fatalrat | 7637a316f0b40eedb840ad41a3e56db7b9432b54c03508774d99747ec44a85f1

Analysis

max time kernel
149s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20251015-en
resource tags

arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
submitted
07/12/2025, 04:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
xtswpssxti2.65.msi
Size 66.3MB
Sample251207-entcjady7f
SHA256 7637a316f0b40eedb840ad41a3e56db7b9432b54c03508774d99747ec44a85f1
MD5 7eaef33038b93b97eefe0b83d48fb839
SHA1 3194b5de4907fad3de70612b12b5fe6031c11ed8
SHA512 c2be54b55a1eeeb9ac71d401e10a883239233d3501961535ea9ef5fbe33e22e7d13490c8570d44239dae899551687b41fd893af0bd4c2e47a4aac7782a0d64b2
SSDEEP 1572864:TbLMPeOHt2IlpfU7VFlggSwAy8ZoQ4waKwGGB8iAP:/LMPT/kVF2wA3h4cJGBJK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

bootkit defense_evasion discovery fatalrat infostealer persistence privilege_escalation ransomware rat stealer trojan upx vmprotect

Malware Config

Extracted

Family

fatalrat

a23.nbdsnb2.top

Signatures

Fatal Rat payload 1 IoCs

rat infostealer

resource	yara_rule
behavioral2/memory/5908-137-0x0000000010000000-0x000000001002D000-memory.dmp	fatalrat

FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
stealer trojan fatalrat
Fatalrat family
fatalrat

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2060	netsh.exe

Executes dropped EXE 12 IoCs

pid	Process
3580	MSIA3E9.tmp
4652	TjNKNK.exe
420	TjNKNK.exe
6032	TjNKNK.exe
1756	TjNKNK.exe
5420	TjNKNP.exe
240	TjNKNP.exe
5560	TjNKNP.exe
3740	TjNKNP.exe
5968	setup.exe
5908	svchost.exe
1184	setup.exe

Loads dropped DLL 7 IoCs

pid	Process
5088	MsiExec.exe
5088	MsiExec.exe
5088	MsiExec.exe
5088	MsiExec.exe
5088	MsiExec.exe
5088	MsiExec.exe
5088	MsiExec.exe

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/files/0x001900000002b07b-127.dat	vmprotect
behavioral2/memory/5968-131-0x0000000000400000-0x00000000007B9000-memory.dmp	vmprotect

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	setup.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\TjNKNK.exe.log	TjNKNK.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\TjNKNP.exe.log	TjNKNP.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x001900000002b081-145.dat	upx
behavioral2/memory/1184-147-0x0000000000250000-0x00000000007F3000-memory.dmp	upx
behavioral2/memory/1184-152-0x0000000000250000-0x00000000007F3000-memory.dmp	upx
behavioral2/memory/1184-153-0x0000000000250000-0x00000000007F3000-memory.dmp	upx
behavioral2/memory/1184-159-0x0000000000250000-0x00000000007F3000-memory.dmp	upx

