Analysis
- max time kernel
266s - max time network
262s - platform
windows10-2004_x64 - resource
win10v2004-20250619-en - resource tags
arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system - submitted
04/10/2025, 13:21
Static task
static1
Behavioral task
behavioral1
Sample
Win64 - LetsPro-A.msi
Resource
win10v2004-20250619-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
Win64 - LetsPro-A.msi
Resource
win10ltsc2021-20250619-en
windows10-ltsc_2021-x64
17 signatures
150 seconds
Behavioral task
behavioral3
Sample
Win64 - LetsPro-A.msi
Resource
win11-20250619-en
windows11-21h2-x64
17 signatures
150 seconds
General
- Target Win64 - LetsPro-A.msi
- Size 76.2MB
- Sample251004-qlvncsdm21
- SHA256 b98b662d81cc24ea59611e4f1d8a53445d44123a9cd0571e4615ed7fab99f387
- MD5 5f1ad9a8d80804ebca0fabd3aff355e7
- SHA1 67abb597de5a11ab9e37b71e5aa6e0c8dd71b6c2
- SHA512 985abc18bc81130a86b95c3ffbb885dae9a86c7a58927e5fb1bbf407328e3c4cb16e8ce3c0e3a504cee02b7695a35aad25e5b00bc889375bb97313441064b4ef
- SSDEEP 1572864:UJ1HSHwSm3J1HSHwSmr+VqYRWiEhy+Vj+VFEeSjLEO8ZzZJTJRpHENzb9oQQjk8u:0+NWXy+V+DUEO8ZdJTJRMZ4Khr
- MD5 SHA1 SHA512 SSDEEP
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: msiexec.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2240 TomatoWallPaper.exe 2240 TomatoWallPaper.exe -
resource yara_rule behavioral1/memory/2240-316-0x0000000002790000-0x00000000027C9000-memory.dmp upx behavioral1/memory/2240-317-0x0000000002790000-0x00000000027C9000-memory.dmp upx behavioral1/memory/2240-329-0x0000000002790000-0x00000000027C9000-memory.dmp upx behavioral1/memory/2240-331-0x0000000002790000-0x00000000027C9000-memory.dmp upx behavioral1/memory/2240-332-0x0000000002790000-0x00000000027C9000-memory.dmp upx behavioral1/memory/2240-344-0x0000000002790000-0x00000000027C9000-memory.dmp upx behavioral1/memory/2240-360-0x0000000002790000-0x00000000027C9000-memory.dmp upx behavioral1/memory/2240-361-0x0000000002790000-0x00000000027C9000-memory.dmp upx behavioral1/memory/2240-359-0x0000000002790000-0x00000000027C9000-memory.dmp upx behavioral1/memory/2240-358-0x0000000002790000-0x00000000027C9000-memory.dmp upx behavioral1/memory/2240-357-0x0000000002790000-0x00000000027C9000-memory.dmp upx behavioral1/memory/2240-356-0x0000000002790000-0x00000000027C9000-memory.dmp upx behavioral1/memory/2240-355-0x0000000002790000-0x00000000027C9000-memory.dmp upx behavioral1/memory/2240-354-0x0000000002790000-0x00000000027C9000-memory.dmp upx behavioral1/memory/2240-353-0x0000000002790000-0x00000000027C9000-memory.dmp upx behavioral1/memory/2240-352-0x0000000002790000-0x00000000027C9000-memory.dmp upx behavioral1/memory/2240-351-0x0000000002790000-0x00000000027C9000-memory.dmp upx behavioral1/memory/2240-350-0x0000000002790000-0x00000000027C9000-memory.dmp upx behavioral1/memory/2240-349-0x0000000002790000-0x00000000027C9000-memory.dmp upx behavioral1/memory/2240-348-0x0000000002790000-0x00000000027C9000-memory.dmp upx behavioral1/memory/2240-347-0x0000000002790000-0x00000000027C9000-memory.dmp upx behavioral1/memory/2240-346-0x0000000002790000-0x00000000027C9000-memory.dmp upx