Analysis
-
max time kernel
135s -
max time network
123s -
platform
windows7_x64 -
resource
win7 -
submitted
13-07-2020 09:35
Static task
static1
Behavioral task
behavioral1
Sample
62a107.exe
Resource
win7
Behavioral task
behavioral2
Sample
62a107.exe
Resource
win10v200430
General
-
Target
62a107.exe
-
Size
156KB
-
MD5
ddb0136ad007d0b77ca903688776dbc6
-
SHA1
f3d9ca6d33be62b382b3ed2446b733938cac5245
-
SHA256
5852518bca655111976a3d44d8418dac0fcdf45338a5a00e66a9e9d4d2dd6122
-
SHA512
088b2d10929c834f2b52016bb6df50b4eabc2cca4699fc052bf1113c6285946e72a53c69ac466221febef595e83f433117dd462746d0cd0f6645807b0a708b78
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\Read_Me.txt
http://7rzpyw3hflwe2c7h.onion/?QQQQQQQQ
http://helpqvrg3cc5mvb3.onion/
Signatures
-
Modifies Installed Components in the registry 2 TTPs 4 IoCs
Processes:
explorer.exeexplorer.exeexplorer.exeexplorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Modifies service 2 TTPs 4 IoCs
Processes:
explorer.exeexplorer.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas explorer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs explorer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas explorer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs explorer.exe -
Enumerates connected drives 3 TTPs
-
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
62a107.exemsiexec.exedescription pid process target process PID 1104 wrote to memory of 1476 1104 62a107.exe 62a107.exe PID 1104 wrote to memory of 1476 1104 62a107.exe 62a107.exe PID 1104 wrote to memory of 1476 1104 62a107.exe 62a107.exe PID 1104 wrote to memory of 1476 1104 62a107.exe 62a107.exe PID 1104 wrote to memory of 1476 1104 62a107.exe 62a107.exe PID 1104 wrote to memory of 1476 1104 62a107.exe 62a107.exe PID 1104 wrote to memory of 1476 1104 62a107.exe 62a107.exe PID 1104 wrote to memory of 1476 1104 62a107.exe 62a107.exe PID 1104 wrote to memory of 1476 1104 62a107.exe 62a107.exe PID 1104 wrote to memory of 1476 1104 62a107.exe 62a107.exe PID 1972 wrote to memory of 2044 1972 msiexec.exe MsiExec.exe PID 1972 wrote to memory of 2044 1972 msiexec.exe MsiExec.exe PID 1972 wrote to memory of 2044 1972 msiexec.exe MsiExec.exe PID 1972 wrote to memory of 2044 1972 msiexec.exe MsiExec.exe PID 1972 wrote to memory of 2044 1972 msiexec.exe MsiExec.exe PID 1972 wrote to memory of 764 1972 msiexec.exe MsiExec.exe PID 1972 wrote to memory of 764 1972 msiexec.exe MsiExec.exe PID 1972 wrote to memory of 764 1972 msiexec.exe MsiExec.exe PID 1972 wrote to memory of 764 1972 msiexec.exe MsiExec.exe PID 1972 wrote to memory of 764 1972 msiexec.exe MsiExec.exe PID 1972 wrote to memory of 764 1972 msiexec.exe MsiExec.exe PID 1972 wrote to memory of 764 1972 msiexec.exe MsiExec.exe PID 1972 wrote to memory of 396 1972 msiexec.exe MsiExec.exe PID 1972 wrote to memory of 396 1972 msiexec.exe MsiExec.exe PID 1972 wrote to memory of 396 1972 msiexec.exe MsiExec.exe PID 1972 wrote to memory of 396 1972 msiexec.exe MsiExec.exe PID 1972 wrote to memory of 396 1972 msiexec.exe MsiExec.exe -
Modifies data under HKEY_USERS 3 IoCs
Processes:
msiexec.exedescription ioc process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\24\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\24 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25 msiexec.exe -
Drops file in Program Files directory 12083 IoCs
Processes:
62a107.exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0212219.WMF 62a107.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD14844_.GIF 62a107.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME42.CSS 62a107.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libposterize_plugin.dll 62a107.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1254.TXT 62a107.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\pushplaysubpicture.png 62a107.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_SelectionSubpicture.png 62a107.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.jsp.jasper.registry_1.0.300.v20130327-1442.jar 62a107.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waxing-gibbous_partly-cloudy.png 62a107.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\plugin.xml 62a107.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Dublin 62a107.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PROOF\MSSP7EN.dub 62a107.exe File opened for modification C:\Program Files\Microsoft Office\Office14\TaxonomyControl.dll 62a107.exe File opened for modification C:\Program Files\Windows Journal\Templates\Genko_1.jtp 62a107.