Overview
overview
7Static
static
3SuperViewe...th.msi
windows11-21h2-x64
6SuperViewe...64.msi
windows11-21h2-x64
6SuperViewe...rl.msi
windows11-21h2-x64
6SuperViewe...64.msi
windows11-21h2-x64
6SuperViewe...TE.msi
windows11-21h2-x64
6SuperViewe...XT.msi
windows11-21h2-x64
6SuperViewe...64.msi
windows11-21h2-x64
6SuperViewe...rt.msi
windows11-21h2-x64
6SuperViewe...or.exe
windows11-21h2-x64
3SuperViewe...er.msi
windows11-21h2-x64
6SuperViewe...er.msi
windows11-21h2-x64
6SuperViewe...re.msi
windows11-21h2-x64
6SuperViewe...er.exe
windows11-21h2-x64
3SuperViewe...64.exe
windows11-21h2-x64
7SuperViewe...86.exe
windows11-21h2-x64
7SuperViewe...ex.msi
windows11-21h2-x64
6SuperViewe...64.msi
windows11-21h2-x64
6SuperViewe...kl.msi
windows11-21h2-x64
6SuperViewe...64.msi
windows11-21h2-x64
6SuperViewe...os.msi
windows11-21h2-x64
SuperViewe...64.msi
windows11-21h2-x64
6SuperViewe...es.msi
windows11-21h2-x64
6SuperViewe...et.msi
windows11-21h2-x64
6SuperViewe...me.msi
windows11-21h2-x64
SuperViewe...ph.msi
windows11-21h2-x64
6SuperViewe...ls.msi
windows11-21h2-x64
6SuperViewe...pp.msi
windows11-21h2-x64
6SuperViewe...rk.msi
windows11-21h2-x64
6SuperViewe...it.msi
windows11-21h2-x64
6SuperViewe...64.msi
windows11-21h2-x64
6SuperViewe...ne.msi
windows11-21h2-x64
6SuperViewe...64.msi
windows11-21h2-x64
6Analysis
-
max time kernel
233s -
max time network
289s -
platform
windows11-21h2_x64 -
resource
win11-20250313-en -
resource tags
arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system -
submitted
28/03/2025, 13:52
Behavioral task
behavioral1
Sample
SuperViewer Installer/Volume/bin/p15/niauth.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral2
Sample
SuperViewer Installer/Volume/bin/p15/niauth64.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
SuperViewer Installer/Volume/bin/p16/nicurl.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral4
Sample
SuperViewer Installer/Volume/bin/p16/nicurl64.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
SuperViewer Installer/Volume/bin/p17/LabVI00/NIWebServer_LVRTE.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral6
Sample
SuperViewer Installer/Volume/bin/p18/LogosXT.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
SuperViewer Installer/Volume/bin/p18/LogosXT64.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral8
Sample
SuperViewer Installer/Volume/bin/p19/ni_error/ni_error_report.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
SuperViewer Installer/Volume/bin/p2/SystemRequirementsError.exe
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral10
Sample
SuperViewer Installer/Volume/bin/p2/VC2015-32Wrapper.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
SuperViewer Installer/Volume/bin/p2/VC2015-64Wrapper.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral12
Sample
SuperViewer Installer/Volume/bin/p2/VC2015Core.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral13
Sample
SuperViewer Installer/Volume/bin/p2/VCRunTimeInstaller.exe
Resource
win11-20250314-en
windows11-21h2-x64
Behavioral task
behavioral14
Sample
SuperViewer Installer/Volume/bin/p2/vc_redist.x64.exe
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral15
Sample
SuperViewer Installer/Volume/bin/p2/vc_redist.x86.exe
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral16
Sample
SuperViewer Installer/Volume/bin/p20/activex.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral17
Sample
SuperViewer Installer/Volume/bin/p20/activex64.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral18
Sample
SuperViewer Installer/Volume/bin/p25/mkl.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral19
Sample
SuperViewer Installer/Volume/bin/p25/mkl64.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral20
Sample
SuperViewer Installer/Volume/bin/p26/logos.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral21