Drops file in Windows directory 34 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIA156.tmp	msiexec.exe
File created	C:\Windows\Pack\aa.exe	msiexec.exe
File created	C:\Windows\Pack\ddd	msiexec.exe
File opened for modification	C:\Windows\Pack\TjNKNK.wrapper.log	TjNKNK.exe
File opened for modification	C:\Windows\Pack\TjNKNP.wrapper.log	TjNKNP.exe
File created	C:\Windows\Installer\e579eb1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e579eb1.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Pack\setup.exe	msiexec.exe
File opened for modification	C:\Windows\Pack\TjNKNP.wrapper.log	TjNKNP.exe
File opened for modification	C:\Windows\Pack\TjNKNP.wrapper.log	TjNKNP.exe
File created	C:\Windows\SystemTemp\~DF9D5D3EC7C357FE77.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9F3D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA157.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF44399C2010EC826A.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC6C813670CB9C59E.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA39A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA3E9.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF308E6EC44F9C804.TMP	msiexec.exe
File created	C:\Windows\Pack\TjNKNP.xml	msiexec.exe
File opened for modification	C:\Windows\Pack\TjNKNP.wrapper.log	TjNKNP.exe
File opened for modification	C:\Windows\Installer\MSIA125.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA135.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Pack\TjNKNP.exe	msiexec.exe
File opened for modification	C:\Windows\Pack\TjNKNK.wrapper.log	TjNKNK.exe
File opened for modification	C:\Windows\Pack\TjNKNK.wrapper.log	TjNKNK.exe
File opened for modification	C:\Windows\Pack\TjNKNK.wrapper.log	TjNKNK.exe
File created	C:\Windows\Installer\SourceHash{DBB56E52-B2C8-4BD0-96DC-EE1D75DE3BAC}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA077.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA114.tmp	msiexec.exe
File created	C:\Windows\Pack\TjNKNK.exe	msiexec.exe
File created	C:\Windows\Pack\TjNKNK.xml	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
1552	msiexec.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIA3E9.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000fa5c1b2a8018d2430000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000fa5c1b2a0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900fa5c1b2a000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dfa5c1b2a000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000fa5c1b2a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Services\	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Services\InstallTime = "2025-12-07 05:06"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7"	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Services\	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Services	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Services\Group = "Fatal"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5612	msiexec.exe
5612	msiexec.exe
3580	MSIA3E9.tmp
3580	MSIA3E9.tmp
1756	TjNKNK.exe
3740	TjNKNP.exe
5968	setup.exe
5968	setup.exe
5908	svchost.exe
5908	svchost.exe
5908	svchost.exe
5908	svchost.exe
5908	svchost.exe
5908	svchost.exe
5908	svchost.exe
5908	svchost.exe
5908	svchost.exe
5908	svchost.exe
5908	svchost.exe
5908	svchost.exe
5908	svchost.exe
5908	svchost.exe
5908	svchost.exe
5908	svchost.exe
5908	svchost.exe
5908	svchost.exe
5908	svchost.exe
5908	svchost.exe
5908	svchost.exe
5908	svchost.exe
5908	svchost.exe
5908	svchost.exe
5908	svchost.exe
5908	svchost.exe
5908	svchost.exe
5908	svchost.exe
5908	svchost.exe
5908	svchost.exe
5908	svchost.exe
5908	svchost.exe
5908	svchost.exe
5908	svchost.exe
5908	svchost.exe
5908	svchost.exe
5908	svchost.exe
5908	svchost.exe
5908	svchost.exe
5908	svchost.exe
5908	svchost.exe
5908	svchost.exe
5908	svchost.exe
5908	svchost.exe
5908	svchost.exe
5908	svchost.exe
5908	svchost.exe
5908	svchost.exe
5908	svchost.exe
5908	svchost.exe
5908	svchost.exe
5908	svchost.exe
5908	svchost.exe
5908	svchost.exe
5908	svchost.exe
5908	svchost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1552	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1552	msiexec.exe
Token: SeSecurityPrivilege	5612	msiexec.exe
Token: SeCreateTokenPrivilege	1552	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1552	msiexec.exe
Token: SeLockMemoryPrivilege	1552	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1552	msiexec.exe
Token: SeMachineAccountPrivilege	1552	msiexec.exe
Token: SeTcbPrivilege	1552	msiexec.exe
Token: SeSecurityPrivilege	1552	msiexec.exe
Token: SeTakeOwnershipPrivilege	1552	msiexec.exe
Token: SeLoadDriverPrivilege	1552	msiexec.exe
Token: SeSystemProfilePrivilege	1552	msiexec.exe
Token: SeSystemtimePrivilege	1552	msiexec.exe
Token: SeProfSingleProcessPrivilege	1552	msiexec.exe
Token: SeIncBasePriorityPrivilege	1552	msiexec.exe
Token: SeCreatePagefilePrivilege	1552	msiexec.exe
Token: SeCreatePermanentPrivilege	1552	msiexec.exe
Token: SeBackupPrivilege	1552	msiexec.exe
Token: SeRestorePrivilege	1552	msiexec.exe
Token: SeShutdownPrivilege	1552	msiexec.exe
Token: SeDebugPrivilege	1552	msiexec.exe
Token: SeAuditPrivilege	1552	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1552	msiexec.exe
Token: SeChangeNotifyPrivilege	1552	msiexec.exe
Token: SeRemoteShutdownPrivilege	1552	msiexec.exe
Token: SeUndockPrivilege	1552	msiexec.exe
Token: SeSyncAgentPrivilege	1552	msiexec.exe
Token: SeEnableDelegationPrivilege	1552	msiexec.exe
Token: SeManageVolumePrivilege	1552	msiexec.exe
Token: SeImpersonatePrivilege	1552	msiexec.exe
Token: SeCreateGlobalPrivilege	1552	msiexec.exe
Token: SeBackupPrivilege	1164	vssvc.exe
Token: SeRestorePrivilege	1164	vssvc.exe
Token: SeAuditPrivilege	1164	vssvc.exe
Token: SeBackupPrivilege	5612	msiexec.exe
Token: SeRestorePrivilege	5612	msiexec.exe
Token: SeRestorePrivilege	5612	msiexec.exe
Token: SeTakeOwnershipPrivilege	5612	msiexec.exe
Token: SeRestorePrivilege	5612	msiexec.exe
Token: SeTakeOwnershipPrivilege	5612	msiexec.exe
Token: SeRestorePrivilege	5612	msiexec.exe
Token: SeTakeOwnershipPrivilege	5612	msiexec.exe
Token: SeRestorePrivilege	5612	msiexec.exe
Token: SeTakeOwnershipPrivilege	5612	msiexec.exe
Token: SeRestorePrivilege	5612	msiexec.exe
Token: SeTakeOwnershipPrivilege	5612	msiexec.exe
Token: SeRestorePrivilege	5612	msiexec.exe
Token: SeTakeOwnershipPrivilege	5612	msiexec.exe
Token: SeRestorePrivilege	5612	msiexec.exe
Token: SeTakeOwnershipPrivilege	5612	msiexec.exe
Token: SeRestorePrivilege	5612	msiexec.exe
Token: SeTakeOwnershipPrivilege	5612	msiexec.exe
Token: SeRestorePrivilege	5612	msiexec.exe
Token: SeTakeOwnershipPrivilege	5612	msiexec.exe
Token: SeRestorePrivilege	5612	msiexec.exe
Token: SeTakeOwnershipPrivilege	5612	msiexec.exe
Token: SeRestorePrivilege	5612	msiexec.exe
Token: SeTakeOwnershipPrivilege	5612	msiexec.exe
Token: SeRestorePrivilege	5612	msiexec.exe
Token: SeTakeOwnershipPrivilege	5612	msiexec.exe
Token: SeDebugPrivilege	4652	TjNKNK.exe
Token: SeDebugPrivilege	420	TjNKNK.exe
Token: SeDebugPrivilege	6032	TjNKNK.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1552	msiexec.exe
1552	msiexec.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5968	setup.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5612 wrote to memory of 4876	5612	msiexec.exe	82
PID 5612 wrote to memory of 5088	5612	msiexec.exe	84
PID 5612 wrote to memory of 3580	5612	msiexec.exe	85
PID 1756 wrote to memory of 2060	1756	TjNKNK.exe	93
PID 3740 wrote to memory of 5968	3740	TjNKNP.exe	102
PID 5968 wrote to memory of 5908	5968	setup.exe	103

