Analysis
- max time kernel
54s - max time network
102s - platform
windows10_x64 - resource
win10v20201028 - submitted
29/01/2021, 09:35
Static task
static1
Behavioral task
behavioral1
Sample
FileSetup-v17.04.41.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
FileSetup-v17.04.41.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target FileSetup-v17.04.41.exe
- Size 4.4MB
- Sample210129-97x41ynnl2
- SHA256 a8fefe8e1f92a30d1cdd4e2e2afaacf08a02c8961f496ee16e89062417ec5f28
- MD5 b7234e4a9aaaacefa890535f8117c8fc
- SHA1 24c4321111ff004105c14e29662682f16900de29
- SHA512 8590be6433943bec0867a18247e25d9821d39db1d06c6957d3895558eb5568dddff0b97acda222f0a16701c50de43d8ad667d6717add6900ec941e71ca28e513
- MD5 SHA1 SHA512
Score
9/10
Malware Config
Signatures
- Nirsoft 6 IoCs
resource yara_rule behavioral2/files/0x000300000001ab79-25.dat Nirsoft behavioral2/files/0x000300000001ab79-26.dat Nirsoft behavioral2/files/0x000400000001a50e-34.dat Nirsoft behavioral2/files/0x000400000001a50e-35.dat Nirsoft behavioral2/files/0x000300000001a2df-40.dat Nirsoft behavioral2/files/0x000300000001a2df-41.dat Nirsoft - Executes dropped EXE 6 IoCs
pid Process 380 6852B33702F6B3BD.exe 840 6852B33702F6B3BD.exe 2980 1611913136958.exe 4524 1611913141380.exe 4016 1611913146396.exe 4568 ThunderFW.exe -
resource yara_rule behavioral2/files/0x000100000001ab78-4.dat office_xlm_macros - Loads dropped DLL 1 IoCs
pid Process 2232 MsiExec.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe - JavaScript code in executable 4 IoCs
resource yara_rule behavioral2/files/0x000100000001ab78-4.dat js behavioral2/files/0x000200000001ab74-11.dat js behavioral2/files/0x000200000001ab74-10.dat js behavioral2/files/0x000200000001ab74-12.dat js - Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 6852B33702F6B3BD.exe File opened for modification \??\PhysicalDrive0 FileSetup-v17.04.41.exe File opened for modification \??\PhysicalDrive0 6852B33702F6B3BD.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4760 FileSetup-v17.04.41.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 380 set thread context of 1812 380 6852B33702F6B3BD.exe 86 PID 380 set thread context of 4044 380 6852B33702F6B3BD.exe 95 PID 380 set thread context of 4476 380 6852B33702F6B3BD.exe 97 - Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 6852B33702F6B3BD.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc 6852B33702F6B3BD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 6852B33702F6B3BD.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName 6852B33702F6B3BD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 6852B33702F6B3BD.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc 6852B33702F6B3BD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 6852B33702F6B3BD.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc 6852B33702F6B3BD.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc 6852B33702F6B3BD.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName 6852B33702F6B3BD.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\FriendlyName 6852B33702F6B3BD.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\FriendlyName 6852B33702F6B3BD.exe - Kills process with taskkill 1 IoCs
