9acec82250082db98a156292e9aebc2ba22ae177f8003fe29d7e59b220e14ebc

Analysis

max time kernel
229s
max time network
216s
platform
windows11-21h2_x64
resource
win11-20250313-en
resource tags

arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system
submitted
28/03/2025, 13:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SuperViewer Installer/Volume/bin/p19/ni_error/ni_error_report.msi
Size

1.1MB
MD5

0cea59575287dc50c9a8272a88b2db2d
SHA1

ca2055220d3ac56d79415b491260d4772655dc62
SHA256

0f4ef1784f9dcf15cda396c698c12d32055f9869d7ab9046d075ebdc9ab46d70
SHA512

466d7a2dd6aeb51a374b0bfd8f0a5d53c0efb1a9175d50bc03720ef21cad156d73a946c2f5b53b51ab9d583c339a5503ff58650c1ef8c4fc93fac64dfb66f14d
SSDEEP

24576:nFRtIJo/3Gf66+TQNxshTK+63S3ZgTqGgeSZUf/:nFRtIf6jC2PJg6Uf

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\National Instruments\Shared\MDF\Manifests\NI Error Reporting 2019 {BDB8510F-A749-420F-83B6-50471C6E900C}.xml	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\WinMIF\ni-error-report-x86_19.0.0.49152-0+f0_windows_all {BDB8510F-A749-420F-83B6-50471C6E900C}.control	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\WinMIF\ni-error-report-x86_19.0.0.49152-0+f0_windows_all {BDB8510F-A749-420F-83B6-50471C6E900C}.instructions	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\NI Error Reporting\niwsrp.dll	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\NI Error Reporting\help\nier.chm	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\NI Error Reporting\help\nierfra.chm	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\NI Error Reporting\nierserver.exe	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\NI Error Reporting\help\nierdeu.chm	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\NI Error Reporting\help\nierjpn.chm	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\NI Error Reporting\help\nierkor.chm	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\_Legal Information\NI Error Reporting 2019 19.00.49152 {BDB8510F-A749-420F-83B6-50471C6E900C}\notice.txt	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\NI Error Reporting\tempNVID.txt	MsiExec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\NI Error Reporting\help\nierchs.chm	msiexec.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e581596.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e581596.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1A41.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD27E0B28DC9070D7.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1604.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI186A.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF45CDEAF0E104F163.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{BDB8510F-A749-420F-83B6-50471C6E900C}	msiexec.exe
File created	C:\Windows\Installer\e581598.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1B617A6E71965BD1.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI180A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI181B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF93AF67F3002D3092.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI170E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI172F.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI18AA.tmp	msiexec.exe