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\xtswpssxti2.65.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1552

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5612
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4876
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 15A4483B0CC7980BD5E0BF9A7CCE3351
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5088
- C:\Windows\Installer\MSIA3E9.tmp
  "C:\Windows\Installer\MSIA3E9.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3580

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1164

C:\Windows\Pack\TjNKNK.exe
"C:\Windows\Pack\TjNKNK.exe" install
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4652

C:\Windows\Pack\TjNKNK.exe
"C:\Windows\Pack\TjNKNK.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:420

C:\Windows\Pack\TjNKNK.exe
"C:\Windows\Pack\TjNKNK.exe" start
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:6032

C:\Windows\Pack\TjNKNK.exe
"C:\Windows\Pack\TjNKNK.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2060

C:\Windows\Pack\TjNKNP.exe
"C:\Windows\Pack\TjNKNP.exe" install
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5420

C:\Windows\Pack\TjNKNP.exe
"C:\Windows\Pack\TjNKNP.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:240

C:\Windows\Pack\TjNKNP.exe
"C:\Windows\Pack\TjNKNP.exe" start
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5560

C:\Windows\Pack\TjNKNP.exe
"C:\Windows\Pack\TjNKNP.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3740
- C:\Windows\Pack\setup.exe
  "C:\Windows\Pack\setup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5968
- - C:\ProgramData\NVIDIARV\svchost.exe
    "C:\ProgramData\NVIDIARV\svchost.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:5908

C:\ProgramData\backup\setup.exe
"C:\ProgramData\backup\setup.exe"
1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
PID:1184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Installer Packages