pid Process 2280 taskkill.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD FileSetup-v17.04.41.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD\Blob = 0300000001000000140000006c0ce2dd0584c47cac18839f14055f19fa270cdd2000000001000000500500003082054c30820434a0030201020206016de34cff62300d06092a864886f70d01010b05003081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a301e170d3030303130313030303030305a170d3438313231353039313533375a3081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a30820122300d06092a864886f70d01010105000382010f003082010a0282010100ae86c5043ed34d99f44fa3052ea34047a7fbbe33188b1dc2ca645ca3249e85e54b4921d4998fda6a22247c32d9087d742af3bf850803ae8c1e25faad53fb8fd823b7353d9a3ac992bf917f693826c790e53a540b120b6553508ec9585e467d310bd3ef9fb61731deb522eb78f43f824b34be36782db7a8cb162cd22247b14e4c5ae633ed66542354a59971bddc59160ecdc521b4477c93ca9e624e0af00298602300f5dc368819c3cb9f02604636888276b3a498570473b5328b0834f327c34285e333da9207e12f0edbb654c8cf11e3cc7cba17a52cd7cd42c10ae095a2e4eb9d3e3f361488243f0584af40e72d6e6e182149bfb8342384f60f12e14734258d0203010001a382017430820170300f0603551d130101ff040530030101ff3082012c06096086480186f842010d0482011d138201195468697320526f6f74206365727469666963617465207761732067656e65726174656420627920436861726c65732050726f787920666f722053534c2050726f7879696e672e20496620746869732063657274696669636174652069732070617274206f66206120636572746966696361746520636861696e2c2074686973206d65616e73207468617420796f752772652062726f7773696e67207468726f75676820436861726c65732050726f787920776974682053534c2050726f7879696e6720656e61626c656420666f72207468697320776562736974652e20506c656173652073656520687474703a2f2f636861726c657370726f78792e636f6d2f73736c20666f72206d6f726520696e666f726d6174696f6e2e300e0603551d0f0101ff040403020204301d0603551d0e04160414f8d0dc54367cf794020f8b92783a5d8a91251f9f300d06092a864886f70d01010b05000382010100662271eb9d5c744c88382de98ba37320e6312104d04273a92007a8670976d6530e6347d00bbded1319bb6754f36237596095922911e3661a70354f6ba0b797a76258be7adebb8c8dbeeed977760b80271d74b2444d92f6c1337a379b73545b251de5f8812b9625abbbfaedc15f8c6c374b9b26dd0fef035185f5899d8819e689dc6db5f0babbfd637c52b1bec80115b889faeed493d4112d744954ad3abe6607c41a4a2d657ba330ed131fa4e8c25bb28ee181dcef8da91c17bfd30a23c8eae81b152ed85ff938afc32b34ffdaffbdb72d9bb04067bfc87f579eba9637b165ea008ea7408bc8265f33c039bf60f506d245a6b53017afc8e161d70ed5b0d76576 FileSetup-v17.04.41.exe - Runs ping.exe 1 TTPs 3 IoCs
pid Process 1392 PING.EXE 3544 PING.EXE 2728 PING.EXE - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2980 1611913136958.exe 2980 1611913136958.exe 4524 1611913141380.exe 4524 1611913141380.exe 4016 1611913146396.exe 4016 1611913146396.exe - Suspicious use of AdjustPrivilegeToken 91 IoCs
description pid Process Token: SeShutdownPrivilege 4292 msiexec.exe Token: SeIncreaseQuotaPrivilege 4292 msiexec.exe Token: SeSecurityPrivilege 3908 msiexec.exe Token: SeCreateTokenPrivilege 4292 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4292 msiexec.exe Token: SeLockMemoryPrivilege 4292 msiexec.exe Token: SeIncreaseQuotaPrivilege 4292 msiexec.exe Token: SeMachineAccountPrivilege 4292 msiexec.exe Token: SeTcbPrivilege 4292 msiexec.exe Token: SeSecurityPrivilege 4292 msiexec.exe Token: SeTakeOwnershipPrivilege 4292 msiexec.exe Token: SeLoadDriverPrivilege 4292 msiexec.exe Token: SeSystemProfilePrivilege 4292 msiexec.exe Token: SeSystemtimePrivilege 4292 msiexec.exe Token: SeProfSingleProcessPrivilege 4292 msiexec.exe Token: SeIncBasePriorityPrivilege 4292 msiexec.exe Token: SeCreatePagefilePrivilege 4292 msiexec.exe Token: SeCreatePermanentPrivilege 4292 msiexec.exe Token: SeBackupPrivilege 4292 msiexec.exe Token: SeRestorePrivilege 4292 msiexec.exe Token: SeShutdownPrivilege 4292 msiexec.exe Token: SeDebugPrivilege 4292 msiexec.exe Token: SeAuditPrivilege 4292 msiexec.exe Token: SeSystemEnvironmentPrivilege 4292 msiexec.exe Token: SeChangeNotifyPrivilege 4292 msiexec.exe Token: SeRemoteShutdownPrivilege 4292 msiexec.exe Token: SeUndockPrivilege 4292 msiexec.exe Token: SeSyncAgentPrivilege 4292 msiexec.exe Token: SeEnableDelegationPrivilege 4292 msiexec.exe Token: SeManageVolumePrivilege 4292 msiexec.exe Token: SeImpersonatePrivilege 4292 msiexec.exe Token: SeCreateGlobalPrivilege 4292 msiexec.exe Token: SeCreateTokenPrivilege 4292 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4292 msiexec.exe Token: SeLockMemoryPrivilege 4292 msiexec.exe Token: SeIncreaseQuotaPrivilege 4292 msiexec.exe Token: SeMachineAccountPrivilege 4292 msiexec.exe Token: SeTcbPrivilege 4292 msiexec.exe Token: SeSecurityPrivilege 4292 msiexec.exe Token: SeTakeOwnershipPrivilege 4292 msiexec.exe Token: SeLoadDriverPrivilege 4292 msiexec.exe Token: SeSystemProfilePrivilege 4292 msiexec.exe Token: SeSystemtimePrivilege 4292 msiexec.exe Token: SeProfSingleProcessPrivilege 4292 msiexec.exe Token: SeIncBasePriorityPrivilege 4292 msiexec.exe Token: SeCreatePagefilePrivilege 4292 msiexec.exe Token: SeCreatePermanentPrivilege 4292 msiexec.exe Token: SeBackupPrivilege 4292 msiexec.exe Token: SeRestorePrivilege 4292 msiexec.exe Token: SeShutdownPrivilege 4292 msiexec.exe Token: SeDebugPrivilege 4292 msiexec.exe Token: SeAuditPrivilege 4292 msiexec.exe Token: SeSystemEnvironmentPrivilege 4292 msiexec.exe Token: SeChangeNotifyPrivilege 4292 msiexec.exe Token: SeRemoteShutdownPrivilege 4292 msiexec.exe Token: SeUndockPrivilege 4292 msiexec.exe Token: SeSyncAgentPrivilege 4292 msiexec.exe Token: SeEnableDelegationPrivilege 4292 msiexec.exe Token: SeManageVolumePrivilege 4292 msiexec.exe Token: SeImpersonatePrivilege 4292 msiexec.exe Token: SeCreateGlobalPrivilege 4292 msiexec.exe Token: SeCreateTokenPrivilege 4292 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4292 msiexec.exe Token: SeLockMemoryPrivilege 4292 msiexec.exe Token: SeIncreaseQuotaPrivilege 4292 msiexec.exe Token: SeMachineAccountPrivilege 4292 msiexec.exe Token: SeTcbPrivilege 4292 msiexec.exe Token: SeSecurityPrivilege 4292 msiexec.exe Token: SeTakeOwnershipPrivilege 4292 msiexec.exe Token: SeLoadDriverPrivilege 4292 msiexec.exe Token: SeSystemProfilePrivilege 4292 msiexec.exe Token: SeSystemtimePrivilege 4292 msiexec.exe Token: SeProfSingleProcessPrivilege 4292 msiexec.exe Token: SeIncBasePriorityPrivilege 4292 msiexec.exe Token: SeCreatePagefilePrivilege 4292 msiexec.exe Token: SeCreatePermanentPrivilege 4292 msiexec.exe Token: SeBackupPrivilege 4292 msiexec.exe Token: SeRestorePrivilege 4292 msiexec.exe Token: SeShutdownPrivilege 4292 msiexec.exe Token: SeDebugPrivilege 4292 msiexec.exe Token: SeAuditPrivilege 4292 msiexec.exe Token: SeSystemEnvironmentPrivilege 4292 msiexec.exe Token: SeChangeNotifyPrivilege 4292 msiexec.exe Token: SeRemoteShutdownPrivilege 4292 msiexec.exe Token: SeUndockPrivilege 4292 msiexec.exe Token: SeSyncAgentPrivilege 4292 msiexec.exe Token: SeEnableDelegationPrivilege 4292 msiexec.exe Token: SeManageVolumePrivilege 4292 msiexec.exe Token: SeImpersonatePrivilege 4292 msiexec.exe Token: SeCreateGlobalPrivilege 4292 msiexec.exe Token: SeDebugPrivilege 2280 taskkill.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4292 msiexec.exe - Suspicious use of WriteProcessMemory 66 IoCs
