49dc002fa1a0a1e33621a7d9340fb7bd0ac8b9834fc5958823d1f2bed6fa5956

Resubmissions

27-06-2024 00:44

240627-a3xahswdlr 10

27-06-2024 00:40

240627-az8t5swbrn 6

Analysis

max time kernel
97s
max time network
55s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27-06-2024 00:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

setup.msi
Size

25.2MB
MD5

3d87a0e5517c9a8fc4adde50bafe7c76
SHA1

a1ba3b688dcb9b17ed1d430f3032e2884a0565e4
SHA256

49dc002fa1a0a1e33621a7d9340fb7bd0ac8b9834fc5958823d1f2bed6fa5956
SHA512

ebadfdc465dc5c32c854931a9f8712320cfc3752e04b3fec56a1b103c6f225c1de0c6892b1cd90b362f56d38685b8d5851e2cbefdf3291f8389b5cea2e337042
SSDEEP

393216:f+KUUMVzPuPA9BA/UODO0HAAqC+7Rw+lK2WhAS7KdROb7xmq7IrWowIpUDV5:f+YMVD9cECbq+QWhASOdM3N7gTwx

Score

6^/10

persistence privilege_escalation

Malware Config

Signatures

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Drops file in Windows directory 16 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSI661E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI670B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7E3F.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6438.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI65A0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7DF0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{4FC60505-AFAE-4294-8C0A-19D5DD0202F0}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAE78.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5763ab.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI675A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI666E.tmp	msiexec.exe
File created	C:\Windows\Installer\e5763af.msi	msiexec.exe
File created	C:\Windows\Installer\e5763ab.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

Executes dropped EXE 2 IoCs

Processes:

UnRAR.exesteamerrorreporter64.exe

pid process

1488 UnRAR.exe
2400 steamerrorreporter64.exe
Loads dropped DLL 9 IoCs

Processes:

MsiExec.exesteamerrorreporter64.exe

pid process

1772 MsiExec.exe
1772 MsiExec.exe
1772 MsiExec.exe
1772 MsiExec.exe
1772 MsiExec.exe
1772 MsiExec.exe
1772 MsiExec.exe
1772 MsiExec.exe
2400 steamerrorreporter64.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Event Triggered Execution: Installer Packages 1 TTPs 1 IoCs
persistence privilege_escalation

Installer Packages
T1546.016

Processes:

msiexec.exe

pid process

3548 msiexec.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

msiexec.exe

pid process

1128 msiexec.exe
1128 msiexec.exe

pid	process
1488	UnRAR.exe
2400	steamerrorreporter64.exe

pid	process
1772	MsiExec.exe
1772	MsiExec.exe
1772	MsiExec.exe
1772	MsiExec.exe
1772	MsiExec.exe
1772	MsiExec.exe
1772	MsiExec.exe
1772	MsiExec.exe
2400	steamerrorreporter64.exe

