Analysis
- max time kernel
261s - max time network
266s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20250619-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20250619-enlocale:en-usos:windows10-ltsc_2021-x64system - submitted
04/10/2025, 13:21
Static task
static1
Behavioral task
behavioral1
Sample
Win64 - LetsPro-A.msi
Resource
win10v2004-20250619-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
Win64 - LetsPro-A.msi
Resource
win10ltsc2021-20250619-en
windows10-ltsc_2021-x64
17 signatures
150 seconds
Behavioral task
behavioral3
Sample
Win64 - LetsPro-A.msi
Resource
win11-20250619-en
windows11-21h2-x64
17 signatures
150 seconds
General
- Target Win64 - LetsPro-A.msi
- Size 76.2MB
- Sample251004-qlvncsdm21
- SHA256 b98b662d81cc24ea59611e4f1d8a53445d44123a9cd0571e4615ed7fab99f387
- MD5 5f1ad9a8d80804ebca0fabd3aff355e7
- SHA1 67abb597de5a11ab9e37b71e5aa6e0c8dd71b6c2
- SHA512 985abc18bc81130a86b95c3ffbb885dae9a86c7a58927e5fb1bbf407328e3c4cb16e8ce3c0e3a504cee02b7695a35aad25e5b00bc889375bb97313441064b4ef
- SSDEEP 1572864:UJ1HSHwSm3J1HSHwSmr+VqYRWiEhy+Vj+VFEeSjLEO8ZzZJTJRpHENzb9oQQjk8u:0+NWXy+V+DUEO8ZdJTJRMZ4Khr
- MD5 SHA1 SHA512 SSDEEP
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 3776 TomatoWallPaper.exe 3776 TomatoWallPaper.exe -
resource yara_rule behavioral2/memory/3776-317-0x0000000003950000-0x0000000003989000-memory.dmp upx behavioral2/memory/3776-316-0x0000000003950000-0x0000000003989000-memory.dmp upx behavioral2/memory/3776-325-0x0000000003950000-0x0000000003989000-memory.dmp upx behavioral2/memory/3776-328-0x0000000003950000-0x0000000003989000-memory.dmp upx behavioral2/memory/3776-330-0x0000000003950000-0x0000000003989000-memory.dmp upx behavioral2/memory/3776-342-0x0000000003950000-0x0000000003989000-memory.dmp upx behavioral2/memory/3776-350-0x0000000003950000-0x0000000003989000-memory.dmp upx behavioral2/memory/3776-361-0x0000000003950000-0x0000000003989000-memory.dmp upx behavioral2/memory/3776-360-0x0000000003950000-0x0000000003989000-memory.dmp upx behavioral2/memory/3776-359-0x0000000003950000-0x0000000003989000-memory.dmp upx behavioral2/memory/3776-358-0x0000000003950000-0x0000000003989000-memory.dmp upx behavioral2/memory/3776-357-0x0000000003950000-0x0000000003989000-memory.dmp upx behavioral2/memory/3776-356-0x0000000003950000-0x0000000003989000-memory.dmp upx behavioral2/memory/3776-355-0x0000000003950000-0x0000000003989000-memory.dmp upx behavioral2/memory/3776-354-0x0000000003950000-0x0000000003989000-memory.dmp upx behavioral2/memory/3776-326-0x0000000003950000-0x0000000003989000-memory.dmp upx behavioral2/memory/3776-353-0x0000000003950000-0x0000000003989000-memory.dmp upx behavioral2/memory/3776-352-0x0000000003950000-0x0000000003989000-memory.dmp upx behavioral2/memory/3776-351-0x0000000003950000-0x0000000003989000-memory.dmp upx behavioral2/memory/3776-349-0x0000000003950000-0x0000000003989000-memory.dmp upx behavioral2/memory/3776-348-0x0000000003950000-0x0000000003989000-memory.dmp upx behavioral2/memory/3776-347-0x0000000003950000-0x0000000003989000-memory.dmp upx behavioral2/memory/3776-346-0x0000000003950000-0x0000000003989000-memory.dmp