T1546.016

Netsh Helper DLL

T1546.007

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Installer Packages

T1546.016

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Pre-OS Boot

T1542

Bootkit

T1542.003

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e579eb4.rbs

Path C:\Config.Msi\e579eb4.rbs
Size 2KB
SHA256 ec9e2e66a7640f491e96aa3744d5fb145e3f47579390c69dc6c02fd22ad53a16
MD5 7e983abb31c19193f46ce49fef190796
SHA1 f5e987d730115c9d68f3de0c85271d01fbc98324
SHA512 64acdab000991faa26183e96864438fd85086141437ebe00803869be78ea1d0c68990d18e26f93fd77ab6d54eae083fb0fc9659341414c845a62f26eba12d5d6
MD5 SHA1 SHA512

Submit Download

svchost.exe

Path C:\ProgramData\NVIDIARV\svchost.exe
Size 3.4MB
SHA256 a7bcaf31d891b60a53ca6286d5939cbd041758c760502fb73618edd382cd34ed
MD5 313cbbcddef0dad771d5beb2035cc938
SHA1 c1bca4c2c8a1b6147d0540a96fed94ccbfd636e0
SHA512 3e0bd95a5e78305208ea4f3e4cc190380abbf07de4c52f34452424c0ce0de053541359d477dc5a0fb816c1b095e18956fba910ab8b49be17344c25b3b65ee392
SSDEEP 98304:a9GMP8yogy7Ka3CAXJZwODBLd1KrztRFHX:MP8xvX3CALfU
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\ProgramData\backup\setup.exe
Size 2.9MB
SHA256 c6ac7d9add40b913112b265d4f366d9ef80bbd711049db085fc750fcad4e14d8
MD5 b52ba2b99108c496389ae5bb81fa6537
SHA1 9073d8c4a1968be24357862015519f2afecd833a
SHA512 6637506ee80d359e729e0011b97e8d827e14356393193247f502b7fcfbbca249dc045b8acfe4b31ce462468f421dc5d9a4e31183bedb66c45a9aa43c01f81397
SSDEEP 49152:sejRVM654Suz/Debm7vpElDBc4uN+C+LHseGi1pm2PfLwUA0EUEiXDSWqf16yag5:sejRVMDhe6yH1ugfHseGKtPDw50E1iTe
MD5 SHA1 SHA512 SSDEEP

Submit Download

TjNKNK.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\TjNKNK.exe.log
Size 1KB
SHA256 c7fe4d0b82bec7d44e817c76123b381269d494e2ff4a7f539ad53eb3ef5c4371
MD5 8005734c5c8a27f0225756ad8ab852df
SHA1 5a611231e25aa2a4dec287c01750da7fa743e981
SHA512 d2c653d0c22503817c9176f93c5e330c9c0d4a244d2e254f9bc895955ef8630e5fd83b5c22459dee5f18a3e1e016a638918087106e54b2fd169b435030d7c60b
MD5 SHA1 SHA512

Submit Download

MSI9F3D.tmp

Path C:\Windows\Installer\MSI9F3D.tmp
Size 587KB
SHA256 e140990b509dd6884a5742bde64f2cdaa10012d472b0b32de43ebecbc83242b6
MD5 c7fbd5ee98e32a77edf1156db3fca622
SHA1 3e534fc55882e9fb940c9ae81e6f8a92a07125a0
SHA512 8691ac8b214cc1e4f34a3ab2bbc0c2391f7f11ebbe5db0dc82825195b5fe5a05310ed1e14d253a9b74a64050d2f2a6623dd2fcd912f80fef51e51845ef1e3a1a
SSDEEP 6144:LSf3W3yLp5AT43trDB8ioyF29qG/NZHLM53PPAOliBU55vjwfM2s3FJT1:LSuyb+4xB49qGl0X2G5pjwfM2s3Fj
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSIA135.tmp

Path C:\Windows\Installer\MSIA135.tmp
Size 1.1MB
SHA256 83fbfcaff3da3eb89f9aec29e6574cf15502fd670cbb2ab0c8a84451b2598b22
MD5 ae463676775a1dd0b7a28ddb265b4065
SHA1 dff64c17885c7628b22631a2cdc9da83e417d348
SHA512 e47c2db249e7a08c5d2864671fbc235e48aebecbe0b2c2334d1a4cba1b5b3037522ff89408589f3559b3a1eaf507bd338645387d55800029bb3b941d4c7744d6
SSDEEP 24576:wBbmgYewSBprKpygTqkg0z/f2sbQEiwiUt5uAD5YqQc3w0RZqTkqMUM0zVQZn:wBflKp/Dz/f2sbQEidUt5uA5hz3w0RZH
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSIA3E9.tmp

