Analysis
-
max time kernel
60s -
max time network
64s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
06-03-2021 07:08
Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
Setup.exe
Resource
win10v20201028
gluptebametasploitplugxraccoonredlinesmokeloadertofseevidarxmrigafefd33a49c7cbd55d417545269920f24c85aa37e71b51d358b75fe1407b56bf2284e3fac50c860fbackdoorbootkitdiscoverydropperevasioninfostealerloadermacrominerpersistencespywarestealertrojanupxxlm
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral4
Sample
Setup.exe
Resource
win10v20201028
buergluptebametasploitplugxraccoonredlinesmokeloadertofseevidarxmrigafefd33a49c7cbd55d417545269920f24c85aa37e71b51d358b75fe1407b56bf2284e3fac50c860fbackdoorbootkitdiscoverydropperevasioninfostealerloadermacrominerpersistencespywarestealertrojanxlm
windows10_x64
0 signatures
0 seconds
General
-
Target
Setup.exe
-
Size
4.2MB
-
MD5
afd51e2ff7beac4d0c88d8f872d6d0d5
-
SHA1
185fd4793db912410de63ac7a5a3b1ac9c266b38
-
SHA256
cecdc8bd4344647b2182696cf04e1db4fbb29aee6b46811999008901910b5c19
-
SHA512
eed33fd55a82fceea21f522a6c59d3e318d7e73c86e9b1f039e37b3ccd6c0b58df24dabfcb71d8ccb818dd236cc329804d6a947240619ad26aed8713fe19a418
Score
9/10
Malware Config
Signatures
-
Nirsoft 6 IoCs
resource yara_rule behavioral1/files/0x000200000001ab59-25.dat Nirsoft behavioral1/files/0x000200000001ab59-26.dat Nirsoft behavioral1/files/0x000400000001a50e-33.dat Nirsoft behavioral1/files/0x000400000001a50e-34.dat Nirsoft behavioral1/files/0x000300000001a2df-40.dat Nirsoft behavioral1/files/0x000300000001a2df-41.dat Nirsoft -
Executes dropped EXE 7 IoCs
pid Process 4496 C0CA61A12E4C8B38.exe 4520 C0CA61A12E4C8B38.exe 1684 1615014383548.exe 2580 1615014388360.exe 2696 1615014393579.exe 2684 ThunderFW.exe 188 MiniThunderPlatform.exe -
resource yara_rule behavioral1/files/0x000100000001ab5b-4.dat office_xlm_macros -
Loads dropped DLL 11 IoCs
pid Process 3372 MsiExec.exe 4496 C0CA61A12E4C8B38.exe 4496 C0CA61A12E4C8B38.exe 188 MiniThunderPlatform.exe 188 MiniThunderPlatform.exe 188 MiniThunderPlatform.exe 188 MiniThunderPlatform.exe 188 MiniThunderPlatform.exe 188 MiniThunderPlatform.exe 188 MiniThunderPlatform.exe 188 MiniThunderPlatform.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 4 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 Setup.exe File opened for modification \??\PhysicalDrive0 C0CA61A12E4C8B38.exe File opened for modification \??\PhysicalDrive0 C0CA61A12E4C8B38.exe File opened for modification \??\PhysicalDrive0 MiniThunderPlatform.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4776 Setup.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 4496 set thread context of 64 4496 C0CA61A12E4C8B38.exe 88 PID 4496 set thread context of 2564 4496 C0CA61A12E4C8B38.exe 97 PID 4496 set thread context of 2936 4496 C0CA61A12E4C8B38.exe 99 -
Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 C0CA61A12E4C8B38.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc C0CA61A12E4C8B38.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 C0CA61A12E4C8B38.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc C0CA61A12E4C8B38.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName C0CA61A12E4C8B38.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc C0CA61A12E4C8B38.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\FriendlyName C0CA61A12E4C8B38.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 C0CA61A12E4C8B38.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName C0CA61A12E4C8B38.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc C0CA61A12E4C8B38.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\FriendlyName C0CA61A12E4C8B38.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 C0CA61A12E4C8B38.exe -
Kills process with taskkill 1 IoCs