behavioral1/memory/2240-345-0x0000000002790000-0x00000000027C9000-memory.dmp upx behavioral1/memory/2240-343-0x0000000002790000-0x00000000027C9000-memory.dmp upx behavioral1/memory/2240-342-0x0000000002790000-0x00000000027C9000-memory.dmp upx behavioral1/memory/2240-341-0x0000000002790000-0x00000000027C9000-memory.dmp upx behavioral1/memory/2240-340-0x0000000002790000-0x00000000027C9000-memory.dmp upx behavioral1/memory/2240-339-0x0000000002790000-0x00000000027C9000-memory.dmp upx behavioral1/memory/2240-338-0x0000000002790000-0x00000000027C9000-memory.dmp upx behavioral1/memory/2240-337-0x0000000002790000-0x00000000027C9000-memory.dmp upx behavioral1/memory/2240-336-0x0000000002790000-0x00000000027C9000-memory.dmp upx behavioral1/memory/2240-335-0x0000000002790000-0x00000000027C9000-memory.dmp upx behavioral1/memory/2240-334-0x0000000002790000-0x00000000027C9000-memory.dmp upx behavioral1/memory/2240-333-0x0000000002790000-0x00000000027C9000-memory.dmp upx behavioral1/memory/2240-330-0x0000000002790000-0x00000000027C9000-memory.dmp upx behavioral1/memory/2240-328-0x0000000002790000-0x00000000027C9000-memory.dmp upx behavioral1/memory/2240-327-0x0000000002790000-0x00000000027C9000-memory.dmp upx behavioral1/memory/2240-326-0x0000000002790000-0x00000000027C9000-memory.dmp upx behavioral1/memory/2240-325-0x0000000002790000-0x00000000027C9000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\locales\ca.pak msiexec.exe File created C:\Program Files (x86)\locales\en-GB.pak msiexec.exe File created C:\Program Files (x86)\locales\ms.pak msiexec.exe File created C:\Program Files (x86)\Installer\Win64 - LetsPro Setup\cs-CZ\Microsoft.ui.xaml.dll.mui msiexec.exe File created C:\Program Files (x86)\2yuzl0\74e2a8661238e7cb3bf6e70ecad2fc68\Mu\Content msiexec.exe File created C:\Program Files (x86)\2yuzl0\74e2a8661238e7cb3bf6e70ecad2fc68\Sigma\Advertising msiexec.exe File created C:\Program Files (x86)\2yuzl0\74e2a8661238e7cb3bf6e70ecad2fc68\Sigma\Cryptomining msiexec.exe File created C:\Program Files (x86)\locales\hu.pak msiexec.exe File created C:\Program Files (x86)\locales\ko.pak msiexec.exe File created C:\Program Files (x86)\locales\ro.pak msiexec.exe File created C:\Program Files (x86)\locales\uk.pak msiexec.exe File created C:\Program Files (x86)\2yuzl0\74e2a8661238e7cb3bf6e70ecad2fc68\Sigma\LICENSE msiexec.exe File created C:\Program Files (x86)\Installer\Win64 - LetsPro Setup\ca-ES\Microsoft.ui.xaml.dll.mui msiexec.exe File created C:\Program Files (x86)\2yuzl0\74e2a8661238e7cb3bf6e70ecad2fc68\Mu\Entities msiexec.exe File created C:\Program Files (x86)\2yuzl0\74e2a8661238e7cb3bf6e70ecad2fc68\Mu\Other msiexec.exe File created C:\Program Files (x86)\locales\bn.pak msiexec.exe File created C:\Program Files (x86)\locales\en-US.pak msiexec.exe File created C:\Program Files (x86)\locales\te.pak msiexec.exe File created C:\Program Files (x86)\locales\lv.pak msiexec.exe File created C:\Program Files (x86)\Installer\Win64 - LetsPro Setup\en-us\Microsoft.ui.xaml.dll.mui msiexec.exe File created C:\Program Files (x86)\2yuzl0\74e2a8661238e7cb3bf6e70ecad2fc68\Mu\Social msiexec.exe File created C:\Program Files (x86)\2yuzl0\74e2a8661238e7cb3bf6e70ecad2fc68\Sigma\Staging msiexec.exe File created C:\Program Files (x86)\locales\da.pak msiexec.exe File created C:\Program Files (x86)\locales\fil.pak msiexec.exe File created C:\Program Files (x86)\locales\sk.pak msiexec.exe File created C:\Program Files (x86)\Installer\Win64 - LetsPro Setup\ServiceData\Logs\service-logs.txt msiexec.exe File created C:\Program Files (x86)\2yuzl0\74e2a8661238e7cb3bf6e70ecad2fc68\Sigma\Content msiexec.exe File created C:\Program Files (x86)\locales\zh-CN.pak msiexec.exe File created C:\Program Files (x86)\locales\kn.pak msiexec.exe File created C:\Program Files (x86)\locales\sr.pak msiexec.exe File created C:\Program Files (x86)\locales\sv.pak msiexec.exe File created C:\Program Files (x86)\2yuzl0\74e2a8661238e7cb3bf6e70ecad2fc68\Mu\Analytics msiexec.exe File created C:\Program Files (x86)\locales\pt-BR.pak msiexec.exe File created C:\Program Files (x86)\locales\sl.pak msiexec.exe File created C:\Program Files (x86)\locales\tr.pak msiexec.exe File created C:\Program Files (x86)\2yuzl0\74e2a8661238e7cb3bf6e70ecad2fc68\Mu\Advertising msiexec.exe File created C:\Program Files (x86)\2yuzl0\74e2a8661238e7cb3bf6e70ecad2fc68\Mu\LICENSE msiexec.exe File created C:\Program Files (x86)\locales\gu.pak msiexec.exe File created C:\Program Files (x86)\locales\hi.pak msiexec.exe File created C:\Program Files (x86)\locales\ml.pak msiexec.exe File created C:\Program Files (x86)\Installer\Win64 - LetsPro Setup\de-DE\Microsoft.ui.xaml.dll.mui msiexec.exe File created C:\Program Files (x86)\2yuzl0\74e2a8661238e7cb3bf6e70ecad2fc68\Mu\TransparentAdvertisers msiexec.exe File created C:\Program Files (x86)\2yuzl0\74e2a8661238e7cb3bf6e70ecad2fc68\Sigma\Entities msiexec.exe File created C:\Program Files (x86)\2yuzl0\74e2a8661238e7cb3bf6e70ecad2fc68\Sigma\Other msiexec.exe File created C:\Program Files (x86)\locales\es.pak msiexec.exe File created C:\Program Files (x86)\locales\es-419.pak msiexec.exe File created C:\Program Files (x86)\locales\it.pak msiexec.exe File created C:\Program Files (x86)\locales\vi.pak msiexec.exe File created C:\Program Files (x86)\locales\fi.pak msiexec.exe File created C:\Program Files (x86)\locales\he.pak msiexec.exe File created C:\Program Files (x86)\locales\ja.pak msiexec.exe File created C:\Program Files (x86)\locales\pl.pak msiexec.exe File created C:\Program Files (x86)\locales\zh-TW.pak msiexec.exe File created C:\Program Files (x86)\Installer\Win64 - LetsPro Setup\el-GR\Microsoft.ui.xaml.dll.mui msiexec.exe File created C:\Program Files (x86)\2yuzl0\74e2a8661238e7cb3bf6e70ecad2fc68\Mu\Fingerprinting msiexec.exe File created C:\Program Files (x86)\2yuzl0\74e2a8661238e7cb3bf6e70ecad2fc68\VisualElementsManifest.dll msiexec.exe File created C:\Program Files (x86)\locales\ar.pak msiexec.exe File created C:\Program Files (x86)\locales\ru.pak msiexec.exe File created C:\Program Files (x86)\2yuzl0\74e2a8661238e7cb3bf6e70ecad2fc68\Sigma\Analytics msiexec.exe File created C:\Program Files (x86)\2yuzl0\74e2a8661238e7cb3bf6e70ecad2fc68\manifest.json msiexec.exe File created C:\Program Files (x86)\locales\am.pak msiexec.exe File created C:\Program Files (x86)\locales\bg.pak msiexec.exe File created C:\Program Files (x86)\locales\el.pak msiexec.exe File created C:\Program Files (x86)\locales\id.pak msiexec.exe - Drops file in Windows directory 28 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI4241.tmp msiexec.exe File created C:\Windows\Installer\e592d8e.msi msiexec.exe File opened for modification C:\Windows\Installer\e592d8e.