Sample
SuperViewer Installer/Volume/bin/p26/logos64.msi
Resource
win11-20250314-en
windows11-21h2-x64
Behavioral task
behavioral22
Sample
SuperViewer Installer/Volume/bin/p27/lvrteres/LV2019rteres.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral23
Sample
SuperViewer Installer/Volume/bin/p28/LV2019rtdnet.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral24
Sample
SuperViewer Installer/Volume/bin/p28/LV2019runtime.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral25
Sample
SuperViewer Installer/Volume/bin/p29/MStudioCW3DGraph.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral26
Sample
SuperViewer Installer/Volume/bin/p3/NISys00/NISysLogUtils.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral27
Sample
SuperViewer Installer/Volume/bin/p4/sslLVRTE/ssl_LVRTEsupp.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral28
Sample
SuperViewer Installer/Volume/bin/p5/NI_De00/dep_framework.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral29
Sample
SuperViewer Installer/Volume/bin/p6/KillBit.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral30
Sample
SuperViewer Installer/Volume/bin/p6/KillBit64.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral31
Sample
SuperViewer Installer/Volume/bin/p7/NITraceEngine.msi
Resource
win11-20250314-en
windows11-21h2-x64
Behavioral task
behavioral32
Sample
SuperViewer Installer/Volume/bin/p7/NITraceEngine64.msi
Resource
win11-20250314-en
windows11-21h2-x64
General
-
Target
SuperViewer Installer/Volume/bin/p17/LabVI00/NIWebServer_LVRTE.msi
-
Size
1.1MB
-
MD5
7d9b07ad95428de54babecfc43dbc793
-
SHA1
cc1a97bf7ef41ea151e317b3a0b9215e138d79c6
-
SHA256
c56f68f1616e296241b60774db7772866e37e57232901f52798f192f6959e44a
-
SHA512
2d5aa8761caa03477dd8fdc39c5baa125b6649a1c5413be7479b2b7e3b90447fc1d93403192aef370bd88421c3afe860b00f324cbcaeb61b8a97c7c6caddbfbe
-
SSDEEP
24576:rkkkkkk3F9txo/3GfS7+kkkkkkL+TQNxshTK+63S3ZgTqGgeSZUf/:zF9t3qFC2PJg6Uf
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe -
Drops file in Program Files directory 27 IoCs
description ioc Process File created C:\Program Files (x86)\National Instruments\_Legal Information\NI LabVIEW 2019 Run-Time Engine Web Server 19.00.49152 {39E48FFF-ED88-4231-A9A7-198A9CE4CCE4}\notice.txt msiexec.exe File created C:\Program Files (x86)\National Instruments\Shared\MDF\Manifests\NI LabVIEW 2019 Run-Time Engine Web Server {39E48FFF-ED88-4231-A9A7-198A9CE4CCE4}.xml msiexec.exe File created C:\Program Files (x86)\National Instruments\Shared\WinMIF\ni-lv-web-server-labview-2019-runtime-engine-x86-s {39E48FFF-ED88-4231-A9A7-198A9CE4CCE4}.instructions msiexec.exe File created C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\libhttp.dll msiexec.exe File created C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\mod_niesp.dll msiexec.exe File created C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\mod_nisessmgr.dll msiexec.exe File created C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\webserver\niwebserver.conf.defaults msiexec.exe File created C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\webserver\mime.types msiexec.exe File created C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\webserver\services\LVWSSysAdmin\WebService.ini msiexec.exe File created C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\libappweb.dll msiexec.exe File created C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\webserver\services\LVWSSysAdmin\localOnly msiexec.exe File created C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\libmpr.dll msiexec.exe File created C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\webserver\LVModules\lvsnapshotmodule.dll msiexec.exe File created C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\webserver\LVModules\lvrfpmodule.dll msiexec.exe File