Overview
overview
7Static
static
3SuperViewe...th.msi
windows11-21h2-x64
6SuperViewe...64.msi
windows11-21h2-x64
6SuperViewe...rl.msi
windows11-21h2-x64
6SuperViewe...64.msi
windows11-21h2-x64
6SuperViewe...TE.msi
windows11-21h2-x64
6SuperViewe...XT.msi
windows11-21h2-x64
6SuperViewe...64.msi
windows11-21h2-x64
6SuperViewe...rt.msi
windows11-21h2-x64
6SuperViewe...or.exe
windows11-21h2-x64
3SuperViewe...er.msi
windows11-21h2-x64
6SuperViewe...er.msi
windows11-21h2-x64
6SuperViewe...re.msi
windows11-21h2-x64
6SuperViewe...er.exe
windows11-21h2-x64
3SuperViewe...64.exe
windows11-21h2-x64
7SuperViewe...86.exe
windows11-21h2-x64
7SuperViewe...ex.msi
windows11-21h2-x64
6SuperViewe...64.msi
windows11-21h2-x64
6SuperViewe...kl.msi
windows11-21h2-x64
6SuperViewe...64.msi
windows11-21h2-x64
6SuperViewe...os.msi
windows11-21h2-x64
SuperViewe...64.msi
windows11-21h2-x64
6SuperViewe...es.msi
windows11-21h2-x64
6SuperViewe...et.msi
windows11-21h2-x64
6SuperViewe...me.msi
windows11-21h2-x64
SuperViewe...ph.msi
windows11-21h2-x64
6SuperViewe...ls.msi
windows11-21h2-x64
6SuperViewe...pp.msi
windows11-21h2-x64
6SuperViewe...rk.msi
windows11-21h2-x64
6SuperViewe...it.msi
windows11-21h2-x64
6SuperViewe...64.msi
windows11-21h2-x64
6SuperViewe...ne.msi
windows11-21h2-x64
6SuperViewe...64.msi
windows11-21h2-x64
6Analysis
-
max time kernel
229s -
max time network
288s -
platform
windows11-21h2_x64 -
resource
win11-20250313-en -
resource tags
arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system -
submitted
28/03/2025, 13:52
Behavioral task
behavioral1
Sample
SuperViewer Installer/Volume/bin/p15/niauth.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral2
Sample
SuperViewer Installer/Volume/bin/p15/niauth64.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
SuperViewer Installer/Volume/bin/p16/nicurl.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral4
Sample
SuperViewer Installer/Volume/bin/p16/nicurl64.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
SuperViewer Installer/Volume/bin/p17/LabVI00/NIWebServer_LVRTE.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral6
Sample
SuperViewer Installer/Volume/bin/p18/LogosXT.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
SuperViewer Installer/Volume/bin/p18/LogosXT64.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral8
Sample
SuperViewer Installer/Volume/bin/p19/ni_error/ni_error_report.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
SuperViewer Installer/Volume/bin/p2/SystemRequirementsError.exe
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral10
Sample
SuperViewer Installer/Volume/bin/p2/VC2015-32Wrapper.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
SuperViewer Installer/Volume/bin/p2/VC2015-64Wrapper.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral12
Sample
SuperViewer Installer/Volume/bin/p2/VC2015Core.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral13
Sample
SuperViewer Installer/Volume/bin/p2/VCRunTimeInstaller.exe
Resource
win11-20250314-en
windows11-21h2-x64
Behavioral task
behavioral14
Sample
SuperViewer Installer/Volume/bin/p2/vc_redist.x64.exe
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral15
Sample
SuperViewer Installer/Volume/bin/p2/vc_redist.x86.exe
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral16
Sample
SuperViewer Installer/Volume/bin/p20/activex.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral17
Sample
SuperViewer Installer/Volume/bin/p20/activex64.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral18
Sample
SuperViewer Installer/Volume/bin/p25/mkl.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral19
Sample
SuperViewer Installer/Volume/bin/p25/mkl64.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral20
Sample
SuperViewer Installer/Volume/bin/p26/logos.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral21
Sample
SuperViewer Installer/Volume/bin/p26/logos64.msi
Resource
win11-20250314-en
windows11-21h2-x64
Behavioral task
behavioral22
Sample
SuperViewer Installer/Volume/bin/p27/lvrteres/LV2019rteres.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral23
Sample
SuperViewer Installer/Volume/bin/p28/LV2019rtdnet.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral24
Sample
SuperViewer Installer/Volume/bin/p28/LV2019runtime.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral25
Sample
SuperViewer Installer/Volume/bin/p29/MStudioCW3DGraph.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral26
Sample
SuperViewer Installer/Volume/bin/p3/NISys00/NISysLogUtils.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral27
Sample
