Analysis
- max time kernel
150s - max time network
15s - platform
windows7_x64 - resource
win7v20201028 - submitted
12/11/2020, 14:04
Static task
static1
Behavioral task
behavioral1
Sample
f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe
- Size 13.9MB
- Sample201112-5gff8afpvs
- SHA256 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242
- MD5 ae942cb5775e61dcd37f4df9ed16c702
- SHA1 0afafcf5dc6a9432de7eb17b7626f589da3323a9
- SHA512 eb3ecc22adda1b3ae6a22aa03ee9f9100bb9388f83d1ec3f42d2767143633a52b1608f2c3d8e1d5d856ea45230a4ce3d23077a4783152c0e306ac4bccb396d0f
- MD5 SHA1 SHA512
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 5 IoCs
pid Process 2000 MsiExec.exe 2044 MsiExec.exe 2044 MsiExec.exe 2044 MsiExec.exe 2044 MsiExec.exe - Enumerates connected drives 3 TTPs 72 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\L: f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe File opened (read-only) \??\N: f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\B: f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe File opened (read-only) \??\I: f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe File opened (read-only) \??\O: f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe File opened (read-only) \??\S: f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\F: f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe File opened (read-only) \??\W: f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\U: f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe File opened (read-only) \??\V: f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\A: f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe File opened (read-only) \??\J: f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe File opened (read-only) \??\M: f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe File opened (read-only) \??\Y: f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe File opened (read-only) \??\T: f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\E: f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe File opened (read-only) \??\G: f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe File opened (read-only) \??\Q: f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe File opened (read-only) \??\Z: f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe File opened (read-only) \??\R: f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\P: f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\X: f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe - JavaScript code in executable 1 IoCs
resource yara_rule behavioral1/files/0x00030000000130ff-11.dat js - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1728 msiexec.exe - Suspicious use of AdjustPrivilegeToken 179 IoCs
description pid Process Token: SeRestorePrivilege 1444 msiexec.exe Token: SeTakeOwnershipPrivilege 1444 msiexec.exe Token: SeSecurityPrivilege 1444 msiexec.exe Token: SeCreateTokenPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeAssignPrimaryTokenPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeLockMemoryPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeIncreaseQuotaPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeMachineAccountPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeTcbPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeSecurityPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeTakeOwnershipPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeLoadDriverPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeSystemProfilePrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeSystemtimePrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeProfSingleProcessPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeIncBasePriorityPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeCreatePagefilePrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeCreatePermanentPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeBackupPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeRestorePrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeShutdownPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeDebugPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeAuditPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeSystemEnvironmentPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeChangeNotifyPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeRemoteShutdownPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeUndockPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeSyncAgentPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeEnableDelegationPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeManageVolumePrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeImpersonatePrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeCreateGlobalPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeCreateTokenPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeAssignPrimaryTokenPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeLockMemoryPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeIncreaseQuotaPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeMachineAccountPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeTcbPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeSecurityPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeTakeOwnershipPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeLoadDriverPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeSystemProfilePrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeSystemtimePrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeProfSingleProcessPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeIncBasePriorityPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeCreatePagefilePrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeCreatePermanentPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeBackupPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeRestorePrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeShutdownPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeDebugPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeAuditPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeSystemEnvironmentPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeChangeNotifyPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeRemoteShutdownPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeUndockPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeSyncAgentPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeEnableDelegationPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeManageVolumePrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeImpersonatePrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeCreateGlobalPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeCreateTokenPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeAssignPrimaryTokenPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeLockMemoryPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeIncreaseQuotaPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeMachineAccountPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeTcbPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeSecurityPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeTakeOwnershipPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeLoadDriverPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeSystemProfilePrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeSystemtimePrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeProfSingleProcessPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeIncBasePriorityPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeCreatePagefilePrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeCreatePermanentPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeBackupPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeRestorePrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeShutdownPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeDebugPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeAuditPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeSystemEnvironmentPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeChangeNotifyPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeRemoteShutdownPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeUndockPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeSyncAgentPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeEnableDelegationPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeManageVolumePrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeImpersonatePrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeCreateGlobalPrivilege 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeShutdownPrivilege 1728 msiexec.exe Token: SeIncreaseQuotaPrivilege 1728 msiexec.exe Token: SeCreateTokenPrivilege 1728 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1728 msiexec.exe Token: SeLockMemoryPrivilege 1728 msiexec.exe Token: SeIncreaseQuotaPrivilege 1728 msiexec.exe Token: SeMachineAccountPrivilege 1728 msiexec.exe Token: SeTcbPrivilege 1728 msiexec.exe Token: SeSecurityPrivilege 1728 msiexec.exe Token: SeTakeOwnershipPrivilege 1728 msiexec.exe Token: SeLoadDriverPrivilege 1728 msiexec.exe Token: SeSystemProfilePrivilege 1728 msiexec.exe Token: SeSystemtimePrivilege 1728 msiexec.exe Token: SeProfSingleProcessPrivilege 1728 msiexec.exe Token: SeIncBasePriorityPrivilege 1728 msiexec.exe Token: SeCreatePagefilePrivilege 1728 msiexec.exe Token: SeCreatePermanentPrivilege 1728 msiexec.exe Token: SeBackupPrivilege 1728 msiexec.exe Token: SeRestorePrivilege 1728 msiexec.exe Token: SeShutdownPrivilege 1728 msiexec.exe Token: SeDebugPrivilege 1728 msiexec.exe Token: SeAuditPrivilege 1728 msiexec.exe Token: SeSystemEnvironmentPrivilege 1728 msiexec.exe Token: SeChangeNotifyPrivilege 1728 msiexec.exe Token: SeRemoteShutdownPrivilege 1728 msiexec.exe Token: SeUndockPrivilege 1728 msiexec.exe Token: SeSyncAgentPrivilege 1728 msiexec.exe Token: SeEnableDelegationPrivilege 1728 msiexec.exe