Analysis
-
max time kernel
59s -
max time network
60s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
04-03-2021 20:36
Static task
static1
Behavioral task
behavioral1
Sample
CorelDraw_keygen_by_KeygenNinja.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
CorelDraw_keygen_by_KeygenNinja.exe
Resource
win10v20201028
azorultelysiumstealergluptebametasploitredlinevidarbackdoorbootkitdiscoverydropperevasioninfostealerloadermacropersistencespywarestealertrojanxlm
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
CorelDraw_keygen_by_KeygenNinja.exe
Resource
win10v20201028
azorultelysiumstealergluptebametasploitplugxredlinesmokeloadervidarxmrigbackdoorbootkitdiscoverydropperevasioninfostealerloadermacrominerpersistencespywarestealertrojanupxxlm
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral4
Sample
CorelDraw_keygen_by_KeygenNinja.exe
Resource
win10v20201028
azorultelysiumstealergluptebametasploitplugxraccoonredlinesmokeloadervidarxmrig75fbe127769a03ab235bd172a881a419ea43e573afefd33a49c7cbd55d417545269920f24c85aa37e71b51d358b75fe1407b56bf2284e3fac50c860fbackdoorbootkitdiscoverydropperevasioninfostealerloadermacrominerpersistencespywarestealertrojanupxxlm
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral5
Sample
CorelDraw_keygen_by_KeygenNinja.exe
Resource
win7v20201028
azorultdjvuelysiumstealergluptebametasploitplugxponyraccoonsmokeloadertaurus_stealertofseevidarxmrigafefd33a49c7cbd55d417545269920f24c85aa37backdoorbootkitdiscoverydropperevasioninfostealerloadermacrominerpersistenceransomwareratspywarestealertrojanupxxlm
windows7_x64
0 signatures
0 seconds
General
-
Target
CorelDraw_keygen_by_KeygenNinja.exe
-
Size
8.6MB
-
MD5
26fb5cbb439c37c7437c43951b56a9e8
-
SHA1
ffe7d540afd6410bd69e502d47252930a1411f73
-
SHA256
ced746e74fedf490bf79b1c68c9e15290c33f42df5fd2281a13708fae54c8ea7
-
SHA512
f0a24019707d4ec9e8477037d2d2f83c511a0e4dc9aa0a0c7a4f97b4a8ab1ac1a5618145fc628068c326856cc0cf9e3c697489cdd4b0d92a369ebd54b5391a78
Malware Config
Extracted
Family
azorult
C2
http://kvaka.li/1210776429.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Executes dropped EXE 9 IoCs
pid Process 3700 keygen-pr.exe 3452 keygen-step-1.exe 1324 keygen-step-3.exe 3904 keygen-step-4.exe 3548 key.exe 1364 file.exe 2756 977.tmp.exe 2620 977.tmp.exe 3208 Setup.exe -
resource yara_rule behavioral1/files/0x000100000001ab8c-55.dat office_xlm_macros -
Loads dropped DLL 1 IoCs
pid Process 1920 MsiExec.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 33 api.ipify.org -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 Setup.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2756 set thread context of 2620 2756 977.tmp.exe 92 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 977.tmp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 977.tmp.exe -
Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\PegasPc file.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 file.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e file.exe -
Runs ping.exe 1 TTPs 2 IoCs
pid Process 2660 PING.EXE 3028 PING.EXE -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2620 977.tmp.exe 2620 977.tmp.exe 1364 file.exe 1364 file.exe 1364 file.exe 1364 file.exe 1364 file.exe 1364 file.exe 1364 file.exe 1364 file.