SuperViewer Installer/Volume/bin/p4/sslLVRTE/ssl_LVRTEsupp.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral28
Sample
SuperViewer Installer/Volume/bin/p5/NI_De00/dep_framework.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral29
Sample
SuperViewer Installer/Volume/bin/p6/KillBit.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral30
Sample
SuperViewer Installer/Volume/bin/p6/KillBit64.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral31
Sample
SuperViewer Installer/Volume/bin/p7/NITraceEngine.msi
Resource
win11-20250314-en
windows11-21h2-x64
Behavioral task
behavioral32
Sample
SuperViewer Installer/Volume/bin/p7/NITraceEngine64.msi
Resource
win11-20250314-en
windows11-21h2-x64
General
-
Target
SuperViewer Installer/Volume/bin/p27/lvrteres/LV2019rteres.msi
-
Size
1.1MB
-
MD5
a992528caea5fa57620a719c0ae6707c
-
SHA1
9367706eb071608a2e15f1e4a22f28bf7f2b3552
-
SHA256
c57209e601c4af813f5a73bc3161be9f00febb2dce25be02351bcec3b35832b2
-
SHA512
fa6e2d8b2bc91f1921bf1f5538d6eafab83754d7a4b6036425376db05d74cad13608103ca229b9d60a2f27156299c93a0d751e4b5e723c7e294f326dad7e99a4
-
SSDEEP
24576:g3FOTTTTTTTTTmti+o/3GflS0+TQNxshTK+63S3ZgTqGgeSZUf/:WFOTTTTTTTTTmtiEINC2PJg6Uf
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\E: msiexec.exe -
Drops file in Program Files directory 23 IoCs
description ioc Process File created C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\ChineseS\VarPropDlg.qm msiexec.exe File created C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\French\vidialogs.rsc msiexec.exe File created C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\ChineseS\MVEProvider.qm msiexec.exe File created C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\German\VarPropDlg.qm msiexec.exe File created C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\German\vidialogs.rsc msiexec.exe File created C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\Japanese\MVEProvider.qm msiexec.exe File created C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\Korean\MVEProvider.qm msiexec.exe File created C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\Korean\vidialogs.rsc msiexec.exe File created C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\German\lvapp.rsc msiexec.exe File created C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\Japanese\lvapp.rsc msiexec.exe File created C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\French\MVEProvider.qm msiexec.exe File created C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\French\VarPropDlg.qm msiexec.exe File created C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\Japanese\vidialogs.rsc msiexec.exe File created C:\Program Files (x86)\National Instruments\Shared\MDF\Manifests\NI LabVIEW Runtime 2019 Non-English Support. {21BC6C6B-8341-48B5-9FDC-CF25E4969533}.xml msiexec.exe File created C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\ChineseS\lvapp.rsc msiexec.exe File created C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\ChineseS\vidialogs.rsc msiexec.exe File created C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\Korean\lvapp.rsc msiexec.exe File created C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\German\MVEProvider.qm msiexec.exe File created C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\Japanese\VarPropDlg.qm msiexec.exe File created C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\Korean\VarPropDlg.qm msiexec.exe File created C:\Program Files (x86)\National Instruments\_Legal Information\NI LabVIEW Runtime 2019 Non-English Support. 19.00.49152 {21BC6C6B-8341-48B5-9FDC-CF25E4969533}\notice.txt msiexec.exe File created C:\Program Files (x86)\National Instruments\Shared\WinMIF\ni-labview-2019-runtime-engine-resource_19.0.0.491 {21BC6C6B-8341-48B5-9FDC-CF25E4969533}.control msiexec.exe File created C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\French\lvapp.rsc msiexec.exe -
Drops file in Windows directory 19 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI4313.tmp msiexec.exe File created C:\Windows\Installer\e583ff4.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI406F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI415A.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF6FCA4C32D3A5CCD2.TMP msiexec.exe File created C:\Windows\Installer\e583ff2.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI418A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI42F3.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{21BC6C6B-8341-48B5-9FDC-CF25E4969533} msiexec.exe File opened for modification C:\Windows\Installer\MSI43A2.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI44CB.tmp msiexec.exe File created C:\Windows\SystemTemp\~DFF2BD48E3AC20F2F4.TMP msiexec.exe File opened for modification C:\Windows\Installer\e583ff2.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI4343.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF5A9FC4BC2EB4AF5B.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFA9E0060A0B11DA6E.TMP msiexec.exe -