upx behavioral2/memory/3776-345-0x0000000003950000-0x0000000003989000-memory.dmp upx behavioral2/memory/3776-344-0x0000000003950000-0x0000000003989000-memory.dmp upx behavioral2/memory/3776-343-0x0000000003950000-0x0000000003989000-memory.dmp upx behavioral2/memory/3776-341-0x0000000003950000-0x0000000003989000-memory.dmp upx behavioral2/memory/3776-340-0x0000000003950000-0x0000000003989000-memory.dmp upx behavioral2/memory/3776-339-0x0000000003950000-0x0000000003989000-memory.dmp upx behavioral2/memory/3776-338-0x0000000003950000-0x0000000003989000-memory.dmp upx behavioral2/memory/3776-337-0x0000000003950000-0x0000000003989000-memory.dmp upx behavioral2/memory/3776-336-0x0000000003950000-0x0000000003989000-memory.dmp upx behavioral2/memory/3776-335-0x0000000003950000-0x0000000003989000-memory.dmp upx behavioral2/memory/3776-334-0x0000000003950000-0x0000000003989000-memory.dmp upx behavioral2/memory/3776-333-0x0000000003950000-0x0000000003989000-memory.dmp upx behavioral2/memory/3776-332-0x0000000003950000-0x0000000003989000-memory.dmp upx behavioral2/memory/3776-331-0x0000000003950000-0x0000000003989000-memory.dmp upx behavioral2/memory/3776-329-0x0000000003950000-0x0000000003989000-memory.dmp upx behavioral2/memory/3776-327-0x0000000003950000-0x0000000003989000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\locales\tr.pak msiexec.exe File created C:\Program Files (x86)\locales\zh-TW.pak msiexec.exe File created C:\Program Files (x86)\Installer\Win64 - LetsPro Setup\ServiceData\IPv6\PrefixTree.bin msiexec.exe File created C:\Program Files (x86)\locales\ar.pak msiexec.exe File created C:\Program Files (x86)\locales\he.pak msiexec.exe File created C:\Program Files (x86)\Installer\Win64 - LetsPro Setup\en-us\Microsoft.ui.xaml.dll.mui msiexec.exe File created C:\Program Files (x86)\2yuzl0\74e2a8661238e7cb3bf6e70ecad2fc68\Mu\Other msiexec.exe File created C:\Program Files (x86)\locales\de.pak msiexec.exe File created C:\Program Files (x86)\locales\fil.pak msiexec.exe File created C:\Program Files (x86)\locales\kn.pak msiexec.exe File created C:\Program Files (x86)\Installer\Win64 - LetsPro Setup\ServiceData\Logs\service-logs.txt msiexec.exe File created C:\Program Files (x86)\2yuzl0\74e2a8661238e7cb3bf6e70ecad2fc68\Sigma\Social msiexec.exe File created C:\Program Files (x86)\locales\nl.pak msiexec.exe File created C:\Program Files (x86)\locales\sr.pak msiexec.exe File created C:\Program Files (x86)\locales\vi.pak msiexec.exe File created C:\Program Files (x86)\2yuzl0\74e2a8661238e7cb3bf6e70ecad2fc68\Mu\Content msiexec.exe File created C:\Program Files (x86)\2yuzl0\74e2a8661238e7cb3bf6e70ecad2fc68\manifest.json msiexec.exe File created C:\Program Files (x86)\locales\en-GB.pak msiexec.exe File created C:\Program Files (x86)\locales\lt.pak msiexec.exe File created C:\Program Files (x86)\locales\pl.pak msiexec.exe File created C:\Program Files (x86)\locales\ur.pak msiexec.exe File created C:\Program Files (x86)\2yuzl0\74e2a8661238e7cb3bf6e70ecad2fc68\Mu\Fingerprinting msiexec.exe File created C:\Program Files (x86)\2yuzl0\74e2a8661238e7cb3bf6e70ecad2fc68\Sigma\Analytics msiexec.exe File