description pid Process procid_target PID 4760 wrote to memory of 4292 4760 FileSetup-v17.04.41.exe 75 PID 4760 wrote to memory of 4292 4760 FileSetup-v17.04.41.exe 75 PID 4760 wrote to memory of 4292 4760 FileSetup-v17.04.41.exe 75 PID 3908 wrote to memory of 2232 3908 msiexec.exe 78 PID 3908 wrote to memory of 2232 3908 msiexec.exe 78 PID 3908 wrote to memory of 2232 3908 msiexec.exe 78 PID 4760 wrote to memory of 380 4760 FileSetup-v17.04.41.exe 81 PID 4760 wrote to memory of 380 4760 FileSetup-v17.04.41.exe 81 PID 4760 wrote to memory of 380 4760 FileSetup-v17.04.41.exe 81 PID 4760 wrote to memory of 840 4760 FileSetup-v17.04.41.exe 82 PID 4760 wrote to memory of 840 4760 FileSetup-v17.04.41.exe 82 PID 4760 wrote to memory of 840 4760 FileSetup-v17.04.41.exe 82 PID 4760 wrote to memory of 1144 4760 FileSetup-v17.04.41.exe 83 PID 4760 wrote to memory of 1144 4760 FileSetup-v17.04.41.exe 83 PID 4760 wrote to memory of 1144 4760 FileSetup-v17.04.41.exe 83 PID 1144 wrote to memory of 1392 1144 cmd.exe 85 PID 1144 wrote to memory of 1392 1144 cmd.exe 85 PID 1144 wrote to memory of 1392 1144 cmd.exe 85 PID 840 wrote to memory of 1776 840 6852B33702F6B3BD.exe 88 PID 840 wrote to memory of 1776 840 6852B33702F6B3BD.exe 88 PID 840 wrote to memory of 1776 840 6852B33702F6B3BD.exe 88 PID 380 wrote to memory of 1812 380 6852B33702F6B3BD.exe 86 PID 380 wrote to memory of 1812 380 6852B33702F6B3BD.exe 86 PID 380 wrote to memory of 1812 380 6852B33702F6B3BD.exe 86 PID 380 wrote to memory of 1812 380 6852B33702F6B3BD.exe 86 PID 380 wrote to memory of 1812 380 6852B33702F6B3BD.exe 86 PID 380 wrote to memory of 1812 380 6852B33702F6B3BD.exe 86 PID 1776 wrote to memory of 2280 1776 cmd.exe 89 PID 1776 wrote to memory of 2280 1776 cmd.exe 89 PID 1776 wrote to memory of 2280 1776 cmd.exe 89 PID 380 wrote to memory of 2980 380 6852B33702F6B3BD.exe 91 PID 380 wrote to memory of 2980 380 6852B33702F6B3BD.exe 91 PID 380 wrote to memory of 2980 380 6852B33702F6B3BD.exe 91 PID 840 wrote to memory of 3084 840 6852B33702F6B3BD.exe 92 PID 840 wrote to memory of 3084 840 6852B33702F6B3BD.exe 92 PID 840 wrote to memory of 3084 840 6852B33702F6B3BD.exe 92 PID 3084 wrote to memory of 3544 3084 cmd.exe 94 PID 3084 wrote to memory of 3544 3084 cmd.exe 94 PID 3084 wrote to memory of 3544 3084 cmd.exe 94 PID 380 wrote to memory of 4044 380 6852B33702F6B3BD.exe 95 PID 380 wrote to memory of 4044 380 6852B33702F6B3BD.exe 95 PID 380 wrote to memory of 4044 380 6852B33702F6B3BD.exe 95 PID 380 wrote to memory of 4044 380 6852B33702F6B3BD.exe 95 PID 380 wrote to memory of 4044 380 6852B33702F6B3BD.exe 95 PID 380 wrote to memory of 4044 380 6852B33702F6B3BD.exe 95 PID 380 wrote to memory of 4524 380 6852B33702F6B3BD.exe 96 PID 380 wrote to memory of 4524 380 6852B33702F6B3BD.exe 96 PID 380 wrote to memory of 4524 380 6852B33702F6B3BD.exe 96 PID 380 wrote to memory of 4476 380 6852B33702F6B3BD.exe 97 PID 380 wrote to memory of 4476 380 6852B33702F6B3BD.exe 97 PID 380 wrote