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1364 file.exe Token: SeShutdownPrivilege 3968 msiexec.exe Token: SeIncreaseQuotaPrivilege 3968 msiexec.exe Token: SeSecurityPrivilege 1312 msiexec.exe Token: SeCreateTokenPrivilege 3968 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3968 msiexec.exe Token: SeLockMemoryPrivilege 3968 msiexec.exe Token: SeIncreaseQuotaPrivilege 3968 msiexec.exe Token: SeMachineAccountPrivilege 3968 msiexec.exe Token: SeTcbPrivilege 3968 msiexec.exe Token: SeSecurityPrivilege 3968 msiexec.exe Token: SeTakeOwnershipPrivilege 3968 msiexec.exe Token: SeLoadDriverPrivilege 3968 msiexec.exe Token: SeSystemProfilePrivilege 3968 msiexec.exe Token: SeSystemtimePrivilege 3968 msiexec.exe Token: SeProfSingleProcessPrivilege 3968 msiexec.exe Token: SeIncBasePriorityPrivilege 3968 msiexec.exe Token: SeCreatePagefilePrivilege 3968 msiexec.exe Token: SeCreatePermanentPrivilege 3968 msiexec.exe Token: SeBackupPrivilege 3968 msiexec.exe Token: SeRestorePrivilege 3968 msiexec.exe Token: SeShutdownPrivilege 3968 msiexec.exe Token: SeDebugPrivilege 3968 msiexec.exe Token: SeAuditPrivilege 3968 msiexec.exe Token: SeSystemEnvironmentPrivilege 3968 msiexec.exe Token: SeChangeNotifyPrivilege 3968 msiexec.exe Token: SeRemoteShutdownPrivilege 3968 msiexec.exe Token: SeUndockPrivilege 3968 msiexec.exe Token: SeSyncAgentPrivilege 3968 msiexec.exe Token: SeEnableDelegationPrivilege 3968 msiexec.exe Token: SeManageVolumePrivilege 3968 msiexec.exe Token: SeImpersonatePrivilege 3968 msiexec.exe Token: SeCreateGlobalPrivilege 3968 msiexec.exe Token: SeCreateTokenPrivilege 3968 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3968 msiexec.exe Token: SeLockMemoryPrivilege 3968 msiexec.exe Token: SeIncreaseQuotaPrivilege 3968 msiexec.exe Token: SeMachineAccountPrivilege 3968 msiexec.exe Token: SeTcbPrivilege 3968 msiexec.exe Token: SeSecurityPrivilege 3968 msiexec.exe Token: SeTakeOwnershipPrivilege 3968 msiexec.exe Token: SeLoadDriverPrivilege 3968 msiexec.exe Token: SeSystemProfilePrivilege 3968 msiexec.exe Token: SeSystemtimePrivilege 3968 msiexec.exe Token: SeProfSingleProcessPrivilege 3968 msiexec.exe Token: SeIncBasePriorityPrivilege 3968 msiexec.exe Token: SeCreatePagefilePrivilege 3968 msiexec.exe Token: SeCreatePermanentPrivilege 3968 msiexec.exe Token: SeBackupPrivilege 3968 msiexec.exe Token: SeRestorePrivilege 3968 msiexec.exe Token: SeShutdownPrivilege 3968 msiexec.exe Token: SeDebugPrivilege 3968 msiexec.exe Token: SeAuditPrivilege 3968 msiexec.exe Token: SeSystemEnvironmentPrivilege 3968 msiexec.exe Token: SeChangeNotifyPrivilege 3968 msiexec.exe Token: SeRemoteShutdownPrivilege 3968 msiexec.exe Token: SeUndockPrivilege 3968 msiexec.exe Token: SeSyncAgentPrivilege 3968 msiexec.exe Token: SeEnableDelegationPrivilege 3968 msiexec.exe Token: SeManageVolumePrivilege 3968 msiexec.exe Token: SeImpersonatePrivilege 3968 msiexec.exe Token: SeCreateGlobalPrivilege 3968 msiexec.exe Token: SeCreateTokenPrivilege 3968 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3968 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3968 msiexec.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3208 Setup.exe -
Suspicious use of WriteProcessMemory 61 IoCs
description pid Process procid_target PID 496 wrote to memory of 188 496 CorelDraw_keygen_by_KeygenNinja.exe 78 PID 496 wrote to memory of 188 496 CorelDraw_keygen_by_KeygenNinja.exe 78 PID 496 wrote to memory of 188 496 CorelDraw_keygen_by_KeygenNinja.exe 78 PID 188 wrote to memory of 3700 188 cmd.exe 81 PID 188 wrote to memory of 3700 188 cmd.exe 81 PID 188 wrote to memory of 3700 188 cmd.exe 81 PID 188 wrote to memory of 3452 188 cmd.exe 82 PID 188 wrote to memory of 3452 188 cmd.exe 82 PID 188 wrote to memory of 3452 188 cmd.exe 82 PID 188 wrote to memory of 1324 188 cmd.exe 83 PID 188 wrote to memory of 1324 188 cmd.exe 83 PID 188 wrote to memory of 1324 188 cmd.exe 83 PID 188 wrote to memory of 3904 188 cmd.exe 84 PID 188 wrote to memory of 3904 188 cmd.exe 84 PID 188 wrote to memory of 3904 188 cmd.exe 84 PID 3700 wrote to memory of 3548 3700 keygen-pr.exe 85 PID 3700 wrote to memory of 3548 3700 keygen-pr.exe 85 PID 3700 wrote to memory of 3548 3700 keygen-pr.exe 85 PID 3904 wrote to memory of 1364 3904 keygen-step-4.exe 86 PID 3904 wrote to memory of 1364 3904 keygen-step-4.exe 