created C:\Program Files (x86)\locales\es.pak msiexec.exe File created C:\Program Files (x86)\locales\pt-BR.pak msiexec.exe File created C:\Program Files (x86)\Installer\Win64 - LetsPro Setup\ca-ES\Microsoft.ui.xaml.dll.mui msiexec.exe File created C:\Program Files (x86)\2yuzl0\74e2a8661238e7cb3bf6e70ecad2fc68\Sigma\Entities msiexec.exe File created C:\Program Files (x86)\locales\am.pak msiexec.exe File created C:\Program Files (x86)\locales\da.pak msiexec.exe File created C:\Program Files (x86)\locales\et.pak msiexec.exe File created C:\Program Files (x86)\locales\mr.pak msiexec.exe File created C:\Program Files (x86)\locales\ms.pak msiexec.exe File created C:\Program Files (x86)\2yuzl0\74e2a8661238e7cb3bf6e70ecad2fc68\Mu\LICENSE msiexec.exe File created C:\Program Files (x86)\2yuzl0\74e2a8661238e7cb3bf6e70ecad2fc68\Mu\Social msiexec.exe File created C:\Program Files (x86)\locales\af.pak msiexec.exe File created C:\Program Files (x86)\locales\nb.pak msiexec.exe File created C:\Program Files (x86)\locales\sw.pak msiexec.exe File created C:\Program Files (x86)\2yuzl0\74e2a8661238e7cb3bf6e70ecad2fc68\Mu\Advertising msiexec.exe File created C:\Program Files (x86)\2yuzl0\74e2a8661238e7cb3bf6e70ecad2fc68\Sigma\Content msiexec.exe File created C:\Program Files (x86)\2yuzl0\74e2a8661238e7cb3bf6e70ecad2fc68\Sigma\Cryptomining msiexec.exe File created C:\Program Files (x86)\2yuzl0\74e2a8661238e7cb3bf6e70ecad2fc68\Sigma\Fingerprinting msiexec.exe File created C:\Program Files (x86)\2yuzl0\74e2a8661238e7cb3bf6e70ecad2fc68\Sigma\Other msiexec.exe File created C:\Program Files (x86)\locales\el.pak msiexec.exe File created C:\Program Files (x86)\locales\fi.pak msiexec.exe File created C:\Program Files (x86)\locales\sk.pak msiexec.exe File created C:\Program Files (x86)\locales\th.pak msiexec.exe File created C:\Program Files (x86)\2yuzl0\74e2a8661238e7cb3bf6e70ecad2fc68\Mu\CompatExceptions msiexec.exe File created C:\Program Files (x86)\2yuzl0\74e2a8661238e7cb3bf6e70ecad2fc68\Mu\Cryptomining msiexec.exe File created C:\Program Files (x86)\2yuzl0\74e2a8661238e7cb3bf6e70ecad2fc68\Sigma\Staging msiexec.exe File created C:\Program Files (x86)\locales\ja.pak msiexec.exe File created C:\Program Files (x86)\locales\sv.pak msiexec.exe File created C:\Program Files (x86)\locales\uk.pak msiexec.exe File created C:\Program Files (x86)\locales\zh-CN.pak msiexec.exe File created C:\Program Files (x86)\2yuzl0\74e2a8661238e7cb3bf6e70ecad2fc68\Sigma\LICENSE msiexec.exe File created C:\Program Files (x86)\locales\gu.pak msiexec.exe File created C:\Program Files (x86)\2yuzl0\74e2a8661238e7cb3bf6e70ecad2fc68\Mu\TransparentAdvertisers msiexec.exe File created C:\Program Files (x86)\locales\hi.pak msiexec.exe File created C:\Program Files (x86)\locales\id.pak msiexec.exe File created C:\Program Files (x86)\locales\pt-PT.pak msiexec.exe File created C:\Program Files (x86)\locales\ta.pak msiexec.exe File created C:\Program Files (x86)\Installer\Win64 - LetsPro Setup\cs-CZ\Microsoft.ui.xaml.dll.mui msiexec.exe File created C:\Program Files (x86)\2yuzl0\74e2a8661238e7cb3bf6e70ecad2fc68\Mu\Analytics msiexec.exe File created C:\Program Files (x86)\locales\fa.pak msiexec.exe File created C:\Program Files (x86)\locales\fr.pak msiexec.exe - Drops file in Windows directory 28 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e592810.