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Web Folders\MSOSV.DLL 62a107.exe File opened for modification C:\Program Files\Internet Explorer\sqmapi.dll 62a107.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\sawindbg.dll 62a107.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\Read_Me.txt 62a107.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\Microsoft.stdformat.dll 62a107.exe File created C:\Program Files\Common Files\Microsoft Shared\Source Engine\Read_Me.txt 62a107.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\NOTEL.ICO 62a107.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\ehshellLogo.png 62a107.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Read_Me.txt 62a107.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui 62a107.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\leftnav.gif 62a107.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01060_.WMF 62a107.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\feature.properties 62a107.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-options-keymap.xml 62a107.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-openide-util-enumerations.xml_hidden 62a107.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD00437_.WMF 62a107.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\TipsImageMask.bmp 62a107.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\Read_Me.txt 62a107.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\content-types.properties 62a107.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-14 62a107.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\vlc.mo 62a107.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\Locales\gu.pak 62a107.exe File created C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\Read_Me.txt 62a107.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0228823.WMF 62a107.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\Read_Me.txt 62a107.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-ui_ja.jar 62a107.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD20013_.WMF 62a107.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PARNT_02.MID 62a107.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\TN00411_.WMF 62a107.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0212661.WMF 62a107.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\Read_Me.txt 62a107.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.nl_zh_4.4.0.v20140623020002.jar 62a107.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-execution_zh_CN.jar 62a107.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-time-l1-1-0.dll 62a107.exe File opened for modification C:\Program Files\Mozilla Firefox\lgpllibs.dll 62a107.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH03224I.JPG 62a107.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18247_.WMF 62a107.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME14.CSS 62a107.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGLBL111.XML 62a107.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\vlc.mo 62a107.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 62a107.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+1 62a107.exe File created C:\Program Files\Java\jre7\lib\zi\America\Argentina\Read_Me.txt 62a107.exe File opened for modification C:\Program Files (x86)\Windows Media Player\en-US\wmplayer.exe.mui 62a107.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME22.CSS 62a107.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\UrbanPhotoAlbum.potx 62a107.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_output\libwasapi_plugin.dll 62a107.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty_settings.png 62a107.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\7.png 62a107.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Nome 62a107.exe -
Drops desktop.ini file(s) 41 IoCs
Processes:
62a107.exeexplorer.exedescription ioc process File opened for modification C:\Users\Public\Documents\desktop.ini 62a107.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 62a107.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 62a107.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 62a107.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 62a107.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 62a107.exe File opened for modification C:\Users\Admin\Music\desktop.ini 62a107.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 62a107.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 62a107.exe File opened for modification C:\Program Files\desktop.ini 62a107.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 62a107.