pid Process 1268 taskkill.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD Setup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD\Blob = 0300000001000000140000006c0ce2dd0584c47cac18839f14055f19fa270cdd2000000001000000500500003082054c30820434a0030201020206016de34cff62300d06092a864886f70d01010b05003081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a301e170d3030303130313030303030305a170d3438313231353039313533375a3081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a30820122300d06092a864886f70d01010105000382010f003082010a0282010100ae86c5043ed34d99f44fa3052ea34047a7fbbe33188b1dc2ca645ca3249e85e54b4921d4998fda6a22247c32d9087d742af3bf850803ae8c1e25faad53fb8fd823b7353d9a3ac992bf917f693826c790e53a540b120b6553508ec9585e467d310bd3ef9fb61731deb522eb78f43f824b34be36782db7a8cb162cd22247b14e4c5ae633ed66542354a59971bddc59160ecdc521b4477c93ca9e624e0af00298602300f5dc368819c3cb9f02604636888276b3a498570473b5328b0834f327c34285e333da9207e12f0edbb654c8cf11e3cc7cba17a52cd7cd42c10ae095a2e4eb9d3e3f361488243f0584af40e72d6e6e182149bfb8342384f60f12e14734258d0203010001a382017430820170300f0603551d130101ff040530030101ff3082012c06096086480186f842010d0482011d138201195468697320526f6f74206365727469666963617465207761732067656e65726174656420627920436861726c65732050726f787920666f722053534c2050726f7879696e672e20496620746869732063657274696669636174652069732070617274206f66206120636572746966696361746520636861696e2c2074686973206d65616e73207468617420796f752772652062726f7773696e67207468726f75676820436861726c65732050726f787920776974682053534c2050726f7879696e6720656e61626c656420666f72207468697320776562736974652e20506c656173652073656520687474703a2f2f636861726c657370726f78792e636f6d2f73736c20666f72206d6f726520696e666f726d6174696f6e2e300e0603551d0f0101ff040403020204301d0603551d0e04160414f8d0dc54367cf794020f8b92783a5d8a91251f9f300d06092a864886f70d01010b05000382010100662271eb9d5c744c88382de98ba37320e6312104d04273a92007a8670976d6530e6347d00bbded1319bb6754f36237596095922911e3661a70354f6ba0b797a76258be7adebb8c8dbeeed977760b80271d74b2444d92f6c1337a379b73545b251de5f8812b9625abbbfaedc15f8c6c374b9b26dd0fef035185f5899d8819e689dc6db5f0babbfd637c52b1bec80115b889faeed493d4112d744954ad3abe6607c41a4a2d657ba330ed131fa4e8c25bb28ee181dcef8da91c17bfd30a23c8eae81b152ed85ff938afc32b34ffdaffbdb72d9bb04067bfc87f579eba9637b165ea008ea7408bc8265f33c039bf60f506d245a6b53017afc8e161d70ed5b0d76576 Setup.exe -
Runs ping.exe 1 TTPs 2 IoCs
pid Process 436 PING.EXE 2304 PING.EXE -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1684 1615014383548.exe 1684 1615014383548.exe 2580 1615014388360.exe 2580 1615014388360.exe 2696 1615014393579.exe 2696 1615014393579.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 768 msiexec.exe Token: SeIncreaseQuotaPrivilege 768 msiexec.exe Token: SeSecurityPrivilege 3280 msiexec.exe Token: SeCreateTokenPrivilege 768 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 768 msiexec.exe Token: SeLockMemoryPrivilege 768 msiexec.exe Token: SeIncreaseQuotaPrivilege 768 msiexec.exe Token: SeMachineAccountPrivilege 768 msiexec.exe Token: SeTcbPrivilege 768 msiexec.exe Token: SeSecurityPrivilege 768 msiexec.exe Token: SeTakeOwnershipPrivilege 768 msiexec.exe Token: SeLoadDriverPrivilege 768 msiexec.exe Token: SeSystemProfilePrivilege 768 msiexec.exe Token: SeSystemtimePrivilege 768 msiexec.exe Token: SeProfSingleProcessPrivilege 768 msiexec.exe Token: SeIncBasePriorityPrivilege 768 msiexec.exe Token: SeCreatePagefilePrivilege 768 msiexec.exe Token: SeCreatePermanentPrivilege 768 msiexec.exe Token: SeBackupPrivilege 768 msiexec.exe Token: SeRestorePrivilege 768 msiexec.exe Token: SeShutdownPrivilege 768 msiexec.exe Token: SeDebugPrivilege 768 msiexec.exe Token: SeAuditPrivilege 768 msiexec.exe Token: SeSystemEnvironmentPrivilege 768 msiexec.exe Token: SeChangeNotifyPrivilege 768 msiexec.exe Token: SeRemoteShutdownPrivilege 768 msiexec.exe Token: SeUndockPrivilege 768 msiexec.exe Token: SeSyncAgentPrivilege 768 msiexec.exe