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI28CB.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2A26.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{A2D2A46D-CAA9-4F08-BDF1-E075CF247E00} msiexec.exe File opened for modification C:\Windows\Installer\{A2D2A46D-CAA9-4F08-BDF1-E075CF247E00}\HaloTray.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI334A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI338A.tmp msiexec.exe File created C:\Windows\Installer\e592810.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI29D6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2A75.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2D59.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2D69.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2E66.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI33BA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3522.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI29F6.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI2CAA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2D18.tmp msiexec.exe File created C:\Windows\Installer\{A2D2A46D-CAA9-4F08-BDF1-E075CF247E00}\HaloTray.exe msiexec.exe File created C:\Windows\Installer\e592814.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI2C5B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2D38.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2D8A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2DB9.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI31A3.tmp msiexec.exe - Executes dropped EXE 1 IoCs
pid Process 3776 TomatoWallPaper.exe - Loads dropped DLL 38 IoCs
pid Process 404 MsiExec.exe 404 MsiExec.exe 404 MsiExec.exe 404 MsiExec.exe 404 MsiExec.exe 404 MsiExec.exe 404 MsiExec.exe 404 MsiExec.exe 404 MsiExec.exe 404 MsiExec.exe 404 MsiExec.exe 404 MsiExec.exe 404 MsiExec.exe 1416 MsiExec.exe 1416 MsiExec.exe 1416 MsiExec.exe 1416 MsiExec.exe 1416 MsiExec.exe 1416 MsiExec.exe 1416 MsiExec.exe 1416 MsiExec.exe 1416 MsiExec.exe 1416 MsiExec.exe 1416 MsiExec.exe 1416 MsiExec.exe 1416 MsiExec.exe 652 MsiExec.exe 652 MsiExec.exe 652 MsiExec.exe 2864 MsiExec.exe 2864 MsiExec.exe 1416 MsiExec.exe 404 MsiExec.exe 404 MsiExec.exe 404 MsiExec.exe 404 MsiExec.exe 3776 TomatoWallPaper.exe 3776 TomatoWallPaper.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TomatoWallPaper.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000077236c028bf47d2d0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000ffffffff00000000270101000088380177236c020000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d083020000000000c050e1000000ffffffff000000000700010000e8410177236c02000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4e30000000000000005000000ffffffff00000000070001000048ea7177236c0200000000000090d4e300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000077236c0200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe - Modifies registry class 