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\RBDIK06K\desktop.ini 62a107.exe File opened for modification C:\Users\Public\Videos\desktop.ini 62a107.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 62a107.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 62a107.exe File opened for modification C:\Users\Admin\Links\desktop.ini 62a107.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 62a107.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\AJM03J3Y\desktop.ini 62a107.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini 62a107.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 62a107.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 62a107.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 62a107.exe File opened for modification C:\Users\Public\Music\desktop.ini 62a107.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 62a107.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 62a107.exe File opened for modification C:\Program Files (x86)\desktop.ini 62a107.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 62a107.exe File opened for modification C:\Users\Public\desktop.ini 62a107.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 62a107.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 62a107.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\ZMLBLRQ7\desktop.ini 62a107.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 62a107.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 62a107.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 62a107.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 62a107.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 62a107.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 62a107.exe File opened for modification \??\M:\$RECYCLE.BIN\S-1-5-21-1131729243-447456001-3632642222-1000\desktop.ini explorer.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\TGVUK4BG\desktop.ini 62a107.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 62a107.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 62a107.exe -
Drops startup file 1 IoCs
Processes:
62a107.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Read_Me.txt 62a107.exe -
Suspicious behavior: EnumeratesProcesses 4530 IoCs
Processes:
62a107.exepid process 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe 1476 62a107.exe -
Suspicious use of FindShellTrayWindow 86 IoCs
Processes:
explorer.exeexplorer.exeexplorer.exeexplorer.exepid process 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1840 explorer.exe 1840 explorer.exe 1840 explorer.exe 1840 explorer.exe 1840 explorer.exe 1840 explorer.exe 1840 explorer.exe 1924 explorer.exe 1924 explorer.exe 1924 explorer.exe 1924 explorer.exe 1924 explorer.exe 1924 explorer.exe 1924 explorer.exe 1924 explorer.exe 1924 explorer.exe 1924 explorer.exe 1924 explorer.exe 1924 explorer.exe 1924 explorer.exe 1924 explorer.exe 1924 explorer.exe 1924 explorer.exe 1924 explorer.exe 1924 explorer.exe 1924 explorer.exe 1924 explorer.exe 1924 explorer.exe 1924 explorer.exe 1924 explorer.exe 1924 explorer.exe 1924 explorer.exe 1924 explorer.exe 1924 explorer.exe 1868 explorer.exe 1868 explorer.exe 1868 explorer.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of AdjustPrivilegeToken 966 IoCs
Processes:
explorer.exemsiexec.exedescription pid process Token: SeShutdownPrivilege 1696 explorer.exe Token: SeShutdownPrivilege 1696 explorer.exe Token: SeShutdownPrivilege 1696 explorer.exe Token: SeShutdownPrivilege 1696 explorer.exe Token: SeShutdownPrivilege 1696 explorer.exe Token: SeShutdownPrivilege 1696 explorer.exe Token: SeShutdownPrivilege 1696 explorer.exe Token: SeShutdownPrivilege 1696 explorer.exe Token: SeShutdownPrivilege 1696 explorer.exe Token: SeShutdownPrivilege 1696 explorer.exe Token: SeIncreaseQuotaPrivilege 1696 explorer.exe Token: SeRestorePrivilege 1972 msiexec.exe Token: SeTakeOwnershipPrivilege 1972 msiexec.exe Token: SeSecurityPrivilege 1972 msiexec.exe Token: SeCreateTokenPrivilege 1696 explorer.exe Token: SeAssignPrimaryTokenPrivilege 1696 explorer.exe Token: SeLockMemoryPrivilege 1696 explorer.exe Token: SeIncreaseQuotaPrivilege 1696 explorer.exe Token: SeMachineAccountPrivilege 1696 explorer.exe Token: SeTcbPrivilege 1696 explorer.exe Token: SeSecurityPrivilege 1696 explorer.exe Token: SeTakeOwnershipPrivilege 1696 explorer.exe Token: SeLoadDriverPrivilege 1696 explorer.exe Token: SeSystemProfilePrivilege 1696 explorer.exe Token: SeSystemtimePrivilege 1696 explorer.exe Token: SeProfSingleProcessPrivilege 1696 explorer.exe Token: SeIncBasePriorityPrivilege 1696 explorer.exe Token: SeCreatePagefilePrivilege 1696 