Overview
overview
7Static
static
3SuperViewe...th.msi
windows11-21h2-x64
6SuperViewe...64.msi
windows11-21h2-x64
6SuperViewe...rl.msi
windows11-21h2-x64
6SuperViewe...64.msi
windows11-21h2-x64
6SuperViewe...TE.msi
windows11-21h2-x64
6SuperViewe...XT.msi
windows11-21h2-x64
6SuperViewe...64.msi
windows11-21h2-x64
6SuperViewe...rt.msi
windows11-21h2-x64
6SuperViewe...or.exe
windows11-21h2-x64
3SuperViewe...er.msi
windows11-21h2-x64
6SuperViewe...er.msi
windows11-21h2-x64
6SuperViewe...re.msi
windows11-21h2-x64
6SuperViewe...er.exe
windows11-21h2-x64
3SuperViewe...64.exe
windows11-21h2-x64
7SuperViewe...86.exe
windows11-21h2-x64
7SuperViewe...ex.msi
windows11-21h2-x64
6SuperViewe...64.msi
windows11-21h2-x64
6SuperViewe...kl.msi
windows11-21h2-x64
6SuperViewe...64.msi
windows11-21h2-x64
6SuperViewe...os.msi
windows11-21h2-x64
SuperViewe...64.msi
windows11-21h2-x64
6SuperViewe...es.msi
windows11-21h2-x64
6SuperViewe...et.msi
windows11-21h2-x64
6SuperViewe...me.msi
windows11-21h2-x64
SuperViewe...ph.msi
windows11-21h2-x64
6SuperViewe...ls.msi
windows11-21h2-x64
6SuperViewe...pp.msi
windows11-21h2-x64
6SuperViewe...rk.msi
windows11-21h2-x64
6SuperViewe...it.msi
windows11-21h2-x64
6SuperViewe...64.msi
windows11-21h2-x64
6SuperViewe...ne.msi
windows11-21h2-x64
6SuperViewe...64.msi
windows11-21h2-x64
6Analysis
-
max time kernel
227s -
max time network
291s -
platform
windows11-21h2_x64 -
resource
win11-20250313-en -
resource tags
arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system -
submitted
28/03/2025, 13:52
Behavioral task
behavioral1
Sample
SuperViewer Installer/Volume/bin/p15/niauth.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral2
Sample
SuperViewer Installer/Volume/bin/p15/niauth64.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
SuperViewer Installer/Volume/bin/p16/nicurl.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral4
Sample
SuperViewer Installer/Volume/bin/p16/nicurl64.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
SuperViewer Installer/Volume/bin/p17/LabVI00/NIWebServer_LVRTE.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral6
Sample
SuperViewer Installer/Volume/bin/p18/LogosXT.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
SuperViewer Installer/Volume/bin/p18/LogosXT64.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral8
Sample
SuperViewer Installer/Volume/bin/p19/ni_error/ni_error_report.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
SuperViewer Installer/Volume/bin/p2/SystemRequirementsError.exe
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral10
Sample
SuperViewer Installer/Volume/bin/p2/VC2015-32Wrapper.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
SuperViewer Installer/Volume/bin/p2/VC2015-64Wrapper.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral12
Sample
SuperViewer Installer/Volume/bin/p2/VC2015Core.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral13
Sample
SuperViewer Installer/Volume/bin/p2/VCRunTimeInstaller.exe
Resource
win11-20250314-en
windows11-21h2-x64
Behavioral task
behavioral14
Sample
SuperViewer Installer/Volume/bin/p2/vc_redist.x64.exe
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral15
Sample
SuperViewer Installer/Volume/bin/p2/vc_redist.x86.exe
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral16
Sample
SuperViewer Installer/Volume/bin/p20/activex.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral17
Sample
SuperViewer Installer/Volume/bin/p20/activex64.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral18
Sample
SuperViewer Installer/Volume/bin/p25/mkl.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral19
Sample
SuperViewer Installer/Volume/bin/p25/mkl64.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral20
Sample
SuperViewer Installer/Volume/bin/p26/logos.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral21
Sample
SuperViewer Installer/Volume/bin/p26/logos64.msi
Resource
win11-20250314-en
windows11-21h2-x64
Behavioral task
