Analysis
-
max time kernel
17s -
max time network
18s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
18-02-2025 08:21
Static task
static1
Behavioral task
behavioral1
Sample
plugdata-Win64.msi
Resource
win7-20241010-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
plugdata-Win64.msi
Resource
win10v2004-20250217-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
plugdata-Win64.msi
-
Size
360.1MB
-
MD5
e5042cbe2eca84c535159f256852dedb
-
SHA1
c966835e4e4e3caec69ade0dbb40a4eead8876a9
-
SHA256
7c97f1aabb8a88cf934ec9341038c2d53c1cfbd655c5f76e4f0d1345325491ed
-
SHA512
7171eebeff0c9d3b0a8110ad0b8cd206eab35af5b4c84a8a0791faef6352c4cd872bbcd67b3d4b15c66ef31b29a93dcd5265769354f4d2a0d5c78536892f3400
-
SSDEEP
6291456:HnFbhczsO1HryMIde16W/Iuho59O281SquBbVDNkYw/7JBRWZEpbZgSoC:lKLyMm4JYE2mSNbX6vu0E
Score
8/10
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 3380 powershell.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Program Files\Common Files\VST3\plugdata.vst3\desktop.ini msiexec.exe File created C:\Program Files\Common Files\VST3\plugdata-fx.vst3\desktop.ini msiexec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe -
Drops file in Program Files directory 20 IoCs
description ioc Process File created C:\Program Files\Common Files\VST3\plugdata-fx.vst3\Plugin.ico msiexec.exe File created C:\Program Files\Common Files\LV2\plugdata-fx.lv2\dsp.ttl msiexec.exe File created C:\Program Files\Common Files\LV2\plugdata-fx.lv2\ui.ttl msiexec.exe File created C:\Program Files\plugdata\Pd.dll msiexec.exe File created C:\Program Files\Common Files\VST3\plugdata.vst3\moduleinfo.json msiexec.exe File created C:\Program Files\Common Files\LV2\plugdata.lv2\dsp.ttl msiexec.exe File created C:\Program Files\Common Files\LV2\plugdata.lv2\ui.ttl msiexec.exe File created C:\Program Files\Common Files\VST3\plugdata-fx.vst3\moduleinfo.json msiexec.exe File created C:\Program Files\Common Files\VST3\plugdata-fx.vst3\Contents\x86_64-win\plugdata-fx.vst3 msiexec.exe File created C:\Program Files\Common Files\LV2\plugdata-fx.lv2\plugdata-fx.dll msiexec.exe File created C:\Program Files\Common Files\LV2\plugdata.lv2\manifest.ttl msiexec.exe File created C:\Program Files\Common Files\LV2\plugdata-fx.lv2\manifest.ttl msiexec.exe File created C:\Program Files\Common Files\LV2\plugdata.lv2\plugdata.dll msiexec.exe File created C:\Program Files\plugdata\plugdata.exe msiexec.exe File created C:\Program Files\Common Files\VST3\plugdata.vst3\desktop.ini msiexec.exe File created C:\Program Files\Common Files\VST3\plugdata-fx.vst3\desktop.ini msiexec.exe File created C:\Program Files\Common Files\VST3\plugdata.vst3\Plugin.ico msiexec.exe File created C:\Program Files\Common Files\CLAP\plugdata-fx.clap msiexec.exe File created C:\Program Files\Common Files\CLAP\plugdata.clap msiexec.exe File created C:\Program Files\Common Files\VST3\plugdata.vst3\Contents\x86_64-win\plugdata.vst3 msiexec.exe -
Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI2B41.tmp msiexec.exe File created C:\Windows\Installer\e5822c7.msi msiexec.exe File created C:\Windows\Installer\e5822c5.msi msiexec.exe File opened for modification C:\Windows\Installer\e5822c5.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{DFC9D6EC-8338-4C48-A420-360A0ECB7D91} msiexec.exe -
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2168 msiexec.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4760 msiexec.exe 4760 msiexec.exe 3380 powershell.exe 3380 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2168 msiexec.exe Token: SeIncreaseQuotaPrivilege 2168 msiexec.exe Token: SeSecurityPrivilege 4760 msiexec.exe Token: SeCreateTokenPrivilege 2168 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2168 msiexec.exe Token: SeLockMemoryPrivilege 2168 msiexec.exe Token: SeIncreaseQuotaPrivilege 2168 msiexec.exe Token: SeMachineAccountPrivilege 2168 msiexec.exe Token: SeTcbPrivilege 2168 msiexec.exe Token: SeSecurityPrivilege 2168 msiexec.exe Token: SeTakeOwnershipPrivilege 2168 msiexec.exe Token: SeLoadDriverPrivilege 2168 msiexec.exe Token: SeSystemProfilePrivilege 2168 msiexec.exe Token: SeSystemtimePrivilege 2168 msiexec.exe Token: SeProfSingleProcessPrivilege 2168 msiexec.exe Token: SeIncBasePriorityPrivilege 2168 msiexec.exe Token: SeCreatePagefilePrivilege 2168 msiexec.exe Token: SeCreatePermanentPrivilege 