Path C:\Windows\Installer\MSIA3E9.tmp
Size 2.2MB
SHA256 89b993b2dc17e2ea54c4214862b5fc479af0d2b61aed38aeac7209ce950d5d4d
MD5 448ec29721187f03eb02fbef8772e7fe
SHA1 223edb0ac10a393c2c638d324d778c634e7687b9
SHA512 3bde29dd1f4ad1202695d8754966871ee3ad5050793405d359c5f7750d99f8c1dcef76ab9d2aabe65e7bd81ca280cec5b6e94d2f7e05aa3dbb7f8e576e2cc046
SSDEEP 49152:+k8l17Hy2f0HpoyPcuO4/KQ5VXB8HDQbiIYYcn:C3bI2yUuJdRyjSiIYY0
MD5 SHA1 SHA512 SSDEEP

Submit Download

TjNKNK.exe

Path C:\Windows\Pack\TjNKNK.exe
Size 832KB
SHA256 923111c7142b3dc783a3c722b19b8a21bcb78222d7a136ac33f0ca8a29f4cb66
MD5 d305d506c0095df8af223ac7d91ca327
SHA1 679cb4c763c84e75ccb0fa3475bd6b7a36e81c4a
SHA512 94d369a4db88bff9556a1d7a7fb0188ed935c3592bae09335542c5502ec878e839177be63ac3ab4af75d4dc38a3a4f5d0fd423115ac72cf5dd710c59604db796
SSDEEP 12288:w5KA2umXkgSSWBpeC5wtKDAOQrM3IbMZuuW1phJb9RlTTzIXGa0/Zxi0akv+9a9h:wleX1phJbpraX0BvX2
MD5 SHA1 SHA512 SSDEEP

Submit Download

TjNKNK.wrapper.log

Path C:\Windows\Pack\TjNKNK.wrapper.log
Size 272B
SHA256 a1802878649a54be56627b5c722ce1f4e0252447628ce6d8e8ca156414b38b31
MD5 661c6a4cc55ad4455e6cac1a5cb19a99
SHA1 211a1036b390570c7dd32c6bec8a68d62bc514d4
SHA512 72c6462b577cbf04a709135385f661f27873333895312df70e4fe46b72627e921c7db701e6f60ea97df8a62d7f7b879a28de7bcd8585773b8e367cb4904b24ad
MD5 SHA1 SHA512

Submit Download

TjNKNK.wrapper.log

Path C:\Windows\Pack\TjNKNK.wrapper.log
Size 336B
SHA256 c507271ff828282c09702deee47129c2e4e20da0739b9c604a02ad6f44297e3e
MD5 11d65c87a0c272b1e4f2c934c7e20c04
SHA1 42f20af1f36564095b1372070df32d944ba336f3
SHA512 affabdc290215b8e64bf404877ef909c6b3b6c39823d18367f912b6959a21495a95d82da10ff0c956dfe0c57690849a6dfebc64fc65dc7f38652993a812816df
MD5 SHA1 SHA512

Submit Download

TjNKNK.wrapper.log

Path C:\Windows\Pack\TjNKNK.wrapper.log
Size 495B
SHA256 a38b3a5a704cf8f5e0dfdfa61f612933c32de51fd224f0bf5fb872392ae9e88e
MD5 172b7579fcd5e48db4495677db6e224c
SHA1 de41d3ddc81a56573dcbd28c7a4832be342e4035
SHA512 d073db8603e7e6a157fcf8530ff746cf7ae95aef84cabb14b8e88664e1730d30d1823823cd422ee795be9d0ebf855315e89bc5843bf46a2ea4ae3e1fcd17566b
MD5 SHA1 SHA512

Submit Download

TjNKNK.wrapper.log

Path C:\Windows\Pack\TjNKNK.wrapper.log
Size 664B
SHA256 5c6dd4bee32f806f83b644520477ac5a5bb890b010ffe7fee292018ac77e8785
MD5 18706c6049b76fda2645ba1bd5a6756a
SHA1 9d57c29326b46cfc76dc9f0081c530b9307e7a96
SHA512 6e08196efaf09211ef26a8006672bfc5af761147c19ca2ff5bf90d026b18082b07ebf26d6af35ac40f4d25bf5cf678c3be5bf27b53cb9b12ff50ce150539e181
MD5 SHA1 SHA512