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D64A2D2A9AAC80F4DB1F0E57FC42E700\VisualCRedistrib msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D64A2D2A9AAC80F4DB1F0E57FC42E700\ProductName = "Win64 - LetsPro Setup" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D64A2D2A9AAC80F4DB1F0E57FC42E700\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D64A2D2A9AAC80F4DB1F0E57FC42E700\AuthorizedLUAApp = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D64A2D2A9AAC80F4DB1F0E57FC42E700\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\688650E394DE3C8449F618C20C347D16 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D64A2D2A9AAC80F4DB1F0E57FC42E700\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D64A2D2A9AAC80F4DB1F0E57FC42E700\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D64A2D2A9AAC80F4DB1F0E57FC42E700\MainFeature msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D64A2D2A9AAC80F4DB1F0E57FC42E700\Language = "2052" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D64A2D2A9AAC80F4DB1F0E57FC42E700\Version = "16777216" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D64A2D2A9AAC80F4DB1F0E57FC42E700\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D64A2D2A9AAC80F4DB1F0E57FC42E700\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D64A2D2A9AAC80F4DB1F0E57FC42E700\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D64A2D2A9AAC80F4DB1F0E57FC42E700\PackageCode = "B80906E71F5430B4489E772074045291" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D64A2D2A9AAC80F4DB1F0E57FC42E700\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D64A2D2A9AAC80F4DB1F0E57FC42E700\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D64A2D2A9AAC80F4DB1F0E57FC42E700\SourceList\PackageName = "Win64 - LetsPro-A.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D64A2D2A9AAC80F4DB1F0E57FC42E700\SourceList\Media msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D64A2D2A9AAC80F4DB1F0E57FC42E700\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D64A2D2A9AAC80F4DB1F0E57FC42E700\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D64A2D2A9AAC80F4DB1F0E57FC42E700 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D64A2D2A9AAC80F4DB1F0E57FC42E700 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\688650E394DE3C8449F618C20C347D16\D64A2D2A9AAC80F4DB1F0E57FC42E700 msiexec.exe - Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 404 MsiExec.exe 404 MsiExec.exe 752 msiexec.exe 752 msiexec.exe 1416 MsiExec.exe 1416 MsiExec.exe 3776 TomatoWallPaper.exe 3776 TomatoWallPaper.exe 3776 TomatoWallPaper.exe 3776 TomatoWallPaper.exe 3776 TomatoWallPaper.exe 3776 TomatoWallPaper.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2240 msiexec.exe Token: SeIncreaseQuotaPrivilege 2240 msiexec.exe Token: SeSecurityPrivilege 752 msiexec.exe Token: SeCreateTokenPrivilege 2240 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2240 msiexec.exe Token: SeLockMemoryPrivilege 2240 msiexec.exe Token: SeIncreaseQuotaPrivilege 2240 msiexec.exe Token: SeMachineAccountPrivilege 2240 msiexec.exe Token: SeTcbPrivilege 2240 msiexec.exe Token: SeSecurityPrivilege 2240 msiexec.exe Token: SeTakeOwnershipPrivilege 2240 msiexec.exe Token: SeLoadDriverPrivilege 2240 msiexec.exe Token: SeSystemProfilePrivilege 2240 msiexec.exe Token: SeSystemtimePrivilege 2240 msiexec.exe Token: SeProfSingleProcessPrivilege 2240 msiexec.exe Token: SeIncBasePriorityPrivilege 2240 msiexec.exe Token: SeCreatePagefilePrivilege 2240 msiexec.exe Token: SeCreatePermanentPrivilege 2240 msiexec.exe Token: SeBackupPrivilege 2240 msiexec.exe Token: SeRestorePrivilege 2240 msiexec.exe Token: SeShutdownPrivilege 2240 msiexec.exe Token: SeDebugPrivilege 2240 msiexec.exe Token: SeAuditPrivilege 2240 msiexec.exe Token: SeSystemEnvironmentPrivilege 2240 msiexec.exe Token: SeChangeNotifyPrivilege 2240 msiexec.exe Token: SeRemoteShutdownPrivilege 2240 msiexec.exe Token: SeUndockPrivilege 2240 msiexec.exe Token: SeSyncAgentPrivilege 2240 msiexec.exe Token: SeEnableDelegationPrivilege 2240 msiexec.exe Token: SeManageVolumePrivilege 2240 msiexec.exe Token: SeImpersonatePrivilege 2240 msiexec.exe Token: SeCreateGlobalPrivilege 2240 msiexec.exe Token: SeCreateTokenPrivilege 2240 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2240 msiexec.exe Token: SeLockMemoryPrivilege 2240 msiexec.exe Token: SeIncreaseQuotaPrivilege 2240 msiexec.exe Token: SeMachineAccountPrivilege 2240 msiexec.exe Token: SeTcbPrivilege 2240 msiexec.exe Token: SeSecurityPrivilege 2240 msiexec.exe Token: SeTakeOwnershipPrivilege 2240 msiexec.exe Token: SeLoadDriverPrivilege 2240 msiexec.exe Token: SeSystemProfilePrivilege 2240 msiexec.exe Token: SeSystemtimePrivilege 2240 msiexec.exe Token: SeProfSingleProcessPrivilege 2240 msiexec.exe Token: SeIncBasePriorityPrivilege 2240 msiexec.exe Token: SeCreatePagefilePrivilege 2240 msiexec.exe Token: SeCreatePermanentPrivilege 2240 msiexec.exe Token: SeBackupPrivilege 2240 msiexec.exe Token: SeRestorePrivilege 2240 msiexec.exe Token: SeShutdownPrivilege 2240 msiexec.exe Token: SeDebugPrivilege 2240 msiexec.exe Token: SeAuditPrivilege 2240 msiexec.exe Token: SeSystemEnvironmentPrivilege 2240 msiexec.exe Token: SeChangeNotifyPrivilege 2240 msiexec.exe Token: SeRemoteShutdownPrivilege 2240 msiexec.exe Token: SeUndockPrivilege 2240 msiexec.exe Token: SeSyncAgentPrivilege 2240 msiexec.exe Token: SeEnableDelegationPrivilege 2240 msiexec.exe Token: SeManageVolumePrivilege 2240 msiexec.exe Token: SeImpersonatePrivilege 2240 msiexec.exe Token: SeCreateGlobalPrivilege 2240 msiexec.exe Token: SeCreateTokenPrivilege 2240 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2240 msiexec.exe Token: SeLockMemoryPrivilege 2240 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2240 msiexec.exe 2240 msiexec.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3776 TomatoWallPaper.exe 3776 TomatoWallPaper.exe - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 752 wrote to memory of 404 752 msiexec.exe 83 PID 752 wrote to memory of 404 752 msiexec.exe 83 PID 752 wrote to memory of 404 752 msiexec.exe 83 PID 752 wrote to memory of 5412 752 msiexec.exe 96 PID 752 wrote to memory of 5412 752 msiexec.exe 96 PID 752 wrote to memory of 1416 752 msiexec.exe 98 PID 752 wrote to memory of 1416 752 msiexec.exe 98 PID 752 wrote to memory of 1416 752 msiexec.exe 98 PID 752 wrote to memory of 652 752 msiexec.exe 99 PID 752 wrote to memory of 652 752 msiexec.exe 99 PID 752 wrote to memory of 652 752 msiexec.exe 99 PID 752 wrote to memory of 2864 752 msiexec.exe 100 PID 752 wrote to memory of 2864 752 msiexec.exe 100 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\Win64 - LetsPro-A.msi"1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2240
