Overview
overview
10Static
static
3TapiSyspre...ep.dll
windows10-2004-x64
1TapiSyspre...fm.dll
windows10-2004-x64
1TapiSyspre...sh.dll
windows10-2004-x64
1TapiSyspre...is.dll
windows10-2004-x64
1acledit/Bl...is.dll
windows10-2004-x64
1acledit/De...er.dll
windows10-2004-x64
1acledit/acledit.dll
windows10-2004-x64
1acledit/printui.dll
windows10-2004-x64
1dsreg/dcntel.dll
windows10-2004-x64
1dsreg/dsound.dll
windows10-2004-x64
1dsreg/dsreg.dll
windows10-2004-x64
1dsreg/sensrsvc.dll
windows10-2004-x64
1pcwum/AppxSip.dll
windows10-2004-x64
8pcwum/asferror.dll
windows10-2004-x64
1pcwum/pcwum.dll
windows10-2004-x64
1pcwum/pdhui.dll
windows10-2004-x64
1setup.msi
windows7-x64
6setup.msi
windows10-2004-x64
10wcimage/SEMgrPS.dll
windows10-2004-x64
1wcimage/Se...pi.dll
windows10-2004-x64
1wcimage/ne...vc.dll
windows10-2004-x64
1wcimage/wcimage.dll
windows10-2004-x64
1Analysis
-
max time kernel
117s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
15-06-2024 06:42
Static task
static1
Behavioral task
behavioral1
Sample
TapiSysprep/TapiSysprep.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral2
Sample
TapiSysprep/netprofm.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
TapiSysprep/rpcnsh.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral4
Sample
TapiSysprep/socialapis.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
acledit/BluetoothApis.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral6
Sample
acledit/DevDispItemProvider.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
acledit/acledit.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral8
Sample
acledit/printui.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
dsreg/dcntel.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral10
Sample
dsreg/dsound.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral11
Sample
dsreg/dsreg.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral12
Sample
dsreg/sensrsvc.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral13
Sample
pcwum/AppxSip.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral14
Sample
pcwum/asferror.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
pcwum/pcwum.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral16
Sample
pcwum/pdhui.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral17
Sample
setup.msi
Resource
win7-20240611-en
Behavioral task
behavioral18
Sample
setup.msi
Resource
win10v2004-20240611-en
Behavioral task
behavioral19
Sample
wcimage/SEMgrPS.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral20
Sample
wcimage/SensorsApi.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
wcimage/netprofmsvc.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral22
Sample
wcimage/wcimage.dll
Resource
win10v2004-20240508-en
General
-
Target
setup.msi
-
Size
24.5MB
-
MD5
fdc648bf32226d52c766cb688801246d
-
SHA1
5f619e26d4d301117047c437d9926834a4e28731
-
SHA256
c0ef3f691eadec87fd949159e49d6dfd2ec864a7ec07290cfd128b09d31ab483
-
SHA512
c2a921f284425588f4d683576f6f10c80f24cabfc58442075bcbbbdb6e707e04ee89817ec6cb60a32bfe2a9565fcf07fa715fe4d0acfd487459e28a9f5587d81
-
SSDEEP
786432:2vMECzf6E8AFIkPe/Ey63gQY/RVbwhzP4:2vMuAmkPesy63gQY/v
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc process File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\A: msiexec.exe -
Drops file in System32 directory 1 IoCs
Processes:
powershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Drops file in Windows directory 11 IoCs
Processes:
msiexec.exedescription ioc process File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI79A7.tmp msiexec.exe File opened for modification C:\Windows\Installer\f765b0e.ipi msiexec.exe File opened for modification C:\Windows\Installer\f765b0b.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI5C91.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6116.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI625E.tmp msiexec.exe File created C:\Windows\Installer\f765b0b.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI603A.tmp msiexec.exe File created C:\Windows\Installer\f765b0e.ipi msiexec.exe File created C:\Windows\Installer\f765b10.msi msiexec.exe -
Loads dropped DLL 4 IoCs
Processes:
MsiExec.exepid process 3012 MsiExec.exe 3012 MsiExec.exe 3012 MsiExec.exe 3012 MsiExec.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exemsiexec.exepid process 2260 powershell.exe 2980 msiexec.exe 2980 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
msiexec.exemsiexec.exepowershell.exedescription pid process Token: SeShutdownPrivilege 2780 msiexec.exe Token: SeIncreaseQuotaPrivilege 2780 msiexec.exe Token: SeRestorePrivilege 2980 msiexec.exe Token: SeTakeOwnershipPrivilege 2980 msiexec.exe Token: SeSecurityPrivilege 2980 msiexec.exe Token: SeCreateTokenPrivilege 2780 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2780 msiexec.exe Token: SeLockMemoryPrivilege 2780 msiexec.exe Token: SeIncreaseQuotaPrivilege 2780 msiexec.exe Token: SeMachineAccountPrivilege 2780 msiexec.exe Token: SeTcbPrivilege 2780 msiexec.exe Token: SeSecurityPrivilege 2780 msiexec.exe Token: SeTakeOwnershipPrivilege 2780 msiexec.exe Token: SeLoadDriverPrivilege 2780 msiexec.exe Token: SeSystemProfilePrivilege 2780 msiexec.exe Token: SeSystemtimePrivilege 2780 msiexec.exe Token: SeProfSingleProcessPrivilege 2780 msiexec.exe Token: SeIncBasePriorityPrivilege 2780 msiexec.exe Token: SeCreatePagefilePrivilege 2780 msiexec.exe Token: SeCreatePermanentPrivilege 2780 msiexec.exe Token: SeBackupPrivilege 2780 msiexec.exe Token: SeRestorePrivilege 2780 msiexec.exe Token: SeShutdownPrivilege 2780 msiexec.exe Token: SeDebugPrivilege 2780 msiexec.exe Token: SeAuditPrivilege 2780 msiexec.exe Token: SeSystemEnvironmentPrivilege 2780 msiexec.exe Token: SeChangeNotifyPrivilege 2780 msiexec.exe Token: SeRemoteShutdownPrivilege 2780 msiexec.exe Token: SeUndockPrivilege 2780 msiexec.exe Token: SeSyncAgentPrivilege 2780 msiexec.exe Token: SeEnableDelegationPrivilege 2780 msiexec.exe Token: SeManageVolumePrivilege 2780 msiexec.exe Token: SeImpersonatePrivilege 2780 msiexec.exe Token: SeCreateGlobalPrivilege 2780 msiexec.exe Token: SeRestorePrivilege 2980 msiexec.exe Token: SeTakeOwnershipPrivilege 2980 msiexec.exe Token: SeRestorePrivilege 2980 msiexec.exe Token: SeTakeOwnershipPrivilege 2980 msiexec.exe Token: SeRestorePrivilege 2980 msiexec.exe Token: SeTakeOwnershipPrivilege 2980 msiexec.exe Token: SeRestorePrivilege 2980 msiexec.exe Token: SeTakeOwnershipPrivilege 2980 msiexec.exe Token: SeRestorePrivilege 2980 msiexec.exe Token: SeTakeOwnershipPrivilege 2980 msiexec.exe Token: SeDebugPrivilege 2260 powershell.exe Token: SeRestorePrivilege 2980 msiexec.exe Token: SeTakeOwnershipPrivilege 2980 msiexec.exe Token: SeRestorePrivilege 2980 msiexec.exe Token: SeTakeOwnershipPrivilege 2980 msiexec.exe Token: SeRestorePrivilege 2980 msiexec.exe Token: SeTakeOwnershipPrivilege 2980 msiexec.exe Token: SeRestorePrivilege 2980 msiexec.exe Token: SeTakeOwnershipPrivilege 2980 msiexec.exe Token: SeRestorePrivilege 2980 msiexec.exe Token: SeTakeOwnershipPrivilege 2980 msiexec.exe Token: SeRestorePrivilege 2980 msiexec.exe Token: SeTakeOwnershipPrivilege 2980 msiexec.exe Token: SeRestorePrivilege 2980 msiexec.exe Token: SeTakeOwnershipPrivilege 2980 msiexec.exe Token: SeRestorePrivilege 2980 msiexec.exe Token: SeTakeOwnershipPrivilege 2980 msiexec.exe Token: SeRestorePrivilege 2980 msiexec.exe Token: SeTakeOwnershipPrivilege 2980 msiexec.exe Token: SeRestorePrivilege 2980 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