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI2E4A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3001.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{A2D2A46D-CAA9-4F08-BDF1-E075CF247E00} msiexec.exe File opened for modification C:\Windows\Installer\MSI32F2.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3875.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI3593.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI373A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3DAA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI403C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2F83.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3041.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI37B8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI37C9.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI38C5.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3971.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3A8C.tmp msiexec.exe File created C:\Windows\Installer\{A2D2A46D-CAA9-4F08-BDF1-E075CF247E00}\HaloTray.exe msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI30EE.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\{A2D2A46D-CAA9-4F08-BDF1-E075CF247E00}\HaloTray.exe msiexec.exe File created C:\Windows\Installer\e592d92.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI3FCD.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI40AA.tmp msiexec.exe - Executes dropped EXE 1 IoCs
pid Process 2240 TomatoWallPaper.exe - Loads dropped DLL 38 IoCs
pid Process 4280 MsiExec.exe 4280 MsiExec.exe 4280 MsiExec.exe 4280 MsiExec.exe 4280 MsiExec.exe 4280 MsiExec.exe 4280 MsiExec.exe 4280 MsiExec.exe 4280 MsiExec.exe 4280 MsiExec.exe 4280 MsiExec.exe 4280 MsiExec.exe 4280 MsiExec.exe 5352 MsiExec.exe 5352 MsiExec.exe 5352 MsiExec.exe 5352 MsiExec.exe 5352 MsiExec.exe 5352 MsiExec.exe 5352 MsiExec.exe 5352 MsiExec.exe 5352 MsiExec.exe 5352 MsiExec.exe 5352 MsiExec.exe 5352 MsiExec.exe 5352 MsiExec.exe 4128 MsiExec.exe 4128 MsiExec.exe 4128 MsiExec.exe 5000 MsiExec.exe 5000 MsiExec.exe 5352 MsiExec.exe 4280 MsiExec.exe 4280 MsiExec.exe 4280 MsiExec.exe 4280 MsiExec.exe 2240 TomatoWallPaper.exe 2240 TomatoWallPaper.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TomatoWallPaper.