Analysis
- max time kernel
112s - max time network
99s - platform
windows7_x64 - resource
win7v20210410 - submitted
27/04/2021, 06:41
Static task
static1
Behavioral task
behavioral1
Sample
0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe
- Size 5.1MB
- Sample210427-9src5vy492
- SHA256 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab
- MD5 d7f573be43de2800c43f0a48051d82e7
- SHA1 c44edb12883a708348cf0dcbf0db458217fc847a
- SHA512 04ae9ccba30c4ef47e16a1842594e44df1dd151853ea44c22df4547cce569b146cc0cbef88762fde791631f21bfff49de8083af6dbc1371dd9bb997b64ed207d
- MD5 SHA1 SHA512
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 3 IoCs
pid Process 980 MsiExec.exe 980 MsiExec.exe 980 MsiExec.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe File opened (read-only) \??\Q: 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe File opened (read-only) \??\T: 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\F: 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe File opened (read-only) \??\V: 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe File opened (read-only) \??\Y: 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\U: 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe File opened (read-only) \??\W: 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe File opened (read-only) \??\G: 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe File opened (read-only) \??\L: 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe File opened (read-only) \??\O: 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe File opened (read-only) \??\K: 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\J: 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe File opened (read-only) \??\S: 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe File opened (read-only) \??\X: 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\M: 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe File opened (read-only) \??\Z: 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\P: 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe File opened (read-only) \??\B: 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe File opened (read-only) \??\N: 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe File opened (read-only) \??\R: 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\A: 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 572 msiexec.exe Token: SeTakeOwnershipPrivilege 572 msiexec.exe Token: SeSecurityPrivilege 572 msiexec.exe Token: SeCreateTokenPrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeAssignPrimaryTokenPrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeLockMemoryPrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeIncreaseQuotaPrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeMachineAccountPrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeTcbPrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeSecurityPrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeTakeOwnershipPrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeLoadDriverPrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeSystemProfilePrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeSystemtimePrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeProfSingleProcessPrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeIncBasePriorityPrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeCreatePagefilePrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeCreatePermanentPrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeBackupPrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeRestorePrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeShutdownPrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeDebugPrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeAuditPrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeSystemEnvironmentPrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeChangeNotifyPrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeRemoteShutdownPrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeUndockPrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeSyncAgentPrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeEnableDelegationPrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeManageVolumePrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeImpersonatePrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeCreateGlobalPrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeCreateTokenPrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeAssignPrimaryTokenPrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeLockMemoryPrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeIncreaseQuotaPrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeMachineAccountPrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeTcbPrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeSecurityPrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeTakeOwnershipPrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeLoadDriverPrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeSystemProfilePrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeSystemtimePrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeProfSingleProcessPrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeIncBasePriorityPrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeCreatePagefilePrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeCreatePermanentPrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeBackupPrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeRestorePrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeShutdownPrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeDebugPrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeAuditPrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeSystemEnvironmentPrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeChangeNotifyPrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeRemoteShutdownPrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeUndockPrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeSyncAgentPrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeEnableDelegationPrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeManageVolumePrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeImpersonatePrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeCreateGlobalPrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeCreateTokenPrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeAssignPrimaryTokenPrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe Token: SeLockMemoryPrivilege 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1096 0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 572 wrote to memory of 980 572 msiexec.exe 30 PID 572 wrote to memory of 980 572 msiexec.exe 30 PID 572 wrote to memory of 980 572 msiexec.exe 30 PID 572 wrote to memory of 980 572 msiexec.exe 30 PID 572 wrote to memory of 980 572 msiexec.exe 30 PID 572 wrote to memory of 980 572 msiexec.exe 30 PID 572 wrote to memory of 980 572 msiexec.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe"C:\Users\Admin\AppData\Local\Temp\0ec8d01e78f2157589701925ec97ada690046fa17ca65a0db766d96533529aab.bin.exe"1⤵
- Enumerates connected drives
- Modifies system certificate store
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1096
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A534D099122E0EA129C1D91C7D2774A7 C2⤵
- Loads dropped DLL
PID:980
-