Overview
overview
7Static
static
3Visual-C-R...25.zip
windows11-21h2-x64
1install_all.bat
windows11-21h2-x64
7vcredist2005_x64.exe
windows11-21h2-x64
7vcredist2005_x86.exe
windows11-21h2-x64
7vcredist2008_x64.exe
windows11-21h2-x64
7vcredist2008_x86.exe
windows11-21h2-x64
vcredist2010_x64.exe
windows11-21h2-x64
7vcredist2010_x86.exe
windows11-21h2-x64
7vcredist2012_x64.exe
windows11-21h2-x64
4vcredist2012_x86.exe
windows11-21h2-x64
4vcredist2013_x64.exe
windows11-21h2-x64
4vcredist2013_x86.exe
windows11-21h2-x64
4vcredist20...64.exe
windows11-21h2-x64
4vcredist20...86.exe
windows11-21h2-x64
4Analysis
- max time kernel
163s - max time network
163s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
03/05/2026, 00:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Visual-C-Runtimes-All-in-One-Dec-2025.zip
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral2
Sample
install_all.bat
Resource
win11-20260130-en
windows11-21h2-x64
24 signatures
300 seconds
Behavioral task
behavioral3
Sample
vcredist2005_x64.exe
Resource
win11-20260130-en
windows11-21h2-x64
16 signatures
300 seconds
Behavioral task
behavioral4
Sample
vcredist2005_x86.exe
Resource
win11-20260130-en
windows11-21h2-x64
16 signatures
300 seconds
Behavioral task
behavioral5
Sample
vcredist2008_x64.exe
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
300 seconds
Behavioral task
behavioral6
Sample
vcredist2008_x86.exe
Resource
win11-20260130-en
windows11-21h2-x64
11 signatures
300 seconds
Behavioral task
behavioral7
Sample
vcredist2010_x64.exe
Resource
win11-20260130-en
windows11-21h2-x64
9 signatures
300 seconds
Behavioral task
behavioral8
Sample
vcredist2010_x86.exe
Resource
win11-20260130-en
windows11-21h2-x64
9 signatures
300 seconds
Behavioral task
behavioral9
Sample
vcredist2012_x64.exe
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
300 seconds
Behavioral task
behavioral10
Sample
vcredist2012_x86.exe
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
300 seconds
Behavioral task
behavioral11
Sample
vcredist2013_x64.exe
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
300 seconds
Behavioral task
behavioral12
Sample
vcredist2013_x86.exe
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
300 seconds
Behavioral task
behavioral13
Sample
vcredist2015_2017_2019_2022_x64.exe
Resource
win11-20260130-en
windows11-21h2-x64
5 signatures
300 seconds
Behavioral task
behavioral14
Sample
vcredist2015_2017_2019_2022_x86.exe
Resource
win11-20260130-en
windows11-21h2-x64
5 signatures
300 seconds
General
- Target vcredist2005_x86.exe
- Size 2.6MB
- Sample260503-apy7yshy8w
- SHA256 4ee4da0fe62d5fa1b5e80c6e6d88a4a2f8b3b140c35da51053d0d7b72a381d29
- MD5 ce2922f83fb4b170affce0ea448b107b
- SHA1 b8fab0bb7f62a24ddfe77b19cd9a1451abd7b847
- SHA512 e94b077e054bd8992374d359f3adc4d1d78d42118d878556715d77182f7d03635850b2b2f06c012ccb7c410e2b3c124cf6508473efe150d3c51a51857ce1c6b0
- SSDEEP 49152:rqGRIgg2SirwkF9xdtb43lyGKCafpKkiwnaDahmPzpY4FPyaza:rxxLFfY/KCCpKk9aWMzZyau
- TLSH T1DDC5331259C4D23AE0A213F45DFD2A734B3D7CA8B72027AFB78250968D262D164357FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 1260 MsiExec.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" vcredist2005_x86.exe - Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 3312 msiexec.exe 3 3312 msiexec.exe 4 2932 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe - Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia80.dll msiexec.exe - Drops file in Windows directory 61 IoCs
description ioc Process File created C:\Windows\SystemTemp\~DF58CC5B355017FF2C.TMP msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260503012542791.0\mfcm80u.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260503012542916.0\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_452bf920.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260503012542963.0\8.0.50727.6195.policy msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260503012542963.1 msiexec.exe File opened for modification C:\Windows\Installer\MSI9D26.tmp msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260503012542744.0\msvcr80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260503012542869.0\mfc80FRA.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260503012542869.0\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_6a5bb789.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260503012542869.0\mfc80ENU.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260503012542963.1\8.0.50727.6195.policy msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260503012542791.0\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_150c9e8b.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260503012542791.0\mfc80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260503012542869.0\mfc80CHT.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260503012542869.0\mfc80ITA.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260503012542931.1\8.0.50727.6195.policy msiexec.exe File created C:\Windows\SystemTemp\~DF517FC0C34E6E7294.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI94F8.tmp msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260503012542728.0\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_a4c618fa.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260503012542869.0\mfc80ESP.dll msiexec.exe File created C:\Windows\Installer\SourceHash{710f4c1c-cc18-4c49-8cbf-51240c89a1a2} msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260503012542744.0\msvcm80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260503012542916.0\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_452bf920.manifest msiexec.exe File created C:\Windows\Installer\e589100.msi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260503012542744.0\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260503012542869.0\mfc80DEU.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260503012542947.0\8.0.50727.6195.policy msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260503012542916.0 msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260503012542963.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260503012542963.1\8.0.50727.6195.cat msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260503012542931.1 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260503012542791.0\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_150c9e8b.cat msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260503012542744.0 msiexec.exe File opened for modification C:\Windows\Installer\e589100.msi msiexec.exe File created C:\Windows\SystemTemp\~DFB72A0D2B7E7F497B.TMP msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260503012542728.0\ATL80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260503012542744.0\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260503012542744.0\msvcp80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260503012542869.0\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_6a5bb789.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260503012542931.0\8.0.50727.6195.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260503012542947.0\8.0.50727.6195.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260503012542963.0\8.0.50727.6195.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260503012542931.1\8.0.50727.6195.cat msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260503012542728.0 msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260503012542791.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260503012542791.0\mfcm80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260503012542869.0\mfc80JPN.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260503012542869.0\mfc80KOR.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260503012542931.0\8.0.50727.6195.policy msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260503012542869.0\mfc80CHS.dll msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260503012542869.0 msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260503012542931.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260503012542791.0\mfc80u.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260503012542916.0\vcomp.dll msiexec.exe File created C:\Windows\Installer\e589104.msi msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260503012542947.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260503012542728.0\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_a4c618fa.manifest msiexec.exe File created C:\Windows\SystemTemp\~DFEEBA4C47C6B2D9D7.TMP msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 3312 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist2005_x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000611ecaf51c3c1a840000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000611ecaf50000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900611ecaf5000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a611ecaf5000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d611ecaf5000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 56 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.ATL,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e00700052005e007000580049006000510075006f00650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\PackageCode = "84067013B7B56744BA0F51892982BC09" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.OpenMP,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e0035006f00300068002c0070004d0076004e003d00650038004d006b0062004900640046007700550000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\1 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\3 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Net msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFC,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e003d0024006b00600049004e005d00490038004300650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AA5D9C68C00F12943B2F6CA09FE28244\c1c4f01781cc94c4c8fb1542c0981a2a msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AA5D9C68C00F12943B2F6CA09FE28244 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Win32Assemblies\Global msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.ATL,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e0036006b007d00700048004c004800240053004400650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\c1c4f01781cc94c4c8fb1542c0981a2a\Servicing_Key msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AA5D9C68C00F12943B2F6CA09FE28244 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\9 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\c1c4f01781cc94c4c8fb1542c0981a2a msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\c1c4f01781cc94c4c8fb1542c0981a2a\VC_Redist msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\Language = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\Version = "134278729" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\2 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\c1c4f01781cc94c4c8fb1542c0981a2a msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.CRT,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e0061005a004f002c0048002a004b00320060004500650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\10 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Features\c1c4f01781cc94c4c8fb1542c0981a2a msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.CRT,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e005f006a0030002c0059005d007300210053006f00650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFC,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e0021004d00210026005a005a006300300025006e00650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFCLOC,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e006600720038005f006c0028006d0032004e004400650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\ProductName = "Microsoft Visual C++ 2005 Redistributable" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\4 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\5 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\6 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFCLOC,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e006900450024005b004d00310025002e0064002700650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.OpenMP,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e00370030002d0054002400210028002a0026004e00650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\7 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\8 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\11 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\PackageName = "vcredist.msi" msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2932 msiexec.exe 2932 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3312 msiexec.exe Token: SeIncreaseQuotaPrivilege 3312 msiexec.exe Token: SeSecurityPrivilege 2932 msiexec.exe Token: SeCreateTokenPrivilege 3312 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3312 msiexec.exe Token: SeLockMemoryPrivilege 3312 msiexec.exe Token: SeIncreaseQuotaPrivilege 3312 msiexec.exe Token: SeMachineAccountPrivilege 3312 msiexec.exe Token: SeTcbPrivilege 3312 msiexec.exe Token: SeSecurityPrivilege 3312 msiexec.exe Token: SeTakeOwnershipPrivilege 3312 msiexec.exe Token: SeLoadDriverPrivilege 3312 msiexec.exe Token: SeSystemProfilePrivilege 3312 msiexec.exe Token: SeSystemtimePrivilege 3312 msiexec.exe Token: SeProfSingleProcessPrivilege 3312 msiexec.exe Token: SeIncBasePriorityPrivilege 3312 msiexec.exe Token: SeCreatePagefilePrivilege 3312 msiexec.exe Token: SeCreatePermanentPrivilege 3312 msiexec.exe Token: SeBackupPrivilege 3312 msiexec.exe Token: SeRestorePrivilege 3312 msiexec.exe Token: SeShutdownPrivilege 3312 msiexec.exe Token: SeDebugPrivilege 3312 msiexec.exe Token: SeAuditPrivilege 3312 msiexec.exe Token: SeSystemEnvironmentPrivilege 3312 msiexec.exe Token: SeChangeNotifyPrivilege 3312 msiexec.exe Token: SeRemoteShutdownPrivilege 3312 msiexec.exe Token: SeUndockPrivilege 3312 msiexec.exe Token: SeSyncAgentPrivilege 3312 msiexec.exe Token: SeEnableDelegationPrivilege 3312 msiexec.exe Token: SeManageVolumePrivilege 3312 msiexec.exe Token: SeImpersonatePrivilege 3312 msiexec.exe Token: SeCreateGlobalPrivilege 3312 msiexec.exe Token: SeBackupPrivilege 5020 vssvc.exe Token: SeRestorePrivilege 5020 vssvc.exe Token: SeAuditPrivilege 5020 vssvc.exe Token: SeBackupPrivilege 2932 msiexec.exe Token: SeRestorePrivilege 2932 msiexec.exe Token: SeRestorePrivilege 2932 msiexec.exe Token: SeTakeOwnershipPrivilege 2932 msiexec.exe Token: SeRestorePrivilege 2932 msiexec.exe Token: SeTakeOwnershipPrivilege 2932 msiexec.exe Token: SeRestorePrivilege 2932 msiexec.exe Token: SeTakeOwnershipPrivilege 2932 msiexec.exe Token: SeRestorePrivilege 2932 msiexec.exe Token: SeTakeOwnershipPrivilege 2932 msiexec.exe Token: SeRestorePrivilege 2932 msiexec.exe Token: SeTakeOwnershipPrivilege 2932 msiexec.exe Token: SeRestorePrivilege 2932 msiexec.exe Token: SeTakeOwnershipPrivilege 2932 msiexec.exe Token: SeRestorePrivilege 2932 msiexec.exe Token: SeTakeOwnershipPrivilege 2932 msiexec.exe Token: SeRestorePrivilege 2932 msiexec.exe Token: SeTakeOwnershipPrivilege 2932 msiexec.exe Token: SeRestorePrivilege 2932 msiexec.exe Token: SeTakeOwnershipPrivilege 2932 msiexec.exe Token: SeRestorePrivilege 2932 msiexec.exe Token: SeTakeOwnershipPrivilege 2932 msiexec.exe Token: SeRestorePrivilege 2932 msiexec.exe Token: SeTakeOwnershipPrivilege 2932 msiexec.exe Token: SeRestorePrivilege 2932 msiexec.exe Token: SeTakeOwnershipPrivilege 2932 msiexec.exe Token: SeRestorePrivilege 2932 msiexec.exe Token: SeTakeOwnershipPrivilege 2932 msiexec.exe Token: SeRestorePrivilege 2932 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3312 msiexec.exe 3312 msiexec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4808 wrote to memory of 3312 4808 vcredist2005_x86.exe 78 PID 2932 wrote to memory of 3232 2932 msiexec.exe 84 PID 2932 wrote to memory of 1260 2932 msiexec.exe 86 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\vcredist2005_x86.exe"C:\Users\Admin\AppData\Local\Temp\vcredist2005_x86.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Windows\SysWOW64\msiexec.exemsiexec /i vcredist.msi2⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3312
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:3232
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding DB6FEA8C748EA93DD04FE9CB9C40AFC62⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1260
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5020
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
- Size 4KB
- SHA256 0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d
- MD5 5f036f91e86e30f749961506951d51eb
- SHA1 acb87b59117c6e2db86f98c4c8bac52eade97cd4
- SHA512 341f250cf3764207b5328a12b31016c0750daddcd16722b4bcef502bcbef7ef379abb601649ee6c3fdf121f3d3cd6890c8a80e5dae3169fe56ef82af20631944
- SSDEEP 96:Dbonzjs6o1BXl7EV4/sClywa3UHimRkISatmQFjm:Dbsns6KXxUrClywawinLatvFjm
- TLSH T100A19E44A75AEB61C331EBB6829B7B51033B6D20178468FAEFDAA1E1695B44C143C3C2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
- Size 342B
- SHA256 a85580f88a4095e461432341006d9dca563f495ecba5560c531dd1bb2996b3a2
- MD5 c0a04202a6a0b5e9532da71f1beed41a
- SHA1 40d9c1bc4b94b1e9d01ea646fb4f3314bf2ac356
- SHA512 405bd25d62e4a5f19aaed5da618e0df122578359333e056b135961d3c0777efc805228cbd065801dba7e4773750ea209d4131a40676dde3869ae703877615bb7
- TLSH T1FAE05E512FE80204F5770A3CA873A549997BB76BAA52CADD0275018D1C21F62CD3271D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredis1.cab
- Size 247KB
- SHA256 913ee5a1cae3e5a1872b3a5efaaa00c58e4beb692492b138f76967da671b0477
- MD5 cc064d4b81619991de8131a86ad77681
- SHA1 88d80d86cc20c27d7d2a872af719300bd2bb73f9
- SHA512 5aff0eb26cfc187bf58721b2b6d73357d9f1e66d1ac5340ad9ddc08b40ad0eda27a144cb3b650604637a7476c282ded83ed890de98a73ccaf0cc021da3a9eb25
- SSDEEP 6144:jdHDtJKx9Q5+LMfpMjU3B0QPdCtngtpoEvdpYKJFj9gGmO:xti+YLYpM45PUtgvTvdfDj9YO
- TLSH T18A4423C8D70C1D642630A1C948A55B6CCD9EA459790E35DA4282F2DE9E1D78FA0FC3F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredist.msi
- Size 2.6MB
- SHA256 91bdd063f6c53126737791c9eccf0b2f4cf44927831527245bc89a0be06c0cb4
- MD5 b20bbeb818222b657df49a9cfe4fed79
- SHA1 3f6508e880b86502773a3275bc9527f046d45502
- SHA512 f534bc7bf1597e728940e6c3b77f864adfaa413bb1e080458326b692b0f96bddf4fbd294eeed36d7764a3578e6c8e919488bbf63b8fe2d4355ab3efd685424a4
- SSDEEP 49152:BxtG+uBvEH/sbE3EyyBU5czkhwZawV4mC5kRuhg6MmqmPAhe75LzNyS:TuVOTWBdzkkawxSh4iAhm51yS
- TLSH T1E9D5F153BA16E3A2E14862300757CA1C7D7E63E12763761D33FD2358889A6FAD33E548
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI94F8.tmp
- Size 28KB
- SHA256 f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f
- MD5 85221b3bcba8dbe4b4a46581aa49f760
- SHA1 746645c92594bfc739f77812d67cfd85f4b92474
- SHA512 060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d
- SSDEEP 192:XOdG/6G4nnykxsdYZ+mrv2ySzLUHypLGgjuXFw5acHKBNtHjhuHWrkA9uBP1WWzT:P6GuZBrvkzAHyxxHKBdaA2dWWzm0ZH
- TLSH T193D20A93BA2494B3DD9031B101EE591652DEC7324B1598E36F1A0ECBBE74DC2DBB118B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.6MB
- SHA256 4d63afe62a2f06fcb14226b85e6c9a2b01be716c43ef25fc1de6c3d43e5921a3
- MD5 d122e80e886951e24f8f6cf0e4b079b5
- SHA1 28d9016453c9d6990c13bb3e9c778e0877a22cbd
- SHA512 27182b395a176d63a5b7ab2c53ce680305f7c40bdbae63cc638955581f781c09b2a690ef40ffaa2b842d2f7a2fc3219ea227e351a59c83fcffe055495cfd6021
- SSDEEP 24576:72gmSp1+doO/vvTLvmEuB0Hq/6pPwYgOWWXd3JEUN/6IkIQRoPFjr5eDB:U
- TLSH T1C147D12436F92210E7B39E3C6CF06A234D3A7D5B9C15DE8D05461B8E0961FB1E872F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{f5ca1e61-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{9846fe63-3c25-4a50-9c18-65d19328a876}_OnDiskSnapshotProp
- Size 6KB
- SHA256 7001d018db56fa905b035b4cbb4a09d3d126808292615fcba4a58e47ed8f7dc5
- MD5 9781b2b6d55d05556d1bd957a9dc67ee
- SHA1 e3c09d3b9a73b3436a1a94e88d5d6f7378c1ee76
- SHA512 bd321a8f17c8855e0f6ae747c8ad9de408c3ade712d9556d812e1db58b7467b7cafe393004ffa42c284963c62a6f103273c260b7ce667384c8ad98aa1e1aa7bb
- SSDEEP 96:FOv9juxvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:00b++ZVmN
- TLSH T16AD177085AF54711E2B3AB3229F14557A877B911EF33CB8E0198638E6670A10F836F5F
- MD5 SHA1 SHA512 SSDEEP TLSH