castlebot | 4cef6738ef175fa988e9867ca19d2a12f1bf55d2cab07246010833fdb0f4d0f0

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20251016-en
resource tags

arch:x64arch:x86image:win10v2004-20251016-enlocale:en-usos:windows10-2004-x64system
submitted
05/11/2025, 09:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4cef6738ef175fa988e9867ca19d2a12f1bf55d2cab07246010833fdb0f4d0f0(3).msi
Size 14.9MB
Sample251105-ls29kavrer
SHA256 4cef6738ef175fa988e9867ca19d2a12f1bf55d2cab07246010833fdb0f4d0f0
MD5 de4bea25ca93e98bfd289250347a18ca
SHA1 aea89f11b7914f44bce9cc35bc33965dd7ec85b6
SHA512 18c8f57359f6258888340c3e9f2c2912f49ca66e31757b69539ca1e57928130eddaa6c6a25044ef883ff528c6a3a678f1b0a4031980ebb27724499d0397bc288
SSDEEP 196608:X+xwjpbi3gdIN4c28yLVw2CgYCqUCAmDS1hcmIEcgZ:X+x484l8cVhCgYHUhmYhcXMZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tag_150 apt discovery castlebot persistence privilege_escalation ransomware themida trojan vmprotect

Malware Config

Signatures

CaslteBOT
CastleBot is modular trojan first observed in early 2025.
trojan castlebot
Castlebot family
castlebot

Detects CastleBOT payload 1 IoCs

trojan apt tag_150

resource	yara_rule
behavioral1/memory/5480-70-0x0000000000BA0000-0x0000000000BE1000-memory.dmp	family_castlebot

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5532	ICACLS.EXE
3976	ICACLS.EXE

Themida packer 4 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x000800000002428e-66.dat	themida
behavioral1/memory/5480-68-0x00000000006F0000-0x0000000000A96000-memory.dmp	themida
behavioral1/memory/5480-69-0x00000000006F0000-0x0000000000A96000-memory.dmp	themida
behavioral1/memory/5480-75-0x00000000006F0000-0x0000000000A96000-memory.dmp	themida

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/files/0x000800000002428e-66.dat	vmprotect
behavioral1/memory/5480-68-0x00000000006F0000-0x0000000000A96000-memory.dmp	vmprotect
behavioral1/memory/5480-69-0x00000000006F0000-0x0000000000A96000-memory.dmp	vmprotect
behavioral1/memory/5480-75-0x00000000006F0000-0x0000000000A96000-memory.dmp	vmprotect

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e57d37e.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	EXPAND.EXE
File opened for modification	C:\Windows\Installer\MSI708A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7146.tmp	msiexec.exe
File created	C:\Windows\Installer\e57d37c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57d37c.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C512005E-A880-4F3C-9E12-FBC862FB1FD3}	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID486.tmp	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	EXPAND.EXE
File opened for modification	C:\Windows\Installer\MSI705A.tmp	msiexec.exe