Token: SeManageVolumePrivilege 1728 msiexec.exe Token: SeImpersonatePrivilege 1728 msiexec.exe Token: SeCreateGlobalPrivilege 1728 msiexec.exe Token: SeCreateTokenPrivilege 1728 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1728 msiexec.exe Token: SeLockMemoryPrivilege 1728 msiexec.exe Token: SeIncreaseQuotaPrivilege 1728 msiexec.exe Token: SeMachineAccountPrivilege 1728 msiexec.exe Token: SeTcbPrivilege 1728 msiexec.exe Token: SeSecurityPrivilege 1728 msiexec.exe Token: SeTakeOwnershipPrivilege 1728 msiexec.exe Token: SeLoadDriverPrivilege 1728 msiexec.exe Token: SeSystemProfilePrivilege 1728 msiexec.exe Token: SeSystemtimePrivilege 1728 msiexec.exe Token: SeProfSingleProcessPrivilege 1728 msiexec.exe Token: SeIncBasePriorityPrivilege 1728 msiexec.exe Token: SeCreatePagefilePrivilege 1728 msiexec.exe Token: SeCreatePermanentPrivilege 1728 msiexec.exe Token: SeBackupPrivilege 1728 msiexec.exe Token: SeRestorePrivilege 1728 msiexec.exe Token: SeShutdownPrivilege 1728 msiexec.exe Token: SeDebugPrivilege 1728 msiexec.exe Token: SeAuditPrivilege 1728 msiexec.exe Token: SeSystemEnvironmentPrivilege 1728 msiexec.exe Token: SeChangeNotifyPrivilege 1728 msiexec.exe Token: SeRemoteShutdownPrivilege 1728 msiexec.exe Token: SeUndockPrivilege 1728 msiexec.exe Token: SeSyncAgentPrivilege 1728 msiexec.exe Token: SeEnableDelegationPrivilege 1728 msiexec.exe Token: SeManageVolumePrivilege 1728 msiexec.exe Token: SeImpersonatePrivilege 1728 msiexec.exe Token: SeCreateGlobalPrivilege 1728 msiexec.exe Token: SeCreateTokenPrivilege 1728 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1728 msiexec.exe Token: SeLockMemoryPrivilege 1728 msiexec.exe Token: SeIncreaseQuotaPrivilege 1728 msiexec.exe Token: SeMachineAccountPrivilege 1728 msiexec.exe Token: SeTcbPrivilege 1728 msiexec.exe Token: SeSecurityPrivilege 1728 msiexec.exe Token: SeTakeOwnershipPrivilege 1728 msiexec.exe Token: SeLoadDriverPrivilege 1728 msiexec.exe Token: SeSystemProfilePrivilege 1728 msiexec.exe Token: SeSystemtimePrivilege 1728 msiexec.exe Token: SeProfSingleProcessPrivilege 1728 msiexec.exe Token: SeIncBasePriorityPrivilege 1728 msiexec.exe Token: SeCreatePagefilePrivilege 1728 msiexec.exe Token: SeCreatePermanentPrivilege 1728 msiexec.exe Token: SeBackupPrivilege 1728 msiexec.exe Token: SeRestorePrivilege 1728 msiexec.exe Token: SeShutdownPrivilege 1728 msiexec.exe Token: SeDebugPrivilege 1728 msiexec.exe Token: SeAuditPrivilege 1728 msiexec.exe Token: SeSystemEnvironmentPrivilege 1728 msiexec.exe Token: SeChangeNotifyPrivilege 1728 msiexec.exe Token: SeRemoteShutdownPrivilege 1728 msiexec.exe Token: SeUndockPrivilege 1728 msiexec.exe Token: SeSyncAgentPrivilege 1728 msiexec.exe Token: SeEnableDelegationPrivilege 1728 msiexec.exe Token: SeManageVolumePrivilege 1728 msiexec.exe Token: SeImpersonatePrivilege 1728 msiexec.exe Token: SeCreateGlobalPrivilege 1728 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe 1728 msiexec.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1444 wrote to memory of 2000 1444 msiexec.exe 27 PID 1444 wrote to memory of 2000 1444 msiexec.exe 27 PID 1444 wrote to memory of 2000 1444 msiexec.exe 27 PID 1444 wrote to memory of 2000 1444 msiexec.exe 27 PID 1444 wrote to memory of 2000 1444 msiexec.exe 27 PID 1444 wrote to memory of 2000 1444 msiexec.exe 27 PID 1444 wrote to memory of 2000 1444 msiexec.exe 27 PID 1724 wrote to memory of 1728 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe 28 PID 1724 wrote to memory of 1728 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe 28 PID 1724 wrote to memory of 1728 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe 28 PID 1724 wrote to memory of 1728 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe 28 PID 1724 wrote to memory of 1728 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe 28 PID 1724 wrote to memory of 1728 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe 28 PID 1724 wrote to memory of 1728 1724 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe 28 PID 1444 wrote to memory of 2044 1444 msiexec.exe 29 PID 1444 wrote to memory of 2044 1444 msiexec.exe 29 PID 1444 wrote to memory of 2044 1444 msiexec.exe 29 PID 1444 wrote to memory of 2044 1444 msiexec.exe 29 PID 1444 wrote to memory of 2044 1444 msiexec.exe 29 PID 1444 wrote to memory of 2044 1444 msiexec.exe 29 PID 1444 wrote to memory of 2044 1444 msiexec.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe"C:\Users\Admin\AppData\Local\Temp\f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe"1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\HyperSnap 8.15\HyperSnap 8.15 (X86) 8.15\install\HyperSnap 8.15 (X86).msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates "2⤵
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:1728
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 332731BB9038F1DB9F8620CCDCC2B2F3 C2⤵
- Loads dropped DLL
PID:2000
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding E918291B5124494EC0856BFC5163B79F C2⤵
- Loads dropped DLL
PID:2044
-