Submit Download

TjNKNK.wrapper.log

Path C:\Windows\Pack\TjNKNK.wrapper.log
Size 774B
SHA256 7a1149b154e99ad22f276ae5b67787c18a9c21745fe79f0cc45b56a00c5325d7
MD5 bb196476290c7e43de04423bbbd57314
SHA1 ded1cf08fb7a9f61006583149f66018187aa0417
SHA512 64b40d60af682dbc2f39ac0f3b9d10e995b029ded4dd3ab1a6c2c6662fec89244ddfe036b489a136480c6a394bc8a06c4a1dba48f27efd2ccc9ec99bbf69e0b1
MD5 SHA1 SHA512

Submit Download

TjNKNK.wrapper.log

Path C:\Windows\Pack\TjNKNK.wrapper.log
Size 958B
SHA256 f2bd250efd6b656e123c222d5796c253857d01034757ba45fe1a4c83808d0106
MD5 da9e51a701a11e85f052ffabd0f37252
SHA1 bf7cb0079473c4aad793121050f0659b06420f5e
SHA512 08971b91620030ae0c43a2667e912d1594c0705f221af6e8c794960f3993cb25dbcdfffbf766663bab7ca7c03bee9ec460af4f47af41c49b143104e6c2f499b1
MD5 SHA1 SHA512

Submit Download

TjNKNK.xml

Path C:\Windows\Pack\TjNKNK.xml
Size 365B
SHA256 7de208a620d57d3e417fd504fce1d4a4e44e9af54f4fd96f3dd7a58a84ac9ca4
MD5 290a3f79cf36020d2195fe2d07ae8be8
SHA1 9e6c0aba0fc06b53d1802b77d05c97f02dea35da
SHA512 c69bb0d14ccd5e1ffd3377de71d312f4eccaf20c0a5398761d18fd375b6cfa74dfd0bf40e1bc8d203b11720ddce53b14b51ed5c4ec2284ee809dcfc4e3acf73c
MD5 SHA1 SHA512

Submit Download

TjNKNP.wrapper.log

Path C:\Windows\Pack\TjNKNP.wrapper.log
Size 268B
SHA256 5e9901e5da5f1ed06a241eb8e6ada2358c9ee28029c147ca9094bf38303803d8
MD5 493d14328c080fcf84219ef4ef6d38a0
SHA1 99622cb498a96d198857fef7cb32c88a9e75bc23
SHA512 f5e618e26d4907054938a0fe142619e91690a2a7a54ff50e4e11f90a34ae278eb43f822207d95beb28c1e222804db12b8baf6e4be90339f87c29a9ccb94627d8
MD5 SHA1 SHA512

Submit Download

TjNKNP.wrapper.log

Path C:\Windows\Pack\TjNKNP.wrapper.log
Size 332B
SHA256 1046089028d055ec4950c4d64754d8c0b7a29cc91eed98440c1ede42128af4df
MD5 17407ee8ca83d6d03fa30a3eb1191f57
SHA1 f7cc7940cbcb2f1f1bd455cdbc885ca27a171077
SHA512 c565e7c4acf4f9f10a5b9c67211ed001fa61a0b931cb28a2fc122cfb49e801f10058a719347f90c1bac3fc43d533227aad5c9b7f930133c5bff763853c30f1ad
MD5 SHA1 SHA512

Submit Download

TjNKNP.wrapper.log

Path C:\Windows\Pack\TjNKNP.wrapper.log
Size 489B
SHA256 f226f81724e311c3d82e337fdb3bb223a45ea6227f8f5a0831a2abfe6b3ccf81
MD5 140682b5c5136dcf754aeded9bb02524
SHA1 7f529430501aa1451c4eee1126b9aec54a6152f0
SHA512 9ea76f0c00fb7b6960bbde70808388a38c263cf846d1ed6b67074a925c47b71b78561591be73e0cfed28df56764fe0b310df590979a4e90b3590ca33e566008f
MD5 SHA1 SHA512

Submit Download

TjNKNP.wrapper.log

Path C:\Windows\Pack\TjNKNP.wrapper.log
Size 725B
SHA256 cb8d758cc55693bdf0f2807f5ea602ed4a44b0f539353dc697cec21fa4dc6ed4
MD5 82f86f478dff4418d19aaaae573b8a70
SHA1 440f2e36e009469ec3afa6de771ca05de54169cf
SHA512 aab03a36d4cf9c494816e9c3e3e708d6c52cda2e388ce8b1b37ca4b1d3c0f80561c27f10aae65b8b463cd586c035c4800c9736d0d19e3472a287aa1291f70b21
MD5 SHA1 SHA512