msiexec.exepid process 2780 msiexec.exe 2780 msiexec.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
msiexec.exeMsiExec.exedescription pid process target process PID 2980 wrote to memory of 3012 2980 msiexec.exe MsiExec.exe PID 2980 wrote to memory of 3012 2980 msiexec.exe MsiExec.exe PID 2980 wrote to memory of 3012 2980 msiexec.exe MsiExec.exe PID 2980 wrote to memory of 3012 2980 msiexec.exe MsiExec.exe PID 2980 wrote to memory of 3012 2980 msiexec.exe MsiExec.exe PID 2980 wrote to memory of 3012 2980 msiexec.exe MsiExec.exe PID 2980 wrote to memory of 3012 2980 msiexec.exe MsiExec.exe PID 3012 wrote to memory of 2260 3012 MsiExec.exe powershell.exe PID 3012 wrote to memory of 2260 3012 MsiExec.exe powershell.exe PID 3012 wrote to memory of 2260 3012 MsiExec.exe powershell.exe PID 3012 wrote to memory of 2260 3012 MsiExec.exe powershell.exe
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\setup.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A58E15DCA491FCDB8C81271531EF03E92⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe-NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss6319.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msi6307.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scr6308.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scr6309.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Config.Msi\f765b0f.rbsFilesize
21KB
MD5c1e5ca19e2f98e4aa1c6fde43b2d369f
SHA13bd34d388abd70ec4fd88c9332e811fff61b3464
SHA25644e8d85eb5960e47520e382d2617b425a7ca8c9b62eac9703edc0c34bdc99c6e
SHA512ce4580785e283906c49212420d8f33e15e998540476c806470a4dd23c8b4b2c268755137e15d0b10a999a4e1183ae81176c80caee8fc1317cf2945d9062cfec3
-
C:\Users\Admin\AppData\Local\Temp\msi6307.txtFilesize
54B
MD59f5bffbb1f8f8340bf45e22a09517ee1
SHA1a5566c63b3681cd56e3b76ed528449ca33a36cc6
SHA2564ca8664da66ad8c90ce03725f92bf7571cf86a290a9ec4a073dad293a60836ef
SHA5128b1b1d13de5aee1748428ffe1ee6131a63e819df8dd42088b7d581ff957adb30e12ba3637e00fac7d7b5aa71a5e35ce09f52772d38f1c441adb19e5e2cd05423
-
C:\Users\Admin\AppData\Local\Temp\pss6319.ps1Filesize
6KB
MD530c30ef2cb47e35101d13402b5661179
SHA125696b2aab86a9233f19017539e2dd83b2f75d4e
SHA25653094df6fa4e57a3265ff04bc1e970c10bcdb3d4094ad6dd610c05b7a8b79e0f
SHA512882be2768138bb75ff7dde7d5ca4c2e024699398baacd0ce1d4619902402e054297e4f464d8cb3c22b2f35d3dabc408122c207facad64ec8014f2c54834cf458
-
C:\Users\Admin\AppData\Local\Temp\scr6308.ps1Filesize
682B
MD5b32210f90a3fbfd1ef15caee45ebc871
SHA191deac74edcf1e6b4c3a81fa322ac76867075c62
SHA256c2aaabc2c09034d97d1ee67d912f25fe5f966539ea19624f062ece0a5aad606b
SHA5127b86aaa400b9f3b73720e99d1ae2f7ef3c4f23a7076b33545cdce6b34a003323fa05203193b1127f0bf25d718fe8d4f81ab282df04ba433dc1219e3f9ba4698b
-
C:\Windows\Installer\MSI5C91.tmpFilesize
738KB
MD5b158d8d605571ea47a238df5ab43dfaa
SHA1bb91ae1f2f7142b9099e3cc285f4f5b84de568e4
SHA256ca763693cc25d316f14a9ebad80ebf00590329550c45adb7e5205486533c2504
SHA51256aef59c198acf2fcd0d95ea6e32ce1c706e5098a0800feff13ddb427bfb4d538de1c415a5cb5496b09a5825155e3abb1c13c8c37dc31549604bd4d63cb70591
-
C:\Windows\Installer\f765b0b.msiFilesize
24.5MB
MD5fdc648bf32226d52c766cb688801246d
SHA15f619e26d4d301117047c437d9926834a4e28731
SHA256c0ef3f691eadec87fd949159e49d6dfd2ec864a7ec07290cfd128b09d31ab483
SHA512c2a921f284425588f4d683576f6f10c80f24cabfc58442075bcbbbdb6e707e04ee89817ec6cb60a32bfe2a9565fcf07fa715fe4d0acfd487459e28a9f5587d81
-
\Windows\Installer\MSI625E.tmpFilesize
758KB
MD5fb4665320c9da54598321c59cc5ed623
SHA189e87b3cc569edd26b5805244cfacb2f9c892bc7
SHA2569fb3156c665211a0081b189142c1d1ab18cda601ee54d5f5d8883ecfa4177a59
SHA512b205552a3cfbaa2202e6ef7e39e229af167b2342a7dc4a2f4cadfe4d05000966cf19e9e208e44d6bb0fd6a56f4283caeed9c13f523e5b301b87f79febb1840cf