to memory of 4476 380 6852B33702F6B3BD.exe 97 PID 380 wrote to memory of 4476 380 6852B33702F6B3BD.exe 97 PID 380 wrote to memory of 4476 380 6852B33702F6B3BD.exe 97 PID 380 wrote to memory of 4476 380 6852B33702F6B3BD.exe 97 PID 380 wrote to memory of 4016 380 6852B33702F6B3BD.exe 98 PID 380 wrote to memory of 4016 380 6852B33702F6B3BD.exe 98 PID 380 wrote to memory of 4016 380 6852B33702F6B3BD.exe 98 PID 380 wrote to memory of 4568 380 6852B33702F6B3BD.exe 99 PID 380 wrote to memory of 4568 380 6852B33702F6B3BD.exe 99 PID 380 wrote to memory of 4568 380 6852B33702F6B3BD.exe 99 PID 380 wrote to memory of 4660 380 6852B33702F6B3BD.exe 100 PID 380 wrote to memory of 4660 380 6852B33702F6B3BD.exe 100 PID 380 wrote to memory of 4660 380 6852B33702F6B3BD.exe 100 PID 4660 wrote to memory of 2728 4660 cmd.exe 102 PID 4660 wrote to memory of 2728 4660 cmd.exe 102 PID 4660 wrote to memory of 2728 4660 cmd.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\FileSetup-v17.04.41.exe"C:\Users\Admin\AppData\Local\Temp\FileSetup-v17.04.41.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Windows\SysWOW64\msiexec.exemsiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\gdiview.msi"2⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4292
-
-
C:\Users\Admin\AppData\Local\Temp\6852B33702F6B3BD.exeC:\Users\Admin\AppData\Local\Temp\6852B33702F6B3BD.exe 0011 installp32⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"3⤵PID:1812
-
-
C:\Users\Admin\AppData\Roaming\1611913136958.exe"C:\Users\Admin\AppData\Roaming\1611913136958.exe" /sjson "C:\Users\Admin\AppData\Roaming\1611913136958.txt"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2980
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"3⤵PID:4044
-
-
C:\Users\Admin\AppData\Roaming\1611913141380.exe"C:\Users\Admin\AppData\Roaming\1611913141380.exe" /sjson "C:\Users\Admin\AppData\Roaming\1611913141380.txt"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4524
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"3⤵PID:4476
-
-
C:\Users\Admin\AppData\Roaming\1611913146396.exe"C:\Users\Admin\AppData\Roaming\1611913146396.exe" /sjson "C:\Users\Admin\AppData\Roaming\1611913146396.txt"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4016
-
-
C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exeC:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe ThunderFW "C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe"3⤵
- Executes dropped EXE
PID:4568
-
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\6852B33702F6B3BD.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 34⤵
- Runs ping.exe
PID:2728
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\6852B33702F6B3BD.exeC:\Users\Admin\AppData\Local\Temp\6852B33702F6B3BD.exe 200 installp32⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe3⤵
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe4⤵
- Kills process with taskkill
PID:2280
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\6852B33702F6B3BD.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 34⤵
- Runs ping.exe
PID:3544
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\FileSetup-v17.04.41.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 33⤵
- Runs ping.exe
PID:1392
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 8BEC64561BE480CF2DB1486CEA018927 C2⤵
- Loads dropped DLL
PID:2232
-