Analysis
-
max time kernel
140s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
25/03/2025, 21:03
Static task
static1
Behavioral task
behavioral1
Sample
08.msi
Resource
win7-20240729-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
08.msi
Resource
win10v2004-20250314-en
windows10-2004-x64
18 signatures
150 seconds
General
-
Target
08.msi
-
Size
5.7MB
-
MD5
436b14fb3637af66cfd787869decbb6f
-
SHA1
b94dab2a8de781973507172017019f0d89527056
-
SHA256
1bd7e0c46933e8dc11cb5375fe14600575ceed6f09fc14fc8b56032524f8bb42
-
SHA512
caad869b295e222c0999a8eee8f270e2d1b937484c69cbf9154211db4f30237d4277ae1549e34fe842f8dbf72660c2d3023eb65bad90d07cec2a23f902b2c0dd
-
SSDEEP
98304:9Yrd1ALFlGmyUMCW/x/64I7gXbzZFx7eG7eI243u/HyuuOneWFug3X:2yFlPyU32i4ISNh5243u/HAlW
Malware Config
Signatures
-
SectopRAT payload 1 IoCs
resource yara_rule behavioral2/memory/2832-76-0x0000000000400000-0x00000000004D4000-memory.dmp family_sectoprat -
Sectoprat family
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: msiexec.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3332 set thread context of 4608 3332 VSAddIn.exe 106 PID 3332 set thread context of 2692 3332 VSAddIn.exe 116 PID 4608 set thread context of 2832 4608 MSBuild.exe 118 -
Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI97CF.tmp msiexec.exe File created C:\Windows\Installer\e579470.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI9617.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI96B4.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{CD2595F7-232E-492D-BE80-BB47C13C86A8} msiexec.exe File created C:\Windows\Installer\e579474.msi msiexec.exe File opened for modification C:\Windows\Installer\e579470.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI94BE.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9722.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe -
Executes dropped EXE 1 IoCs
pid Process 3332 VSAddIn.exe -
Loads dropped DLL 4 IoCs
pid Process 2092 MsiExec.exe 2092 MsiExec.exe 2092 MsiExec.exe 2092 MsiExec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2664 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSBuild.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language more.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSBuild.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000002a49892b502c64420000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800002a49892b0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809002a49892b000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d2a49892b000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000002a49892b00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 3872 msiexec.exe 3872 msiexec.exe 3332 VSAddIn.exe 3332 VSAddIn.exe 3332 VSAddIn.exe 3332 VSAddIn.exe 3332 VSAddIn.exe 3332 VSAddIn.exe 4608 MSBuild.exe 4608 MSBuild.exe 4608 MSBuild.exe 4608 MSBuild.exe 4608 MSBuild.exe 4608 MSBuild.exe 4608 MSBuild.exe 2692 more.com 2692 more.com 2692 more.com -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 3332 VSAddIn.exe 3332 VSAddIn.exe 3332 VSAddIn.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2664 msiexec.exe Token: SeIncreaseQuotaPrivilege 2664 msiexec.exe Token: SeSecurityPrivilege 3872 msiexec.exe Token: SeCreateTokenPrivilege 2664 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2664 msiexec.exe Token: SeLockMemoryPrivilege 2664 msiexec.exe Token: SeIncreaseQuotaPrivilege 2664 msiexec.exe Token: SeMachineAccountPrivilege 2664 msiexec.exe Token: SeTcbPrivilege 2664 msiexec.exe Token: SeSecurityPrivilege 2664 msiexec.exe Token: SeTakeOwnershipPrivilege 2664 msiexec.exe Token: SeLoadDriverPrivilege 2664 msiexec.exe Token: SeSystemProfilePrivilege 2664 msiexec.exe Token: SeSystemtimePrivilege 