2168 msiexec.exe Token: SeBackupPrivilege 2168 msiexec.exe Token: SeRestorePrivilege 2168 msiexec.exe Token: SeShutdownPrivilege 2168 msiexec.exe Token: SeDebugPrivilege 2168 msiexec.exe Token: SeAuditPrivilege 2168 msiexec.exe Token: SeSystemEnvironmentPrivilege 2168 msiexec.exe Token: SeChangeNotifyPrivilege 2168 msiexec.exe Token: SeRemoteShutdownPrivilege 2168 msiexec.exe Token: SeUndockPrivilege 2168 msiexec.exe Token: SeSyncAgentPrivilege 2168 msiexec.exe Token: SeEnableDelegationPrivilege 2168 msiexec.exe Token: SeManageVolumePrivilege 2168 msiexec.exe Token: SeImpersonatePrivilege 2168 msiexec.exe Token: SeCreateGlobalPrivilege 2168 msiexec.exe Token: SeBackupPrivilege 2248 vssvc.exe Token: SeRestorePrivilege 2248 vssvc.exe Token: SeAuditPrivilege 2248 vssvc.exe Token: SeRestorePrivilege 4760 msiexec.exe Token: SeTakeOwnershipPrivilege 4760 msiexec.exe Token: SeRestorePrivilege 4760 msiexec.exe Token: SeTakeOwnershipPrivilege 4760 msiexec.exe Token: SeDebugPrivilege 3380 powershell.exe Token: SeRestorePrivilege 4760 msiexec.exe Token: SeTakeOwnershipPrivilege 4760 msiexec.exe Token: SeRestorePrivilege 4760 msiexec.exe Token: SeTakeOwnershipPrivilege 4760 msiexec.exe Token: SeRestorePrivilege 4760 msiexec.exe Token: SeTakeOwnershipPrivilege 4760 msiexec.exe Token: SeRestorePrivilege 4760 msiexec.exe Token: SeTakeOwnershipPrivilege 4760 msiexec.exe Token: SeRestorePrivilege 4760 msiexec.exe Token: SeTakeOwnershipPrivilege 4760 msiexec.exe Token: SeRestorePrivilege 4760 msiexec.exe Token: SeTakeOwnershipPrivilege 4760 msiexec.exe Token: SeRestorePrivilege 4760 msiexec.exe Token: SeTakeOwnershipPrivilege 4760 msiexec.exe Token: SeRestorePrivilege 4760 msiexec.exe Token: SeTakeOwnershipPrivilege 4760 msiexec.exe Token: SeRestorePrivilege 4760 msiexec.exe Token: SeTakeOwnershipPrivilege 4760 msiexec.exe Token: SeRestorePrivilege 4760 msiexec.exe Token: SeTakeOwnershipPrivilege 4760 msiexec.exe Token: SeRestorePrivilege 4760 msiexec.exe Token: SeTakeOwnershipPrivilege 4760 msiexec.exe Token: SeRestorePrivilege 4760 msiexec.exe Token: SeTakeOwnershipPrivilege 4760 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2168 msiexec.exe 2168 msiexec.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4760 wrote to memory of 3380 4760 msiexec.exe 93 PID 4760 wrote to memory of 3380 4760 msiexec.exe 93 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\plugdata-Win64.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2168
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -e JABkAGkAcwBwAGwAYQB5AE4AYQBtAGUAIAA9ACAAIgBwAGwAdQBnAGQAYQB0AGEAIgAKACQAcAB1AGIAbABpAHMAaABlAHIAIAA9ACAAIgBUAGkAbQBvAHQAaAB5ACAAUwBjAGgAbwBlAG4AIgAKACQAcgBlAGcAaQBzAHQAcgB5AFAAYQB0AGgAIAA9ACAAIgBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABVAG4AaQBuAHMAdABhAGwAbAAiAAoAJABzAHUAYgBLAGUAeQBzACAAPQAgAEcAZQB0AC0AQwBoAGkAbABkAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHIAZQBnAGkAcwB0AHIAeQBQAGEAdABoAAoACgBmAG8AcgBlAGEAYwBoACAAKAAkAHMAdQBiAEsAZQB5ACAAaQBuACAAJABzAHUAYgBLAGUAeQBzACkAIAB7AAoAIAAgACAAIAAkAGMAdQByAHIAZQBuAHQASwBlAHkAIAA9ACAARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACQAcwB1AGIASwBlAHkALgBQAFMAUABhAHQAaAAKACAAIAAgACAAaQBmACAAKAAkAGMAdQByAHIAZQBuAHQASwBlAHkALgBEAGkAcwBwAGwAYQB5AE4AYQBtAGUAIAAtAGUAcQAgACQAZABpAHMAcABsAGEAeQBOAGEAbQBlACAALQBhAG4AZAAgACQAYwB1AHIAcgBlAG4AdABLAGUAeQAuAFAAdQBiAGwAaQBzAGgAZQByACAALQBlAHEAIAAkAHAAdQBiAGwAaQBzAGgAZQByACkAIAB7AAoAIAAgACAAIAAgACAAIAAgAFIAZQBtAG8AdgBlAC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAcwB1AGIASwBlAHkALgBQAFMAUABhAHQAaAAgAC0AUgBlAGMAdQByAHMAZQAgAC0ARgBvAHIAYwBlAAoAIAAgACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiAFIAZQBnAGkAcwB0AHIAeQAgAGUAbgB0AHIAeQAgAHIAZQBtAG8AdgBlAGQAOgAgACQAKAAkAHMAdQBiAEsAZQB5AC4AUABTAFAAYQB0AGgAKQAiAAoAIAAgACAAIAB9AAoAfQA=2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3380
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2248
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13KB
MD56b0cad5fe22b782daaf457a6d7e4d05a
SHA1aa2d965345562c9fab7c2bbadae0ae92cc9d6ab6
SHA256a52432a20f8aaaac066064b339a88c9b58ceea14c84e341d90e28bfba2515736
SHA512fa45f6b6364f700f1e4152c0beb53e93d1804e67ab69870cc0f54bbd375bf8794d5008266a39760a7337640f4dbfc1614daa870c7fb76c4c89ff88a18de69ea9
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82