Loads dropped DLL 11 IoCs

pid	Process
4856	MsiExec.exe
4856	MsiExec.exe
4856	MsiExec.exe
4856	MsiExec.exe
1752	MsiExec.exe
1752	MsiExec.exe
1752	MsiExec.exe
1752	MsiExec.exe
1752	MsiExec.exe
1752	MsiExec.exe
1752	MsiExec.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000005dcbaaff1daa426e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800005dcbaaff0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809005dcbaaff000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d5dcbaaff000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000005dcbaaff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 25 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0158BDB947AF024386B0574C1E609C0\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0158BDB947AF024386B0574C1E609C0\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\SuperViewer Installer\\Volume\\bin\\p19\\ni_error\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F0158BDB947AF024386B0574C1E609C0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F0158BDB947AF024386B0574C1E609C0\ni_error.NI.ERROR.REP.2019	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0158BDB947AF024386B0574C1E609C0\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0158BDB947AF024386B0574C1E609C0\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0158BDB947AF024386B0574C1E609C0\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F0158BDB947AF024386B0574C1E609C0\NIMUFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0158BDB947AF024386B0574C1E609C0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0158BDB947AF024386B0574C1E609C0\ProductName = "NI Error Reporting 2019"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0158BDB947AF024386B0574C1E609C0\PackageCode = "76DADA992CBC4DD42838A7C251CBC77E"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0158BDB947AF024386B0574C1E609C0\Language = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0158BDB947AF024386B0574C1E609C0\Version = "318816256"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0158BDB947AF024386B0574C1E609C0\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SuperViewer Installer\\Volume\\bin\\p19\\ni_error\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0158BDB947AF024386B0574C1E609C0\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0158BDB947AF024386B0574C1E609C0\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0158BDB947AF024386B0574C1E609C0\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0158BDB947AF024386B0574C1E609C0\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\6C818E2480B27ED4DB190BDF07C411A9	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0158BDB947AF024386B0574C1E609C0\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0158BDB947AF024386B0574C1E609C0\SourceList\PackageName = "ni_error_report.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0158BDB947AF024386B0574C1E609C0\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0158BDB947AF024386B0574C1E609C0\SourceList\Media\2 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\6C818E2480B27ED4DB190BDF07C411A9\F0158BDB947AF024386B0574C1E609C0	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F0158BDB947AF024386B0574C1E609C0\SourceList\Net	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	6092	msiexec.exe
Token: SeIncreaseQuotaPrivilege	6092	msiexec.exe
Token: SeSecurityPrivilege	5856	msiexec.exe
Token: SeCreateTokenPrivilege	6092	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	6092	msiexec.exe
Token: SeLockMemoryPrivilege	6092	msiexec.exe
Token: SeIncreaseQuotaPrivilege	6092	msiexec.exe
Token: SeMachineAccountPrivilege	6092	msiexec.exe
Token: SeTcbPrivilege	6092	msiexec.exe
Token: SeSecurityPrivilege	6092	msiexec.exe
Token: SeTakeOwnershipPrivilege	6092	msiexec.exe
Token: SeLoadDriverPrivilege	6092	msiexec.exe
Token: SeSystemProfilePrivilege	6092	msiexec.exe
Token: SeSystemtimePrivilege	6092	msiexec.exe
Token: SeProfSingleProcessPrivilege	6092	msiexec.exe
Token: SeIncBasePriorityPrivilege	6092	msiexec.exe
Token: SeCreatePagefilePrivilege	6092	msiexec.exe
Token: SeCreatePermanentPrivilege	6092	msiexec.exe
Token: SeBackupPrivilege	6092	msiexec.exe
Token: SeRestorePrivilege	6092	msiexec.exe
Token: SeShutdownPrivilege	6092	msiexec.exe
Token: SeDebugPrivilege	6092	msiexec.exe
Token: SeAuditPrivilege	6092	msiexec.exe
Token: SeSystemEnvironmentPrivilege	6092	msiexec.exe
Token: SeChangeNotifyPrivilege	6092	msiexec.exe
Token: SeRemoteShutdownPrivilege	6092	msiexec.exe
Token: SeUndockPrivilege	6092	msiexec.exe
Token: SeSyncAgentPrivilege	6092	msiexec.exe
Token: SeEnableDelegationPrivilege	6092	msiexec.exe
Token: SeManageVolumePrivilege	6092	msiexec.exe
Token: SeImpersonatePrivilege	6092	msiexec.exe
Token: SeCreateGlobalPrivilege	6092	msiexec.exe
Token: SeCreateTokenPrivilege	6092	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	6092	msiexec.exe
Token: SeLockMemoryPrivilege	6092	msiexec.exe
Token: SeIncreaseQuotaPrivilege	6092	msiexec.exe
Token: SeMachineAccountPrivilege	6092	msiexec.exe
Token: SeTcbPrivilege	6092	msiexec.exe
Token: SeSecurityPrivilege	6092	msiexec.exe
Token: SeTakeOwnershipPrivilege	6092	msiexec.exe
Token: SeLoadDriverPrivilege	6092	msiexec.exe
Token: SeSystemProfilePrivilege	6092	msiexec.exe
Token: SeSystemtimePrivilege	6092	msiexec.exe
Token: SeProfSingleProcessPrivilege	6092	msiexec.exe
Token: SeIncBasePriorityPrivilege	6092	msiexec.exe
Token: SeCreatePagefilePrivilege	6092	msiexec.exe
Token: SeCreatePermanentPrivilege	6092	msiexec.exe
Token: SeBackupPrivilege	6092	msiexec.exe
Token: SeRestorePrivilege	6092	msiexec.exe
Token: SeShutdownPrivilege	6092	msiexec.exe
Token: SeDebugPrivilege	6092	msiexec.exe
Token: SeAuditPrivilege	6092	msiexec.exe
Token: SeSystemEnvironmentPrivilege	6092	msiexec.exe
Token: SeChangeNotifyPrivilege	6092	msiexec.exe
Token: SeRemoteShutdownPrivilege	6092	msiexec.exe
Token: SeUndockPrivilege	6092	msiexec.exe
Token: SeSyncAgentPrivilege	6092	msiexec.exe
Token: SeEnableDelegationPrivilege	6092	msiexec.exe
Token: SeManageVolumePrivilege	6092	msiexec.exe
Token: SeImpersonatePrivilege	6092	msiexec.exe
Token: SeCreateGlobalPrivilege	6092	msiexec.exe
Token: SeCreateTokenPrivilege	6092	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	6092	msiexec.exe
Token: SeLockMemoryPrivilege	6092	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
6092	msiexec.exe
6092	msiexec.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5856 wrote to memory of 4856	5856	msiexec.exe	85
PID 5856 wrote to memory of 4856	5856	msiexec.exe	85
PID 5856 wrote to memory of 4856	5856	msiexec.exe	85
PID 5856 wrote to memory of 3076	5856	msiexec.exe	89
PID 5856 wrote to memory of 3076	5856	msiexec.exe	89
PID 5856 wrote to memory of 1752	5856	msiexec.exe	91
PID 5856 wrote to memory of 1752	5856	msiexec.exe	91
PID 5856 wrote to memory of 1752	5856	msiexec.exe	91