explorer.exe Token: SeCreatePermanentPrivilege 1696 explorer.exe Token: SeBackupPrivilege 1696 explorer.exe Token: SeRestorePrivilege 1696 explorer.exe Token: SeShutdownPrivilege 1696 explorer.exe Token: SeDebugPrivilege 1696 explorer.exe Token: SeAuditPrivilege 1696 explorer.exe Token: SeSystemEnvironmentPrivilege 1696 explorer.exe Token: SeChangeNotifyPrivilege 1696 explorer.exe Token: SeRemoteShutdownPrivilege 1696 explorer.exe Token: SeUndockPrivilege 1696 explorer.exe Token: SeSyncAgentPrivilege 1696 explorer.exe Token: SeEnableDelegationPrivilege 1696 explorer.exe Token: SeManageVolumePrivilege 1696 explorer.exe Token: SeImpersonatePrivilege 1696 explorer.exe Token: SeCreateGlobalPrivilege 1696 explorer.exe Token: SeRestorePrivilege 1972 msiexec.exe Token: SeTakeOwnershipPrivilege 1972 msiexec.exe Token: SeRestorePrivilege 1972 msiexec.exe Token: SeTakeOwnershipPrivilege 1972 msiexec.exe Token: SeShutdownPrivilege 1696 explorer.exe Token: SeShutdownPrivilege 1696 explorer.exe Token: SeShutdownPrivilege 1696 explorer.exe Token: SeShutdownPrivilege 1696 explorer.exe Token: SeRestorePrivilege 1972 msiexec.exe Token: SeTakeOwnershipPrivilege 1972 msiexec.exe Token: SeRestorePrivilege 1972 msiexec.exe Token: SeTakeOwnershipPrivilege 1972 msiexec.exe Token: SeRestorePrivilege 1972 msiexec.exe Token: SeTakeOwnershipPrivilege 1972 msiexec.exe Token: SeRestorePrivilege 1972 msiexec.exe Token: SeTakeOwnershipPrivilege 1972 msiexec.exe Token: SeRestorePrivilege 1972 msiexec.exe Token: SeTakeOwnershipPrivilege 1972 msiexec.exe Token: SeRestorePrivilege 1972 msiexec.exe Token: SeTakeOwnershipPrivilege 1972 msiexec.exe Token: SeRestorePrivilege 1972 msiexec.exe -
Suspicious use of SendNotifyMessage 97 IoCs
Processes:
explorer.exeexplorer.exeexplorer.exepid process 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1696 explorer.exe 1840 explorer.exe 1840 explorer.exe 1840 explorer.exe 1840 explorer.exe 1840 explorer.exe 1840 explorer.exe 1840 explorer.exe 1840 explorer.exe 1840 explorer.exe 1840 explorer.exe 1840 explorer.exe 1840 explorer.exe 1840 explorer.exe 1840 explorer.exe 1840 explorer.exe 1924 explorer.exe 1924 explorer.exe 1924 explorer.exe 1924 explorer.exe 1924 explorer.exe 1924 explorer.exe 1924 explorer.exe 1924 explorer.exe 1924 explorer.exe 1924 explorer.exe 1924 explorer.exe 1924 explorer.exe 1924 explorer.exe 1924 explorer.exe 1924 explorer.exe 1924 explorer.exe 1924 explorer.exe 1924 explorer.exe 1924 explorer.exe 1924 explorer.exe -
Modifies registry class 208 IoCs
Processes:
explorer.exemsiexec.exeexplorer.exedescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\HTMLHelp\2.0\LocalReg\CLSID msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\HTMLHelp\2.0\LocalReg\CLSID\{314111e2-a502-11d2-bbca-00c04f8ec294} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{314111c7-a502-11d2-bbca-00c04f8ec294}\TypeLib\ = "{31411197-a502-11d2-bbca-00c04f8ec294}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31411198-a502-11d2-bbca-00c04f8ec294}\VersionIndependentProgID\ = "HxDS.HxSession" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31411198-a502-11d2-bbca-00c04f8ec294}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4} msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\HTMLHelp\2.0\LocalReg\CLSID\{314111bd-a502-11d2-bbca-00c04f8ec294}\VersionIndependentProgID msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\ShellEx msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{314111f0-a502-11d2-bbca-00c04f8ec294}\VersionIndependentProgID msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{31411198-a502-11d2-bbca-00c04f8ec294}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4} msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\HTMLHelp\2.0\LocalReg\CLSID\{314111bd-a502-11d2-bbca-00c04f8ec294}\ProgID msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\HTMLHelp\2.0\LocalReg\CLSID\{314111e2-a502-11d2-bbca-00c04f8ec294}\InprocServer32 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\shell\edit\command msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{31411228-a502-11d2-bbca-00c04f8ec294}\Implemented Categories msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\HTMLHelp\2.0\LocalReg\CLSID\{314111bd-a502-11d2-bbca-00c04f8ec294}\InprocServer32\ = "C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" msiexec.exe Set value (data) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\HTMLHelp\2.0\LocalReg\CLSID\{314111db-a502-11d2-bbca-00c04f8ec294}\Programmable msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{314111f7-a502-11d2-bbca-00c04f8ec294}\TypeLib msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{31411228-a502-11d2-bbca-00c04f8ec294}\ProgID msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31411219-a502-11d2-bbca-00c04f8ec294}\Programmable\ msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\SOFTWARE\Microsoft\HTMLHelp\2.0\LocalReg\CLSID\{314111db-a502-11d2-bbca-00c04f8ec294}\Programmable msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{314111c7-a502-11d2-bbca-00c04f8ec294}\TypeLib msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31411198-a502-11d2-bbca-00c04f8ec294}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}\ msiexec.exe Set value (data) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{314111f7-a502-11d2-bbca-00c04f8ec294}\Implemented Categories msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{314111f0-a502-11d2-bbca-00c04f8ec294}\VersionIndependentProgID msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31411219-a502-11d2-bbca-00c04f8ec294}\TypeLib\ = "{31411197-A502-11D2-BBCA-00C04F8EC294}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\SOFTWARE\Microsoft\HTMLHelp\2.0\LocalReg\CLSID\{314111e2-a502-11d2-bbca-00c04f8ec294}\ProgID msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{314111c7-a502-11d2-bbca-00c04f8ec294}\Implemented Categories msiexec.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31411219-a502-11d2-bbca-00c04f8ec294}\TypeLib msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{31411219-a502-11d2-bbca-00c04f8ec294}\TypeLib msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\SOFTWARE\Microsoft\HTMLHelp\2.0\LocalReg\CLSID\{314111e2-a502-11d2-bbca-00c04f8ec294}\Programmable msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{314111f7-a502-11d2-bbca-00c04f8ec294}\TypeLib\ = "{31411197-a502-11d2-bbca-00c04f8ec294}" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\HTMLHelp\2.0\LocalReg\CLSID\{314111db-a502-11d2-bbca-00c04f8ec294}\ = "HxPlugIn Class" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\SOFTWARE\Microsoft\HTMLHelp\2.0\LocalReg\CLSID\{314111db-a502-11d2-bbca-00c04f8ec294}\Implemented Categories msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\HTMLHelp\2.0\LocalReg\CLSID\{314111bd-a502-11d2-bbca-00c04f8ec294}\TypeLib msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\HTMLHelp\2.0\LocalReg\CLSID\{314111e2-a502-11d2-bbca-00c04f8ec294}\Programmable msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31411228-a502-11d2-bbca-00c04f8ec294}\Implemented Categories msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{314111f7-a502-11d2-bbca-00c04f8ec294} msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{31411198-a502-11d2-bbca-00c04f8ec294}\TypeLib msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31411198-a502-11d2-bbca-00c04f8ec294}\TypeLib\ = "{31411197-a502-11d2-bbca-00c04f8ec294}" msiexec.exe Set value (data) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\DefaultIcon msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\xmlfile\shell\edit msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{31411198-a502-11d2-bbca-00c04f8ec294} msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31411198-a502-11d2-bbca-00c04f8ec294}\TypeLib msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\SOFTWARE\Microsoft\HTMLHelp\2.0\LocalReg\CLSID\{314111e2-a502-11d2-bbca-00c04f8ec294}\TypeLib msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\HTMLHelp\2.0\LocalReg\CLSID\{314111db-a502-11d2-bbca-00c04f8ec294}\TypeLib\ = "{314111d9-a502-11d2-bbca-00c04f8ec294}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\SOFTWARE\Microsoft\HTMLHelp\2.0\LocalReg\CLSID\{314111db-a502-11d2-bbca-00c04f8ec294}\ProgID msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\HTMLHelp\2.0 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\SOFTWARE\Microsoft\HTMLHelp\2.0\LocalReg\CLSID\{314111db-a502-11d2-bbca-00c04f8ec294}\TypeLib msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\HTMLHelp\2.0\LocalReg\CLSID\{314111bd-a502-11d2-bbca-00c04f8ec294}\VersionIndependentProgID\ = "HxDs.HxRegister" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{314111c7-a502-11d2-bbca-00c04f8ec294} msiexec.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_Classes\Local Settings explorer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{314111c7-a502-11d2-bbca-00c04f8ec294}\Programmable msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{31411219-a502-11d2-bbca-00c04f8ec294}\ProgID msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\SOFTWARE\Microsoft\HTMLHelp\2.0\LocalReg\CLSID\{314111e2-a502-11d2-bbca-00c04f8ec294} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{314111c7-a502-11d2-bbca-00c04f8ec294}\ = "HxProtocol Class" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31411198-a502-11d2-bbca-00c04f8ec294}\ProgID\ = "HxDS.HxSession.1" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{31411228-a502-11d2-bbca-00c04f8ec294}\Programmable msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\HTMLHelp\2.0\LocalReg\CLSID\{314111e2-a502-11d2-bbca-00c04f8ec294}\Implemented Categories\ msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{31411198-a502-11d2-bbca-00c04f8ec294}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4} msiexec.exe -