Token: SeEnableDelegationPrivilege 768 msiexec.exe Token: SeManageVolumePrivilege 768 msiexec.exe Token: SeImpersonatePrivilege 768 msiexec.exe Token: SeCreateGlobalPrivilege 768 msiexec.exe Token: SeCreateTokenPrivilege 768 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 768 msiexec.exe Token: SeLockMemoryPrivilege 768 msiexec.exe Token: SeIncreaseQuotaPrivilege 768 msiexec.exe Token: SeMachineAccountPrivilege 768 msiexec.exe Token: SeTcbPrivilege 768 msiexec.exe Token: SeSecurityPrivilege 768 msiexec.exe Token: SeTakeOwnershipPrivilege 768 msiexec.exe Token: SeLoadDriverPrivilege 768 msiexec.exe Token: SeSystemProfilePrivilege 768 msiexec.exe Token: SeSystemtimePrivilege 768 msiexec.exe Token: SeProfSingleProcessPrivilege 768 msiexec.exe Token: SeIncBasePriorityPrivilege 768 msiexec.exe Token: SeCreatePagefilePrivilege 768 msiexec.exe Token: SeCreatePermanentPrivilege 768 msiexec.exe Token: SeBackupPrivilege 768 msiexec.exe Token: SeRestorePrivilege 768 msiexec.exe Token: SeShutdownPrivilege 768 msiexec.exe Token: SeDebugPrivilege 768 msiexec.exe Token: SeAuditPrivilege 768 msiexec.exe Token: SeSystemEnvironmentPrivilege 768 msiexec.exe Token: SeChangeNotifyPrivilege 768 msiexec.exe Token: SeRemoteShutdownPrivilege 768 msiexec.exe Token: SeUndockPrivilege 768 msiexec.exe Token: SeSyncAgentPrivilege 768 msiexec.exe Token: SeEnableDelegationPrivilege 768 msiexec.exe Token: SeManageVolumePrivilege 768 msiexec.exe Token: SeImpersonatePrivilege 768 msiexec.exe Token: SeCreateGlobalPrivilege 768 msiexec.exe Token: SeCreateTokenPrivilege 768 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 768 msiexec.exe Token: SeLockMemoryPrivilege 768 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 768 msiexec.exe -
Suspicious use of WriteProcessMemory 63 IoCs
description pid Process procid_target PID 4776 wrote to memory of 768 4776 Setup.exe 76 PID 4776 wrote to memory of 768 4776 Setup.exe 76 PID 4776 wrote to memory of 768 4776 Setup.exe 76 PID 3280 wrote to memory of 3372 3280 msiexec.exe 79 PID 3280 wrote to memory of 3372 3280 msiexec.exe 79 PID 3280 wrote to memory of 3372 3280 msiexec.exe 79 PID 4776 wrote to memory of 4496 4776 Setup.exe 83 PID 4776 wrote to memory of 4496 4776 Setup.exe 83 PID 4776 wrote to memory of 4496 4776 Setup.exe 83 PID 4776 wrote to memory of 4520 4776 Setup.exe 84 PID 4776 wrote to memory of 4520 4776 Setup.exe 84 PID 4776 wrote to memory of 4520 4776 Setup.exe 84 PID 4776 wrote to memory of 4560 4776 Setup.exe 85 PID 4776 wrote to memory of 4560 4776 Setup.exe 85 PID 4776 wrote to memory of 4560 4776 Setup.exe 85 PID 4560 wrote to memory of 436 4560 cmd.exe 87 PID 4560 wrote to memory of 436 4560 cmd.exe 87 PID 4560 wrote to memory of 436 4560 cmd.exe 87 PID 4496 wrote to memory of 64 4496 C0CA61A12E4C8B38.exe 88 PID 4496 wrote to memory of 64 4496 C0CA61A12E4C8B38.exe 88 PID 4496 wrote to memory of 64 4496 C0CA61A12E4C8B38.exe 88 PID 4496 wrote to memory of 64 4496 C0CA61A12E4C8B38.exe 88 PID 4496 wrote to memory of 64 4496 C0CA61A12E4C8B38.exe 88 PID 4496 wrote to memory of 64 4496 C0CA61A12E4C8B38.exe 88 PID 4520 wrote to memory of 992 4520 C0CA61A12E4C8B38.exe 89 PID 4520 wrote to memory of 992 4520 C0CA61A12E4C8B38.exe 89 PID 4520 wrote to memory of 992 4520 C0CA61A12E4C8B38.exe 89 PID 992 wrote to memory of 1268 992 cmd.exe 91 PID 992 wrote to memory of 1268 992 cmd.exe 91 PID 992 wrote to memory of 1268 992 cmd.exe 91 PID 4496 wrote to memory of 1684 4496 C0CA61A12E4C8B38.exe 93 PID 4496 wrote to memory of 1684 4496 C0CA61A12E4C8B38.exe 93 PID 4496 wrote to memory of 1684 4496 C0CA61A12E4C8B38.exe 93 PID 4520 wrote to memory of 1548 4520 C0CA61A12E4C8B38.exe 94 PID 4520 wrote to memory of 1548 4520 C0CA61A12E4C8B38.exe 94 PID 4520 wrote to memory of 1548 4520 C0CA61A12E4C8B38.exe 94 PID 1548 wrote to memory of 2304 1548 cmd.exe 96 PID 1548 wrote to