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C3BFF6B99FE2E25EB92106E651AD28B8 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:404
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:5412
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 181999F9BBF6486359600B2AAFDC233D2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1416
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding AD911D2D9DBCD5555726A3DCBE1D26A2 E Global\MSI00002⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:652
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 6C7631474BC8CB624108323CB320C9082⤵
- Loads dropped DLL
PID:2864
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:3868
-
C:\Users\Admin\AppData\Local\Bin\TomatoWallPaper.exe"C:\Users\Admin\AppData\Local\Bin\TomatoWallPaper.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3776
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e592813.rbs
- Size 463KB
- SHA256 2559bd8f6359eed5ebb99a83aa35fc881f8340e7b63626038d2d7e7906d0b23b
- MD5 35bd1811865610e99d004f3f39bf4876
- SHA1 79650d418d14b0b67f7b44509fe2dd88157d435a
- SHA512 7f8d356c44db71fb4f489c78f318daaf955594d0ba09108329a084a58c0f79d06e2cd76da9baf6a140f5946cf8cc1a1eb78536bdd63825ffb19b26245f99aa6e
- SSDEEP 6144:xofA0RiTxQa/fMIaFKGTprl1ofA0RiTxQa/fMIaFKGTprlA:nCAOKGnjCAOKGnA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\2yuzl0\74e2a8661238e7cb3bf6e70ecad2fc68\VisualElementsManifest.dll
- Size 329KB
- SHA256 00c323e5fcaf6fb244b73a43934a9b5cf19dc85ae826f133e95d5d836b06f923
- MD5 e40dc15dc1add1256b4bfe09f34b3829
- SHA1 8d64ad25bd2b42d930da584c8df51563354af490
- SHA512 2c3a5b86734522289332d1e7d6ef794a4e2841af7feb88ce1b03a3c0e9b184d13b4a3e6191d3d33e459d0fa74a249061b7ca4af20e85a3f700104c61c9d9eac2
- SSDEEP 6144:haaxoBio9/rLpQ3yF4SZ1qc9z2IQiohfGCfc0:mMo9/PpMymSOcPQioJK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Bin\Sysdiag\license.dat
- Size 174B
- SHA256 2b549013a4c6a0bb92287cca40daa6d5e76a4c39b06fa7395ec3471e3b748bce
- MD5 7c831e083a96fd81ce08628e8be4695b
- SHA1 6dd392153b4abbabda206e9f18971689d76cea1d
- SHA512 f976073fd564c80949d9a8f77de1ed0e51fd4b1397569c0ac7c7cceec42190650c315eb93bdeb954612187ff10124e0143f4dab8f44835226d9614c2e68a290d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\HaloTray.exe
- Size 1.6MB
- SHA256 e26eff452d61191588add27666ea8e0377bd0927ac8d327cee16b820633aba81
- MD5 be482d41d38c6a6691010e58fb8e1876
- SHA1 06b0e9638874d716c028d5fc38fa7edf349575e9
- SHA512 99f46c4918effa367ab96497f143661826fb8f7e8ddfc30502cf69e2438ad6146b0d56c74d9d57116c2193c5637f98dbf782ea950bcf19b46d280a15a1c90ba8
- SSDEEP 24576:2/uKt7BP1mHS7wpoIpJbJTlXT5ysLwcJFuUk1DgFLEwTeDqTBaU/:22Kt7bmIn0fTlbUcFkRgFLEw59aq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI7B79.tmp