Loads dropped DLL 11 IoCs
pid Process 4984 MsiExec.exe 4984 MsiExec.exe 4984 MsiExec.exe 4984 MsiExec.exe 1060 MsiExec.exe 1060 MsiExec.exe 1060 MsiExec.exe 1060 MsiExec.exe 1060 MsiExec.exe 1060 MsiExec.exe 1060 MsiExec.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000005dcbaaff1daa426e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800005dcbaaff0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809005dcbaaff000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d5dcbaaff000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000005dcbaaff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe -
Modifies registry class 25 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6C6CB1214385B84F9CDFC524E695933\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\SuperViewer Installer\\Volume\\bin\\p27\\lvrteres\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6C6CB1214385B84F9CDFC524E695933 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6C6CB1214385B84F9CDFC524E695933\ProductName = "NI LabVIEW Runtime 2019 Non-English Support." msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6C6CB1214385B84F9CDFC524E695933\Language = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6C6CB1214385B84F9CDFC524E695933\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6C6CB1214385B84F9CDFC524E695933\AuthorizedLUAApp = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6C6CB1214385B84F9CDFC524E695933\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6C6CB1214385B84F9CDFC524E695933\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6C6CB1214385B84F9CDFC524E695933\SourceList\Media\1 = ";" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6C6CB1214385B84F9CDFC524E695933\Version = "318816256" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6C6CB1214385B84F9CDFC524E695933\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5A94D644038FFDA4C8870F23486D88D2 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6C6CB1214385B84F9CDFC524E695933\SourceList\PackageName = "LV2019rteres.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6C6CB1214385B84F9CDFC524E695933\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SuperViewer Installer\\Volume\\bin\\p27\\lvrteres\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6C6CB1214385B84F9CDFC524E695933\SourceList\Media\2 = ";" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B6C6CB1214385B84F9CDFC524E695933 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B6C6CB1214385B84F9CDFC524E695933\LVRTEres.LV.RTER2019 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B6C6CB1214385B84F9CDFC524E695933\NIMUFeature msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6C6CB1214385B84F9CDFC524E695933\SourceList\Net msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6C6CB1214385B84F9CDFC524E695933\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6C6CB1214385B84F9CDFC524E695933\PackageCode = "BEB68B04AD4216E44A2A55ABC4BC7186" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6C6CB1214385B84F9CDFC524E695933\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5A94D644038FFDA4C8870F23486D88D2\B6C6CB1214385B84F9CDFC524E695933 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6C6CB1214385B84F9CDFC524E695933\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6C6CB1214385B84F9CDFC524E695933\SourceList\Media msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2820 msiexec.exe Token: SeIncreaseQuotaPrivilege 2820 msiexec.exe Token: SeSecurityPrivilege 2736 msiexec.exe Token: SeCreateTokenPrivilege 2820 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2820 msiexec.exe Token: SeLockMemoryPrivilege 2820 msiexec.exe Token: SeIncreaseQuotaPrivilege 2820 msiexec.exe Token: SeMachineAccountPrivilege 2820 msiexec.exe Token: SeTcbPrivilege 2820 msiexec.exe Token: SeSecurityPrivilege 2820 msiexec.exe Token: SeTakeOwnershipPrivilege 2820 msiexec.exe Token: SeLoadDriverPrivilege 2820 msiexec.exe Token: SeSystemProfilePrivilege 2820 msiexec.exe Token: SeSystemtimePrivilege 2820 msiexec.exe Token: SeProfSingleProcessPrivilege 2820 msiexec.exe Token: SeIncBasePriorityPrivilege 2820 msiexec.exe Token: SeCreatePagefilePrivilege 2820 msiexec.exe Token: SeCreatePermanentPrivilege 2820 msiexec.exe Token: SeBackupPrivilege 2820 msiexec.exe Token: SeRestorePrivilege 2820 msiexec.exe Token: SeShutdownPrivilege 2820 msiexec.exe Token: SeDebugPrivilege 2820 msiexec.exe Token: SeAuditPrivilege 2820 msiexec.exe Token: SeSystemEnvironmentPrivilege 2820 msiexec.exe Token: SeChangeNotifyPrivilege 2820 msiexec.exe Token: SeRemoteShutdownPrivilege 2820 msiexec.exe Token: SeUndockPrivilege 2820 msiexec.exe Token: SeSyncAgentPrivilege 2820 msiexec.exe Token: SeEnableDelegationPrivilege 2820 msiexec.exe Token: SeManageVolumePrivilege 2820 msiexec.exe Token: SeImpersonatePrivilege 2820 msiexec.exe Token: SeCreateGlobalPrivilege 2820 msiexec.exe Token: SeCreateTokenPrivilege 2820 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2820 msiexec.exe Token: SeLockMemoryPrivilege 2820 msiexec.exe Token: SeIncreaseQuotaPrivilege 2820 msiexec.exe Token: SeMachineAccountPrivilege 2820 msiexec.exe Token: SeTcbPrivilege 2820 msiexec.exe Token: SeSecurityPrivilege 2820 msiexec.exe Token: SeTakeOwnershipPrivilege 2820 msiexec.exe Token: SeLoadDriverPrivilege 2820 msiexec.exe Token: SeSystemProfilePrivilege 2820 msiexec.exe Token: SeSystemtimePrivilege 2820 msiexec.exe Token: SeProfSingleProcessPrivilege 2820 msiexec.exe Token: SeIncBasePriorityPrivilege 2820 msiexec.exe Token: SeCreatePagefilePrivilege 2820 msiexec.exe Token: SeCreatePermanentPrivilege 2820 msiexec.exe Token: SeBackupPrivilege 2820 msiexec.exe Token: SeRestorePrivilege 2820 msiexec.exe Token: SeShutdownPrivilege 2820 msiexec.exe Token: SeDebugPrivilege 2820 msiexec.exe Token: SeAuditPrivilege 2820 msiexec.exe Token: SeSystemEnvironmentPrivilege 2820 msiexec.exe Token: SeChangeNotifyPrivilege 2820 msiexec.exe Token: SeRemoteShutdownPrivilege 2820 msiexec.exe Token: SeUndockPrivilege 2820 msiexec.exe Token: SeSyncAgentPrivilege 2820 msiexec.exe Token: SeEnableDelegationPrivilege 2820 msiexec.exe Token: SeManageVolumePrivilege 2820 msiexec.exe Token: SeImpersonatePrivilege 2820 msiexec.exe Token: SeCreateGlobalPrivilege 2820 msiexec.exe Token: SeCreateTokenPrivilege 2820 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2820 msiexec.exe Token: SeLockMemoryPrivilege 2820 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2820 msiexec.exe 2820 msiexec.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2736 wrote to memory of 4984 2736 msiexec.exe 84 PID 2736 wrote to memory of 4984 2736 msiexec.exe 84 PID 2736 wrote to memory of 4984 2736 msiexec.exe 84 PID 2736 wrote to memory of 1648 2736 msiexec.exe 88 PID 2736 wrote to memory of 1648 2736 msiexec.exe 88 PID 2736 wrote to memory of 1060 2736 msiexec.exe 90 PID 2736 wrote to memory of 1060 2736 msiexec.exe 90 PID 2736 wrote to memory of 1060 2736 msiexec.exe 90 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\SuperViewer Installer\Volume\bin\p27\lvrteres\LV2019rteres.msi"1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2820
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 2E6EADC8ABFE854A9938414F7F96D363 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4984
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:1648
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 671EA07E7A0A79068B0AF99D05EB48142⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1060
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:620
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD5e8178de2dc12622c50e3f417d679d593
SHA1630eae146421a9861221cc323a029130ff9bf19a
SHA2567b714396ef814b1b6ba780032bc0b864a9f9d778fe23d515bab73acf6c8a357e
SHA512f7530d66bb42403ab6ceb9ce75f0f5f6e716e90330f93068cc00d86bedfdd5b3c01f74e6844db1d23a230593d5890e0520cd865023f1d2372d8e323b8adc6519
-
Filesize
639KB
MD5c6417930af8969f9f2cb431acd76ec89
SHA1d2f2dc9b44f5f79348f7f36091b26a5465ad4f2b
SHA2561b89704532113150fc7a8a06b5367ee26937c346635a860e93662e1fbb5cd79b
SHA512f30d7a5b51f5d866ccabf3e15a45d3b4013e28a9bdaaf2176e8b121fbd4ab41a8e67c059b2ece8db5bc7a0ce043e76bbc4e3f6400fb9cd2886e1ffcd9e65d79b
-
Filesize
24.6MB
MD501ee817e72df33856a62f0e2ad2e99f1
SHA1a60ed083f7dfcde5fc67d1078831106c62e9ae21
SHA256d317b50408da6e348380982d4dfc48122146b0cee8601aece72c387183c67e51
SHA512f0b884412209ca7aa605da42ed68da866d860dbd1b28106626185d5363e6f8ab11d1ad1026f9e5476ebaa353116462c3bfe97a885faa516829ddf709a2e3aaef
-
\??\Volume{ffaacb5d-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{6a46a560-a323-4333-ba89-7e036ee20341}_OnDiskSnapshotProp
Filesize6KB
MD59638273975b9f0531ab493c564868aea
SHA1c182cf81da56e1f704e43f9052ed06748e4356f4
SHA2566a9e21b9eeaa0b77eace8dded6e1dd075403d4dbd60ce4fafbef02412aa533c3
SHA512f634c4db9de173194a3088c78d552fb3870785fa82afbb9e137873d16a385208e64601f586bde5025edbd93d1aecf2444696543bd44862645c05a64f2624404b