Drops file in Windows directory 42 IoCs
Processes:
msiexec.exedescription ioc process File opened for modification C:\Windows\Installer\MSIC4E7.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID61B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIFC26.tmp msiexec.exe File created C:\Windows\Installer\1bb65.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI2221.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3455.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3EB5.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIBF97.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC5E2.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIEA1B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF986.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1E59.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2436.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI257F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2D6C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI32BD.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2ED6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC370.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID7B1.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3D6A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC6EC.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI403C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4241.tmp msiexec.exe File created C:\Windows\Installer\1bb62.mst msiexec.exe File opened for modification C:\Windows\Installer\MSIC0C1.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC799.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1968.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2270.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3DF8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4175.tmp msiexec.exe File opened for modification C:\Windows\Installer\1bb62.mst msiexec.exe File opened for modification C:\Windows\Installer\MSID89C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4BD4.tmp msiexec.exe File opened for modification C:\Windows\Installer\1bb65.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIBE20.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI1958.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI22CF.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2DDA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2E68.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3379.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4A6C.tmp msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
62a107.exedescription pid process target process PID 1104 set thread context of 1476 1104 62a107.exe 62a107.exe -
Loads dropped DLL 40 IoCs
Processes:
MsiExec.exeMsiExec.exeMsiExec.exepid process 2044 MsiExec.exe 2044 MsiExec.exe 764 MsiExec.exe 2044 MsiExec.exe 2044 MsiExec.exe 2044 MsiExec.exe 2044 MsiExec.exe 764 MsiExec.exe 2044 MsiExec.exe 2044 MsiExec.exe 2044 MsiExec.exe 2044 MsiExec.exe 2044 MsiExec.exe 2044 MsiExec.exe 764 MsiExec.exe 2044 MsiExec.exe 764 MsiExec.exe 2044 MsiExec.exe 2044 MsiExec.exe 764 MsiExec.exe 764 MsiExec.exe 764 MsiExec.exe 764 MsiExec.exe 764 MsiExec.exe 764 MsiExec.exe 2044 MsiExec.exe 2044 MsiExec.exe 2044 MsiExec.exe 2044 MsiExec.exe 2044 MsiExec.exe 396 MsiExec.exe 396 MsiExec.exe 396 MsiExec.exe 396 MsiExec.exe 396 MsiExec.exe 396 MsiExec.exe 396 MsiExec.exe 396 MsiExec.exe 396 MsiExec.exe 396 MsiExec.exe -
Registers COM server for autorun 1 TTPs 24 IoCs
Processes:
msiexec.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31411228-a502-11d2-bbca-00c04f8ec294}\InprocServer32\ = "C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{31411219-a502-11d2-bbca-00c04f8ec294}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{31411198-a502-11d2-bbca-00c04f8ec294}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31411198-a502-11d2-bbca-00c04f8ec294}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31411198-a502-11d2-bbca-00c04f8ec294}\InprocServer32\ = "C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31411198-a502-11d2-bbca-00c04f8ec294}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{31411228-a502-11d2-bbca-00c04f8ec294}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{314111f0-a502-11d2-bbca-00c04f8ec294}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31411228-a502-11d2-bbca-00c04f8ec294}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{314111c7-a502-11d2-bbca-00c04f8ec294}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{314111c7-a502-11d2-bbca-00c04f8ec294}\InprocServer32 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{314111f0-a502-11d2-bbca-00c04f8ec294}\InprocServer32 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{314111f7-a502-11d2-bbca-00c04f8ec294}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{314111f0-a502-11d2-bbca-00c04f8ec294}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{314111f0-a502-11d2-bbca-00c04f8ec294}\InprocServer32\ = "C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{314111f7-a502-11d2-bbca-00c04f8ec294}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{314111f7-a502-11d2-bbca-00c04f8ec294}\InprocServer32\ = "C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31411219-a502-11d2-bbca-00c04f8ec294}\InprocServer32\ = "C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31411219-a502-11d2-bbca-00c04f8ec294}\InprocServer32 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31411228-a502-11d2-bbca-00c04f8ec294}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{314111c7-a502-11d2-bbca-00c04f8ec294}\InprocServer32\ = "C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{314111c7-a502-11d2-bbca-00c04f8ec294}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{314111f7-a502-11d2-bbca-00c04f8ec294}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31411219-a502-11d2-bbca-00c04f8ec294}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\62a107.exe"C:\Users\Admin\AppData\Local\Temp\62a107.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\62a107.exe"{path}"2⤵
- Drops file in Program Files directory
- Drops desktop.ini file(s)
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies service
- Drops desktop.ini file(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
- Modifies registry class
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of WriteProcessMemory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Modifies registry class
- Drops file in Windows directory
- Registers COM server for autorun
-
C:\Windows\system32\MsiExec.exeC:\Windows\system32\MsiExec.exe -Embedding 244E34865E46121BD9C215D7B74717A42⤵
- Loads dropped DLL
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D05FAD2724D0DB292EF4058EF522AAFC2⤵
- Loads dropped DLL
-
C:\Windows\system32\MsiExec.exeC:\Windows\system32\MsiExec.exe -Embedding 6E9903C1490FC0B69CBBD04254E96381 M Global\MSI00002⤵
- Loads dropped DLL
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies service
- Suspicious use of FindShellTrayWindow
- Modifies registry class
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Hx1F71.tmp
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\Read_Me.txt
-
C:\Users\Admin\Desktop\ApproveTest.tif.readme
-
C:\Users\Admin\Desktop\CloseRegister.cab.readme
-
C:\Users\Admin\Desktop\CompareEdit.vbs.readme
-
C:\Users\Admin\Desktop\ConfirmRemove.mpeg.readme
-
C:\Users\Admin\Desktop\ConnectSwitch.vssx.readme
-
C:\Users\Admin\Desktop\ConvertToGet.xls.readme
-
C:\Users\Admin\Desktop\DebugHide.dll.readme
-
C:\Users\Admin\Desktop\ExpandShow.WTV.readme
-
C:\Users\Admin\Desktop\HideOptimize.avi.readme
-
C:\Users\Admin\Desktop\LockRestore.png.readme
-
C:\Users\Admin\Desktop\OpenPush.txt.readme
-
C:\Users\Admin\Desktop\OpenSuspend.vssx.readme
-
C:\Users\Admin\Desktop\OutInstall.vst.readme
-
C:\Users\Admin\Desktop\OutTrace.vdw.readme
-
C:\Users\Admin\Desktop\PingFind.DVR.readme
-
C:\Users\Admin\Desktop\Read_Me.txt
-
C:\Users\Admin\Desktop\RenameSync.lock.readme
-
C:\Users\Admin\Desktop\ResetMeasure.vbs.readme
-
C:\Users\Admin\Desktop\RestartBackup.crw.readme
-
C:\Users\Admin\Desktop\RestartSkip.odt.readme
-
C:\Users\Admin\Desktop\RestartSwitch.DVR-MS.readme
-
C:\Users\Admin\Desktop\SaveDisconnect.xls.readme
-
C:\Users\Admin\Desktop\SendEnter.vb.readme
-
C:\Users\Admin\Desktop\SplitResume.xht.readme
-
C:\Users\Admin\Desktop\SplitTest.001.readme
-
C:\Users\Admin\Desktop\SuspendPop.potm.readme
-
C:\Users\Admin\Desktop\SwitchUnblock.iso.readme
-
C:\Users\Admin\Desktop\UnregisterMerge.cmd.readme
-
C:\Users\Admin\Desktop\WritePush.kix.readme
-