behavioral22
Sample
SuperViewer Installer/Volume/bin/p27/lvrteres/LV2019rteres.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral23
Sample
SuperViewer Installer/Volume/bin/p28/LV2019rtdnet.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral24
Sample
SuperViewer Installer/Volume/bin/p28/LV2019runtime.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral25
Sample
SuperViewer Installer/Volume/bin/p29/MStudioCW3DGraph.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral26
Sample
SuperViewer Installer/Volume/bin/p3/NISys00/NISysLogUtils.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral27
Sample
SuperViewer Installer/Volume/bin/p4/sslLVRTE/ssl_LVRTEsupp.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral28
Sample
SuperViewer Installer/Volume/bin/p5/NI_De00/dep_framework.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral29
Sample
SuperViewer Installer/Volume/bin/p6/KillBit.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral30
Sample
SuperViewer Installer/Volume/bin/p6/KillBit64.msi
Resource
win11-20250313-en
windows11-21h2-x64
Behavioral task
behavioral31
Sample
SuperViewer Installer/Volume/bin/p7/NITraceEngine.msi
Resource
win11-20250314-en
windows11-21h2-x64
Behavioral task
behavioral32
Sample
SuperViewer Installer/Volume/bin/p7/NITraceEngine64.msi
Resource
win11-20250314-en
windows11-21h2-x64
General
-
Target
SuperViewer Installer/Volume/bin/p18/LogosXT64.msi
-
Size
1.1MB
-
MD5
990c47e8a1e9873127bc4de5912ef297
-
SHA1
43453fe15172724622191f8326028db6058e07ca
-
SHA256
9d21da46509198d2cd5ee1f2371ad638ab5cbc60629534a58d6e08a991652d0b
-
SHA512
a064510a6d1f857ef3e4cbca745d66ddb2920ad0768a70fe20d4c410672997d899bb475ec0c5a29a4548d275e75eb1c0dc978196caa699aa9ad85f647775f63b
-
SSDEEP
24576:KFvt9sZo/3GfK+TQNxshTK+63S3ZgTqGgeSZUf/:KFvtevzC2PJg6Uf
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\National Instruments\Shared\LogosXT\nilxtcor.dll msiexec.exe File created C:\Program Files\National Instruments\Shared\LogosXT\nipspxts.dll msiexec.exe -
Drops file in Windows directory 19 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSIFF40.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF0B26105121B47CA4.TMP msiexec.exe File opened for modification C:\Windows\Installer\e57fed2.msi msiexec.exe File opened for modification C:\Windows\Installer\MSID7.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI116.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF19D253C6B30D38BE.TMP msiexec.exe File created C:\Windows\Installer\e57fed2.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI194.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1A5.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DFBDEFC964FFA103BD.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI2A1.tmp msiexec.exe File created C:\Windows\Installer\e57fed4.msi msiexec.exe File created C:\Windows\SystemTemp\~DF446F7A643F64B983.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI1F4.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{FE3294EC-57C4-4B24-9C4B-D734C2761458} msiexec.exe File opened for modification C:\Windows\Installer\MSI39C.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe -
Loads dropped DLL 11 IoCs
pid Process 956 MsiExec.exe 956 MsiExec.exe 956 MsiExec.exe 956 MsiExec.exe 5052 MsiExec.exe 5052 MsiExec.exe 5052 MsiExec.exe 5052 MsiExec.exe 5052 MsiExec.exe 5052 MsiExec.exe 5052 MsiExec.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000003c9263343ee389390000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800003c9263340000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809003c926334000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d3c926334000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000003c92633400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe -
Modifies registry class 24 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CE4923EF4C7542B4C9B47D432C674185\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CE4923EF4C7542B4C9B47D432C674185\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SuperViewer Installer\\Volume\\bin\\p18\\" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CE4923EF4C7542B4C9B47D432C674185\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CE4923EF4C7542B4C9B47D432C674185 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CE4923EF4C7542B4C9B47D432C674185\Version = "318816256" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CE4923EF4C7542B4C9B47D432C674185\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CE4923EF4C7542B4C9B47D432C674185\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3EA9FBD273AA5A44B37CC730A6F704F msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CE4923EF4C7542B4C9B47D432C674185\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CE4923EF4C7542B4C9B47D432C674185\SourceList\PackageName = "LogosXT64.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CE4923EF4C7542B4C9B47D432C674185\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CE4923EF4C7542B4C9B47D432C674185\LOGOS64_XT.LOGOS64XT.1900 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CE4923EF4C7542B4C9B47D432C674185\NIMUFeature msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CE4923EF4C7542B4C9B47D432C674185\ProductName = "NI Logos64 XT Support" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3EA9FBD273AA5A44B37CC730A6F704F\CE4923EF4C7542B4C9B47D432C674185 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CE4923EF4C7542B4C9B47D432C674185\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CE4923EF4C7542B4C9B47D432C674185\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CE4923EF4C7542B4C9B47D432C674185 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CE4923EF4C7542B4C9B47D432C674185\PackageCode = "3CC8CA1902F19DF4D93CB12B632C3247" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CE4923EF4C7542B4C9B47D432C674185\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CE4923EF4C7542B4C9B47D432C674185\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CE4923EF4C7542B4C9B47D432C674185\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CE4923EF4C7542B4C9B47D432C674185\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\SuperViewer Installer\\Volume\\bin\\p18\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CE4923EF4C7542B4C9B47D432C674185\Language = "9" msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4028 msiexec.exe Token: SeIncreaseQuotaPrivilege 4028 msiexec.exe Token: SeSecurityPrivilege 2312 msiexec.exe Token: SeCreateTokenPrivilege 4028 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4028 msiexec.exe Token: SeLockMemoryPrivilege 4028 msiexec.exe Token: SeIncreaseQuotaPrivilege 4028 msiexec.exe Token: SeMachineAccountPrivilege 4028 msiexec.exe Token: SeTcbPrivilege 4028 msiexec.exe Token: SeSecurityPrivilege 4028 msiexec.exe Token: SeTakeOwnershipPrivilege 4028 msiexec.exe Token: SeLoadDriverPrivilege 4028 msiexec.exe Token: SeSystemProfilePrivilege 4028 msiexec.exe Token: SeSystemtimePrivilege 4028 msiexec.exe Token: SeProfSingleProcessPrivilege 4028 msiexec.exe Token: SeIncBasePriorityPrivilege 4028 msiexec.exe Token: SeCreatePagefilePrivilege 4028 msiexec.exe Token: SeCreatePermanentPrivilege 4028 msiexec.exe Token: SeBackupPrivilege 4028 msiexec.exe Token: SeRestorePrivilege 4028 msiexec.exe Token: SeShutdownPrivilege 4028 msiexec.exe Token: SeDebugPrivilege 4028 msiexec.exe Token: SeAuditPrivilege 4028 msiexec.exe Token: SeSystemEnvironmentPrivilege 4028 msiexec.exe Token: SeChangeNotifyPrivilege 4028 msiexec.exe Token: SeRemoteShutdownPrivilege 4028 msiexec.exe Token: SeUndockPrivilege 4028 msiexec.exe Token: SeSyncAgentPrivilege 4028 msiexec.exe Token: SeEnableDelegationPrivilege 4028 msiexec.exe Token: SeManageVolumePrivilege 4028 msiexec.exe Token: SeImpersonatePrivilege 4028 msiexec.exe Token: SeCreateGlobalPrivilege 4028 msiexec.exe Token: SeCreateTokenPrivilege 4028 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4028 