Executes dropped EXE 1 IoCs

pid	Process
5480	signed.exe

Loads dropped DLL 3 IoCs

pid	Process
4008	MsiExec.exe
4008	MsiExec.exe
4008	MsiExec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4244	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ICACLS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXPAND.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	signed.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ICACLS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ac2e5b4cce4692210000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000ac2e5b4c0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900ac2e5b4c000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dac2e5b4c000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000ac2e5b4c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 22 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E500215C088AC3F4E921BF8C26BFF13D\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\C0201C4C5D9A46C448E44BDA3BA260F2\E500215C088AC3F4E921BF8C26BFF13D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E500215C088AC3F4E921BF8C26BFF13D\SourceList\PackageName = "4cef6738ef175fa988e9867ca19d2a12f1bf55d2cab07246010833fdb0f4d0f0(3).msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E500215C088AC3F4E921BF8C26BFF13D\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E500215C088AC3F4E921BF8C26BFF13D\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E500215C088AC3F4E921BF8C26BFF13D\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E500215C088AC3F4E921BF8C26BFF13D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E500215C088AC3F4E921BF8C26BFF13D\PackageCode = "222EF54FB0D46F34A8D956645D0C79A6"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E500215C088AC3F4E921BF8C26BFF13D\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E500215C088AC3F4E921BF8C26BFF13D\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E500215C088AC3F4E921BF8C26BFF13D\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E500215C088AC3F4E921BF8C26BFF13D\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E500215C088AC3F4E921BF8C26BFF13D\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E500215C088AC3F4E921BF8C26BFF13D\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E500215C088AC3F4E921BF8C26BFF13D\ProductName = "ASUS DialPad Driver - UNREGISTERED - Wrapped using MSI Wrapper from www.exemsi.com"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E500215C088AC3F4E921BF8C26BFF13D\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\C0201C4C5D9A46C448E44BDA3BA260F2	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E500215C088AC3F4E921BF8C26BFF13D\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E500215C088AC3F4E921BF8C26BFF13D\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E500215C088AC3F4E921BF8C26BFF13D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E500215C088AC3F4E921BF8C26BFF13D\ProductFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E500215C088AC3F4E921BF8C26BFF13D\Version = "16777216"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4200	msiexec.exe
4200	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4244	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4244	msiexec.exe
Token: SeSecurityPrivilege	4200	msiexec.exe
Token: SeCreateTokenPrivilege	4244	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4244	msiexec.exe
Token: SeLockMemoryPrivilege	4244	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4244	msiexec.exe
Token: SeMachineAccountPrivilege	4244	msiexec.exe
Token: SeTcbPrivilege	4244	msiexec.exe
Token: SeSecurityPrivilege	4244	msiexec.exe
Token: SeTakeOwnershipPrivilege	4244	msiexec.exe
Token: SeLoadDriverPrivilege	4244	msiexec.exe
Token: SeSystemProfilePrivilege	4244	msiexec.exe
Token: SeSystemtimePrivilege	4244	msiexec.exe
Token: SeProfSingleProcessPrivilege	4244	msiexec.exe
Token: SeIncBasePriorityPrivilege	4244	msiexec.exe
Token: SeCreatePagefilePrivilege	4244	msiexec.exe
Token: SeCreatePermanentPrivilege	4244	msiexec.exe
Token: SeBackupPrivilege	4244	msiexec.exe
Token: SeRestorePrivilege	4244	msiexec.exe
Token: SeShutdownPrivilege	4244	msiexec.exe
Token: SeDebugPrivilege	4244	msiexec.exe
Token: SeAuditPrivilege	4244	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4244	msiexec.exe
Token: SeChangeNotifyPrivilege	4244	msiexec.exe
Token: SeRemoteShutdownPrivilege	4244	msiexec.exe
Token: SeUndockPrivilege	4244	msiexec.exe
Token: SeSyncAgentPrivilege	4244	msiexec.exe
Token: SeEnableDelegationPrivilege	4244	msiexec.exe
Token: SeManageVolumePrivilege	4244	msiexec.exe
Token: SeImpersonatePrivilege	4244	msiexec.exe
Token: SeCreateGlobalPrivilege	4244	msiexec.exe
Token: SeBackupPrivilege	4276	vssvc.exe
Token: SeRestorePrivilege	4276	vssvc.exe
Token: SeAuditPrivilege	4276	vssvc.exe
Token: SeBackupPrivilege	4200	msiexec.exe
Token: SeRestorePrivilege	4200	msiexec.exe
Token: SeRestorePrivilege	4200	msiexec.exe
Token: SeTakeOwnershipPrivilege	4200	msiexec.exe
Token: SeRestorePrivilege	4200	msiexec.exe
Token: SeTakeOwnershipPrivilege	4200	msiexec.exe
Token: SeBackupPrivilege	2488	srtasks.exe
Token: SeRestorePrivilege	2488	srtasks.exe
Token: SeSecurityPrivilege	2488	srtasks.exe
Token: SeTakeOwnershipPrivilege	2488	srtasks.exe
Token: SeBackupPrivilege	2488	srtasks.exe
Token: SeRestorePrivilege	2488	srtasks.exe
Token: SeSecurityPrivilege	2488	srtasks.exe
Token: SeTakeOwnershipPrivilege	2488	srtasks.exe
Token: SeRestorePrivilege	4200	msiexec.exe
Token: SeTakeOwnershipPrivilege	4200	msiexec.exe
Token: SeRestorePrivilege	4200	msiexec.exe
Token: SeTakeOwnershipPrivilege	4200	msiexec.exe
Token: SeRestorePrivilege	4200	msiexec.exe
Token: SeTakeOwnershipPrivilege	4200	msiexec.exe
Token: SeRestorePrivilege	4200	msiexec.exe
Token: SeTakeOwnershipPrivilege	4200	msiexec.exe
Token: SeRestorePrivilege	4200	msiexec.exe
Token: SeTakeOwnershipPrivilege	4200	msiexec.exe
Token: SeRestorePrivilege	4200	msiexec.exe
Token: SeTakeOwnershipPrivilege	4200	msiexec.exe
Token: SeRestorePrivilege	4200	msiexec.exe
Token: SeTakeOwnershipPrivilege	4200	msiexec.exe
Token: SeRestorePrivilege	4200	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4244	msiexec.exe
4244	msiexec.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4200 wrote to memory of 2488	4200	msiexec.exe	99
PID 4200 wrote to memory of 2488	4200	msiexec.exe	99
PID 4200 wrote to memory of 4008	4200	msiexec.exe	101
PID 4200 wrote to memory of 4008	4200	msiexec.exe	101
PID 4200 wrote to memory of 4008	4200	msiexec.exe	101
PID 4008 wrote to memory of 5532	4008	MsiExec.exe	102
PID 4008 wrote to memory of 5532	4008	MsiExec.exe	102
PID 4008 wrote to memory of 5532	4008	MsiExec.exe	102
PID 4008 wrote to memory of 616	4008	MsiExec.exe	104
PID 4008 wrote to memory of 616	4008	MsiExec.exe	104
PID 4008 wrote to memory of 616	4008	MsiExec.exe	104
PID 4008 wrote to memory of 5480	4008	MsiExec.exe	106
PID 4008 wrote to memory of 5480	4008	MsiExec.exe	106
PID 4008 wrote to memory of 5480	4008	MsiExec.exe	106
PID 4008 wrote to memory of 3976	4008	MsiExec.exe	114
PID 4008 wrote to memory of 3976	4008	MsiExec.exe	114
PID 4008 wrote to memory of 3976	4008	MsiExec.exe	114
PID 4008 wrote to memory of 4040	4008	MsiExec.exe	116
PID 4008 wrote to memory of 4040	4008	MsiExec.exe	116
PID 4008 wrote to memory of 4040	4008	MsiExec.exe	116