pid	process
3548	msiexec.exe

pid	process
1128	msiexec.exe
1128	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	3548	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3548	msiexec.exe
Token: SeSecurityPrivilege	1128	msiexec.exe
Token: SeCreateTokenPrivilege	3548	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3548	msiexec.exe
Token: SeLockMemoryPrivilege	3548	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3548	msiexec.exe
Token: SeMachineAccountPrivilege	3548	msiexec.exe
Token: SeTcbPrivilege	3548	msiexec.exe
Token: SeSecurityPrivilege	3548	msiexec.exe
Token: SeTakeOwnershipPrivilege	3548	msiexec.exe
Token: SeLoadDriverPrivilege	3548	msiexec.exe
Token: SeSystemProfilePrivilege	3548	msiexec.exe
Token: SeSystemtimePrivilege	3548	msiexec.exe
Token: SeProfSingleProcessPrivilege	3548	msiexec.exe
Token: SeIncBasePriorityPrivilege	3548	msiexec.exe
Token: SeCreatePagefilePrivilege	3548	msiexec.exe
Token: SeCreatePermanentPrivilege	3548	msiexec.exe
Token: SeBackupPrivilege	3548	msiexec.exe
Token: SeRestorePrivilege	3548	msiexec.exe
Token: SeShutdownPrivilege	3548	msiexec.exe
Token: SeDebugPrivilege	3548	msiexec.exe
Token: SeAuditPrivilege	3548	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3548	msiexec.exe
Token: SeChangeNotifyPrivilege	3548	msiexec.exe
Token: SeRemoteShutdownPrivilege	3548	msiexec.exe
Token: SeUndockPrivilege	3548	msiexec.exe
Token: SeSyncAgentPrivilege	3548	msiexec.exe
Token: SeEnableDelegationPrivilege	3548	msiexec.exe
Token: SeManageVolumePrivilege	3548	msiexec.exe
Token: SeImpersonatePrivilege	3548	msiexec.exe
Token: SeCreateGlobalPrivilege	3548	msiexec.exe
Token: SeRestorePrivilege	1128	msiexec.exe
Token: SeTakeOwnershipPrivilege	1128	msiexec.exe
Token: SeRestorePrivilege	1128	msiexec.exe
Token: SeTakeOwnershipPrivilege	1128	msiexec.exe
Token: SeRestorePrivilege	1128	msiexec.exe
Token: SeTakeOwnershipPrivilege	1128	msiexec.exe
Token: SeRestorePrivilege	1128	msiexec.exe
Token: SeTakeOwnershipPrivilege	1128	msiexec.exe
Token: SeRestorePrivilege	1128	msiexec.exe
Token: SeTakeOwnershipPrivilege	1128	msiexec.exe
Token: SeRestorePrivilege	1128	msiexec.exe
Token: SeTakeOwnershipPrivilege	1128	msiexec.exe
Token: SeRestorePrivilege	1128	msiexec.exe
Token: SeTakeOwnershipPrivilege	1128	msiexec.exe
Token: SeRestorePrivilege	1128	msiexec.exe
Token: SeTakeOwnershipPrivilege	1128	msiexec.exe
Token: SeRestorePrivilege	1128	msiexec.exe
Token: SeTakeOwnershipPrivilege	1128	msiexec.exe
Token: SeRestorePrivilege	1128	msiexec.exe
Token: SeTakeOwnershipPrivilege	1128	msiexec.exe
Token: SeRestorePrivilege	1128	msiexec.exe
Token: SeTakeOwnershipPrivilege	1128	msiexec.exe
Token: SeRestorePrivilege	1128	msiexec.exe
Token: SeTakeOwnershipPrivilege	1128	msiexec.exe
Token: SeRestorePrivilege	1128	msiexec.exe
Token: SeTakeOwnershipPrivilege	1128	msiexec.exe
Token: SeRestorePrivilege	1128	msiexec.exe
Token: SeTakeOwnershipPrivilege	1128	msiexec.exe
Token: SeRestorePrivilege	1128	msiexec.exe
Token: SeTakeOwnershipPrivilege	1128	msiexec.exe
Token: SeRestorePrivilege	1128	msiexec.exe
Token: SeTakeOwnershipPrivilege	1128	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

3548 msiexec.exe
3548 msiexec.exe

pid	process
3548	msiexec.exe
3548	msiexec.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

msiexec.exe

description	pid	process	target process
PID 1128 wrote to memory of 1772	1128	msiexec.exe	MsiExec.exe
PID 1128 wrote to memory of 1772	1128	msiexec.exe	MsiExec.exe
PID 1128 wrote to memory of 1772	1128	msiexec.exe	MsiExec.exe
PID 1128 wrote to memory of 1488	1128	msiexec.exe	UnRAR.exe
PID 1128 wrote to memory of 1488	1128	msiexec.exe	UnRAR.exe
PID 1128 wrote to memory of 2400	1128	msiexec.exe	steamerrorreporter64.exe
PID 1128 wrote to memory of 2400	1128	msiexec.exe	steamerrorreporter64.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\setup.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3548

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1128

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 4AC0B6D606F75BB175F6E941E86AFAB1
2⤵
- Loads dropped DLL
PID:1772

C:\Users\Admin\AppData\Roaming\Kidoc Wiasc Publisher\PubQuo\UnRAR.exe
"C:\Users\Admin\AppData\Roaming\Kidoc Wiasc Publisher\PubQuo\UnRAR.exe" x -p "C:\Users\Admin\AppData\Roaming\Kidoc Wiasc Publisher\PubQuo\ruw9eigh.rar" "C:\Users\Admin\AppData\Roaming\Kidoc Wiasc Publisher\PubQuo\"
2⤵
- Executes dropped EXE
PID:1488

C:\Users\Admin\AppData\Roaming\Kidoc Wiasc Publisher\PubQuo\steamerrorreporter64.exe
"C:\Users\Admin\AppData\Roaming\Kidoc Wiasc Publisher\PubQuo\steamerrorreporter64.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2400

C:\Windows\system32\notepad.exe
"C:\Windows\system32\notepad.exe"
1⤵
PID:1652

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5763ae.rbs
Filesize
22KB

MD5
a9aaa662cf1978e801f9ae49147832a6

SHA1
d6cfa8ccf862b5061c3269c4fdfefff8709c2039

SHA256
34ce111071fe687abb351d61a1c315bb023e44c235b5a70dc2838fc0da863b7c

SHA512
de4286941073c78530885f50e5433f67159b6012d63e2a0a6828e863d43d47911bd3dc231fb7818784376b013a19dbe257d2d6a4ebbac42ff0ceee16e474e8f8

Download Submit
C:\Users\Admin\AppData\Roaming\Kidoc Wiasc Publisher\PubQuo\UnRAR.exe
Filesize
494KB

