilege 2564 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2564 msiexec.exe Token: SeLockMemoryPrivilege 2564 msiexec.exe Token: SeIncreaseQuotaPrivilege 2564 msiexec.exe Token: SeMachineAccountPrivilege 2564 msiexec.exe Token: SeTcbPrivilege 2564 msiexec.exe Token: SeSecurityPrivilege 2564 msiexec.exe Token: SeTakeOwnershipPrivilege 2564 msiexec.exe Token: SeLoadDriverPrivilege 2564 msiexec.exe Token: SeSystemProfilePrivilege 2564 msiexec.exe Token: SeSystemtimePrivilege 2564 msiexec.exe Token: SeProfSingleProcessPrivilege 2564 msiexec.exe Token: SeIncBasePriorityPrivilege 2564 msiexec.exe Token: SeCreatePagefilePrivilege 2564 msiexec.exe Token: SeCreatePermanentPrivilege 2564 msiexec.exe Token: SeBackupPrivilege 2564 msiexec.exe Token: SeRestorePrivilege 2564 msiexec.exe Token: SeShutdownPrivilege 2564 msiexec.exe Token: SeDebugPrivilege 2564 msiexec.exe Token: SeAuditPrivilege 2564 msiexec.exe Token: SeSystemEnvironmentPrivilege 2564 msiexec.exe Token: SeChangeNotifyPrivilege 2564 msiexec.exe Token: SeRemoteShutdownPrivilege 2564 msiexec.exe Token: SeUndockPrivilege 2564 msiexec.exe Token: SeSyncAgentPrivilege 2564 msiexec.exe Token: SeEnableDelegationPrivilege 2564 msiexec.exe Token: SeManageVolumePrivilege 2564 msiexec.exe Token: SeImpersonatePrivilege 2564 msiexec.exe Token: SeCreateGlobalPrivilege 2564 msiexec.exe Token: SeBackupPrivilege 2908 vssvc.exe Token: SeRestorePrivilege 2908 vssvc.exe Token: SeAuditPrivilege 2908 vssvc.exe Token: SeBackupPrivilege 2036 msiexec.exe Token: SeRestorePrivilege 2036 msiexec.exe Token: SeRestorePrivilege 2912 DrvInst.exe Token: SeRestorePrivilege 2912 DrvInst.exe Token: SeRestorePrivilege 2912 DrvInst.exe Token: SeRestorePrivilege 2912 DrvInst.exe Token: SeRestorePrivilege 2912 DrvInst.exe Token: SeRestorePrivilege 2912 DrvInst.exe Token: SeRestorePrivilege 2912 DrvInst.exe Token: SeLoadDriverPrivilege 2912 DrvInst.exe Token: SeLoadDriverPrivilege 2912 DrvInst.exe Token: SeLoadDriverPrivilege 2912 DrvInst.exe Token: SeRestorePrivilege 2036 msiexec.exe Token: SeTakeOwnershipPrivilege 2036 msiexec.exe Token: SeRestorePrivilege 2036 msiexec.exe Token: SeTakeOwnershipPrivilege 2036 msiexec.exe Token: SeRestorePrivilege 2036 msiexec.exe Token: SeTakeOwnershipPrivilege 2036 msiexec.exe Token: SeDebugPrivilege 2368 powershell.exe Token: SeRestorePrivilege 2036 msiexec.exe Token: SeTakeOwnershipPrivilege 2036 msiexec.exe Token: SeRestorePrivilege 2036 msiexec.exe Token: SeTakeOwnershipPrivilege 2036 msiexec.exe Token: SeRestorePrivilege 2036 msiexec.exe Token: SeTakeOwnershipPrivilege 2036 msiexec.exe Token: SeRestorePrivilege 2036 msiexec.exe Token: SeTakeOwnershipPrivilege 2036 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2564 msiexec.exe 2564 msiexec.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2036 wrote to memory of 2368 2036 msiexec.exe 35 PID 2036 wrote to memory of 2368 2036 msiexec.exe 35 PID 2036 wrote to memory of 2368 2036 msiexec.exe 35 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\plugdata-Win64.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2564
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -e JABkAGkAcwBwAGwAYQB5AE4AYQBtAGUAIAA9ACAAIgBwAGwAdQBnAGQAYQB0AGEAIgAKACQAcAB1AGIAbABpAHMAaABlAHIAIAA9ACAAIgBUAGkAbQBvAHQAaAB5ACAAUwBjAGgAbwBlAG4AIgAKACQAcgBlAGcAaQBzAHQAcgB5AFAAYQB0AGgAIAA9ACAAIgBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABVAG4AaQBuAHMAdABhAGwAbAAiAAoAJABzAHUAYgBLAGUAeQBzACAAPQAgAEcAZQB0AC0AQwBoAGkAbABkAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHIAZQBnAGkAcwB0AHIAeQBQAGEAdABoAAoACgBmAG8AcgBlAGEAYwBoACAAKAAkAHMAdQBiAEsAZQB5ACAAaQBuACAAJABzAHUAYgBLAGUAeQBzACkAIAB7AAoAIAAgACAAIAAkAGMAdQByAHIAZQBuAHQASwBlAHkAIAA9ACAARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACQAcwB1AGIASwBlAHkALgBQAFMAUABhAHQAaAAKACAAIAAgACAAaQBmACAAKAAkAGMAdQByAHIAZQBuAHQASwBlAHkALgBEAGkAcwBwAGwAYQB5AE4AYQBtAGUAIAAtAGUAcQAgACQAZABpAHMAcABsAGEAeQBOAGEAbQBlACAALQBhAG4AZAAgACQAYwB1AHIAcgBlAG4AdABLAGUAeQAuAFAAdQBiAGwAaQBzAGgAZQByACAALQBlAHEAIAAkAHAAdQBiAGwAaQBzAGgAZQByACkAIAB7AAoAIAAgACAAIAAgACAAIAAgAFIAZQBtAG8AdgBlAC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAcwB1AGIASwBlAHkALgBQAFMAUABhAHQAaAAgAC0AUgBlAGMAdQByAHMAZQAgAC0ARgBvAHIAYwBlAAoAIAAgACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiAFIAZQBnAGkAcwB0AHIAeQAgAGUAbgB0AHIAeQAgAHIAZQBtAG8AdgBlAGQAOgAgACQAKAAkAHMAdQBiAEsAZQB5AC4AUABTAFAAYQB0AGgAKQAiAAoAIAAgACAAIAB9AAoAfQA=2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2368
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2908
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000514" "00000000000005F0"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2912
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD5740beb29b1fafbbde37c9ccd6e07537e
SHA1c691d2e80b53edc4ca0da6ec3c26d7b3b9720649
SHA256904e184350d832cc8490c714616a675b8da43296e597cad7d7f3d9f7dece40e7
SHA512e77780059e302fb08805ed39893a319290fe7788324dc79f29fd91ac0b344352b4bfc1d18e4d47ba6ec2d32ab0bb194e10120b8c465baec2e72ee6a20a784803