created C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\webserver\modules\mod_niauth.dll msiexec.exe File created C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\webserver\ws_www\LoginPage.xap msiexec.exe File created C:\Program Files (x86)\National Instruments\Shared\WinMIF\ni-lv-web-server-labview-2019-runtime-engine-x86-s {39E48FFF-ED88-4231-A9A7-198A9CE4CCE4}.control msiexec.exe File created C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\webserver\logs\access.log msiexec.exe File created C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\webserver\logs\error.log msiexec.exe File created C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\libappwebcore.dll msiexec.exe File created C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\webserver\LVModules\lvauthmodule.dll msiexec.exe File created C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\mod_niws.dll msiexec.exe File created C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\webserver\ws_www\login.html msiexec.exe File created C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\webserver\ws_www\clientaccesspolicy.xml msiexec.exe File created C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\webserver\services\LVWSSysAdmin\sysadminsvc.dll msiexec.exe File created C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\libpcre.dll msiexec.exe File created C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2019\ws_runtime.dll msiexec.exe -
Drops file in Windows directory 19 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e58071f.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI79C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9C1.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB39.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF864A6296804A0D8F.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIBA9.tmp msiexec.exe File created C:\Windows\Installer\e58071f.msi msiexec.exe File created C:\Windows\Installer\SourceHash{39E48FFF-ED88-4231-A9A7-198A9CE4CCE4} msiexec.exe File opened for modification C:\Windows\Installer\MSIDFC.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF93B8E5DD1359F9FD.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI982.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DF7D36615DCA683945.TMP msiexec.exe File created C:\Windows\Installer\e580721.msi msiexec.exe File created C:\Windows\SystemTemp\~DFE70E399616E03B22.TMP msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIB4A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB6A.tmp msiexec.exe -
Loads dropped DLL 11 IoCs
pid Process 2052 MsiExec.exe 2052 MsiExec.exe 2052 MsiExec.exe 2052 MsiExec.exe 2044 MsiExec.exe 2044 MsiExec.exe 2044 MsiExec.exe 2044 MsiExec.exe 2044 MsiExec.exe 2044 MsiExec.exe 2044 MsiExec.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000b49cff4fc6d8ed1d0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000b49cff4f0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900b49cff4f000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1db49cff4f000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000b49cff4f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe -
Modifies registry class 25 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FFF84E9388DE13249A7A91A8C94ECC4E\WebServerLVRTE.LV.WSRVRRTE.2019 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FFF84E9388DE13249A7A91A8C94ECC4E\PackageCode = "B6D3C21DA859E2748851819A6698B99A" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FFF84E9388DE13249A7A91A8C94ECC4E\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FFF84E9388DE13249A7A91A8C94ECC4E\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FFF84E9388DE13249A7A91A8C94ECC4E\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FFF84E9388DE13249A7A91A8C94ECC4E\SourceList\PackageName = "NIWebServer_LVRTE.