Analysis
- max time kernel
151s - max time network
142s - platform
windows10_x64 - resource
win10v20201028 - submitted
12/11/2020, 14:04
Static task
static1
Behavioral task
behavioral1
Sample
f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe
- Size 13.9MB
- Sample201112-5gff8afpvs
- SHA256 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242
- MD5 ae942cb5775e61dcd37f4df9ed16c702
- SHA1 0afafcf5dc6a9432de7eb17b7626f589da3323a9
- SHA512 eb3ecc22adda1b3ae6a22aa03ee9f9100bb9388f83d1ec3f42d2767143633a52b1608f2c3d8e1d5d856ea45230a4ce3d23077a4783152c0e306ac4bccb396d0f
- MD5 SHA1 SHA512
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 6 IoCs
pid Process 3728 MsiExec.exe 204 MsiExec.exe 204 MsiExec.exe 204 MsiExec.exe 204 MsiExec.exe 204 MsiExec.exe - Enumerates connected drives 3 TTPs 72 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe File opened (read-only) \??\F: f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe File opened (read-only) \??\M: f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe File opened (read-only) \??\X: f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe File opened (read-only) \??\Z: f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe File opened (read-only) \??\T: f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\O: f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe File opened (read-only) \??\W: f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe File opened (read-only) \??\Y: f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\U: f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe File opened (read-only) \??\N: f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\J: f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe File opened (read-only) \??\P: f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe File opened (read-only) \??\L: f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\A: f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe File opened (read-only) \??\H: f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe - JavaScript code in executable 1 IoCs
resource yara_rule behavioral2/files/0x000100000001ab5e-6.dat js - Suspicious use of AdjustPrivilegeToken 177 IoCs
description pid Process Token: SeSecurityPrivilege 2440 msiexec.exe Token: SeCreateTokenPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeAssignPrimaryTokenPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeLockMemoryPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeIncreaseQuotaPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeMachineAccountPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeTcbPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeSecurityPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeTakeOwnershipPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeLoadDriverPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeSystemProfilePrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeSystemtimePrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeProfSingleProcessPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeIncBasePriorityPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeCreatePagefilePrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeCreatePermanentPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeBackupPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeRestorePrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeShutdownPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeDebugPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeAuditPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeSystemEnvironmentPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeChangeNotifyPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeRemoteShutdownPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeUndockPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeSyncAgentPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeEnableDelegationPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeManageVolumePrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeImpersonatePrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeCreateGlobalPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeCreateTokenPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeAssignPrimaryTokenPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeLockMemoryPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeIncreaseQuotaPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeMachineAccountPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeTcbPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeSecurityPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeTakeOwnershipPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeLoadDriverPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeSystemProfilePrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeSystemtimePrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeProfSingleProcessPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeIncBasePriorityPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeCreatePagefilePrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeCreatePermanentPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeBackupPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeRestorePrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeShutdownPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeDebugPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeAuditPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeSystemEnvironmentPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeChangeNotifyPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeRemoteShutdownPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeUndockPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeSyncAgentPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeEnableDelegationPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeManageVolumePrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeImpersonatePrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeCreateGlobalPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeCreateTokenPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeAssignPrimaryTokenPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeLockMemoryPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeIncreaseQuotaPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeMachineAccountPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeTcbPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeSecurityPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeTakeOwnershipPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeLoadDriverPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeSystemProfilePrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeSystemtimePrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeProfSingleProcessPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeIncBasePriorityPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeCreatePagefilePrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeCreatePermanentPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeBackupPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeRestorePrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeShutdownPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeDebugPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeAuditPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeSystemEnvironmentPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeChangeNotifyPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeRemoteShutdownPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeUndockPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeSyncAgentPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeEnableDelegationPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeManageVolumePrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeImpersonatePrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeCreateGlobalPrivilege 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe Token: SeShutdownPrivilege 2252 msiexec.exe Token: SeIncreaseQuotaPrivilege 2252 msiexec.exe Token: SeCreateTokenPrivilege 2252 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2252 msiexec.exe Token: SeLockMemoryPrivilege 2252 msiexec.exe Token: SeIncreaseQuotaPrivilege 2252 msiexec.exe Token: SeMachineAccountPrivilege 2252 msiexec.exe Token: SeTcbPrivilege 2252 msiexec.exe Token: SeSecurityPrivilege 2252 msiexec.exe Token: SeTakeOwnershipPrivilege 2252 msiexec.exe Token: SeLoadDriverPrivilege 2252 msiexec.exe Token: SeSystemProfilePrivilege 2252 msiexec.exe Token: SeSystemtimePrivilege 2252 msiexec.exe Token: SeProfSingleProcessPrivilege 2252 msiexec.exe Token: SeIncBasePriorityPrivilege 2252 msiexec.exe Token: SeCreatePagefilePrivilege 2252 msiexec.exe Token: SeCreatePermanentPrivilege 2252 msiexec.exe Token: SeBackupPrivilege 2252 msiexec.exe Token: SeRestorePrivilege 2252 msiexec.exe Token: SeShutdownPrivilege 2252 msiexec.exe Token: SeDebugPrivilege 2252 msiexec.exe Token: SeAuditPrivilege 2252 msiexec.exe Token: SeSystemEnvironmentPrivilege 2252 msiexec.exe Token: SeChangeNotifyPrivilege 2252 msiexec.exe Token: SeRemoteShutdownPrivilege 2252 msiexec.exe Token: SeUndockPrivilege 2252 msiexec.exe Token: SeSyncAgentPrivilege 2252 msiexec.exe Token: SeEnableDelegationPrivilege 2252 msiexec.exe Token: SeManageVolumePrivilege 2252 msiexec.exe Token: SeImpersonatePrivilege 2252 msiexec.exe Token: SeCreateGlobalPrivilege 2252 msiexec.exe Token: SeCreateTokenPrivilege 2252 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2252 msiexec.exe Token: SeLockMemoryPrivilege 2252 msiexec.exe Token: SeIncreaseQuotaPrivilege 2252 msiexec.exe Token: SeMachineAccountPrivilege 2252 msiexec.exe Token: SeTcbPrivilege 2252 msiexec.exe Token: SeSecurityPrivilege 2252 msiexec.exe Token: SeTakeOwnershipPrivilege 2252 msiexec.exe Token: SeLoadDriverPrivilege 2252 msiexec.exe Token: SeSystemProfilePrivilege 2252 msiexec.exe Token: SeSystemtimePrivilege 2252 msiexec.exe Token: SeProfSingleProcessPrivilege 2252 msiexec.exe Token: SeIncBasePriorityPrivilege 2252 msiexec.exe Token: SeCreatePagefilePrivilege 2252 msiexec.exe Token: SeCreatePermanentPrivilege 2252 msiexec.exe Token: SeBackupPrivilege 2252 msiexec.exe Token: SeRestorePrivilege 2252 msiexec.exe Token: SeShutdownPrivilege 2252 msiexec.exe Token: SeDebugPrivilege 2252 msiexec.exe Token: SeAuditPrivilege 2252 msiexec.exe Token: SeSystemEnvironmentPrivilege 2252 msiexec.exe Token: SeChangeNotifyPrivilege 2252 msiexec.exe Token: SeRemoteShutdownPrivilege 2252 msiexec.exe Token: SeUndockPrivilege 2252 msiexec.exe Token: SeSyncAgentPrivilege 2252 msiexec.exe Token: SeEnableDelegationPrivilege 2252 msiexec.exe Token: SeManageVolumePrivilege 2252 msiexec.exe Token: SeImpersonatePrivilege 2252 msiexec.exe Token: SeCreateGlobalPrivilege 2252 msiexec.exe Token: SeCreateTokenPrivilege 2252 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2252 msiexec.exe Token: SeLockMemoryPrivilege 2252 msiexec.exe Token: SeIncreaseQuotaPrivilege 2252 msiexec.exe Token: SeMachineAccountPrivilege 2252 msiexec.exe Token: SeTcbPrivilege 2252 msiexec.exe Token: SeSecurityPrivilege 2252 msiexec.exe Token: SeTakeOwnershipPrivilege 2252 msiexec.exe Token: SeLoadDriverPrivilege 2252 msiexec.exe Token: SeSystemProfilePrivilege 2252 msiexec.exe Token: SeSystemtimePrivilege 2252 msiexec.exe Token: SeProfSingleProcessPrivilege 2252 msiexec.exe Token: SeIncBasePriorityPrivilege 2252 msiexec.exe Token: SeCreatePagefilePrivilege 2252 msiexec.exe Token: SeCreatePermanentPrivilege 2252 msiexec.exe Token: SeBackupPrivilege 2252 msiexec.exe Token: SeRestorePrivilege 2252 msiexec.exe Token: SeShutdownPrivilege 2252 msiexec.exe Token: SeDebugPrivilege 2252 msiexec.exe Token: SeAuditPrivilege 2252 msiexec.exe Token: SeSystemEnvironmentPrivilege 2252 msiexec.exe Token: SeChangeNotifyPrivilege 2252 msiexec.exe Token: SeRemoteShutdownPrivilege 2252 msiexec.exe Token: SeUndockPrivilege 2252 msiexec.exe Token: SeSyncAgentPrivilege 2252 msiexec.exe Token: SeEnableDelegationPrivilege 2252 msiexec.exe Token: SeManageVolumePrivilege 2252 msiexec.exe Token: SeImpersonatePrivilege 2252 msiexec.exe Token: SeCreateGlobalPrivilege 2252 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe 2252 msiexec.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2440 wrote to memory of 3728 2440 msiexec.exe 77 PID 2440 wrote to memory of 3728 2440 msiexec.exe 77 PID 2440 wrote to memory of 3728 2440 msiexec.exe 77 PID 424 wrote to memory of 2252 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe 78 PID 424 wrote to memory of 2252 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe 78 PID 424 wrote to memory of 2252 424 f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe 78 PID 2440 wrote to memory of 204 2440 msiexec.exe 79 PID 2440 wrote to memory of 204 2440 msiexec.exe 79 PID 2440 wrote to memory of 204 2440 msiexec.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe"C:\Users\Admin\AppData\Local\Temp\f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe"1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:424 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\HyperSnap 8.15\HyperSnap 8.15 (X86) 8.15\install\HyperSnap 8.15 (X86).msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\f9911b3afb169b55efa561019120d2a33ba6b1485fe70e16a70833725b6a3242.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates "2⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
PID:2252
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 363FBD334C55920F28B693E887BA3951 C2⤵
- Loads dropped DLL
PID:3728
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 08899D19ABF04AE17B79F714161268D1 C2⤵
- Loads dropped DLL
PID:204
-