Overview
overview
7Static
static
3SuperViewe...th.msi
windows11-21h2-x64
6SuperViewe...64.msi
windows11-21h2-x64
6SuperViewe...rl.msi
windows11-21h2-x64
6SuperViewe...64.msi
windows11-21h2-x64
6SuperViewe...TE.msi
windows11-21h2-x64
6SuperViewe...XT.msi
windows11-21h2-x64
6SuperViewe...64.msi
windows11-21h2-x64
6SuperViewe...rt.msi
windows11-21h2-x64
6SuperViewe...or.exe
windows11-21h2-x64
3SuperViewe...er.msi
windows11-21h2-x64
6SuperViewe...er.msi
windows11-21h2-x64
6SuperViewe...re.msi
windows11-21h2-x64
6SuperViewe...er.exe
windows11-21h2-x64
3SuperViewe...64.exe
windows11-21h2-x64
7SuperViewe...86.exe
windows11-21h2-x64
7SuperViewe...ex.msi
windows11-21h2-x64
6SuperViewe...64.msi
windows11-21h2-x64
6SuperViewe...kl.msi
windows11-21h2-x64
6SuperViewe...64.msi
windows11-21h2-x64
6SuperViewe...os.msi
windows11-21h2-x64
SuperViewe...64.msi
windows11-21h2-x64
6SuperViewe...es.msi
windows11-21h2-x64
6SuperViewe...et.msi
windows11-21h2-x64
6SuperViewe...me.msi
windows11-21h2-x64
SuperViewe...ph.msi
windows11-21h2-x64
6SuperViewe...ls.msi
windows11-21h2-x64
6SuperViewe...pp.msi
windows11-21h2-x64
6SuperViewe...rk.msi
windows11-21h2-x64
6SuperViewe...it.msi
windows11-21h2-x64
6SuperViewe...64.msi
windows11-21h2-x64
6SuperViewe...ne.msi
windows11-21h2-x64
6SuperViewe...64.msi
windows11-21h2-x64
6Analysis
-
max time kernel
231s -
max time network
291s -
platform
windows11-21h2_x64 -
resource
win11-20250313-en -
resource tags
arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system -
submitted
28/03/2025, 13:52
Behavioral task
behavioral1
Sample
SuperViewer Installer/Volume/bin/p15/niauth.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral2
Sample
SuperViewer Installer/Volume/bin/p15/niauth64.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
SuperViewer Installer/Volume/bin/p16/nicurl.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral4
Sample
SuperViewer Installer/Volume/bin/p16/nicurl64.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
SuperViewer Installer/Volume/bin/p17/LabVI00/NIWebServer_LVRTE.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral6
Sample
SuperViewer Installer/Volume/bin/p18/LogosXT.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
SuperViewer Installer/Volume/bin/p18/LogosXT64.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral8
Sample
SuperViewer Installer/Volume/bin/p19/ni_error/ni_error_report.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
SuperViewer Installer/Volume/bin/p2/SystemRequirementsError.exe
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral10
Sample
SuperViewer Installer/Volume/bin/p2/VC2015-32Wrapper.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
SuperViewer Installer/Volume/bin/p2/VC2015-64Wrapper.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral12
Sample
SuperViewer Installer/Volume/bin/p2/VC2015Core.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral13
Sample
SuperViewer Installer/Volume/bin/p2/VCRunTimeInstaller.exe
Resource
win11-20250314-en
windows11-21h2-x64
Behavioral task
behavioral14
Sample
SuperViewer Installer/Volume/bin/p2/vc_redist.x64.exe
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral15
Sample
SuperViewer Installer/Volume/bin/p2/vc_redist.x86.exe
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral16
Sample
SuperViewer Installer/Volume/bin/p20/activex.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral17
Sample
SuperViewer Installer/Volume/bin/p20/activex64.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral18
Sample
SuperViewer Installer/Volume/bin/p25/mkl.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral19
Sample
SuperViewer Installer/Volume/bin/p25/mkl64.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral20
Sample
SuperViewer Installer/Volume/bin/p26/logos.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral21
Sample
SuperViewer Installer/Volume/bin/p26/logos64.msi
Resource
win11-20250314-en
windows11-21h2-x64
Behavioral task
behavioral22
Sample
SuperViewer Installer/Volume/bin/p27/lvrteres/LV2019rteres.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral23
Sample
SuperViewer Installer/Volume/bin/p28/LV2019rtdnet.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral24
Sample
SuperViewer Installer/Volume/bin/p28/LV2019runtime.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral25
Sample
SuperViewer Installer/Volume/bin/p29/MStudioCW3DGraph.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral26
Sample
SuperViewer Installer/Volume/bin/p3/NISys00/NISysLogUtils.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral27
Sample
SuperViewer Installer/Volume/bin/p4/sslLVRTE/ssl_LVRTEsupp.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral28
Sample
SuperViewer Installer/Volume/bin/p5/NI_De00/dep_framework.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral29
Sample
SuperViewer Installer/Volume/bin/p6/KillBit.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral30
Sample
SuperViewer Installer/Volume/bin/p6/KillBit64.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral31
Sample
SuperViewer Installer/Volume/bin/p7/NITraceEngine.msi
Resource
win11-20250314-en
windows11-21h2-x64
Behavioral task
behavioral32
Sample
SuperViewer Installer/Volume/bin/p7/NITraceEngine64.msi
Resource
win11-20250314-en
windows11-21h2-x64
General
-
Target
SuperViewer Installer/Volume/bin/p20/activex.msi
-
Size
1.1MB
-
MD5
2df25b30e70ba5bac6bb7f4525128dff
-
SHA1
ec5a83c0fef5f28944c03826f83d9fced85c3710
-
SHA256
c7329e9500c8aa32802199abb1fc91585f17c6648be74cebad7f736ee056d36d
-
SHA512
eed10f2eb8b6588bee0ac98d98739b3568b94f4e828143b92abaa78793634b50ae57037b7a0fc399d2e09bd42f2e70f0ec6df679ad3ee743e9c3935ec8f1509e
-
SSDEEP
24576:/tGWMVo/3G1x6W+TQNxshTK+63S3ZgTqGgeSZUf/:/tGWM5x63C2PJg6Uf
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\G: msiexec.exe -
Drops file in Program Files directory 8 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\Merge Modules\ActiveX_Container.msm msiexec.exe File created C:\Program Files (x86)\Common Files\Merge Modules\ActiveX_Container64.msm msiexec.exe File created C:\Program Files (x86)\National Instruments\_Legal Information\NI ActiveX Container 17.11.49152 {88DFF01E-7C87-4E35-B194-CB7A2E32FA6D}\notice.txt msiexec.exe File created C:\Program Files (x86)\National Instruments\Shared\MDF\Manifests\NI ActiveX Container {88DFF01E-7C87-4E35-B194-CB7A2E32FA6D}.xml msiexec.exe File created C:\Program Files (x86)\National Instruments\Shared\WinMIF\ni-activex-container_17.1.1.49152-0+f0_windows_all {88DFF01E-7C87-4E35-B194-CB7A2E32FA6D}.control msiexec.exe File created C:\Program Files (x86)\National Instruments\Shared\nicont.dll msiexec.exe File created C:\Program Files (x86)\National Instruments\Shared\nicontdt.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Merge Modules\nicont.ver msiexec.exe -
Drops file in Windows directory 19 IoCs
description ioc Process File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DFEBDA34EF8871792D.TMP msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI6A40.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6B0E.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI6C2A.tmp msiexec.exe File created C:\Windows\Installer\e58680c.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI6A10.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{88DFF01E-7C87-4E35-B194-CB7A2E32FA6D} msiexec.exe File created C:\Windows\Installer\e58680e.msi msiexec.exe File opened for modification C:\Windows\Installer\e58680c.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI684A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6AED.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6AEE.tmp msiexec.exe File created C:\Windows\SystemTemp\~DFDFE2BFD557095DAE.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF46ED4DDF2BFFCE48.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFE99C02EC191D3A98.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI6B4E.tmp msiexec.exe -
Loads dropped DLL 11 IoCs
pid Process 2340 MsiExec.exe 2340 MsiExec.exe 2340 MsiExec.exe 2340 MsiExec.exe 1872 MsiExec.exe 1872 MsiExec.exe 1872 MsiExec.exe 1872 MsiExec.exe 1872 MsiExec.exe 1872 MsiExec.exe 1872 MsiExec.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000003c9263343ee389390000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800003c9263340000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809003c926334000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d3c926334000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000003c92633400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe -
Modifies registry class 63 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{36F5B0A5-2343-11D3-8CBF-0050049FD5AD} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{36F5B0A5-2343-11D3-8CBF-0050049FD5AD}\ = "NIConAppManager Class" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5B115901-387C-11D3-8CC3-0050049FD5AD}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FFD8878C753E41B49BCA7E223AFD6\PackageCode = "FCD7C37B3A8320749A575DDF0E6C6214" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FFD8878C753E41B49BCA7E223AFD6\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FFD8878C753E41B49BCA7E223AFD6\SourceList\Media\2 = ";" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5B115901-387C-11D3-8CC3-0050049FD5AD} msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FFD8878C753E41B49BCA7E223AFD6\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FFD8878C753E41B49BCA7E223AFD6\SourceList\PackageName = "activex.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FFD8878C753E41B49BCA7E223AFD6\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\SuperViewer Installer\\Volume\\bin\\p20\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7E985DEE-3D20-11D2-A3EA-006008CA119A}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E10FFD8878C753E41B49BCA7E223AFD6\ActiveX_MSM.NI.ACTIVEX.2017 = "activex.NI.ACTIVEX.2017" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FFD8878C753E41B49BCA7E223AFD6 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FFD8878C753E41B49BCA7E223AFD6\ProductName = "NI ActiveX Container" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FFD8878C753E41B49BCA7E223AFD6\AuthorizedLUAApp = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FFD8878C753E41B49BCA7E223AFD6\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\788A83011E3298240BDBC0B4386CAB12\E10FFD8878C753E41B49BCA7E223AFD6 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FFD8878C753E41B49BCA7E223AFD6\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{36F5B0A5-2343-11D3-8CBF-0050049FD5AD}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{7E985DEE-3D20-11D2-A3EA-006008CA119A} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81124122-34F7-11D3-B548-444553540000}\InprocServer32\ = "C:\\PROGRA~2\\NATION~1\\Shared\\nicontdt.dll" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{97C81FAE-7A51-11D2-938C-00A02411EBE6} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{97C81FAE-7A51-11D2-938C-00A02411EBE6}\ = "NIPropertyBrowser Class" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FFD8878C753E41B49BCA7E223AFD6\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{81124122-34F7-11D3-B548-444553540000}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{5B115901-387C-11D3-8CC3-0050049FD5AD}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E10FFD8878C753E41B49BCA7E223AFD6\activex.NI.ACTIVEX.2017 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FFD8878C753E41B49BCA7E223AFD6\Version = "285982720" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81124122-34F7-11D3-B548-444553540000} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81124122-34F7-11D3-B548-444553540000}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FFD8878C753E41B49BCA7E223AFD6\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SuperViewer Installer\\Volume\\bin\\p20\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{36F5B0A5-2343-11D3-8CBF-0050049FD5AD}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7E985DEE-3D20-11D2-A3EA-006008CA119A}\InprocServer32\ = "C:\\PROGRA~2\\NATION~1\\Shared\\nicont.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7E985DEE-3D20-11D2-A3EA-006008CA119A}\ = "NIConAppManager Class" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{97C81FAE-7A51-11D2-938C-00A02411EBE6}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{5B115901-387C-11D3-8CC3-0050049FD5AD} msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\788A83011E3298240BDBC0B4386CAB12 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FFD8878C753E41B49BCA7E223AFD6\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{7E985DEE-3D20-11D2-A3EA-006008CA119A}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7E985DEE-3D20-11D2-A3EA-006008CA119A} msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FFD8878C753E41B49BCA7E223AFD6\Language = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7E985DEE-3D20-11D2-A3EA-006008CA119A}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E10FFD8878C753E41B49BCA7E223AFD6 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E10FFD8878C753E41B49BCA7E223AFD6\NIMUFeature msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5B115901-387C-11D3-8CC3-0050049FD5AD}\InprocServer32\ = "C:\\PROGRA~2\\NATION~1\\Shared\\nicontdt.dll" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FFD8878C753E41B49BCA7E223AFD6\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FFD8878C753E41B49BCA7E223AFD6\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{97C81FAE-7A51-11D2-938C-00A02411EBE6}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{36F5B0A5-2343-11D3-8CBF-0050049FD5AD} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{36F5B0A5-2343-11D3-8CBF-0050049FD5AD}\InprocServer32\ = "C:\\PROGRA~2\\NATION~1\\Shared\\nicontdt.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{36F5B0A5-2343-11D3-8CBF-0050049FD5AD}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FFD8878C753E41B49BCA7E223AFD6\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E10FFD8878C753E41B49BCA7E223AFD6\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{81124122-34F7-11D3-B548-444553540000} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81124122-34F7-11D3-B548-444553540000}\ = "NIXConTextPersistence Class" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5B115901-387C-11D3-8CC3-0050049FD5AD}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{97C81FAE-7A51-11D2-938C-00A02411EBE6}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81124122-34F7-11D3-B548-444553540000}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{97C81FAE-7A51-11D2-938C-00A02411EBE6}\InprocServer32\ = "C:\\PROGRA~2\\NATION~1\\Shared\\nicontdt.dll" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{97C81FAE-7A51-11D2-938C-00A02411EBE6} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5B115901-387C-11D3-8CC3-0050049FD5AD}\ = "NIControlEnumerators Class" msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4696 msiexec.exe Token: SeIncreaseQuotaPrivilege 4696 msiexec.exe Token: SeSecurityPrivilege 1560 msiexec.exe Token: SeCreateTokenPrivilege 4696 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4696 msiexec.exe Token: SeLockMemoryPrivilege 4696 msiexec.exe Token: SeIncreaseQuotaPrivilege 4696 msiexec.exe Token: SeMachineAccountPrivilege 4696 msiexec.exe Token: SeTcbPrivilege 4696 msiexec.exe Token: SeSecurityPrivilege 4696 msiexec.exe Token: SeTakeOwnershipPrivilege 4696 msiexec.exe Token: SeLoadDriverPrivilege 4696 msiexec.exe Token: SeSystemProfilePrivilege 4696 msiexec.exe Token: SeSystemtimePrivilege 4696 msiexec.exe Token: SeProfSingleProcessPrivilege 4696 msiexec.exe Token: SeIncBasePriorityPrivilege 4696 msiexec.exe Token: SeCreatePagefilePrivilege 4696 msiexec.exe Token: SeCreatePermanentPrivilege 4696 msiexec.exe Token: SeBackupPrivilege 4696 msiexec.exe Token: SeRestorePrivilege 4696 msiexec.exe Token: SeShutdownPrivilege 4696 msiexec.exe Token: SeDebugPrivilege 4696 msiexec.exe Token: SeAuditPrivilege 4696 msiexec.exe Token: SeSystemEnvironmentPrivilege 4696 msiexec.exe Token: SeChangeNotifyPrivilege 4696 msiexec.exe Token: SeRemoteShutdownPrivilege 4696 msiexec.exe Token: SeUndockPrivilege 4696 msiexec.exe Token: SeSyncAgentPrivilege 4696 msiexec.exe Token: SeEnableDelegationPrivilege 4696 msiexec.exe Token: SeManageVolumePrivilege 4696 msiexec.exe Token: SeImpersonatePrivilege 4696 msiexec.exe Token: SeCreateGlobalPrivilege 4696 msiexec.exe Token: SeCreateTokenPrivilege 4696 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4696 msiexec.exe Token: SeLockMemoryPrivilege 4696 msiexec.exe Token: SeIncreaseQuotaPrivilege 4696 msiexec.exe Token: SeMachineAccountPrivilege 4696 msiexec.exe Token: SeTcbPrivilege 4696 msiexec.exe Token: SeSecurityPrivilege 4696 msiexec.exe Token: SeTakeOwnershipPrivilege 4696 msiexec.exe Token: SeLoadDriverPrivilege 4696 msiexec.exe Token: SeSystemProfilePrivilege 4696 msiexec.exe Token: SeSystemtimePrivilege 4696 msiexec.exe Token: SeProfSingleProcessPrivilege 4696 msiexec.exe Token: SeIncBasePriorityPrivilege 4696 msiexec.exe Token: SeCreatePagefilePrivilege 4696 msiexec.exe Token: SeCreatePermanentPrivilege 4696 msiexec.exe Token: SeBackupPrivilege 4696 msiexec.exe Token: SeRestorePrivilege 4696 msiexec.exe Token: SeShutdownPrivilege 4696 msiexec.exe Token: SeDebugPrivilege 4696 msiexec.exe Token: SeAuditPrivilege 4696 msiexec.exe Token: SeSystemEnvironmentPrivilege 4696 msiexec.exe Token: SeChangeNotifyPrivilege 4696 msiexec.exe Token: SeRemoteShutdownPrivilege 4696 msiexec.exe Token: SeUndockPrivilege 4696 msiexec.exe Token: SeSyncAgentPrivilege 4696 msiexec.exe Token: SeEnableDelegationPrivilege 4696 msiexec.exe Token: SeManageVolumePrivilege 4696 msiexec.exe Token: SeImpersonatePrivilege 4696 msiexec.exe Token: SeCreateGlobalPrivilege 4696 msiexec.exe Token: SeCreateTokenPrivilege 4696 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4696 msiexec.exe Token: SeLockMemoryPrivilege 4696 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4696 msiexec.exe 4696 msiexec.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1560 wrote to memory of 2340 1560 msiexec.exe 85 PID 1560 wrote to memory of 2340 1560 msiexec.exe 85 PID 1560 wrote to memory of 2340 1560 msiexec.exe 85 PID 1560 wrote to memory of 276 1560 msiexec.exe 89 PID 1560 wrote to memory of 276 1560 msiexec.exe 89 PID 1560 wrote to memory of 1872 1560 msiexec.exe 91 PID 1560 wrote to memory of 1872 1560 msiexec.exe 91 PID 1560 wrote to memory of 1872 1560 msiexec.exe 91 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\SuperViewer Installer\Volume\bin\p20\activex.msi"1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4696
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding CB924E84756EDAEB52229175AF2C5C7B C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2340
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:276
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C690A75120605CFE879580BE9C63FE402⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1872
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:2012
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD510ec7186fee98e6e0bd2da07414f6592
SHA13b6f1d604b3bbbe90f6e74b9bb39952be9755cc8
SHA25638740105ac60af9e4c5c0f54a39e9d5bd04f4eac017953f416eed9166313a1c8
SHA512eb8b03b8dac0e1d0621cb28e5758557a1ba2d7964b99c676b0b3b5eb14dd8cbf56d0917ab9ec90a1fa73de3926b8afd46b5b9191d99d40c44b320fb79f36f919
-
Filesize
2KB
MD5fb337d8a37c4f80bc06bec8619cd1660
SHA15e8b9a4bf739e643f9ed7929a4a23ed49427cdef
SHA256777b307640470d68c553d7b51e60705c01508a333d33c9b93dddec15d33a168c
SHA512ae6bba9536f735a4fecf86a4e7c5f15b9abdfe7a48bb30a0e8917f2de4869569f3a1def3ade01cebce587cc8967dd69d84d1b485b90108f8ccd0936d7403c89b
-
Filesize
639KB
MD5c6417930af8969f9f2cb431acd76ec89
SHA1d2f2dc9b44f5f79348f7f36091b26a5465ad4f2b
SHA2561b89704532113150fc7a8a06b5367ee26937c346635a860e93662e1fbb5cd79b
SHA512f30d7a5b51f5d866ccabf3e15a45d3b4013e28a9bdaaf2176e8b121fbd4ab41a8e67c059b2ece8db5bc7a0ce043e76bbc4e3f6400fb9cd2886e1ffcd9e65d79b
-
Filesize
24.6MB
MD5ac38216db85a9019f665f4d93c2c5e22
SHA10bd5588ed325e1df95d1c93c0c637b980cb39449
SHA25608814bc3e9839be94128202a25f6b8164b8ad8132a4f8aa9235a7f474ed57f55
SHA512ca90b928cec9100c584f79479e0bf44cd29bdb5d632efbc16e3095fd9f77f1b75134243babb97e3d5af1968bd464a1a9e287582ebdf58c9d66e912b8f6f089ef
-
\??\Volume{3463923c-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{7110955c-0528-47a0-9e4a-abf218828031}_OnDiskSnapshotProp
Filesize6KB
MD5accc749618b496290a1565986fef6864
SHA14cee37a2d2784ec7087435a8f1405374b6b1db18
SHA2566d810ca940762feb896c793fa20a1ea15dba09b7c733075e950a8a5cd3289940
SHA512d3d468d4cdd7af56781f6bb738cc75207bf167a7decc8b266ed571049ec64222758552c2565ae62f7e0fcf4a5a435304b785ad162df576fcd5bba625b2b5d4ad