IOC Report
vFjfAgq5PM.msi

vFjfAgq5PM.msi

Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {4203B04D-806D-4EBE-BCFF-E19C0C1E195F}, Number of Words: 2, Subject: Windows Service Association, Author: Microsoft, Name of Creating Application: Windows Service Association, Template: ;1033, Comments: This installer database contains the logic and data required to install Windows Service Association., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200

initial sample

C:\Program Files (x86)\Dropbox\Update\dropbox.exe (copy)

PE32 executable (GUI) Intel 80386, for MS Windows

dropped

C:\Program Files (x86)\Dropbox\Update\goopdate.dll (copy)

PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows

dropped

C:\Users\Public\Documents\CapCut_installer.exe

PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive

dropped

C:\Users\user\AppData\Local\Temp\pssFDDB.ps1

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\scrFDCA.ps1

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\Windows\System32\msiexec.exe

"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\vFjfAgq5PM.msi"

C:\Windows\System32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\SysWOW64\msiexec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 9342AE7FC298454AC0E2B46CA904726C

C:\Windows\SysWOW64\msiexec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 84080775417F402876A00B89D1C4E077 E Global\MSI0000

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

-NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssFDDB.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msiFDC9.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scrFDCA.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scrFDCB.txt" -propSep " :<->: " -testPrefix "_testValue."

C:\Users\Public\Documents\CapCut_installer.exe

"C:\Users\Public\Documents\capcut_installer.exe"

C:\Program Files (x86)\Dropbox\Update\dropbox.exe

"C:\Program Files (x86)\Dropbox\Update\dropbox.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" -Command "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"C:\Program Files (x86)\Dropbox\Update\Dropbox.exe\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'GoogleUpdateTaskMachineUA'"

C:\Program Files (x86)\Dropbox\Update\dropbox.exe

"C:\Program Files (x86)\Dropbox\Update\Dropbox.exe"

C:\Program Files (x86)\Dropbox\Update\dropbox.exe

"C:\Program Files (x86)\Dropbox\Update\Dropbox.exe"