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\SuperViewer Installer\Volume\bin\p19\ni_error\ni_error_report.msi"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:6092

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5856
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8EB31DBC66B3B38235CA9F4DF3E51945 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4856
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3076
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1D9DFDC0A8F441C28987C814A029C85A
  2⤵
  - Drops file in Program Files directory
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1752

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e581597.rbs

Filesize
15KB

MD5
be195c5f3b7d0e7ced0aac871cfcacff

SHA1
c4228dc000b438ade7e467737575894fafb69dde

SHA256
97e0d559593183509aff9a249708d4272d4c08111028b85caeb8a9187550542f

SHA512
40f186dc7ec50493984aa51cb24c0189e6e194030368c7db0ef6725efbd076e888259866edfccdce65b27566a9fc752f0a453af5e11d999136a0a75f93557252

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI7F32.tmp

Filesize
639KB

MD5
c6417930af8969f9f2cb431acd76ec89

SHA1
d2f2dc9b44f5f79348f7f36091b26a5465ad4f2b

SHA256
1b89704532113150fc7a8a06b5367ee26937c346635a860e93662e1fbb5cd79b

SHA512
f30d7a5b51f5d866ccabf3e15a45d3b4013e28a9bdaaf2176e8b121fbd4ab41a8e67c059b2ece8db5bc7a0ce043e76bbc4e3f6400fb9cd2886e1ffcd9e65d79b

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.6MB

MD5
8911dacee6de6f61a3afd3c513bd5204

SHA1
86a6447719824d6f427194745db0729c0aed6c43

SHA256
ff8355ba6b33fc71e0f5c2c9fd3efe61955065f2058543bca8e4b11f214c9c16

SHA512
f7b6d0995d7c6d48a7cb088c0bf39c04a482d1f3c6769d398cfb01942fdf94bc01124f2fbb43601966cb6430ebd5cc456c3a8e3b2c4ea907d9b6549f912b4892

Download Submit
\??\Volume{ffaacb5d-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{a394f6b1-0144-4558-8ee7-88b844972af7}_OnDiskSnapshotProp

Filesize
6KB

MD5
39e57961fae85f863f386107d7f284c5

SHA1
4b345a447bcc3a9d140468c152239313941c706b

SHA256
f963f988a8e8e6437c781b7e8854ff658e53907cbf12f08e73ab540048c3d143

SHA512
0a31184ebd1bed4ca0a2ac8b75f15bf6c50911754e7e75e243c8f7fd485d756e5f77c3689310d0fc69e41e43c092b2f53ff69140b84643feb4121ebc94c663e8

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads