Overview
overview
8Static
static
3HowToFishTrainer.exe
windows10-2004-x64
8HowToFishTrainer.exe
windows11-ltsc_2024-x64
8d3dcompiler_47.dll
windows10-2004-x64
1dxcompiler.dll
windows10-2004-x64
1dxil.dll
windows10-2004-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows10-2004-x64
1res/Engine...api.js
windows10-2004-x64
3res/Engine...api.js
windows11-ltsc_2024-x64
8res/Engine...gex.js
windows10-2004-x64
3res/Engine...gex.js
windows11-ltsc_2024-x64
8res/Engine...ema.js
windows10-2004-x64
3res/Engine...ema.js
windows11-ltsc_2024-x64
8res/Extern...p1.exe
windows10-2004-x64
6res/Extern...p1.exe
windows11-ltsc_2024-x64
6res/Extern...p1.exe
windows10-2004-x64
res/Extern...p1.exe
windows11-ltsc_2024-x64
res/Extern...12.exe
windows10-2004-x64
4res/Extern...12.exe
windows11-ltsc_2024-x64
4res/Extern...12.exe
windows10-2004-x64
4res/Extern...12.exe
windows11-ltsc_2024-x64
4res/Extern...13.exe
windows10-2004-x64
4res/Extern...13.exe
windows11-ltsc_2024-x64
6res/Extern...64.exe
windows10-2004-x64
4res/Extern...64.exe
windows11-ltsc_2024-x64
6res/Extern...86.exe
windows10-2004-x64
4res/Extern...86.exe
windows11-ltsc_2024-x64
6vcruntime140.dll
windows10-2004-x64
1vcruntime140.dll
windows11-ltsc_2024-x64
6vulkan-1.dll
windows10-2004-x64
1Analysis
- max time kernel
598s - max time network
433s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/08/2026, 03:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
HowToFishTrainer.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
600 seconds
Behavioral task
behavioral2
Sample
HowToFishTrainer.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
19 signatures
600 seconds
Behavioral task
behavioral3
Sample
d3dcompiler_47.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral4
Sample
dxcompiler.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral5
Sample
dxil.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral6
Sample
ffmpeg.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral7
Sample
libEGL.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral8
Sample
res/Engine/Common/Include/SteamAPI/steam_api.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
600 seconds
Behavioral task
behavioral9
Sample
res/Engine/Common/Include/SteamAPI/steam_api.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
15 signatures
600 seconds
Behavioral task
behavioral10
Sample
res/Engine/Common/Include/rapidjson/internal/regex.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
600 seconds
Behavioral task
behavioral11
Sample
res/Engine/Common/Include/rapidjson/internal/regex.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
15 signatures
600 seconds
Behavioral task
behavioral12
Sample
res/Engine/Common/Include/rapidjson/schema.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
600 seconds
Behavioral task
behavioral13
Sample
res/Engine/Common/Include/rapidjson/schema.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
15 signatures
600 seconds
Behavioral task
behavioral14
Sample
res/External/Redistributables/2005/vcredist_x86_2005.sp1.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
600 seconds
Behavioral task
behavioral15
Sample
res/External/Redistributables/2005/vcredist_x86_2005.sp1.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
16 signatures
600 seconds
Behavioral task
behavioral16
Sample
res/External/Redistributables/2008/vcredist_x86_2008.sp1.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
600 seconds
Behavioral task
behavioral17
Sample
res/External/Redistributables/2008/vcredist_x86_2008.sp1.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
600 seconds
Behavioral task
behavioral18
Sample
res/External/Redistributables/2012/vcredist_x64_2012.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
600 seconds
Behavioral task
behavioral19
Sample
res/External/Redistributables/2012/vcredist_x64_2012.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
600 seconds
Behavioral task
behavioral20
Sample
res/External/Redistributables/2012/vcredist_x86_2012.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
600 seconds
Behavioral task
behavioral21
Sample
res/External/Redistributables/2012/vcredist_x86_2012.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
600 seconds
Behavioral task
behavioral22
Sample
res/External/Redistributables/2013/vcredist_x64_2013.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
600 seconds
Behavioral task
behavioral23
Sample
res/External/Redistributables/2013/vcredist_x64_2013.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
17 signatures
600 seconds
Behavioral task
behavioral24
Sample
res/External/Redistributables/2015andUp/VC_redist.x64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
600 seconds
Behavioral task
behavioral25
Sample
res/External/Redistributables/2015andUp/VC_redist.x64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
18 signatures
600 seconds
Behavioral task
behavioral26
Sample
res/External/Redistributables/2015andUp/VC_redist.x86.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
600 seconds
Behavioral task
behavioral27
Sample
res/External/Redistributables/2015andUp/VC_redist.x86.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
18 signatures
600 seconds
Behavioral task
behavioral28
Sample
vcruntime140.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral29
Sample
vcruntime140.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
600 seconds
Behavioral task
behavioral30
Sample
vulkan-1.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
600 seconds
General
- Target res/External/Redistributables/2005/vcredist_x86_2005.sp1.exe
- Size 2.6MB
- Sample260823-dq8dssxset
- SHA256 8648c5fc29c44b9112fe52f9a33f80e7fc42d10f3b5b42b2121542a13e44adfd
- MD5 4f1611f2d0ae799507f60c10ff8654c5
- SHA1 56ae8221e8024c8deed430e01a6160795c64cf53
- SHA512 f9a9f31010bcd890c1755ac3de2f6821a707aaeae2644cf083124dbdfdee86bd46206762e2487b942120970ca2ced2a87931b778e9fe4ae087d67b1865dd4b1a
- SSDEEP 49152:OqGRIgg2SirwkF9xdtb43lyGKCafpKkiwnaDahmPzpY4FPyazw:OxxLFfY/KCCpKk9aWMzZyaM
- TLSH T162C5331259C0D23AE0A223B45EFD29635B3D7CB8772027EFB78650968D262C164357FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" vcredist_x86_2005.sp1.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe - Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia80.dll msiexec.exe - Drops file in Windows directory 57 IoCs
description ioc Process File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIF354.tmp msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041738870.0\mfc80u.dll msiexec.exe File created C:\Windows\Installer\SourceHash{710f4c1c-cc18-4c49-8cbf-51240c89a1a2} msiexec.exe File opened for modification C:\Windows\Installer\MSID17.tmp msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041738666.0\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_a4c618fa.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041740151.0\8.0.50727.6195.policy msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260823041740151.0 msiexec.exe File opened for modification C:\Windows\Installer\e58ead8.msi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041738698.0\msvcm80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041740135.0\8.0.50727.6195.cat msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260823041740135.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041739120.0\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_6a5bb789.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041739120.0\mfc80FRA.dll msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260823041740120.1 msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041738666.0\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_a4c618fa.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041740120.1\8.0.50727.6195.policy msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041740166.0\8.0.50727.6195.policy msiexec.exe File created C:\Windows\Installer\e58eadc.msi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041738698.0\msvcp80.dll msiexec.exe File created C:\Windows\Installer\e58ead8.msi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041740120.0\8.0.50727.6195.policy msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041738870.0\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_150c9e8b.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041739120.0\mfc80KOR.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041739729.0\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_452bf920.manifest msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260823041738870.0 msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260823041739120.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041738870.0\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_150c9e8b.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041739120.0\mfc80ENU.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041738698.0\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041739120.0\mfc80ESP.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041740135.0\8.0.50727.6195.policy msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260823041738698.0 msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260823041740166.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041738698.0\msvcr80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041738870.0\mfcm80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041738870.0\mfcm80u.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041739120.0\mfc80CHS.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041740120.0\8.0.50727.6195.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041738698.0\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041739120.0\mfc80DEU.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041740151.0\8.0.50727.6195.cat msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041739729.0\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_452bf920.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041740120.1\8.0.50727.6195.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041740166.0\8.0.50727.6195.cat msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260823041738666.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041738666.0\ATL80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041738870.0\mfc80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041739120.0\mfc80CHT.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041739120.0\mfc80JPN.dll msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260823041739729.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041739120.0\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_6a5bb789.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041739120.0\mfc80ITA.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260823041739729.0\vcomp.dll msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260823041740120.0 msiexec.exe - Loads dropped DLL 2 IoCs
pid Process 2288 MsiExec.exe 2288 MsiExec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2920 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist_x86_2005.sp1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e0d688459d835b340000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e0d688450000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900e0d68845000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ae0d68845000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de0d68845000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 45 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AA5D9C68C00F12943B2F6CA09FE28244 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\6 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\11 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFCLOC,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e006600720038005f006c0028006d0032004e004400650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\8 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\c1c4f01781cc94c4c8fb1542c0981a2a\VC_Redist msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.CRT,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e005f006a0030002c0059005d007300210053006f00650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFC,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e003d0024006b00600049004e005d00490038004300650038004d006b0062004900640046007700550000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\c1c4f01781cc94c4c8fb1542c0981a2a msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\4 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\Clients = 3a0000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AA5D9C68C00F12943B2F6CA09FE28244\c1c4f01781cc94c4c8fb1542c0981a2a msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\1 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\3 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\7 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.ATL,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e0036006b007d00700048004c004800240053004400650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\PackageCode = "84067013B7B56744BA0F51892982BC09" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\PackageName = "vcredist.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\2 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\10 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.OpenMP,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e0035006f00300068002c0070004d0076004e003d00650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\c1c4f01781cc94c4c8fb1542c0981a2a\Servicing_Key msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\Language = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFC,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e0021004d00210026005a005a006300300025006e00650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFCLOC,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e006900450024005b004d00310025002e0064002700650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\ProductName = "Microsoft Visual C++ 2005 Redistributable" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\Version = "134278729" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\5 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\9 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.ATL,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e00700052005e007000580049006000510075006f00650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.CRT,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e0061005a004f002c0048002a004b00320060004500650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.OpenMP,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e00370030002d0054002400210028002a0026004e00650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\Assignment = "1" msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1428 msiexec.exe 1428 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2920 msiexec.exe Token: SeIncreaseQuotaPrivilege 2920 msiexec.exe Token: SeSecurityPrivilege 1428 msiexec.exe Token: SeCreateTokenPrivilege 2920 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2920 msiexec.exe Token: SeLockMemoryPrivilege 2920 msiexec.exe Token: SeIncreaseQuotaPrivilege 2920 msiexec.exe Token: SeMachineAccountPrivilege 2920 msiexec.exe Token: SeTcbPrivilege 2920 msiexec.exe Token: SeSecurityPrivilege 2920 msiexec.exe Token: SeTakeOwnershipPrivilege 2920 msiexec.exe Token: SeLoadDriverPrivilege 2920 msiexec.exe Token: SeSystemProfilePrivilege 2920 msiexec.exe Token: SeSystemtimePrivilege 2920 msiexec.exe Token: SeProfSingleProcessPrivilege 2920 msiexec.exe Token: SeIncBasePriorityPrivilege 2920 msiexec.exe Token: SeCreatePagefilePrivilege 2920 msiexec.exe Token: SeCreatePermanentPrivilege 2920 msiexec.exe Token: SeBackupPrivilege 2920 msiexec.exe Token: SeRestorePrivilege 2920 msiexec.exe Token: SeShutdownPrivilege 2920 msiexec.exe Token: SeDebugPrivilege 2920 msiexec.exe Token: SeAuditPrivilege 2920 msiexec.exe Token: SeSystemEnvironmentPrivilege 2920 msiexec.exe Token: SeChangeNotifyPrivilege 2920 msiexec.exe Token: SeRemoteShutdownPrivilege 2920 msiexec.exe Token: SeUndockPrivilege 2920 msiexec.exe Token: SeSyncAgentPrivilege 2920 msiexec.exe Token: SeEnableDelegationPrivilege 2920 msiexec.exe Token: SeManageVolumePrivilege 2920 msiexec.exe Token: SeImpersonatePrivilege 2920 msiexec.exe Token: SeCreateGlobalPrivilege 2920 msiexec.exe Token: SeBackupPrivilege 2508 vssvc.exe Token: SeRestorePrivilege 2508 vssvc.exe Token: SeAuditPrivilege 2508 vssvc.exe Token: SeBackupPrivilege 1428 msiexec.exe Token: SeRestorePrivilege 1428 msiexec.exe Token: SeRestorePrivilege 1428 msiexec.exe Token: SeTakeOwnershipPrivilege 1428 msiexec.exe Token: SeRestorePrivilege 1428 msiexec.exe Token: SeTakeOwnershipPrivilege 1428 msiexec.exe Token: SeRestorePrivilege 1428 msiexec.exe Token: SeTakeOwnershipPrivilege 1428 msiexec.exe Token: SeBackupPrivilege 3008 srtasks.exe Token: SeRestorePrivilege 3008 srtasks.exe Token: SeSecurityPrivilege 3008 srtasks.exe Token: SeTakeOwnershipPrivilege 3008 srtasks.exe Token: SeBackupPrivilege 3008 srtasks.exe Token: SeRestorePrivilege 3008 srtasks.exe Token: SeSecurityPrivilege 3008 srtasks.exe Token: SeTakeOwnershipPrivilege 3008 srtasks.exe Token: SeRestorePrivilege 1428 msiexec.exe Token: SeTakeOwnershipPrivilege 1428 msiexec.exe Token: SeRestorePrivilege 1428 msiexec.exe Token: SeTakeOwnershipPrivilege 1428 msiexec.exe Token: SeRestorePrivilege 1428 msiexec.exe Token: SeTakeOwnershipPrivilege 1428 msiexec.exe Token: SeRestorePrivilege 1428 msiexec.exe Token: SeTakeOwnershipPrivilege 1428 msiexec.exe Token: SeRestorePrivilege 1428 msiexec.exe Token: SeTakeOwnershipPrivilege 1428 msiexec.exe Token: SeRestorePrivilege 1428 msiexec.exe Token: SeTakeOwnershipPrivilege 1428 msiexec.exe Token: SeRestorePrivilege 1428 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2920 msiexec.exe 2920 msiexec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4980 wrote to memory of 2920 4980 vcredist_x86_2005.sp1.exe 89 PID 1428 wrote to memory of 3008 1428 msiexec.exe 100 PID 1428 wrote to memory of 2288 1428 msiexec.exe 102 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\res\External\Redistributables\2005\vcredist_x86_2005.sp1.exe"C:\Users\Admin\AppData\Local\Temp\res\External\Redistributables\2005\vcredist_x86_2005.sp1.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Windows\SysWOW64\msiexec.exemsiexec /i vcredist.msi2⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2920
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:3008
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A9AC9354E1978432288EE39F0E2588BB2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2288
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2508
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58eadb.rbs
- Size 73KB
- SHA256 970fbf858e23114f1ddc126d03e959ebcc7976dd14f58e2b149f0b71f8c78993
- MD5 3f753f725eac5153c9e2b3e17b5b0bbd
- SHA1 1d766054060b5a9d03d3b953605149278db0e530
- SHA512 39374e4ffd5d3ad25f1218623517cb94e6405329b3a18805f0f0738fe98730d8e970d1403cf019616f43aa7a56bf6156aa4664370716c342f11fb88622651341
- SSDEEP 768:mAm2Cr7m60AQfAF++AjCjR5QmozU+nj2EXSqrZch/ieCuLYY:1mf7mBAgJ+AjCjR5Qmo32EMhJ
- TLSH T14473CCB26A8FE997E70C987D59009989F58D5EB7EE73943C1BCC0D8E9C5AFD808D0109
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredis1.cab
- Size 247KB
- SHA256 913ee5a1cae3e5a1872b3a5efaaa00c58e4beb692492b138f76967da671b0477
- MD5 cc064d4b81619991de8131a86ad77681
- SHA1 88d80d86cc20c27d7d2a872af719300bd2bb73f9
- SHA512 5aff0eb26cfc187bf58721b2b6d73357d9f1e66d1ac5340ad9ddc08b40ad0eda27a144cb3b650604637a7476c282ded83ed890de98a73ccaf0cc021da3a9eb25
- SSDEEP 6144:jdHDtJKx9Q5+LMfpMjU3B0QPdCtngtpoEvdpYKJFj9gGmO:xti+YLYpM45PUtgvTvdfDj9YO
- TLSH T18A4423C8D70C1D642630A1C948A55B6CCD9EA459790E35DA4282F2DE9E1D78FA0FC3F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredist.msi
- Size 2.6MB
- SHA256 91bdd063f6c53126737791c9eccf0b2f4cf44927831527245bc89a0be06c0cb4
- MD5 b20bbeb818222b657df49a9cfe4fed79
- SHA1 3f6508e880b86502773a3275bc9527f046d45502
- SHA512 f534bc7bf1597e728940e6c3b77f864adfaa413bb1e080458326b692b0f96bddf4fbd294eeed36d7764a3578e6c8e919488bbf63b8fe2d4355ab3efd685424a4
- SSDEEP 49152:BxtG+uBvEH/sbE3EyyBU5czkhwZawV4mC5kRuhg6MmqmPAhe75LzNyS:TuVOTWBdzkkawxSh4iAhm51yS
- TLSH T1E9D5F153BA16E3A2E14862300757CA1C7D7E63E12763761D33FD2358889A6FAD33E548
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIF354.tmp
- Size 28KB
- SHA256 f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f
- MD5 85221b3bcba8dbe4b4a46581aa49f760
- SHA1 746645c92594bfc739f77812d67cfd85f4b92474
- SHA512 060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d
- SSDEEP 192:XOdG/6G4nnykxsdYZ+mrv2ySzLUHypLGgjuXFw5acHKBNtHjhuHWrkA9uBP1WWzT:P6GuZBrvkzAHyxxHKBdaA2dWWzm0ZH
- TLSH T193D20A93BA2494B3DD9031B101EE591652DEC7324B1598E36F1A0ECBBE74DC2DBB118B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 cd248e5c87164f3a8013725a2c0df0a6b590aa79df9e1c612f212d7c6ff8a93e
- MD5 fd9b96cbd5b962a95379e0a6b114addb
- SHA1 0b92eb1606e47f70e509d5878a300aa47a14bf33
- SHA512 ec53f21c708ec8ef458b2b649dc5626918aa285be7cd996e4a66cb59a4de7eb69c61a73569ccd6ecbffd18636facac37527956d660446cfe6f974c519e99d391
- SSDEEP 24576:ru8m+1zqdoO/vvTLL2L+ema/qCkTzFbC39md5k6lT0aKusyWYvFCztAhO:q
- TLSH T1DE47C52476F92100E7F79E3CACF06A2359397D5B9C19EE8D05411F4E0922BB1E872F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{4588d6e0-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{e597369c-6f8d-450a-82ce-f8ca6d6b2f29}_OnDiskSnapshotProp
- Size 6KB
- SHA256 ddac796be8c43ab66417017e4d4cbbeb728baca4fcc319702e465a217de73a34
- MD5 e5e642d1b6dd55e690a8eecf8e170e8a
- SHA1 2ea906a1772adc9c1625455418fa0eafc3b84d51
- SHA512 ff3c48bb7a60f2f0a1d8054ef74c015a946c12c3df2f31109bac8188ab933cfcb9362c36dc06c72ed24936f406f16460fa6021f13ba86039c4c8b61aa0fc124a
- SSDEEP 96:FCZv9BAuvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:QZNb++ZVmN
- TLSH T1D7D198185AE54711E2B3AB322CF18557A877B911EF33CB8E0298238E2670910F875F5F
- MD5 SHA1 SHA512 SSDEEP TLSH