memory of 2304 1548 cmd.exe 96 PID 1548 wrote to memory of 2304 1548 cmd.exe 96 PID 4496 wrote to memory of 2564 4496 C0CA61A12E4C8B38.exe 97 PID 4496 wrote to memory of 2564 4496 C0CA61A12E4C8B38.exe 97 PID 4496 wrote to memory of 2564 4496 C0CA61A12E4C8B38.exe 97 PID 4496 wrote to memory of 2564 4496 C0CA61A12E4C8B38.exe 97 PID 4496 wrote to memory of 2564 4496 C0CA61A12E4C8B38.exe 97 PID 4496 wrote to memory of 2564 4496 C0CA61A12E4C8B38.exe 97 PID 4496 wrote to memory of 2580 4496 C0CA61A12E4C8B38.exe 98 PID 4496 wrote to memory of 2580 4496 C0CA61A12E4C8B38.exe 98 PID 4496 wrote to memory of 2580 4496 C0CA61A12E4C8B38.exe 98 PID 4496 wrote to memory of 2936 4496 C0CA61A12E4C8B38.exe 99 PID 4496 wrote to memory of 2936 4496 C0CA61A12E4C8B38.exe 99 PID 4496 wrote to memory of 2936 4496 C0CA61A12E4C8B38.exe 99 PID 4496 wrote to memory of 2936 4496 C0CA61A12E4C8B38.exe 99 PID 4496 wrote to memory of 2936 4496 C0CA61A12E4C8B38.exe 99 PID 4496 wrote to memory of 2936 4496 C0CA61A12E4C8B38.exe 99 PID 4496 wrote to memory of 2696 4496 C0CA61A12E4C8B38.exe 100 PID 4496 wrote to memory of 2696 4496 C0CA61A12E4C8B38.exe 100 PID 4496 wrote to memory of 2696 4496 C0CA61A12E4C8B38.exe 100 PID 4496 wrote to memory of 2684 4496 C0CA61A12E4C8B38.exe 101 PID 4496 wrote to memory of 2684 4496 C0CA61A12E4C8B38.exe 101 PID 4496 wrote to memory of 2684 4496 C0CA61A12E4C8B38.exe 101 PID 4496 wrote to memory of 188 4496 C0CA61A12E4C8B38.exe 102 PID 4496 wrote to memory of 188 4496 C0CA61A12E4C8B38.exe 102 PID 4496 wrote to memory of 188 4496 C0CA61A12E4C8B38.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Windows\SysWOW64\msiexec.exemsiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\gdiview.msi"2⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:768
-
-
C:\Users\Admin\AppData\Local\Temp\C0CA61A12E4C8B38.exeC:\Users\Admin\AppData\Local\Temp\C0CA61A12E4C8B38.exe 0011 installp12⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"3⤵PID:64
-
-
C:\Users\Admin\AppData\Roaming\1615014383548.exe"C:\Users\Admin\AppData\Roaming\1615014383548.exe" /sjson "C:\Users\Admin\AppData\Roaming\1615014383548.txt"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1684
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"3⤵PID:2564
-
-
C:\Users\Admin\AppData\Roaming\1615014388360.exe"C:\Users\Admin\AppData\Roaming\1615014388360.exe" /sjson "C:\Users\Admin\AppData\Roaming\1615014388360.txt"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2580
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"3⤵PID:2936
-
-
C:\Users\Admin\AppData\Roaming\1615014393579.exe"C:\Users\Admin\AppData\Roaming\1615014393579.exe" /sjson "C:\Users\Admin\AppData\Roaming\1615014393579.txt"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2696
-
-
C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exeC:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe ThunderFW "C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe"3⤵
- Executes dropped EXE
PID:2684
-
-
C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe"C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe" -StartTP3⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
PID:188
-
-
-
C:\Users\Admin\AppData\Local\Temp\C0CA61A12E4C8B38.exeC:\Users\Admin\AppData\Local\Temp\C0CA61A12E4C8B38.exe 200 installp12⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe3⤵
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe4⤵
- Kills process with taskkill
PID:1268
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\C0CA61A12E4C8B38.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 34⤵
- Runs ping.exe
PID:2304
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\Setup.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 33⤵
- Runs ping.exe
PID:436
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1D733840332A00E82564A23D39DC970A C2⤵
- Loads dropped DLL
PID:3372
-