2664 msiexec.exe Token: SeProfSingleProcessPrivilege 2664 msiexec.exe Token: SeIncBasePriorityPrivilege 2664 msiexec.exe Token: SeCreatePagefilePrivilege 2664 msiexec.exe Token: SeCreatePermanentPrivilege 2664 msiexec.exe Token: SeBackupPrivilege 2664 msiexec.exe Token: SeRestorePrivilege 2664 msiexec.exe Token: SeShutdownPrivilege 2664 msiexec.exe Token: SeDebugPrivilege 2664 msiexec.exe Token: SeAuditPrivilege 2664 msiexec.exe Token: SeSystemEnvironmentPrivilege 2664 msiexec.exe Token: SeChangeNotifyPrivilege 2664 msiexec.exe Token: SeRemoteShutdownPrivilege 2664 msiexec.exe Token: SeUndockPrivilege 2664 msiexec.exe Token: SeSyncAgentPrivilege 2664 msiexec.exe Token: SeEnableDelegationPrivilege 2664 msiexec.exe Token: SeManageVolumePrivilege 2664 msiexec.exe Token: SeImpersonatePrivilege 2664 msiexec.exe Token: SeCreateGlobalPrivilege 2664 msiexec.exe Token: SeBackupPrivilege 2640 vssvc.exe Token: SeRestorePrivilege 2640 vssvc.exe Token: SeAuditPrivilege 2640 vssvc.exe Token: SeBackupPrivilege 3872 msiexec.exe Token: SeRestorePrivilege 3872 msiexec.exe Token: SeRestorePrivilege 3872 msiexec.exe Token: SeTakeOwnershipPrivilege 3872 msiexec.exe Token: SeRestorePrivilege 3872 msiexec.exe Token: SeTakeOwnershipPrivilege 3872 msiexec.exe Token: SeRestorePrivilege 3872 msiexec.exe Token: SeTakeOwnershipPrivilege 3872 msiexec.exe Token: SeRestorePrivilege 3872 msiexec.exe Token: SeTakeOwnershipPrivilege 3872 msiexec.exe Token: SeRestorePrivilege 3872 msiexec.exe Token: SeTakeOwnershipPrivilege 3872 msiexec.exe Token: SeRestorePrivilege 3872 msiexec.exe Token: SeTakeOwnershipPrivilege 3872 msiexec.exe Token: SeRestorePrivilege 3872 msiexec.exe Token: SeTakeOwnershipPrivilege 3872 msiexec.exe Token: SeRestorePrivilege 3872 msiexec.exe Token: SeTakeOwnershipPrivilege 3872 msiexec.exe Token: SeRestorePrivilege 3872 msiexec.exe Token: SeTakeOwnershipPrivilege 3872 msiexec.exe Token: SeRestorePrivilege 3872 msiexec.exe Token: SeTakeOwnershipPrivilege 3872 msiexec.exe Token: SeRestorePrivilege 3872 msiexec.exe Token: SeTakeOwnershipPrivilege 3872 msiexec.exe Token: SeRestorePrivilege 3872 msiexec.exe Token: SeTakeOwnershipPrivilege 3872 msiexec.exe Token: SeRestorePrivilege 3872 msiexec.exe Token: SeTakeOwnershipPrivilege 3872 msiexec.exe Token: SeRestorePrivilege 3872 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2664 msiexec.exe 2664 msiexec.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 3872 wrote to memory of 2156 3872 msiexec.exe 100 PID 3872 wrote to memory of 2156 3872 msiexec.exe 100 PID 3872 wrote to memory of 2092 3872 msiexec.exe 102 PID 3872 wrote to memory of 2092 3872 msiexec.exe 102 PID 3872 wrote to memory of 2092 3872 msiexec.exe 102 PID 3872 wrote to memory of 3332 3872 msiexec.exe 103 PID 3872 wrote to memory of 3332 3872 msiexec.exe 103 PID 3332 wrote to memory of 4608 3332 VSAddIn.exe 106 PID 3332 wrote to memory of 4608 3332 VSAddIn.exe 106 PID 3332 wrote to memory of 4608 3332 VSAddIn.exe 106 PID 3332 wrote to memory of 4608 3332 VSAddIn.exe 106 PID 3332 wrote to memory of 4608 3332 VSAddIn.exe 106 PID 4608 wrote to memory of 220 4608 MSBuild.exe 115 PID 4608 wrote to memory of 220 4608 MSBuild.exe 115 PID 4608 wrote to memory of 220 4608 MSBuild.exe 115 PID 4608 wrote to memory of 220 4608 MSBuild.exe 115 PID 4608 wrote to memory of 220 4608 MSBuild.exe 115 PID 4608 wrote to memory of 220 4608 MSBuild.exe 115 PID 4608 wrote to memory of 220 4608 MSBuild.exe 115 PID 4608 wrote to memory of 220 4608 MSBuild.exe 115 PID 3332 wrote to memory of 2692 3332 VSAddIn.exe 116 PID 3332 wrote to memory of 2692 3332 VSAddIn.exe 116 PID 3332 wrote to memory of 2692 3332 VSAddIn.exe 116 PID 4608 wrote to memory of 2832 4608 MSBuild.exe 118 PID 4608 wrote to memory of 2832 4608 MSBuild.exe 118 PID 4608 wrote to memory of 2832 4608 MSBuild.exe 118 PID 4608 wrote to memory of 2832 4608 MSBuild.exe 118 PID 4608 wrote to memory of 2832 4608 MSBuild.exe 118 PID 4608 wrote to memory of 2832 4608 MSBuild.exe 118 PID 4608 wrote to memory of 2832 4608 MSBuild.exe 118 PID 4608 wrote to memory of 2832 4608 MSBuild.exe 118 PID 3332 wrote to memory of 2692 3332 VSAddIn.exe 116 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\08.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2664