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000024258b225650624b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000024258b220000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090024258b22000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d24258b22000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000024258b2200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D64A2D2A9AAC80F4DB1F0E57FC42E700\ProductName = "Win64 - LetsPro Setup" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D64A2D2A9AAC80F4DB1F0E57FC42E700\PackageCode = "B80906E71F5430B4489E772074045291" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D64A2D2A9AAC80F4DB1F0E57FC42E700\Version = "16777216" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D64A2D2A9AAC80F4DB1F0E57FC42E700\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D64A2D2A9AAC80F4DB1F0E57FC42E700\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\688650E394DE3C8449F618C20C347D16\D64A2D2A9AAC80F4DB1F0E57FC42E700 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D64A2D2A9AAC80F4DB1F0E57FC42E700\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D64A2D2A9AAC80F4DB1F0E57FC42E700\MainFeature msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D64A2D2A9AAC80F4DB1F0E57FC42E700 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D64A2D2A9AAC80F4DB1F0E57FC42E700\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D64A2D2A9AAC80F4DB1F0E57FC42E700\SourceList\PackageName = "Win64 - LetsPro-A.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D64A2D2A9AAC80F4DB1F0E57FC42E700\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D64A2D2A9AAC80F4DB1F0E57FC42E700\VisualCRedistrib msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D64A2D2A9AAC80F4DB1F0E57FC42E700\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\688650E394DE3C8449F618C20C347D16 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D64A2D2A9AAC80F4DB1F0E57FC42E700\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D64A2D2A9AAC80F4DB1F0E57FC42E700\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D64A2D2A9AAC80F4DB1F0E57FC42E700\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D64A2D2A9AAC80F4DB1F0E57FC42E700\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D64A2D2A9AAC80F4DB1F0E57FC42E700 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D64A2D2A9AAC80F4DB1F0E57FC42E700\Language = "2052" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D64A2D2A9AAC80F4DB1F0E57FC42E700\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D64A2D2A9AAC80F4DB1F0E57FC42E700\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D64A2D2A9AAC80F4DB1F0E57FC42E700\SourceList\Media msiexec.exe - Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 4280 MsiExec.exe 4280 MsiExec.exe 3884 msiexec.exe 3884 msiexec.exe 5352 MsiExec.exe 5352 MsiExec.exe 2240 TomatoWallPaper.exe 2240 TomatoWallPaper.exe 2240 TomatoWallPaper.exe 2240 TomatoWallPaper.exe 2240 TomatoWallPaper.exe 2240 TomatoWallPaper.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5224 msiexec.exe Token: SeIncreaseQuotaPrivilege 5224 msiexec.exe Token: SeSecurityPrivilege 3884 msiexec.exe Token: SeCreateTokenPrivilege 5224 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5224 msiexec.exe Token: SeLockMemoryPrivilege 5224 msiexec.exe Token: SeIncreaseQuotaPrivilege 5224 msiexec.exe Token: SeMachineAccountPrivilege 5224 msiexec.exe Token: SeTcbPrivilege 5224 msiexec.exe Token: SeSecurityPrivilege 5224 msiexec.exe Token: SeTakeOwnershipPrivilege 5224 msiexec.exe Token: SeLoadDriverPrivilege 5224 msiexec.exe Token: SeSystemProfilePrivilege 5224 msiexec.exe Token: SeSystemtimePrivilege 5224 msiexec.exe Token: SeProfSingleProcessPrivilege 5224 msiexec.exe Token: SeIncBasePriorityPrivilege 5224 msiexec.exe Token: SeCreatePagefilePrivilege 5224 msiexec.exe Token: SeCreatePermanentPrivilege 5224 msiexec.exe Token: SeBackupPrivilege 5224 msiexec.exe Token: SeRestorePrivilege 5224 msiexec.exe Token: SeShutdownPrivilege 5224 msiexec.exe Token: SeDebugPrivilege 5224 msiexec.exe Token: SeAuditPrivilege 5224 msiexec.exe Token: SeSystemEnvironmentPrivilege 5224 msiexec.exe Token: SeChangeNotifyPrivilege 5224 msiexec.exe Token: SeRemoteShutdownPrivilege 5224 msiexec.exe Token: SeUndockPrivilege 5224 msiexec.exe Token: SeSyncAgentPrivilege 5224 msiexec.exe Token: SeEnableDelegationPrivilege 5224 msiexec.exe Token: SeManageVolumePrivilege 5224 msiexec.exe Token: SeImpersonatePrivilege 5224 msiexec.exe Token: SeCreateGlobalPrivilege 5224 msiexec.exe Token: SeCreateTokenPrivilege 5224 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5224 msiexec.exe Token: SeLockMemoryPrivilege 5224 msiexec.exe Token: SeIncreaseQuotaPrivilege 5224 msiexec.exe Token: SeMachineAccountPrivilege 5224 msiexec.exe Token: SeTcbPrivilege 5224 msiexec.exe Token: SeSecurityPrivilege 5224 msiexec.exe Token: SeTakeOwnershipPrivilege 5224 msiexec.exe Token: SeLoadDriverPrivilege 5224 msiexec.exe Token: SeSystemProfilePrivilege 5224 msiexec.exe Token: SeSystemtimePrivilege 5224 msiexec.exe Token: SeProfSingleProcessPrivilege 5224 msiexec.exe Token: SeIncBasePriorityPrivilege 5224 msiexec.exe Token: SeCreatePagefilePrivilege 5224 msiexec.exe Token: SeCreatePermanentPrivilege 5224 msiexec.exe Token: SeBackupPrivilege 5224 msiexec.exe Token: SeRestorePrivilege 5224 msiexec.exe Token: SeShutdownPrivilege 5224 msiexec.exe Token: SeDebugPrivilege 5224 msiexec.exe Token: SeAuditPrivilege 5224 msiexec.exe Token: SeSystemEnvironmentPrivilege 5224 msiexec.exe Token: SeChangeNotifyPrivilege 5224 msiexec.exe Token: SeRemoteShutdownPrivilege 5224 msiexec.exe Token: SeUndockPrivilege 5224 msiexec.exe Token: SeSyncAgentPrivilege 5224 msiexec.exe Token: SeEnableDelegationPrivilege 5224 msiexec.exe Token: SeManageVolumePrivilege 5224 msiexec.exe Token: SeImpersonatePrivilege 5224 msiexec.exe Token: SeCreateGlobalPrivilege 5224 msiexec.exe Token: SeCreateTokenPrivilege 5224 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5224 msiexec.exe Token: SeLockMemoryPrivilege 5224 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 5224 msiexec.exe 5224 msiexec.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2240 TomatoWallPaper.exe 2240 TomatoWallPaper.exe - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 3884 wrote to memory of 4280 3884 msiexec.exe 86 PID 3884 wrote to memory of 4280 3884 msiexec.exe 86 PID 3884 wrote to memory of 4280 3884 msiexec.exe 86 PID 3884 wrote to memory of 2792 3884 msiexec.exe 100 PID 3884 wrote to memory of 2792 3884 msiexec.exe 100 PID 3884 wrote to memory of 5352 3884 msiexec.exe 102 PID 3884 wrote to memory of 5352 3884 msiexec.exe 102 PID 3884 wrote to memory of 5352 3884 msiexec.exe 102 PID 3884 wrote to memory of 4128 3884 msiexec.exe 103 PID 3884 wrote to memory of 4128 3884 msiexec.exe 103 PID 3884 wrote to memory of 4128 3884 msiexec.exe 103 PID 3884 wrote to memory of 5000 3884 msiexec.exe 104 PID 3884 wrote to memory of 5000 3884 msiexec.exe 104 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\Win64 - LetsPro-A.msi"1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5224