Submit Download

TjNKNP.xml

Path C:\Windows\Pack\TjNKNP.xml
Size 294B
SHA256 b09256eb486cb5272f1b83dcbddb7880d02f200908b8ae808fa30e05bf8fe6c3
MD5 0b969a177446a5df785e0545592c074d
SHA1 27c7a0385a367ecd267ad144ed4addf33714b342
SHA512 0bb58bfa725789abde49dd6eff3a95bdd734ddbc9cd4f3628320d935e6ee8ef858ae0ee2dec504e2f2a79f4152fef2b09db13a9eea5008ec6f649fff705ce7cf
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\Windows\Pack\setup.exe
Size 1.9MB
SHA256 210584e0c67e4fa3655175b50175ef4748cea35c8313cc125a184d5fc90ac0b3
MD5 4c279db4cdb406977bade2f65c7e61b6
SHA1 bb4e6928480e4923c37918ece98248e7d596c397
SHA512 3a833868ad29deefd916114d7b8fe5ce29e1611d23f124b7d9fa1d1b007630d8532ba3dedb767c9487dff076881538689065ca42c9dc420bf125280d35469cdb
SSDEEP 49152:MnNcfMj5TLPhPJF5d9OJtc1wC2nreYIaaskvaN:Mue5RdsJw7sas
MD5 SHA1 SHA512 SSDEEP

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.6MB
SHA256 6784375187e1410a65a92953ffd1be415e55a0beaae71b1ccfae1d71eda04289
MD5 d2e7cd805a4b7f1da11a0d99d7a838af
SHA1 033dd446d3b1ef1939b345423ab35abba2aec9d1
SHA512 54d2218148940b859755b766e98bb6b004fdb1cfaf2e8e6b62089b9d0cc57a7cdfe9928f95e3c95be39b7f9f88268bc45dee4a33f226a112c8eb3afdaa480a27
SSDEEP 24576:rZ1mSptidoO/vvTLMWHeBUXaf6V/wYjtWGUNHZ03ecq4EbDC4MGK7rtwb:C
MD5 SHA1 SHA512 SSDEEP

Submit Download

{cf8ac2a1-e099-43d1-8c2c-8cfe1344ad2d}_OnDiskSnapshotProp

Path \??\Volume{2a1b5cfa-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{cf8ac2a1-e099-43d1-8c2c-8cfe1344ad2d}_OnDiskSnapshotProp
Size 6KB
SHA256 9245a151b62d048d346dcdb7ca8adbb4e42f1e935eaa2e77009242a3069e9c62
MD5 a1d0c13713f53cdea0da3ccd48a675d8
SHA1 e8a546f4917b688a1caa00b3e2e7eb377e126eae
SHA512 cc7819d64273ff957431ae0198b32442f083ec6cf499d3c18769e006524c5dd30c4fc98b18c1b370bca4398923d1b1826f9a72db9c2ec268030daa2cc0b503f1
SSDEEP 96:FRMPDqMFDD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:bMp1b++ZVm
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1184-147-0x0000000000250000-0x00000000007F3000-memory.dmp

Download

memory/1184-159-0x0000000000250000-0x00000000007F3000-memory.dmp

Download

memory/1184-153-0x0000000000250000-0x00000000007F3000-memory.dmp

Download

memory/1184-152-0x0000000000250000-0x00000000007F3000-memory.dmp

Download

memory/3580-57-0x00000000034C0000-0x00000000034C1000-memory.dmp

Download

memory/3580-59-0x0000000000E60000-0x0000000001275000-memory.dmp

Download

memory/4652-63-0x0000000000470000-0x0000000000546000-memory.dmp

Download

memory/5612-75-0x00000164002B0000-0x0000016400D72000-memory.dmp

Download

memory/5908-135-0x0000000000400000-0x0000000000910000-memory.dmp

Download

memory/5908-137-0x0000000010000000-0x000000001002D000-memory.dmp

Download

memory/5968-131-0x0000000000400000-0x00000000007B9000-memory.dmp

Download

memory/5968-129-0x00000000008D0000-0x00000000008D1000-memory.dmp

Download