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\4cef6738ef175fa988e9867ca19d2a12f1bf55d2cab07246010833fdb0f4d0f0(3).msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4244

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2488
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1AB69F55FBA9A4EB6A19C052DEE65F62
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4008
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-669c10f6-28e0-487d-b769-93feaec90922\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:5532
- - C:\Windows\SysWOW64\EXPAND.EXE
    "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:616
- - C:\Users\Admin\AppData\Local\Temp\MW-669c10f6-28e0-487d-b769-93feaec90922\files\signed.exe
    "C:\Users\Admin\AppData\Local\Temp\MW-669c10f6-28e0-487d-b769-93feaec90922\files\signed.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5480
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-669c10f6-28e0-487d-b769-93feaec90922\." /SETINTEGRITYLEVEL (CI)(OI)LOW
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:3976
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\Admin\AppData\Local\Temp\MW-669c10f6-28e0-487d-b769-93feaec90922\files"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4040

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

File and Directory Permissions Modification

T1222

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e57d37d.rbs

Path C:\Config.Msi\e57d37d.rbs
Size 7KB
SHA256 fe0c47ea6870f5820245bd1fbc9c2dbabd8562a14f956e4ec761e66a6dddf656
MD5 9c0d997eb8db776106127ae2236c4467
SHA1 9817d3c2ff68bd101d027d5978ae88497bc82a1e
SHA512 ea5c839c338c0c05adc1d70b7015de5ccfe3f424093f11b935c2af9ba4c7000d9536f3870c25b465f9b39890655cacdd4341336b8daa59ab9bebce3e304a8cce
SSDEEP 96:pOuAEguA2wVeeuWUaUf3TCsThqfUf3TC6ju1nWuA5Thq5HbuAl55cZWv3vOvrwug:pOuCuCeeWtfOIFfOWumius+0uxMp5
MD5 SHA1 SHA512 SSDEEP

Submit Download

files.cab

Path C:\Users\Admin\AppData\Local\Temp\MW-669c10f6-28e0-487d-b769-93feaec90922\files.cab
Size 14.6MB
SHA256 dd14dcbd48b63fba08e531f58bbb2c5db71cf5f545652bbcdb48aaaab8f72215
MD5 541b727fbad9ff9e4fd99d52ad491fef
SHA1 4761deb5a4666f894d33ec6cd2d9150b3ad7ff17
SHA512 2a608e900877013876e7e03f3df58c043828bfa9bb250eefd197b457cbc5e76c5e081bb59644ba9b39489353239dad30418d7cca60b0ab506a2acadf8697f772
SSDEEP 196608:s+xwjpbi3gdIN4c28yLVw2CgYCqUCAmDS1hcmIEcgZd:s+x484l8cVhCgYHUhmYhcXMZd
MD5 SHA1 SHA512 SSDEEP

Submit Download

signed.exe

Path C:\Users\Admin\AppData\Local\Temp\MW-669c10f6-28e0-487d-b769-93feaec90922\files\signed.exe
Size 14.6MB
SHA256 5b2adba1eeb0f5e756cfc94641ab4ad2bc9c8ec61c11938537b69c31cc992540
MD5 3c267a7fb03d334d5d00679fbc5a0bff
SHA1 40d3aadc398b991b875d5f74fd00db369187c5ad
SHA512 fa8bcb0438f8dfa56159b492e52e6b9d33d1d91a70be62233a46e17f441961214ea11d7e1bbd927fc7a0decae6f6cb6b11d7cf625ee04949961def3ef3b5378e
SSDEEP 196608:XosodFvI8od3rHsjnZSUB4RNzB4xfZyeyB2S1vsYLTA:XosW4HQnQUGRNzWxRyJ2Sl/TA
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiwrapper.ini

