Overview
overview
7Static
static
3SuperViewe...th.msi
windows11-21h2-x64
6SuperViewe...64.msi
windows11-21h2-x64
6SuperViewe...rl.msi
windows11-21h2-x64
6SuperViewe...64.msi
windows11-21h2-x64
6SuperViewe...TE.msi
windows11-21h2-x64
6SuperViewe...XT.msi
windows11-21h2-x64
6SuperViewe...64.msi
windows11-21h2-x64
6SuperViewe...rt.msi
windows11-21h2-x64
6SuperViewe...or.exe
windows11-21h2-x64
3SuperViewe...er.msi
windows11-21h2-x64
6SuperViewe...er.msi
windows11-21h2-x64
6SuperViewe...re.msi
windows11-21h2-x64
6SuperViewe...er.exe
windows11-21h2-x64
3SuperViewe...64.exe
windows11-21h2-x64
7SuperViewe...86.exe
windows11-21h2-x64
7SuperViewe...ex.msi
windows11-21h2-x64
6SuperViewe...64.msi
windows11-21h2-x64
6SuperViewe...kl.msi
windows11-21h2-x64
6SuperViewe...64.msi
windows11-21h2-x64
6SuperViewe...os.msi
windows11-21h2-x64
SuperViewe...64.msi
windows11-21h2-x64
6SuperViewe...es.msi
windows11-21h2-x64
6SuperViewe...et.msi
windows11-21h2-x64
6SuperViewe...me.msi
windows11-21h2-x64
SuperViewe...ph.msi
windows11-21h2-x64
6SuperViewe...ls.msi
windows11-21h2-x64
6SuperViewe...pp.msi
windows11-21h2-x64
6SuperViewe...rk.msi
windows11-21h2-x64
6SuperViewe...it.msi
windows11-21h2-x64
6SuperViewe...64.msi
windows11-21h2-x64
6SuperViewe...ne.msi
windows11-21h2-x64
6SuperViewe...64.msi
windows11-21h2-x64
6Analysis
-
max time kernel
220s -
max time network
279s -
platform
windows11-21h2_x64 -
resource
win11-20250313-en -
resource tags
arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system -
submitted
28/03/2025, 13:52
Behavioral task
behavioral1
Sample
SuperViewer Installer/Volume/bin/p15/niauth.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral2
Sample
SuperViewer Installer/Volume/bin/p15/niauth64.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
SuperViewer Installer/Volume/bin/p16/nicurl.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral4
Sample
SuperViewer Installer/Volume/bin/p16/nicurl64.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
SuperViewer Installer/Volume/bin/p17/LabVI00/NIWebServer_LVRTE.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral6
Sample
SuperViewer Installer/Volume/bin/p18/LogosXT.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
SuperViewer Installer/Volume/bin/p18/LogosXT64.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral8
Sample
SuperViewer Installer/Volume/bin/p19/ni_error/ni_error_report.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
SuperViewer Installer/Volume/bin/p2/SystemRequirementsError.exe
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral10
Sample
SuperViewer Installer/Volume/bin/p2/VC2015-32Wrapper.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
SuperViewer Installer/Volume/bin/p2/VC2015-64Wrapper.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral12
Sample
SuperViewer Installer/Volume/bin/p2/VC2015Core.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral13
Sample
SuperViewer Installer/Volume/bin/p2/VCRunTimeInstaller.exe
Resource
win11-20250314-en
windows11-21h2-x64
Behavioral task
behavioral14
Sample
SuperViewer Installer/Volume/bin/p2/vc_redist.x64.exe
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral15
Sample
SuperViewer Installer/Volume/bin/p2/vc_redist.x86.exe
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral16
Sample
SuperViewer Installer/Volume/bin/p20/activex.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral17
Sample
SuperViewer Installer/Volume/bin/p20/activex64.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral18
Sample
SuperViewer Installer/Volume/bin/p25/mkl.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral19
Sample
SuperViewer Installer/Volume/bin/p25/mkl64.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral20
Sample
SuperViewer Installer/Volume/bin/p26/logos.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral21
Sample
