0ec7cc1d954f61f7f8c3a1d7b65be6a0023b2b38d6278679867c1695db7f2596

General

Target

SecuriteInfo.com.Exploit.AppendedJar.1.Gen.18612.14136.msi
Size

1.5MB
MD5

63919fe60f8a6549c8a583fc9de6e1c0
SHA1

a70d3d0ff6fe23ffd3d2a1ac5cbd699fc140c7fd
SHA256

0ec7cc1d954f61f7f8c3a1d7b65be6a0023b2b38d6278679867c1695db7f2596
SHA512

b3301a78ff766ec545a00f3cf4d281632922e36a013cf19ba57641e535d25ce31a3e2e173bc6574f404554b13e8d0393b65d8fc35be7647030f10de5518af50f

Score

6^/10

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

System Information Discovery

Processes:

msiexec.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

Processes:

msiexec.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	648	msiexec.exe
Token: SeIncreaseQuotaPrivilege	648	msiexec.exe
Token: SeSecurityPrivilege	3528	msiexec.exe
Token: SeCreateTokenPrivilege	648	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	648	msiexec.exe
Token: SeLockMemoryPrivilege	648	msiexec.exe
Token: SeIncreaseQuotaPrivilege	648	msiexec.exe
Token: SeMachineAccountPrivilege	648	msiexec.exe
Token: SeTcbPrivilege	648	msiexec.exe
Token: SeSecurityPrivilege	648	msiexec.exe
Token: SeTakeOwnershipPrivilege	648	msiexec.exe
Token: SeLoadDriverPrivilege	648	msiexec.exe
Token: SeSystemProfilePrivilege	648	msiexec.exe
Token: SeSystemtimePrivilege	648	msiexec.exe
Token: SeProfSingleProcessPrivilege	648	msiexec.exe
Token: SeIncBasePriorityPrivilege	648	msiexec.exe
Token: SeCreatePagefilePrivilege	648	msiexec.exe
Token: SeCreatePermanentPrivilege	648	msiexec.exe
Token: SeBackupPrivilege	648	msiexec.exe
Token: SeRestorePrivilege	648	msiexec.exe
Token: SeShutdownPrivilege	648	msiexec.exe
Token: SeDebugPrivilege	648	msiexec.exe
Token: SeAuditPrivilege	648	msiexec.exe
Token: SeSystemEnvironmentPrivilege	648	msiexec.exe
Token: SeChangeNotifyPrivilege	648	msiexec.exe
Token: SeRemoteShutdownPrivilege	648	msiexec.exe
Token: SeUndockPrivilege	648	msiexec.exe
Token: SeSyncAgentPrivilege	648	msiexec.exe
Token: SeEnableDelegationPrivilege	648	msiexec.exe
Token: SeManageVolumePrivilege	648	msiexec.exe
Token: SeImpersonatePrivilege	648	msiexec.exe
Token: SeCreateGlobalPrivilege	648	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

msiexec.exe

pid process

648 msiexec.exe

pid	process
648	msiexec.exe