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding E83FE772E6B8CADFC7181BDBE08FC733 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4280
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:2792
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F86CD085DECCE7BC85D75DF17139D93F2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5352
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1A6E926699B6C47FF3C206C75E204FEB E Global\MSI00002⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4128
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding BC60222CE821490ED097B16BE59B03BE2⤵
- Loads dropped DLL
PID:5000
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:6072
-
C:\Users\Admin\AppData\Local\Bin\TomatoWallPaper.exeC:\Users\Admin\AppData\Local\Bin\TomatoWallPaper.exe1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2240
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e592d91.rbs
- Size 463KB
- SHA256 e04e9eae4ee15c550d412929385dbb77e0172d0dd28ad8bfe598178a6459c5ec
- MD5 91e3675eb3217c075e13b790d323f231
- SHA1 17a3c552a53777fa8f84796a5a0f9b7cab8026bb
- SHA512 df58b6e7d70081ba01b97320271b1f7eccfb2e07c141b3277fd704b2932dc5f66ed3c00d568da7d7828ae61b112e8a476cd6a21799272ca6af6bb3c84d7f2050
- SSDEEP 6144:DofA0RiTxQa/fMIaFKGTprlkofA0RiTxQa/fMIaFKGTprln:lCAOKGnOCAOKGnn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\2yuzl0\74e2a8661238e7cb3bf6e70ecad2fc68\VisualElementsManifest.dll
- Size 329KB
- SHA256 00c323e5fcaf6fb244b73a43934a9b5cf19dc85ae826f133e95d5d836b06f923
- MD5 e40dc15dc1add1256b4bfe09f34b3829
- SHA1 8d64ad25bd2b42d930da584c8df51563354af490
- SHA512 2c3a5b86734522289332d1e7d6ef794a4e2841af7feb88ce1b03a3c0e9b184d13b4a3e6191d3d33e459d0fa74a249061b7ca4af20e85a3f700104c61c9d9eac2
- SSDEEP 6144:haaxoBio9/rLpQ3yF4SZ1qc9z2IQiohfGCfc0:mMo9/PpMymSOcPQioJK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Bin\Sysdiag\license.dat
- Size 174B
- SHA256 2b549013a4c6a0bb92287cca40daa6d5e76a4c39b06fa7395ec3471e3b748bce
- MD5 7c831e083a96fd81ce08628e8be4695b
- SHA1 6dd392153b4abbabda206e9f18971689d76cea1d
- SHA512 f976073fd564c80949d9a8f77de1ed0e51fd4b1397569c0ac7c7cceec42190650c315eb93bdeb954612187ff10124e0143f4dab8f44835226d9614c2e68a290d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\HaloTray.exe
- Size 1.6MB
- SHA256 e26eff452d61191588add27666ea8e0377bd0927ac8d327cee16b820633aba81
- MD5 be482d41d38c6a6691010e58fb8e1876
- SHA1 06b0e9638874d716c028d5fc38fa7edf349575e9
- SHA512 99f46c4918effa367ab96497f143661826fb8f7e8ddfc30502cf69e2438ad6146b0d56c74d9d57116c2193c5637f98dbf782ea950bcf19b46d280a15a1c90ba8
- SSDEEP 24576:2/uKt7BP1mHS7wpoIpJbJTlXT5ysLwcJFuUk1DgFLEwTeDqTBaU/:22Kt7bmIn0fTlbUcFkRgFLEw59aq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI79D3.tmp
- Size 1001KB