SuperViewer Installer/Volume/bin/p26/logos64.msi
Resource
win11-20250314-en
windows11-21h2-x64
Behavioral task
behavioral22
Sample
SuperViewer Installer/Volume/bin/p27/lvrteres/LV2019rteres.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral23
Sample
SuperViewer Installer/Volume/bin/p28/LV2019rtdnet.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral24
Sample
SuperViewer Installer/Volume/bin/p28/LV2019runtime.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral25
Sample
SuperViewer Installer/Volume/bin/p29/MStudioCW3DGraph.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral26
Sample
SuperViewer Installer/Volume/bin/p3/NISys00/NISysLogUtils.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral27
Sample
SuperViewer Installer/Volume/bin/p4/sslLVRTE/ssl_LVRTEsupp.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral28
Sample
SuperViewer Installer/Volume/bin/p5/NI_De00/dep_framework.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral29
Sample
SuperViewer Installer/Volume/bin/p6/KillBit.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral30
Sample
SuperViewer Installer/Volume/bin/p6/KillBit64.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral31
Sample
SuperViewer Installer/Volume/bin/p7/NITraceEngine.msi
Resource
win11-20250314-en
windows11-21h2-x64
Behavioral task
behavioral32
Sample
SuperViewer Installer/Volume/bin/p7/NITraceEngine64.msi
Resource
win11-20250314-en
windows11-21h2-x64
General
-
Target
SuperViewer Installer/Volume/bin/p20/activex64.msi
-
Size
1.1MB
-
MD5
d6dac71061c0dcd7c3051db051e9ac6a
-
SHA1
ded20bb6293bc88e9fa8df75399e721c716945df
-
SHA256
d8d87ddda62473108468170340b6624699b9952f278bc7db69296c081320be09
-
SHA512
028864d0c43d1e3b6b163405cd60e6f6cd8812ada09a5aa13f82a83d6fe386952acd3c11f16a1ab689b83ef8d5da8d3f4b2fff4a1b14d64eb6763a3f2339aa3c
-
SSDEEP
24576:st6nFJo/3G1yQ+TQNxshTK+63S3ZgTqGgeSZUf/:st6nF1mC2PJg6Uf
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\National Instruments\Shared\nicontdt.dll msiexec.exe File created C:\Program Files\National Instruments\Shared\nicont.dll msiexec.exe -
Drops file in Windows directory 19 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e5859f2.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI5C16.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5C66.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF66F94FEDF9804CE8.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI5D45.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF09569E91C455EA21.TMP msiexec.exe File created C:\Windows\Installer\e5859f2.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI5C36.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5C88.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI5CD7.tmp msiexec.exe File created C:\Windows\Installer\e5859f4.msi msiexec.exe File created C:\Windows\SystemTemp\~DFCC43F664476349E4.TMP msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI5A31.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5C67.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF1F461ED8BC100FFB.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{168152A0-6ECA-472B-8157-01E280F6D158} msiexec.exe -
Loads dropped DLL 11 IoCs
pid Process 3088 MsiExec.exe 3088 MsiExec.exe 3088 MsiExec.exe 3088 MsiExec.exe 2288 MsiExec.exe 2288 MsiExec.exe 2288 MsiExec.exe 2288 MsiExec.exe 2288 MsiExec.exe 2288 MsiExec.exe 2288 MsiExec.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000b49cff4fc6d8ed1d0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000b49cff4f0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900b49cff4f000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1db49cff4f000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000b49cff4f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe -
Modifies registry class 60 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\86A7FE1C5A0D8FE4A88B8FB9DE0F7DB9\0A251861ACE6B2741875102E086F1D85 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A251861ACE6B2741875102E086F1D85\SourceList\PackageName = "activex64.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{81124122-34F7-11D3-B548-444553540000}\ = "NIXConTextPersistence Class" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36F5B0A5-2343-11D3-8CBF-0050049FD5AD}\InprocServer32\ = "C:\\PROGRA~1\\NATION~1\\Shared\\nicontdt.dll" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A251861ACE6B2741875102E086F1D85\Language = "9" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7E985DEE-3D20-11D2-A3EA-006008CA119A} msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{97C81FAE-7A51-11D2-938C-00A02411EBE6} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{97C81FAE-7A51-11D2-938C-00A02411EBE6}\ = "NIPropertyBrowser Class" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{36F5B0A5-2343-11D3-8CBF-0050049FD5AD} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5B115901-387C-11D3-8CC3-0050049FD5AD}\ = "NIControlEnumerators Class" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\86A7FE1C5A0D8FE4A88B8FB9DE0F7DB9 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A251861ACE6B2741875102E086F1D85\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SuperViewer Installer\\Volume\\bin\\p20\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7E985DEE-3D20-11D2-A3EA-006008CA119A}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A251861ACE6B2741875102E086F1D85 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A251861ACE6B2741875102E086F1D85\Version = "285982720" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A251861ACE6B2741875102E086F1D85\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A251861ACE6B2741875102E086F1D85\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{81124122-34F7-11D3-B548-444553540000}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5B115901-387C-11D3-8CC3-0050049FD5AD}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{81124122-34F7-11D3-B548-444553540000}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{97C81FAE-7A51-11D2-938C-00A02411EBE6} msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0A251861ACE6B2741875102E086F1D85 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7E985DEE-3D20-11D2-A3EA-006008CA119A}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{97C81FAE-7A51-11D2-938C-00A02411EBE6}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{36F5B0A5-2343-11D3-8CBF-0050049FD5AD}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{5B115901-387C-11D3-8CC3-0050049FD5AD}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5B115901-387C-11D3-8CC3-0050049FD5AD} msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A251861ACE6B2741875102E086F1D85\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A251861ACE6B2741875102E086F1D85\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{7E985DEE-3D20-11D2-A3EA-006008CA119A} msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{81124122-34F7-11D3-B548-444553540000} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36F5B0A5-2343-11D3-8CBF-0050049FD5AD}\ = "NIConAppManager Class" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{81124122-34F7-11D3-B548-444553540000}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36F5B0A5-2343-11D3-8CBF-0050049FD5AD}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5B115901-387C-11D3-8CC3-0050049FD5AD}\InprocServer32\ = "C:\\PROGRA~1\\NATION~1\\Shared\\nicontdt.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0A251861ACE6B2741875102E086F1D85\activex64.NI.ACTIVEX64.2017 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A251861ACE6B2741875102E086F1D85\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A251861ACE6B2741875102E086F1D85\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\SuperViewer Installer\\Volume\\bin\\p20\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A251861ACE6B2741875102E086F1D85\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{81124122-34F7-11D3-B548-444553540000}\InprocServer32\ = "C:\\PROGRA~1\\NATION~1\\Shared\\nicontdt.dll" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36F5B0A5-2343-11D3-8CBF-0050049FD5AD} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{97C81FAE-7A51-11D2-938C-00A02411EBE6}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A251861ACE6B2741875102E086F1D85\ProductName = "NI ActiveX Container (64-bit)" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A251861ACE6B2741875102E086F1D85\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A251861ACE6B2741875102E086F1D85\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A251861ACE6B2741875102E086F1D85\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7E985DEE-3D20-11D2-A3EA-006008CA119A}\ = "NIConAppManager Class" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{81124122-34F7-11D3-B548-444553540000} msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{97C81FAE-7A51-11D2-938C-00A02411EBE6}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{97C81FAE-7A51-11D2-938C-00A02411EBE6}\InprocServer32\ = "C:\\PROGRA~1\\NATION~1\\Shared\\nicontdt.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0A251861ACE6B2741875102E086F1D85\NIMUFeature msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A251861ACE6B2741875102E086F1D85\PackageCode = "920183FE7E8D9DA439CCB84B1F770E89" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A251861ACE6B2741875102E086F1D85\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0A251861ACE6B2741875102E086F1D85\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{7E985DEE-3D20-11D2-A3EA-006008CA119A}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7E985DEE-3D20-11D2-A3EA-006008CA119A}\InprocServer32\ = "C:\\PROGRA~1\\NATION~1\\Shared\\nicont.dll" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{5B115901-387C-11D3-8CC3-0050049FD5AD} msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5B115901-387C-11D3-8CC3-0050049FD5AD}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36F5B0A5-2343-11D3-8CBF-0050049FD5AD}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1520 msiexec.exe Token: SeIncreaseQuotaPrivilege 1520 msiexec.exe Token: SeSecurityPrivilege 2960 msiexec.exe Token: SeCreateTokenPrivilege 1520 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1520 msiexec.exe Token: SeLockMemoryPrivilege 1520 msiexec.exe Token: SeIncreaseQuotaPrivilege 1520 msiexec.exe Token: SeMachineAccountPrivilege 1520 msiexec.exe Token: SeTcbPrivilege 1520 msiexec.exe Token: SeSecurityPrivilege 1520 msiexec.exe Token: SeTakeOwnershipPrivilege 1520 msiexec.exe Token: SeLoadDriverPrivilege 1520 msiexec.exe Token: SeSystemProfilePrivilege 1520 msiexec.exe Token: SeSystemtimePrivilege 1520 msiexec.exe Token: SeProfSingleProcessPrivilege 1520 msiexec.exe Token: SeIncBasePriorityPrivilege 1520 msiexec.exe Token: SeCreatePagefilePrivilege 1520 msiexec.exe Token: SeCreatePermanentPrivilege 1520 msiexec.exe Token: SeBackupPrivilege 1520 msiexec.exe Token: SeRestorePrivilege 1520 msiexec.exe Token: SeShutdownPrivilege 1520 msiexec.exe Token: SeDebugPrivilege 1520 msiexec.exe Token: SeAuditPrivilege 1520 msiexec.exe Token: SeSystemEnvironmentPrivilege 1520 msiexec.exe Token: SeChangeNotifyPrivilege 1520 msiexec.exe Token: SeRemoteShutdownPrivilege 1520 msiexec.exe Token: SeUndockPrivilege 1520 msiexec.exe Token: SeSyncAgentPrivilege 1520 msiexec.exe Token: SeEnableDelegationPrivilege 1520 msiexec.exe Token: SeManageVolumePrivilege 1520 msiexec.exe Token: SeImpersonatePrivilege 1520 msiexec.exe Token: SeCreateGlobalPrivilege 1520 msiexec.exe Token: SeCreateTokenPrivilege 1520 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1520 msiexec.exe Token: SeLockMemoryPrivilege 1520 msiexec.exe Token: SeIncreaseQuotaPrivilege 1520 msiexec.exe Token: SeMachineAccountPrivilege 1520 msiexec.exe Token: SeTcbPrivilege 1520 msiexec.exe Token: SeSecurityPrivilege 1520 msiexec.exe Token: SeTakeOwnershipPrivilege 1520 msiexec.exe Token: SeLoadDriverPrivilege 1520 msiexec.exe Token: SeSystemProfilePrivilege 1520 msiexec.exe Token: SeSystemtimePrivilege 1520 msiexec.exe Token: SeProfSingleProcessPrivilege 1520 msiexec.exe Token: SeIncBasePriorityPrivilege 1520 msiexec.exe Token: SeCreatePagefilePrivilege 1520 msiexec.exe Token: SeCreatePermanentPrivilege 1520 msiexec.exe Token: SeBackupPrivilege 1520 msiexec.exe Token: SeRestorePrivilege 1520 msiexec.exe Token: SeShutdownPrivilege 1520 msiexec.exe Token: SeDebugPrivilege 1520 msiexec.exe Token: SeAuditPrivilege 1520 msiexec.exe Token: SeSystemEnvironmentPrivilege 1520 msiexec.exe Token: SeChangeNotifyPrivilege 1520 msiexec.exe Token: SeRemoteShutdownPrivilege 1520 msiexec.exe Token: SeUndockPrivilege 1520 msiexec.exe Token: SeSyncAgentPrivilege 1520 msiexec.exe Token: SeEnableDelegationPrivilege 1520 msiexec.exe Token: SeManageVolumePrivilege 1520 msiexec.exe Token: SeImpersonatePrivilege 1520 msiexec.exe Token: SeCreateGlobalPrivilege 1520 msiexec.exe Token: SeCreateTokenPrivilege 1520 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1520 msiexec.exe Token: SeLockMemoryPrivilege 1520 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1520 msiexec.exe 1520 msiexec.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2960 wrote to memory of 3088 2960 msiexec.exe 85 PID 2960 wrote to memory of 3088 2960 msiexec.exe 85 PID 2960 wrote to memory of 3088 2960 msiexec.exe 85 PID 2960 wrote to memory of 4608 2960 msiexec.exe 89 PID 2960 wrote to memory of 4608 2960 msiexec.exe 89 PID 2960 wrote to memory of 2288 2960 msiexec.exe 91 PID 2960 wrote to memory of 2288 2960 msiexec.exe 91 PID 2960 wrote to memory of 2288 2960 msiexec.exe 91 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\SuperViewer Installer\Volume\bin\p20\activex64.msi"1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1520
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 177750B080B3F4C7E2E3B9B13504F1CF C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3088
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4608
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 116BEDD5C65A973ED796C59E7A985D592⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2288
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:3856
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14KB
MD54a7bc5d09a8998e0b72a7b7278cad7a3
SHA125b2e05aa5df1ceccf024a8e77083b54df81c5c9
SHA2562190dcda440961faf37db89b30933c31bcad870700cc4deb04ab8070e8342fe1
SHA5121a7c0c876fc7b6c9f333de5b52f45aadfb2068f950abcea9327e835b53af0c0d08575d045c6d7f33b825ba7c170989fc8cdb47df77473a98b1ad7e3b11e7cf8a
-
Filesize
639KB
MD5c6417930af8969f9f2cb431acd76ec89
SHA1d2f2dc9b44f5f79348f7f36091b26a5465ad4f2b
SHA2561b89704532113150fc7a8a06b5367ee26937c346635a860e93662e1fbb5cd79b
SHA512f30d7a5b51f5d866ccabf3e15a45d3b4013e28a9bdaaf2176e8b121fbd4ab41a8e67c059b2ece8db5bc7a0ce043e76bbc4e3f6400fb9cd2886e1ffcd9e65d79b
-
Filesize
24.6MB
MD50d2d928fa9282b3f98ad6c6488bd7ff5
SHA1f0dbac92ed09c9904410ced54308bf3730642dc3
SHA256763a938b96ca069cb90125520c9db8f73dc6626a792c70b6fd15e26564fb2384
SHA5123b2d50ec67f4682e8d2428316787ea12c872679930866e7b3d6f19a493318d47b9cfedfa99d7f8e8a3a602ec87398823a3ada0bd88feb17d832101b45bb3776f
-
\??\Volume{4fff9cb4-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{8ec32bfc-c4a3-44bb-bc90-57eba47a1059}_OnDiskSnapshotProp
Filesize6KB
MD54f9d132623e5a2e40f7c29b28d344ac1
SHA1a56c4d6a2f8bc02d19c6b31e517110c8a92c7593
SHA2566ee200569fc2ba3112fa811ab193592dfae6de74975d7b4aea2e3769ec808778
SHA51201670da73ebb13ca1bbf7e38a16b87e46aab09112cc641f0c31c825da8d6263b68cbe2e308cbf89d9ad89013498364aa2dcda73f61fabbde11724d6142d22931