msiexec.exe Token: SeLockMemoryPrivilege 4028 msiexec.exe Token: SeIncreaseQuotaPrivilege 4028 msiexec.exe Token: SeMachineAccountPrivilege 4028 msiexec.exe Token: SeTcbPrivilege 4028 msiexec.exe Token: SeSecurityPrivilege 4028 msiexec.exe Token: SeTakeOwnershipPrivilege 4028 msiexec.exe Token: SeLoadDriverPrivilege 4028 msiexec.exe Token: SeSystemProfilePrivilege 4028 msiexec.exe Token: SeSystemtimePrivilege 4028 msiexec.exe Token: SeProfSingleProcessPrivilege 4028 msiexec.exe Token: SeIncBasePriorityPrivilege 4028 msiexec.exe Token: SeCreatePagefilePrivilege 4028 msiexec.exe Token: SeCreatePermanentPrivilege 4028 msiexec.exe Token: SeBackupPrivilege 4028 msiexec.exe Token: SeRestorePrivilege 4028 msiexec.exe Token: SeShutdownPrivilege 4028 msiexec.exe Token: SeDebugPrivilege 4028 msiexec.exe Token: SeAuditPrivilege 4028 msiexec.exe Token: SeSystemEnvironmentPrivilege 4028 msiexec.exe Token: SeChangeNotifyPrivilege 4028 msiexec.exe Token: SeRemoteShutdownPrivilege 4028 msiexec.exe Token: SeUndockPrivilege 4028 msiexec.exe Token: SeSyncAgentPrivilege 4028 msiexec.exe Token: SeEnableDelegationPrivilege 4028 msiexec.exe Token: SeManageVolumePrivilege 4028 msiexec.exe Token: SeImpersonatePrivilege 4028 msiexec.exe Token: SeCreateGlobalPrivilege 4028 msiexec.exe Token: SeCreateTokenPrivilege 4028 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4028 msiexec.exe Token: SeLockMemoryPrivilege 4028 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4028 msiexec.exe 4028 msiexec.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2312 wrote to memory of 956 2312 msiexec.exe 84 PID 2312 wrote to memory of 956 2312 msiexec.exe 84 PID 2312 wrote to memory of 956 2312 msiexec.exe 84 PID 2312 wrote to memory of 5024 2312 msiexec.exe 88 PID 2312 wrote to memory of 5024 2312 msiexec.exe 88 PID 2312 wrote to memory of 5052 2312 msiexec.exe 90 PID 2312 wrote to memory of 5052 2312 msiexec.exe 90 PID 2312 wrote to memory of 5052 2312 msiexec.exe 90 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\SuperViewer Installer\Volume\bin\p18\LogosXT64.msi"1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4028
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding FEEED7460EF2C7A9FD47221D7875878D C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:956
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:5024
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 65C1BA8400C239D8672C996018E15E9B2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5052
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:4536
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9KB
MD5acf191a5287e30fe6f308f6b05708ffc
SHA1fbffc5483093d3a429ae7ce2d0fe8420f017f119
SHA256955a2138a490618bffad58be3f097eac23ae7e92dd4ad3a989f51063b466e858
SHA5128bfa1c145c5b51c2b0957aef44586d552e6b144a8f524f66ee06881c059067cc9005ab6105f2d92c101fce95c73d60cfb787e63581483856b263358527438f28
-
Filesize
639KB
MD5c6417930af8969f9f2cb431acd76ec89
SHA1d2f2dc9b44f5f79348f7f36091b26a5465ad4f2b
SHA2561b89704532113150fc7a8a06b5367ee26937c346635a860e93662e1fbb5cd79b
SHA512f30d7a5b51f5d866ccabf3e15a45d3b4013e28a9bdaaf2176e8b121fbd4ab41a8e67c059b2ece8db5bc7a0ce043e76bbc4e3f6400fb9cd2886e1ffcd9e65d79b
-
Filesize
24.6MB
MD5b63bd9a3e269b415af052ddb48a816e5
SHA15062a5d77ccf6453885e5664a24050986e746cde
SHA256966e5f20c581bef3a2d964500e36c29de53bca7cacf791941d97b11b2b1d9503
SHA512732ab31d75abce60b8f4f15e0cf09e7ae3d2e2717f9f95302123a4a2e594c4f2442b766a07bc42475c5074deb3edf4cabcd8e71230563684791e5fe734dd0a61
-
\??\Volume{3463923c-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{bf374b0f-8909-4cf1-a096-864cdc5a513d}_OnDiskSnapshotProp
Filesize6KB
MD5b88aa917827b018551143c206e3d1346
SHA16649d1bf0df7c186d0d52fd94614d700317860ef
SHA2568d1b200b76ad3a5d3e87191673eff62762155705e2903df18959063b40d02278
SHA512afca03616bb581090d6c7925b840ef830245ab3cafcb79b6684070595c548c56acdbd01d1904cf1f62c151dfb3cdbc5d2037f31e630d60cf0e1137824ed58e5a