Analysis
- max time kernel
113s - max time network
140s - platform
windows10_x64 - resource
win10v20210410 - submitted
10/08/2021, 15:20
Static task
static1
Behavioral task
behavioral1
Sample
ContratoAprovado+002336.msi
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
ContratoAprovado+002336.msi
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target ContratoAprovado+002336.msi
- Size 2.2MB
- Sample210810-rybjgptj76
- SHA256 c5d5bd4d5b66de5559e4ebb98251b74b49baa08a50cfc8f69b2c9005fcc861a4
- MD5 0a125b6c2639a01c8cd3b960c55e2369
- SHA1 190232aa432033b7be99cc8fe154fe5341f67578
- SHA512 cf52bd3b66ae50b7c30454abe0b9c49cd8fd7e49043d48136e67e60dcad09b81536b37290d256c17e05ba0f54646edb44d1ac2ef2f870ca070c089464d6e714d
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Blocklisted process makes network request 3 IoCs
flow pid Process 10 2748 MsiExec.exe 13 2748 MsiExec.exe 15 2748 MsiExec.exe - Executes dropped EXE 2 IoCs
pid Process 1564 MSI40F3.tmp 3920 JKGHFD9807Y.exe -
resource yara_rule behavioral2/memory/3920-150-0x0000000003F80000-0x0000000004979000-memory.dmp upx - Loads dropped DLL 12 IoCs
pid Process 2748 MsiExec.exe 2748 MsiExec.exe 2748 MsiExec.exe 2748 MsiExec.exe 2748 MsiExec.exe 2748 MsiExec.exe 2748 MsiExec.exe 2748 MsiExec.exe 2748 MsiExec.exe 3920 JKGHFD9807Y.exe 3920 JKGHFD9807Y.exe 3920 JKGHFD9807Y.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\JKGHFD9807Y.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Valoryz\\Unisvevo\\JKGHFD9807Y.exe" JKGHFD9807Y.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\P: msiexec.exe - Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Drops file in Windows directory 17 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI40F3.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI259E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI293B.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{B4351E97-59D1-48B9-8052-AB9783F98697} msiexec.exe File opened for modification C:\Windows\Installer\MSI3FB8.tmp msiexec.exe File opened for modification C:\Windows\Installer\f742541.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI2BCE.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2CFA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI284F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI28AE.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2A84.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2C0D.tmp msiexec.exe File created C:\Windows\Installer\f742541.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI2C6C.tmp msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "335374043" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "335422628" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "335390636" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3793201419" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0D83332D-F9EF-11EB-A11C-CE9B817779E4} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30903803" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3789763930" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a78544a31905944182f01a5a4525351900000000020000000000106600000001000020000000dc292177ecb245b98e913b8855eac921cdfaa3bdb3145bd272b36fdec00d0614000000000e80000000020000200000005fc4d2ed0eed6c3662f6abd5b9b0453384669d8bc27e29ff231ffc3ee0b9f6032000000040e7c4c58f65ca30fbf1aa1d10578cbadd2315959361a8f83be331b92647489e400000001fb8ccc7e830fc845c78c8a374b77d2ef028082a3179bed606d162a156e3a0d18690cac386d31cdde343c3dee2445fa02c55bf2f623a297e87db24c8a5521983 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30903803" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30903803" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a78544a31905944182f01a5a4525351900000000020000000000106600000001000020000000d1e1214e21f7cdde15f1afe4e4a7b565faba93c69974a023936fcf84e1af0ce6000000000e800000000200002000000010759a2e4cbd6e8764b3bc2a91e57967ebc9f75db1c03e6226585e807ba821cf20000000d07952680500a996dfc5b1965665ee74a831a62468c4cea89eb48e17019474a240000000ba8840f2c79e6d4dbf6533a7a8e12423c658e3c739b5520533d0ee85bb08a7d5e64f1b40c08420a88192588ca125a483a59ab5c745b237ac0223807a7a3c4ae9 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 109703e3fb8dd701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3789763930" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4066f5e2fb8dd701 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz! iexplore.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1812 msiexec.exe 1812 msiexec.exe 3920 JKGHFD9807Y.exe 3920 JKGHFD9807Y.exe 3920 JKGHFD9807Y.exe 3920 JKGHFD9807Y.exe 3920 JKGHFD9807Y.exe 3920 JKGHFD9807Y.exe 3920 JKGHFD9807Y.exe 3920 JKGHFD9807Y.exe - Suspicious use of AdjustPrivilegeToken 62 IoCs
description pid Process Token: SeShutdownPrivilege 3200 msiexec.exe Token: SeIncreaseQuotaPrivilege 3200 msiexec.exe Token: SeSecurityPrivilege 1812 msiexec.exe Token: SeCreateTokenPrivilege 3200 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3200 msiexec.exe Token: SeLockMemoryPrivilege 3200 msiexec.exe Token: SeIncreaseQuotaPrivilege 3200 msiexec.exe Token: SeMachineAccountPrivilege 3200 msiexec.exe Token: SeTcbPrivilege 3200 msiexec.exe Token: SeSecurityPrivilege 3200 msiexec.exe Token: SeTakeOwnershipPrivilege 3200 msiexec.exe Token: SeLoadDriverPrivilege 3200 msiexec.exe Token: SeSystemProfilePrivilege 3200 msiexec.exe Token: SeSystemtimePrivilege 3200 msiexec.exe Token: SeProfSingleProcessPrivilege 3200 msiexec.exe Token: SeIncBasePriorityPrivilege 3200 msiexec.exe Token: SeCreatePagefilePrivilege 3200 msiexec.exe Token: SeCreatePermanentPrivilege 3200 msiexec.exe Token: SeBackupPrivilege 3200 msiexec.exe Token: SeRestorePrivilege 3200 msiexec.exe Token: SeShutdownPrivilege 3200 msiexec.exe Token: SeDebugPrivilege 3200 msiexec.exe Token: SeAuditPrivilege 3200 msiexec.exe Token: SeSystemEnvironmentPrivilege 3200 msiexec.exe Token: SeChangeNotifyPrivilege 3200 msiexec.exe Token: SeRemoteShutdownPrivilege 3200 msiexec.exe Token: SeUndockPrivilege 3200 msiexec.exe Token: SeSyncAgentPrivilege 3200 msiexec.exe Token: SeEnableDelegationPrivilege 3200 msiexec.exe Token: SeManageVolumePrivilege 3200 msiexec.exe Token: SeImpersonatePrivilege 3200 msiexec.exe Token: SeCreateGlobalPrivilege 3200 msiexec.exe Token: SeRestorePrivilege 1812 msiexec.exe Token: SeTakeOwnershipPrivilege 1812 msiexec.exe Token: SeRestorePrivilege 1812 msiexec.exe Token: SeTakeOwnershipPrivilege 1812 msiexec.exe Token: SeRestorePrivilege 1812 msiexec.exe Token: SeTakeOwnershipPrivilege 1812 msiexec.exe Token: SeRestorePrivilege 1812 msiexec.exe Token: SeTakeOwnershipPrivilege 1812 msiexec.exe Token: SeRestorePrivilege 1812 msiexec.exe Token: SeTakeOwnershipPrivilege 1812 msiexec.exe Token: SeRestorePrivilege 1812 msiexec.exe Token: SeTakeOwnershipPrivilege 1812 msiexec.exe Token: SeRestorePrivilege 1812 msiexec.exe Token: SeTakeOwnershipPrivilege 1812 msiexec.exe Token: SeRestorePrivilege 1812 msiexec.exe Token: SeTakeOwnershipPrivilege 1812 msiexec.exe Token: SeRestorePrivilege 1812 msiexec.exe Token: SeTakeOwnershipPrivilege 1812 msiexec.exe Token: SeRestorePrivilege 1812 msiexec.exe Token: SeTakeOwnershipPrivilege 1812 msiexec.exe Token: SeRestorePrivilege 1812 msiexec.exe Token: SeTakeOwnershipPrivilege 1812 msiexec.exe Token: SeRestorePrivilege 1812 msiexec.exe Token: SeTakeOwnershipPrivilege 1812 msiexec.exe Token: SeRestorePrivilege 1812 msiexec.exe Token: SeTakeOwnershipPrivilege 1812 msiexec.exe Token: SeRestorePrivilege 1812 msiexec.exe Token: SeTakeOwnershipPrivilege 1812 msiexec.exe Token: SeRestorePrivilege 1812 msiexec.exe Token: SeTakeOwnershipPrivilege 1812 msiexec.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 3200 msiexec.exe 3200 msiexec.exe 4092 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4092 iexplore.exe 4092 iexplore.exe 3480 IEXPLORE.EXE 3480 IEXPLORE.EXE 3480 IEXPLORE.EXE 3480 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1812 wrote to memory of 2748 1812 msiexec.exe 77 PID 1812 wrote to memory of 2748 1812 msiexec.exe 77 PID 1812 wrote to memory of 2748 1812 msiexec.exe 77 PID 1812 wrote to memory of 1564 1812 msiexec.exe 81 PID 1812 wrote to memory of 1564 1812 msiexec.exe 81 PID 1812 wrote to memory of 1564 1812 msiexec.exe 81 PID 3920 wrote to memory of 4092 3920 JKGHFD9807Y.exe 84 PID 3920 wrote to memory of 4092 3920 JKGHFD9807Y.exe 84 PID 4092 wrote to memory of 3480 4092 iexplore.exe 85 PID 4092 wrote to memory of 3480 4092 iexplore.exe 85 PID 4092 wrote to memory of 3480 4092 iexplore.exe 85
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ContratoAprovado+002336.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3200
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 33570D68637DEAC0D14EB0EE7CBCE3E82⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:2748
-
-
C:\Windows\Installer\MSI40F3.tmp"C:\Windows\Installer\MSI40F3.tmp" /DontWait "C:\Users\Admin\AppData\Roaming\Valoryz\Unisvevo\JKGHFD9807Y.exe"2⤵
- Executes dropped EXE
PID:1564
-
-
C:\Users\Admin\AppData\Roaming\Valoryz\Unisvevo\JKGHFD9807Y.exe"C:\Users\Admin\AppData\Roaming\Valoryz\Unisvevo\JKGHFD9807Y.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://bit.ly/3yvbVdO2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4092 CREDAT:82945 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3480
-
-