- Size 1001KB
- SHA256 e831a5aebc7bd941fa815a9441e552a0ba699f9bd5454036a68ccbb42200353a
- MD5 de574f7f5256f98f356a2d620c4a2288
- SHA1 1d57d182bb748170f5cefb7ecf594b4998e113b8
- SHA512 431f3ea61d23028e1c538af3c808e7213d629615e3cb22b41d44715ff805323da82880c35bc90fffe95621132dad96eab5bfcc395863f167664a5666369d0d5b
- SSDEEP 24576:KnknHeDU4dmI6Eepd5TsP1Ih0lhSMXlrcsiG/Ch:6knHeVdOEod5+1d7csiG/Ch
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI7FD5.tmp
- Size 1.1MB
- SHA256 1b21039c84e860b0619a17d9f1508e5e622a1d4834b86e1b8eeffafe5d59f683
- MD5 dd194cab81ba0394a9300fac3290fd22
- SHA1 3ef676605e239b53bec63310e14b7df75e0d42f8
- SHA512 14bc3815b0367830759ca3e48edbe7061423ca72cea5ed0b2070674ee3acd7c17e8f3ce7dc6b9f83b9215507402daa0b162d68afd809b76612009fa73831f8dc
- SSDEEP 24576:GPJ8b0//0fB+NmXDnN1DLrVsKAkm2zan4rx4Ta5QGvHkHNJjAXN5yCkRg51nR73:dR5n1nrVsKAkm2za4rCuQGvHkHNJjAXj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI8004.tmp
- Size 893KB
- SHA256 3b4bac5bbb4bf191691a1b052926418d4bcab5e9aad9d535f4e1e87a19617308
- MD5 1e105e916a38059af2253769bc9be624
- SHA1 521ec39ffafd44ddd5cd793ecc126481f1ee411a
- SHA512 eec650afe3ccb812241716530722129e35917043bca41cbba3b7e17b9f560f346908b9559d4c2f2313032348a5ba1cbf3f1d4dc66553b1da9d956c754322059a
- SSDEEP 24576:0RGpIr2wmiWdSxRa4hMERh0lhSMXlMOZGs+oUw4SaWB:BpndAhMtBGvoUw4SaWB
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Public\Desktop\LetsPro.lnk
- Size 2KB
- SHA256 44be641426ed7c43f58893dd97901e88b74a15a5d76886b74d78165f86b9e045
- MD5 73c3483a491f28e15ca1992d5f67e454
- SHA1 2fb25b887548ba69aaaa0367510e301fdfee930e
- SHA512 ca1ffd002aac29a29597aa3f9251e9605a83015894681f74efd3b49b0015fee1a7e055b3b22cb8a0c8e5df54c73e72579a267fe2af9d7fd3881e287a3ac9fd53
- MD5 SHA1 SHA512
- Path C:\Windows\Installer\MSI2CAA.tmp
- Size 413KB
- SHA256 b67558a2e199fc4e7cb1d7e707c07c50010288a429964b7b7094e3a647bc504e
- MD5 bdcc47609079646aa037c3750135f6df
- SHA1 f3200b2ed07fa764475c7400a673e82218db2ebf
- SHA512 47cbfac808a0ee59c7bd7599ac3771a2c3e2aff5a8e8006b3f0281376d2c94a6906d9e1c70bf7a7b697adab930fd24cd419adbb575b65577c53fd6c2a1c99f60
- SSDEEP 6144:MbchTeNtRYRJeLb7sgvSyb/NcMkFwSEoph0lhSMXlBXBWEi21A/62FpF:MI9qb7DZuMLoph0lhSMXltOxpF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI2E66.tmp
- Size 221KB
- SHA256 d212a9866102e67e6a53fef7ba6f2ee2c4cb51044627d1e94603b97feda95a64
- MD5 0dc7813d04c30181d8e5703993807374
- SHA1 1cb7058f34cdefb562b82ec10607f733804c0aa8
- SHA512 31c8f1bc3b43efa931bad482412d2687f913f22993f55960b007e5ecff4071fcc51d4df8cf6f1f4080e41c35fb52c5161c988982fb97279b2b4d9fea2884f8ef
- SSDEEP 3072:TPcnfo30fcyZXGbA7CLF7E32TdpmL2zwIahlzYIQQ+aUkKGThnKL+pgan:rofA0RiTxQa/fMIaFKGTprln
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI33BA.tmp
- Size 32KB
- SHA256 ef117874193c6a4be3aa673f8a2eced02171eabf69edbfd2bf11b44e2a938e92
- MD5 db2641066ce171cd603266f9f23ed23d
- SHA1 aa44ced2683f8bd9dc12c4dfc4c2a608f2972f5d
- SHA512 4d12d948a1558a5df923b637248cf4c9ea7535a812385c046a0c963751ae0ad1a2d10a7aa6c85be7756fed1b079ec9ef2697f389b5f137423993c1e10ed0ab1a
- SSDEEP 768:Dxkp3SWRKEOZ/JsFox0j1X0j1h+Y7N2Ip4tbxf1mlDU0CmF:1C3poEOSo62L7Q9ffI4M
- MD5 SHA1 SHA512 SSDEEP