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FFF84E9388DE13249A7A91A8C94ECC4E\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FFF84E9388DE13249A7A91A8C94ECC4E\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FFF84E9388DE13249A7A91A8C94ECC4E msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FFF84E9388DE13249A7A91A8C94ECC4E\NIMUFeature msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FFF84E9388DE13249A7A91A8C94ECC4E\ProductName = "NI LabVIEW 2019 Run-Time Engine Web Server" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FFF84E9388DE13249A7A91A8C94ECC4E\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FFF84E9388DE13249A7A91A8C94ECC4E\SourceList\Media\2 = ";" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FFF84E9388DE13249A7A91A8C94ECC4E\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FFF84E9388DE13249A7A91A8C94ECC4E\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\SuperViewer Installer\\Volume\\bin\\p17\\LabVI00\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FFF84E9388DE13249A7A91A8C94ECC4E\Version = "318816256" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FFF84E9388DE13249A7A91A8C94ECC4E\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FFF84E9388DE13249A7A91A8C94ECC4E\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B083069068AEC0E4B87541DCC8FCC251 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B083069068AEC0E4B87541DCC8FCC251\FFF84E9388DE13249A7A91A8C94ECC4E msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FFF84E9388DE13249A7A91A8C94ECC4E\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FFF84E9388DE13249A7A91A8C94ECC4E msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FFF84E9388DE13249A7A91A8C94ECC4E\Language = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FFF84E9388DE13249A7A91A8C94ECC4E\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SuperViewer Installer\\Volume\\bin\\p17\\LabVI00\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FFF84E9388DE13249A7A91A8C94ECC4E\SourceList\Media\1 = ";" msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3472 msiexec.exe Token: SeIncreaseQuotaPrivilege 3472 msiexec.exe Token: SeSecurityPrivilege 3076 msiexec.exe Token: SeCreateTokenPrivilege 3472 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3472 msiexec.exe Token: SeLockMemoryPrivilege 3472 msiexec.exe Token: SeIncreaseQuotaPrivilege 3472 msiexec.exe Token: SeMachineAccountPrivilege 3472 msiexec.exe Token: SeTcbPrivilege 3472 msiexec.exe Token: SeSecurityPrivilege 3472 msiexec.exe Token: SeTakeOwnershipPrivilege 3472 msiexec.exe Token: SeLoadDriverPrivilege 3472 msiexec.exe Token: SeSystemProfilePrivilege 3472 msiexec.exe Token: SeSystemtimePrivilege 3472 msiexec.exe Token: SeProfSingleProcessPrivilege 3472 msiexec.exe Token: SeIncBasePriorityPrivilege 3472 msiexec.exe Token: SeCreatePagefilePrivilege 3472 msiexec.exe Token: SeCreatePermanentPrivilege 3472 msiexec.exe Token: SeBackupPrivilege 3472 msiexec.exe Token: SeRestorePrivilege 3472 msiexec.exe Token: SeShutdownPrivilege 3472 msiexec.exe Token: SeDebugPrivilege 3472 msiexec.exe Token: SeAuditPrivilege 3472 msiexec.exe Token: SeSystemEnvironmentPrivilege 3472 msiexec.exe Token: SeChangeNotifyPrivilege 3472 msiexec.exe Token: SeRemoteShutdownPrivilege 3472 msiexec.exe Token: SeUndockPrivilege 3472 msiexec.exe Token: SeSyncAgentPrivilege 3472 msiexec.exe Token: SeEnableDelegationPrivilege 3472 msiexec.exe Token: SeManageVolumePrivilege 3472 msiexec.exe Token: SeImpersonatePrivilege 3472 msiexec.exe Token: SeCreateGlobalPrivilege 3472 msiexec.exe Token: SeCreateTokenPrivilege 3472 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3472 msiexec.exe Token: SeLockMemoryPrivilege 3472 msiexec.exe Token: SeIncreaseQuotaPrivilege 3472 msiexec.exe Token: SeMachineAccountPrivilege 