- SHA256 e831a5aebc7bd941fa815a9441e552a0ba699f9bd5454036a68ccbb42200353a
- MD5 de574f7f5256f98f356a2d620c4a2288
- SHA1 1d57d182bb748170f5cefb7ecf594b4998e113b8
- SHA512 431f3ea61d23028e1c538af3c808e7213d629615e3cb22b41d44715ff805323da82880c35bc90fffe95621132dad96eab5bfcc395863f167664a5666369d0d5b
- SSDEEP 24576:KnknHeDU4dmI6Eepd5TsP1Ih0lhSMXlrcsiG/Ch:6knHeVdOEod5+1d7csiG/Ch
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI81A9.tmp
- Size 1.1MB
- SHA256 1b21039c84e860b0619a17d9f1508e5e622a1d4834b86e1b8eeffafe5d59f683
- MD5 dd194cab81ba0394a9300fac3290fd22
- SHA1 3ef676605e239b53bec63310e14b7df75e0d42f8
- SHA512 14bc3815b0367830759ca3e48edbe7061423ca72cea5ed0b2070674ee3acd7c17e8f3ce7dc6b9f83b9215507402daa0b162d68afd809b76612009fa73831f8dc
- SSDEEP 24576:GPJ8b0//0fB+NmXDnN1DLrVsKAkm2zan4rx4Ta5QGvHkHNJjAXN5yCkRg51nR73:dR5n1nrVsKAkm2za4rCuQGvHkHNJjAXj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI8295.tmp
- Size 893KB
- SHA256 3b4bac5bbb4bf191691a1b052926418d4bcab5e9aad9d535f4e1e87a19617308
- MD5 1e105e916a38059af2253769bc9be624
- SHA1 521ec39ffafd44ddd5cd793ecc126481f1ee411a
- SHA512 eec650afe3ccb812241716530722129e35917043bca41cbba3b7e17b9f560f346908b9559d4c2f2313032348a5ba1cbf3f1d4dc66553b1da9d956c754322059a
- SSDEEP 24576:0RGpIr2wmiWdSxRa4hMERh0lhSMXlMOZGs+oUw4SaWB:BpndAhMtBGvoUw4SaWB
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Public\Desktop\LetsPro.lnk
- Size 2KB
- SHA256 aa6f19b8630782f8911f2f3e599d6e3418518d4a40eae8e4cd0151c33d8286d9
- MD5 526853ac40fb7d4eb278963b487125fd
- SHA1 2c892c0c7ff7737fd4719d81fa4c38b5afc1f448
- SHA512 a049d2b517cfac08c247ec69e0c14b1e4c6f57dd7277f0ac4ef5fa25370653ba940863bd5eb6c78b006150c266dc115d89edae47cc0fc027047ad74c1055f1ca
- MD5 SHA1 SHA512
- Path C:\Windows\Installer\MSI3593.tmp
- Size 413KB
- SHA256 b67558a2e199fc4e7cb1d7e707c07c50010288a429964b7b7094e3a647bc504e
- MD5 bdcc47609079646aa037c3750135f6df
- SHA1 f3200b2ed07fa764475c7400a673e82218db2ebf
- SHA512 47cbfac808a0ee59c7bd7599ac3771a2c3e2aff5a8e8006b3f0281376d2c94a6906d9e1c70bf7a7b697adab930fd24cd419adbb575b65577c53fd6c2a1c99f60
- SSDEEP 6144:MbchTeNtRYRJeLb7sgvSyb/NcMkFwSEoph0lhSMXlBXBWEi21A/62FpF:MI9qb7DZuMLoph0lhSMXltOxpF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI3A8C.tmp
- Size 221KB
- SHA256 d212a9866102e67e6a53fef7ba6f2ee2c4cb51044627d1e94603b97feda95a64
- MD5 0dc7813d04c30181d8e5703993807374
- SHA1 1cb7058f34cdefb562b82ec10607f733804c0aa8
- SHA512 31c8f1bc3b43efa931bad482412d2687f913f22993f55960b007e5ecff4071fcc51d4df8cf6f1f4080e41c35fb52c5161c988982fb97279b2b4d9fea2884f8ef
- SSDEEP 3072:TPcnfo30fcyZXGbA7CLF7E32TdpmL2zwIahlzYIQQ+aUkKGThnKL+pgan:rofA0RiTxQa/fMIaFKGTprln
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI40AA.tmp
- Size 32KB
- SHA256 ef117874193c6a4be3aa673f8a2eced02171eabf69edbfd2bf11b44e2a938e92
- MD5 db2641066ce171cd603266f9f23ed23d
- SHA1 aa44ced2683f8bd9dc12c4dfc4c2a608f2972f5d
- SHA512 4d12d948a1558a5df923b637248cf4c9ea7535a812385c046a0c963751ae0ad1a2d10a7aa6c85be7756fed1b079ec9ef2697f389b5f137423993c1e10ed0ab1a
- SSDEEP 768:Dxkp3SWRKEOZ/JsFox0j1X0j1h+Y7N2Ip4tbxf1mlDU0CmF:1C3poEOSo62L7Q9ffI4M
- MD5 SHA1 SHA512 SSDEEP