Analysis
- max time kernel
111s - max time network
97s - platform
windows7_x64 - resource
win7v20210410 - submitted
27/04/2021, 06:41
Static task
static1
Behavioral task
behavioral1
Sample
0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe
- Size 5.1MB
- Sample210427-b2eshqhfja
- SHA256 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55
- MD5 c3aa5ffcab6ac655b4ae3fe9b26bde0e
- SHA1 c8dad4aa1d63325cf851b0d0fd4b9cb358932ca5
- SHA512 fa9e4cc795ff417cacc60cc1a923aa336962944125da369495c637aea4f7588e5103f6dfca16695e71b529861f4374b52bce9a872e5f50728a5e020b43b10107
- MD5 SHA1 SHA512
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 3 IoCs
pid Process 1084 MsiExec.exe 1084 MsiExec.exe 1084 MsiExec.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe File opened (read-only) \??\P: 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe File opened (read-only) \??\R: 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe File opened (read-only) \??\W: 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe File opened (read-only) \??\X: 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe File opened (read-only) \??\E: 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe File opened (read-only) \??\N: 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe File opened (read-only) \??\U: 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\M: 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe File opened (read-only) \??\Q: 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe File opened (read-only) \??\Y: 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe File opened (read-only) \??\I: 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe File opened (read-only) \??\L: 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe File opened (read-only) \??\S: 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\T: 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe File opened (read-only) \??\G: 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe File opened (read-only) \??\K: 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe File opened (read-only) \??\V: 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe File opened (read-only) \??\O: 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe File opened (read-only) \??\Z: 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 1376 msiexec.exe Token: SeTakeOwnershipPrivilege 1376 msiexec.exe Token: SeSecurityPrivilege 1376 msiexec.exe Token: SeCreateTokenPrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeAssignPrimaryTokenPrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeLockMemoryPrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeIncreaseQuotaPrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeMachineAccountPrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeTcbPrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeSecurityPrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeTakeOwnershipPrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeLoadDriverPrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeSystemProfilePrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeSystemtimePrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeProfSingleProcessPrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeIncBasePriorityPrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeCreatePagefilePrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeCreatePermanentPrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeBackupPrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeRestorePrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeShutdownPrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeDebugPrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeAuditPrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeSystemEnvironmentPrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeChangeNotifyPrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeRemoteShutdownPrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeUndockPrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeSyncAgentPrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeEnableDelegationPrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeManageVolumePrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeImpersonatePrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeCreateGlobalPrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeCreateTokenPrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeAssignPrimaryTokenPrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeLockMemoryPrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeIncreaseQuotaPrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeMachineAccountPrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeTcbPrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeSecurityPrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeTakeOwnershipPrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeLoadDriverPrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeSystemProfilePrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeSystemtimePrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeProfSingleProcessPrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeIncBasePriorityPrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeCreatePagefilePrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeCreatePermanentPrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeBackupPrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeRestorePrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeShutdownPrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeDebugPrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeAuditPrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeSystemEnvironmentPrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeChangeNotifyPrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeRemoteShutdownPrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeUndockPrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeSyncAgentPrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeEnableDelegationPrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeManageVolumePrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeImpersonatePrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeCreateGlobalPrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeCreateTokenPrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeAssignPrimaryTokenPrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe Token: SeLockMemoryPrivilege 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1888 0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1376 wrote to memory of 1084 1376 msiexec.exe 30 PID 1376 wrote to memory of 1084 1376 msiexec.exe 30 PID 1376 wrote to memory of 1084 1376 msiexec.exe 30 PID 1376 wrote to memory of 1084 1376 msiexec.exe 30 PID 1376 wrote to memory of 1084 1376 msiexec.exe 30 PID 1376 wrote to memory of 1084 1376 msiexec.exe 30 PID 1376 wrote to memory of 1084 1376 msiexec.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe"C:\Users\Admin\AppData\Local\Temp\0240347f0a7e6318facda5d29103c2dba44ef0d45f76706cd5ade058a69c0c55.bin.exe"1⤵
- Enumerates connected drives
- Modifies system certificate store
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1888
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 2E220589D056FC85AD27DD6951C47118 C2⤵
- Loads dropped DLL
PID:1084
-