3472 msiexec.exe Token: SeTcbPrivilege 3472 msiexec.exe Token: SeSecurityPrivilege 3472 msiexec.exe Token: SeTakeOwnershipPrivilege 3472 msiexec.exe Token: SeLoadDriverPrivilege 3472 msiexec.exe Token: SeSystemProfilePrivilege 3472 msiexec.exe Token: SeSystemtimePrivilege 3472 msiexec.exe Token: SeProfSingleProcessPrivilege 3472 msiexec.exe Token: SeIncBasePriorityPrivilege 3472 msiexec.exe Token: SeCreatePagefilePrivilege 3472 msiexec.exe Token: SeCreatePermanentPrivilege 3472 msiexec.exe Token: SeBackupPrivilege 3472 msiexec.exe Token: SeRestorePrivilege 3472 msiexec.exe Token: SeShutdownPrivilege 3472 msiexec.exe Token: SeDebugPrivilege 3472 msiexec.exe Token: SeAuditPrivilege 3472 msiexec.exe Token: SeSystemEnvironmentPrivilege 3472 msiexec.exe Token: SeChangeNotifyPrivilege 3472 msiexec.exe Token: SeRemoteShutdownPrivilege 3472 msiexec.exe Token: SeUndockPrivilege 3472 msiexec.exe Token: SeSyncAgentPrivilege 3472 msiexec.exe Token: SeEnableDelegationPrivilege 3472 msiexec.exe Token: SeManageVolumePrivilege 3472 msiexec.exe Token: SeImpersonatePrivilege 3472 msiexec.exe Token: SeCreateGlobalPrivilege 3472 msiexec.exe Token: SeCreateTokenPrivilege 3472 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3472 msiexec.exe Token: SeLockMemoryPrivilege 3472 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3472 msiexec.exe 3472 msiexec.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3076 wrote to memory of 2052 3076 msiexec.exe 85 PID 3076 wrote to memory of 2052 3076 msiexec.exe 85 PID 3076 wrote to memory of 2052 3076 msiexec.exe 85 PID 3076 wrote to memory of 1420 3076 msiexec.exe 89 PID 3076 wrote to memory of 1420 3076 msiexec.exe 89 PID 3076 wrote to memory of 2044 3076 msiexec.exe 91 PID 3076 wrote to memory of 2044 3076 msiexec.exe 91 PID 3076 wrote to memory of 2044 3076 msiexec.exe 91 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\SuperViewer Installer\Volume\bin\p17\LabVI00\NIWebServer_LVRTE.msi"1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3472
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 96B87A8DDB0F920296232D1FDD8BB143 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2052
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:1420
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 963E0B49D44C0D93E968F3A4018AB3B92⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2044
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:900
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21KB
MD5bd03b63ef7004c410aef434e1c20d402
SHA17577458b088d156050b2ee777f317a12adad0949
SHA256f7f1dcc1a080cff11e7af753f51ab8069085b97e6ed9af4ac96a1b63b48a48b8
SHA51218b73ab22df9103c09859b5e9a7180770c6a7921bc51edf1adc076d3f766d0a9a25f5341b17eae841f905f5ac45dd0bb6dcb7cf8e94a5af3fa6aac54a5676ef7
-
Filesize
639KB
MD5c6417930af8969f9f2cb431acd76ec89
SHA1d2f2dc9b44f5f79348f7f36091b26a5465ad4f2b
SHA2561b89704532113150fc7a8a06b5367ee26937c346635a860e93662e1fbb5cd79b
SHA512f30d7a5b51f5d866ccabf3e15a45d3b4013e28a9bdaaf2176e8b121fbd4ab41a8e67c059b2ece8db5bc7a0ce043e76bbc4e3f6400fb9cd2886e1ffcd9e65d79b
-
Filesize
24.6MB
MD50a2936ef9315a7d8519f541a8f4ba644
SHA17ef7ab06923416cdaf3bac7a899172dc5910c8b7
SHA25698dd9aefe7c5cecc70693745e1d03a599981f9591928c9d52528f54593ea15aa
SHA51204e9d66d47caccc812ea9927779ede7f01ddac1ae1c587873ecdb37c703fd4c0d263a48120b2403a6466fc270e7ddccbe3d769f58df8a3d6e9e3c132cfdc0dc7
-
\??\Volume{4fff9cb4-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{c019f4fc-b440-41cc-99bd-ce5944c46c12}_OnDiskSnapshotProp
Filesize6KB
MD568f5af81b708bd26e07af4954e8f2651
SHA17d61f6af3e23d7ff1dbda49c4cd33f95007eac78
SHA256ab79e267bd33349d5745f0c3bc67eca627e89192d11c5b79ab609dae4f3a4be6
SHA512923f3be13de01c2a710b91f2fa4066b629253341a33633984153948068fb30ae364375261129118e289aa109edbd51b3e75063a213df0bbec6c02b222c41c1d5