86 PID 3904 wrote to memory of 1364 3904 keygen-step-4.exe 86 PID 1324 wrote to memory of 3400 1324 keygen-step-3.exe 87 PID 1324 wrote to memory of 3400 1324 keygen-step-3.exe 87 PID 1324 wrote to memory of 3400 1324 keygen-step-3.exe 87 PID 3548 wrote to memory of 3332 3548 key.exe 89 PID 3548 wrote to memory of 3332 3548 key.exe 89 PID 3548 wrote to memory of 3332 3548 key.exe 89 PID 3400 wrote to memory of 2660 3400 cmd.exe 90 PID 3400 wrote to memory of 2660 3400 cmd.exe 90 PID 3400 wrote to memory of 2660 3400 cmd.exe 90 PID 1364 wrote to memory of 2756 1364 file.exe 91 PID 1364 wrote to memory of 2756 1364 file.exe 91 PID 1364 wrote to memory of 2756 1364 file.exe 91 PID 2756 wrote to memory of 2620 2756 977.tmp.exe 92 PID 2756 wrote to memory of 2620 2756 977.tmp.exe 92 PID 2756 wrote to memory of 2620 2756 977.tmp.exe 92 PID 2756 wrote to memory of 2620 2756 977.tmp.exe 92 PID 2756 wrote to memory of 2620 2756 977.tmp.exe 92 PID 2756 wrote to memory of 2620 2756 977.tmp.exe 92 PID 2756 wrote to memory of 2620 2756 977.tmp.exe 92 PID 2756 wrote to memory of 2620 2756 977.tmp.exe 92 PID 2756 wrote to memory of 2620 2756 977.tmp.exe 92 PID 2756 wrote to memory of 2620 2756 977.tmp.exe 92 PID 2756 wrote to memory of 2620 2756 977.tmp.exe 92 PID 2756 wrote to memory of 2620 2756 977.tmp.exe 92 PID 2756 wrote to memory of 2620 2756 977.tmp.exe 92 PID 1364 wrote to memory of 3060 1364 file.exe 93 PID 1364 wrote to memory of 3060 1364 file.exe 93 PID 1364 wrote to memory of 3060 1364 file.exe 93 PID 3060 wrote to memory of 3028 3060 cmd.exe 96 PID 3060 wrote to memory of 3028 3060 cmd.exe 96 PID 3060 wrote to memory of 3028 3060 cmd.exe 96 PID 3904 wrote to memory of 3208 3904 keygen-step-4.exe 95 PID 3904 wrote to memory of 3208 3904 keygen-step-4.exe 95 PID 3904 wrote to memory of 3208 3904 keygen-step-4.exe 95 PID 3208 wrote to memory of 3968 3208 Setup.exe 97 PID 3208 wrote to memory of 3968 3208 Setup.exe 97 PID 3208 wrote to memory of 3968 3208 Setup.exe 97 PID 1312 wrote to memory of 1920 1312 msiexec.exe 99 PID 1312 wrote to memory of 1920 1312 msiexec.exe 99 PID 1312 wrote to memory of 1920 1312 msiexec.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\CorelDraw_keygen_by_KeygenNinja.exe"C:\Users\Admin\AppData\Local\Temp\CorelDraw_keygen_by_KeygenNinja.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:188 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exekeygen-pr.exe -p83fsase3Ge3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exeC:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat5⤵PID:3332
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exekeygen-step-1.exe3⤵
- Executes dropped EXE
PID:3452
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exekeygen-step-3.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30005⤵
- Runs ping.exe
PID:2660
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exekeygen-step-4.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"4⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Roaming\977.tmp.exe"C:\Users\Admin\AppData\Roaming\977.tmp.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Roaming\977.tmp.exe"C:\Users\Admin\AppData\Roaming\977.tmp.exe"6⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2620
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"5⤵
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.16⤵
- Runs ping.exe
PID:3028
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"4⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Windows\SysWOW64\msiexec.exemsiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\gdiview.msi"5⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3968
-
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 55DD5A60BD5E43EDAD550B711D03F65E C2⤵
- Loads dropped DLL
PID:1920
-