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:2156
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 2AEBF3B6291331729034FB00D20EF5992⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2092
-
-
C:\Users\Admin\AppData\Roaming\Causerie\VSAddIn.exe"C:\Users\Admin\AppData\Roaming\Causerie\VSAddIn.exe"2⤵
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"4⤵PID:220
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"4⤵
- System Location Discovery: System Language Discovery
PID:2832
-
-
-
C:\Windows\SysWOW64\more.comC:\Windows\SysWOW64\more.com3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2692
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2640
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD53c2e52f47a91fac18c140d15435486b8
SHA1090e5362ec31b64fc452a90a61faf75e8442aa8c
SHA256414b0fb0297724ade539173261b74309f791ae72fa65cdc19f03a652fe48215c
SHA512b47c29d330a7ffac217e067e01f2c3029349032f0f865f5448783240fae06d4e94fedd7ebbe950a6656c83611c28c89dd3dc794fb03f315edc8c2f657bbe6a27
-
Filesize
1KB
MD57e49b3290ebec042bdc962964fe4504c
SHA1db2d7bb458f81ec9f48325fdbbebbd714d063db4
SHA256f9464d9adaf5b3f451b99c61744351b9099de570798c367f4f8a4f294fa2d42c
SHA512c590a9021e04ab93f5d6e666e054144066e0823d36354a7b545b1290462215df83b71c09efe6c69e839cf4a10ac520d829e146ab15c9b959c83f0822cbe09d8a
-
Filesize
1.9MB
MD5eb7417474afce7ec5a8c818c5502c1a8
SHA1f8fa2e3e21d47265915a7a7d5a51e19509b22038
SHA256886fe661e800ac08116c96e67a76ce302b7bebe60b52415a0fcdd50526792850
SHA512ea2489a15766b70835c609de6cfdf152b5a519e7fa1cfb56e202ca1dc60119c543c97f53cee4d85244d55784181de7c5f366fa643fcae83d954ce870e8ba58b7
-
Filesize
2.3MB
MD51b859c7d515b6defddcb5212b86f9683
SHA1c9982e808f5b50586da71804e11be1610a37312b
SHA256d8f4d465a8247459d85ef7ce9c2ba355d3cd0f8755d91e2bad8714e279b99377
SHA51201aab40302f787bdb5c15928dd51e5d2cfac0613b2486076ed9b037514a6a68be480e14e95ad36bb23c541a40ad155eb50c7f77259466f3b285806dbf35574c8
-
Filesize
386KB
MD572b1c6699ddc2baab105d32761285df2
SHA1fc85e9fb190f205e6752624a5231515c4ee4e155
SHA256bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97
SHA512cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170
-
Filesize
5.7MB
MD5436b14fb3637af66cfd787869decbb6f
SHA1b94dab2a8de781973507172017019f0d89527056
SHA2561bd7e0c46933e8dc11cb5375fe14600575ceed6f09fc14fc8b56032524f8bb42
SHA512caad869b295e222c0999a8eee8f270e2d1b937484c69cbf9154211db4f30237d4277ae1549e34fe842f8dbf72660c2d3023eb65bad90d07cec2a23f902b2c0dd
-
Filesize
24.1MB
MD51d65a22c44de755dcb90f4e3d1aec0cc
SHA17b73a939f07193ee5595cb8e6e85db1bc59f0bf5
SHA2560bf22dc1a1fb41044678df73c3da8745ae3ec5e30e520312654c1e938dd6afaa
SHA51230f0939e91bfc2d7395f471a599ab2e8a32f5ad011ee920927dc2fb24df99a82f05f46746d14bc6f1a8bdf449c7b420b2b8b117a5ae4485c5d81708f5f3174f8
-
\??\Volume{2b89492a-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{5e1ab8d7-e714-4d5a-b47c-c021b4ea1911}_OnDiskSnapshotProp
Filesize6KB
MD565ac1edac4f878a76d9075b088474957
SHA1848f13521fb7099e18c116c2446e5a51193bd094
SHA2568cbc3671ecfbeee7f436fc8b35a467395582b3cd7a4a2994c9e93207a31986bb
SHA512c825d27e3f3d86547c3be3c0d8f9e680effd42d8a0db5e13cd8ac4982cb1ff8cf06a42b5062adae10a8ea2e22275e5906d2e7255956dba83da4d38445ff0e235