C:\Users\Admin\Desktop\desktop.ini.readme
-
C:\Users\Public\Desktop\Adobe Reader 9.lnk.readme
-
C:\Users\Public\Desktop\Firefox.lnk.readme
-
C:\Users\Public\Desktop\Google Chrome.lnk.readme
-
C:\Users\Public\Desktop\Read_Me.txt
-
C:\Users\Public\Desktop\VLC media player.lnk.readme
-
C:\Users\Public\Desktop\desktop.ini.readme
-
C:\Windows\Installer\MSI1968.tmp
-
C:\Windows\Installer\MSI1E59.tmp
-
C:\Windows\Installer\MSI2221.tmp
-
C:\Windows\Installer\MSI2270.tmp
-
C:\Windows\Installer\MSI22CF.tmp
-
C:\Windows\Installer\MSI2436.tmp
-
C:\Windows\Installer\MSI257F.tmp
-
C:\Windows\Installer\MSI2D6C.tmp
-
C:\Windows\Installer\MSI2DDA.tmp
-
C:\Windows\Installer\MSI2E68.tmp
-
C:\Windows\Installer\MSI2ED6.tmp
-
C:\Windows\Installer\MSI32BD.tmp
-
C:\Windows\Installer\MSI3379.tmp
-
C:\Windows\Installer\MSI3455.tmp
-
C:\Windows\Installer\MSI3D6A.tmp
-
C:\Windows\Installer\MSI3DF8.tmp
-
C:\Windows\Installer\MSI3EB5.tmp
-
C:\Windows\Installer\MSI403C.tmp
-
C:\Windows\Installer\MSI4175.tmp
-
C:\Windows\Installer\MSI4241.tmp
-
C:\Windows\Installer\MSI4A6C.tmp
-
C:\Windows\Installer\MSI4BD4.tmp
-
C:\Windows\Installer\MSIBE20.tmp
-
C:\Windows\Installer\MSIBF97.tmp
-
C:\Windows\Installer\MSIC0C1.tmp
-
C:\Windows\Installer\MSIC370.tmp
-
C:\Windows\Installer\MSIC4E7.tmp
-
C:\Windows\Installer\MSIC5E2.tmp
-
C:\Windows\Installer\MSIC6EC.tmp
-
C:\Windows\Installer\MSIC799.tmp
-
C:\Windows\Installer\MSID61B.tmp
-
C:\Windows\Installer\MSID7B1.tmp
-
C:\Windows\Installer\MSID89C.tmp
-
C:\Windows\Installer\MSIEA1B.tmp
-
C:\Windows\Installer\MSIF986.tmp
-
C:\Windows\Installer\MSIFC26.tmp
-
\??\M:\$RECYCLE.BIN\S-1-5-21-1131729243-447456001-3632642222-1000\desktop.ini
-
\Users\Admin\AppData\Local\Temp\Hx1F71.tmp
-
\Users\Admin\AppData\Local\Temp\Hx1F71.tmp
-
\Users\Admin\AppData\Local\Temp\Hx1F71.tmp
-
\Users\Admin\AppData\Local\Temp\Hx1F71.tmp
-
\Windows\Installer\MSI1968.tmp
-
\Windows\Installer\MSI1E59.tmp
-
\Windows\Installer\MSI2221.tmp
-
\Windows\Installer\MSI2270.tmp
-
\Windows\Installer\MSI22CF.tmp
-
\Windows\Installer\MSI2436.tmp
-
\Windows\Installer\MSI257F.tmp
-
\Windows\Installer\MSI2D6C.tmp
-
\Windows\Installer\MSI2DDA.tmp
-
\Windows\Installer\MSI2E68.tmp
-
\Windows\Installer\MSI2ED6.tmp
-
\Windows\Installer\MSI32BD.tmp
-
\Windows\Installer\MSI3379.tmp
-
\Windows\Installer\MSI3455.tmp
-
\Windows\Installer\MSI3D6A.tmp
-
\Windows\Installer\MSI3DF8.tmp
-
\Windows\Installer\MSI3EB5.tmp
-
\Windows\Installer\MSI403C.tmp
-
\Windows\Installer\MSI4175.tmp
-
\Windows\Installer\MSI4241.tmp
-
\Windows\Installer\MSI4A6C.tmp
-
\Windows\Installer\MSI4BD4.tmp
-
\Windows\Installer\MSIBE20.tmp
-
\Windows\Installer\MSIBF97.tmp
-
\Windows\Installer\MSIC0C1.tmp
-
\Windows\Installer\MSIC370.tmp
-
\Windows\Installer\MSIC4E7.tmp
-
\Windows\Installer\MSIC5E2.tmp
-
\Windows\Installer\MSIC6EC.tmp
-
\Windows\Installer\MSIC799.tmp
-
\Windows\Installer\MSID61B.tmp
-
\Windows\Installer\MSID7B1.tmp
-
\Windows\Installer\MSID89C.tmp
-
\Windows\Installer\MSIEA1B.tmp
-
\Windows\Installer\MSIF986.tmp
-
\Windows\Installer\MSIFC26.tmp
-
memory/396-125-0x0000000000000000-mapping.dmp
-
memory/764-20-0x0000000000000000-mapping.dmp
-
memory/1104-1-0x0000000000000000-0x0000000000000000-disk.dmp
-
memory/1476-4-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1476-3-0x0000000000407CA0-mapping.dmp
-
memory/1476-2-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1696-14-0x0000000004F80000-0x0000000004F84000-memory.dmpFilesize
16KB
-
memory/1696-5-0x0000000003AB0000-0x0000000003AB1000-memory.dmpFilesize
4KB
-
memory/1696-13-0x0000000009780000-0x0000000009784000-memory.dmpFilesize
16KB
-
memory/1840-33-0x0000000003920000-0x0000000003921000-memory.dmpFilesize
4KB
-
memory/1868-147-0x0000000003750000-0x0000000003751000-memory.dmpFilesize
4KB
-
memory/1924-42-0x0000000008F70000-0x0000000008F74000-memory.dmpFilesize
16KB
-
memory/1924-43-0x0000000004770000-0x0000000004774000-memory.dmpFilesize
16KB
-
memory/1972-138-0x0000000005AC0000-0x0000000005AC4000-memory.dmpFilesize
16KB
-
memory/1972-50-0x0000000002C20000-0x0000000002C24000-memory.dmpFilesize
16KB
-
memory/1972-51-0x0000000002BA0000-0x0000000002BA4000-memory.dmpFilesize
16KB
-
memory/1972-98-0x0000000002BA0000-0x0000000002BA4000-memory.dmpFilesize
16KB
-
memory/1972-144-0x0000000005AC0000-0x0000000005AC4000-memory.dmpFilesize
16KB
-
memory/1972-145-0x0000000004CB0000-0x0000000004CD0000-memory.dmpFilesize
128KB
-
memory/1972-146-0x00000000011B0000-0x00000000011B4000-memory.dmpFilesize
16KB
-
memory/1972-124-0x0000000004CB0000-0x0000000004CD0000-memory.dmpFilesize
128KB
-
memory/2044-15-0x0000000000000000-mapping.dmp