Path C:\Users\Admin\AppData\Local\Temp\MW-669c10f6-28e0-487d-b769-93feaec90922\msiwrapper.ini
Size 1004B
SHA256 d2a691a17ea2166b378b4d5085d17d804407b41f789c99ef34d0d1e6736b93d4
MD5 b1d1fac5f4dc88f3121c2aab96c36dcc
SHA1 71e1ed6ceccf41818e91bfd83ae75e185175a269
SHA512 e9860222090dd7d2048a702afaba5d8aeb0743c2a12ab5382ebe7e4c25defdf0d507534b4f3cc452e2f5e4dd2a20c47abcc7276e2e0a1b9958a67c01df97903e
MD5 SHA1 SHA512

Submit Download

msiwrapper.ini

Path C:\Users\Admin\AppData\Local\Temp\MW-669c10f6-28e0-487d-b769-93feaec90922\msiwrapper.ini
Size 1KB
SHA256 b4619166115ab5f75f77c165e8bfb154a5319537fa00434bc35420f158c55462
MD5 a87b85ed5ed72a8f2ea94e6cd0cc76ef
SHA1 5d82f07f0d67275086a4e19d85fa122d8596deac
SHA512 8124b18a25bfe90f520d3112a49d4a93cb75ca5e47293967aa79a04a3590b54eda40c7a86bfd444216f753cb4bb4277dcfc47d790d1b205bedf4bd0d9ea462b3
MD5 SHA1 SHA512

Submit Download

msiwrapper.ini

Path C:\Users\Admin\AppData\Local\Temp\MW-669c10f6-28e0-487d-b769-93feaec90922\msiwrapper.ini
Size 1KB
SHA256 1d86ff3a42df48296b5e6f886bad95c96900d62f54fd4d1cff961f0e122eb67b
MD5 50bd45155d9172ed49c4e911083043db
SHA1 af237714556b45b718721e305094f5087928e794
SHA512 6bac4821a2012a12b5edb64e9254fc5a3a1c26cf562a96b1fb2db21902cf4d22788d70f88831746f7293fab9d5152651399383f314b049709e38c81ae2ef05ce
MD5 SHA1 SHA512

Submit Download

MSID486.tmp

Path C:\Windows\Installer\MSID486.tmp
Size 208KB
SHA256 fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1
MD5 0c8921bbcc37c6efd34faf44cf3b0cb5
SHA1 dcfa71246157edcd09eecaf9d4c5e360b24b3e49
SHA512 ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108
SSDEEP 3072:xspAtOdmXwCGjtYNKbYO2gjpcm8rRuqpjCL42loHUvU0yGxr5GqM2a8:jtOdiRQYpgjpjew5DHyGxcqo8
MD5 SHA1 SHA512 SSDEEP

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 56d4de727c870faf13182de9892e645bf3952237fb19cd4a00ff846bc2e122ac
MD5 799d5a5c2ca34a9fd4d274b44ce3a239
SHA1 1ea3a90939b1d63b26104595ecb2503528904b60
SHA512 fc18b1cdb8a8eb2f1e1f7bd01e3aaf39aa0b11ebffcdef60e892c804e8202a7ebdd284c3c0155dab11878cf1f18c7ba7ad973230e0a74e63ccf43609795c6047
SSDEEP 24576:EZxm+1I9doO/vvTLv2w+VWqkhpf04FQycGmNSvx1oUqRe3554PFjojbh11:7D
MD5 SHA1 SHA512 SSDEEP

Submit Download

{3245a48d-581f-44ec-a670-8f1dd9b44a86}_OnDiskSnapshotProp

Path \??\Volume{4c5b2eac-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{3245a48d-581f-44ec-a670-8f1dd9b44a86}_OnDiskSnapshotProp
Size 6KB
SHA256 fc79f44294942de794630532ad6a33813455e960daf9feb4cc50f678c449d32f
MD5 1b7f065edc5b8706237c5383aee8f2a4
SHA1 13c7aeb6e99a7998f51765c9b71d3a734c027b93
SHA512 4a1f1fd6ad4ed8b1415172073f7c98602e38328a0136ac2e9b456e1dfbd95013fb8a85bd9bd413dd95c0667b601ec3652f418021110ff4327e9e8820bd007d4a
SSDEEP 96:F5KKCMFDD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:fz1b++ZVm
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/5480-68-0x00000000006F0000-0x0000000000A96000-memory.dmp

Download

memory/5480-69-0x00000000006F0000-0x0000000000A96000-memory.dmp

Download

memory/5480-70-0x0000000000BA0000-0x0000000000BE1000-memory.dmp

Download

memory/5480-75-0x00000000006F0000-0x0000000000A96000-memory.dmp

Download