MD5
98ccd44353f7bc5bad1bc6ba9ae0cd68

SHA1
76a4e5bf8d298800c886d29f85ee629e7726052d

SHA256
e51021f6cb20efbd2169f2a2da10ce1abca58b4f5f30fbf4bae931e4ecaac99b

SHA512
d6e8146a1055a59cba5e2aaf47f6cb184acdbe28e42ec3daebf1961a91cec5904554d9d433ebf943dd3639c239ef11560fa49f00e1cff02e11cd8d3506c4125f

Download Submit
C:\Users\Admin\AppData\Roaming\Kidoc Wiasc Publisher\PubQuo\ruw9eigh.rar
Filesize
373KB

MD5
3bb1ffe94c9dbb62a7d25f3c284a8b0a

SHA1
3252e94a08282832877209a21f9635454c9214e4

SHA256
61317fbab24ad8b0c043c391b501a8c2850c0e82a466b7c6ccadf9cf1fcd78e9

SHA512
92adcc8abf1d5575c668fac7470321160519000976c044b72f3e4d79ff1571b72d9adf4689e0608d8bbe121b52a58c32f2e8825980fb8285a7383dab77ca5127

Download Submit
C:\Users\Admin\AppData\Roaming\Kidoc Wiasc Publisher\PubQuo\steamerrorreporter64.exe
Filesize
639KB

MD5
fd3ce044ac234fdab3df9d7f492c470a

SHA1
a74a287d5d82a8071ab36c72b2786342d83a8ef7

SHA256
0a0c09753b5103e86e32c2d8086dd1399f0d97a00e1525ec9c390067cdb242ba

SHA512
86d7e805fab0e5130003facbb1525ee261440846f342f53ae64c3f8d676d1208d5fd9bd91e3222c63cc30c443348eb5ddedab14c8847dae138fba7e9be69d08d

Download Submit
C:\Users\Admin\AppData\Roaming\Kidoc Wiasc Publisher\PubQuo\tier0_s64.dll
Filesize
386KB

MD5
7e60404cfb232a1d3708a9892d020e84

SHA1
31328d887bee17641608252fb2f9cd6caf8ba522

SHA256
5a3e15cb90baf4b3ebe0621fa6f5f37b0fe99848387d6f2fd99ae770d1e6d766

SHA512
4d8abd59bd77bdb6e5b5e5f902d2a10fa5136437c51727783e79aed6a796f9ee1807faf14f1a72a1341b9f868f61de8c676b00a4b07a2a26cfb8a4db1b77eb3c

Download Submit
C:\Windows\Installer\MSI6438.tmp
Filesize
738KB

MD5
b158d8d605571ea47a238df5ab43dfaa

SHA1
bb91ae1f2f7142b9099e3cc285f4f5b84de568e4

SHA256
ca763693cc25d316f14a9ebad80ebf00590329550c45adb7e5205486533c2504

SHA512
56aef59c198acf2fcd0d95ea6e32ce1c706e5098a0800feff13ddb427bfb4d538de1c415a5cb5496b09a5825155e3abb1c13c8c37dc31549604bd4d63cb70591

Download Submit
C:\Windows\Installer\MSI670B.tmp
Filesize
1.1MB

MD5
1a2b237796742c26b11a008d0b175e29

SHA1
cfd5affcfb3b6fd407e58dfc7187fad4f186ea18

SHA256
81e0df47bcb2b3380fb0fb58b0d673be4ef1b0367fd2b0d80ab8ee292fc8f730

SHA512
3135d866bf91f9e09b980dd649582072df1f53eabe4c5ac5d34fff1aeb5b6fa01d38d87fc31de19a0887a910e95309bcf0e7ae54e6e8ed2469feb64da4a4f9e5

Download Submit
C:\Windows\Installer\MSI7E3F.tmp
Filesize
364KB

MD5
54d74546c6afe67b3d118c3c477c159a

SHA1
957f08beb7e27e657cd83d8ee50388b887935fae

SHA256
f9956417af079e428631a6c921b79716d960c3b4917c6b7d17ff3cb945f18611

SHA512
d27750b913cc2b7388e9948f42385d0b4124e48335ae7fc0bc6971f4f807dbc9af63fe88675bc440eb42b9a92551bf2d77130b1633ddda90866616b583ae924f

Download Submit
C:\Windows\Installer\e5763ab.msi
Filesize
25.2MB

MD5
3d87a0e5517c9a8fc4adde50bafe7c76

SHA1
a1ba3b688dcb9b17ed1d430f3032e2884a0565e4

SHA256
49dc002fa1a0a1e33621a7d9340fb7bd0ac8b9834fc5958823d1f2bed6fa5956

SHA512
ebadfdc465dc5c32c854931a9f8712320cfc3752e04b3fec56a1b103c6f225c1de0c6892b1cd90b362f56d38685b8d5851e2cbefdf3291f8389b5cea2e337042

Download Submit