Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
1Anime-Figh...24.exe
windows7_x64
8Anime-Figh...24.exe
windows7_x64
10Anime-Figh...24.exe
windows7_x64
10Anime-Figh...24.exe
windows7_x64
8Anime-Figh...24.exe
windows11_x64
8Anime-Figh...24.exe
windows10_x64
10Anime-Figh...24.exe
windows10_x64
Anime-Figh...24.exe
windows10_x64
10Anime-Figh...24.exe
windows10_x64
10Anime-Figh...24.exe
windows10_x64
10Analysis
-
max time kernel
65s -
max time network
64s -
platform
windows7_x64 -
resource
win7-jp -
submitted
02/09/2021, 19:12
Static task
static1
Behavioral task
behavioral1
Sample
Anime-Fighters-Infin_734316524.exe
Resource
win7-jp
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Anime-Fighters-Infin_734316524.exe
Resource
win7-fr
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
Anime-Fighters-Infin_734316524.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral4
Sample
Anime-Fighters-Infin_734316524.exe
Resource
win7-de
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral5
Sample
Anime-Fighters-Infin_734316524.exe
Resource
win11
windows11_x64
0 signatures
0 seconds
Behavioral task
behavioral6
Sample
Anime-Fighters-Infin_734316524.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral7
Sample
Anime-Fighters-Infin_734316524.exe
Resource
win10-jp
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral8
Sample
Anime-Fighters-Infin_734316524.exe
Resource
win10-fr
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral9
Sample
Anime-Fighters-Infin_734316524.exe
Resource
win10-en
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral10
Sample
Anime-Fighters-Infin_734316524.exe
Resource
win10-de
windows10_x64
0 signatures
0 seconds
General
-
Target
Anime-Fighters-Infin_734316524.exe
-
Size
3.9MB
-
MD5
bd2b73492acf20dec004360b1605032d
-
SHA1
60ddf3c107d94bbeb102a2d7ede945eb5edd2b35
-
SHA256
12b6272825140a15eabec58f97b49aed3ce5db7816a0b3c2674f6ae8746367ca
-
SHA512
dae236259e32a9e4b789f020dbd8082b376e3c2b56fd94523a44cf4b5a557f3661aeefc24b5605218ba0479ee1b9a8cb7b5c1df6c103673a99f13bc4210c90da
Score
8/10
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 4 IoCs
pid Process 1888 Anime-Fighters-Infin_734316524.tmp 1364 Expedita.exe 1648 tQX8KOqP9O.exe 1544 KCYg6pTj0.exe -
Loads dropped DLL 19 IoCs
pid Process 1920 Anime-Fighters-Infin_734316524.exe 1888 Anime-Fighters-Infin_734316524.tmp 1888 Anime-Fighters-Infin_734316524.tmp 1888 Anime-Fighters-Infin_734316524.tmp 1888 Anime-Fighters-Infin_734316524.tmp 1364 Expedita.exe 1364 Expedita.exe 1364 Expedita.exe 1544 KCYg6pTj0.exe 1544 KCYg6pTj0.exe 1544 KCYg6pTj0.exe 1384 MsiExec.exe 1384 MsiExec.exe 1456 MsiExec.exe 1456 MsiExec.exe 1456 MsiExec.exe 1456 MsiExec.exe 1456 MsiExec.exe 1456 MsiExec.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: KCYg6pTj0.exe File opened (read-only) \??\W: KCYg6pTj0.exe File opened (read-only) \??\Y: KCYg6pTj0.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: KCYg6pTj0.exe File opened (read-only) \??\N: KCYg6pTj0.exe File opened (read-only) \??\P: KCYg6pTj0.exe File opened (read-only) \??\T: KCYg6pTj0.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: KCYg6pTj0.exe File opened (read-only) \??\M: KCYg6pTj0.exe File opened (read-only) \??\Z: KCYg6pTj0.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: KCYg6pTj0.exe File opened (read-only) \??\F: KCYg6pTj0.exe File opened (read-only) \??\K: KCYg6pTj0.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\S: KCYg6pTj0.exe File opened (read-only) \??\U: KCYg6pTj0.exe File opened (read-only) \??\V: KCYg6pTj0.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\G: KCYg6pTj0.exe File opened (read-only) \??\I: KCYg6pTj0.exe File opened (read-only) \??\R: KCYg6pTj0.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: KCYg6pTj0.exe File opened (read-only) \??\O: KCYg6pTj0.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\L: KCYg6pTj0.exe File opened (read-only) \??\Q: KCYg6pTj0.exe File opened (read-only) \??\X: KCYg6pTj0.exe -
Drops file in Program Files directory 16 IoCs
description ioc Process File created C:\Program Files (x86)\Vel\is-ABQA4.tmp Anime-Fighters-Infin_734316524.tmp File created C:\Program Files (x86)\Vel\magnam\is-C06F1.tmp Anime-Fighters-Infin_734316524.tmp File created C:\Program Files (x86)\Vel\nesciunt\is-BRFPN.tmp Anime-Fighters-Infin_734316524.tmp File created C:\Program Files (x86)\Vel\voluptas\is-9I96J.tmp Anime-Fighters-Infin_734316524.tmp File opened for modification C:\Program Files (x86)\Vel\magnam\Expedita.exe Anime-Fighters-Infin_734316524.tmp File created C:\Program Files (x86)\Vel\unins000.dat Anime-Fighters-Infin_734316524.tmp File created C:\Program Files (x86)\Vel\nesciunt\is-SQ0LK.tmp Anime-Fighters-Infin_734316524.tmp File created C:\Program Files (x86)\Vel\is-S27GC.tmp Anime-Fighters-Infin_734316524.tmp File created C:\Program Files (x86)\Vel\magnam\is-JT6KQ.tmp Anime-Fighters-Infin_734316524.tmp File created C:\Program Files (x86)\Vel\magnam\is-HKS1F.tmp Anime-Fighters-Infin_734316524.tmp File created C:\Program Files (x86)\Vel\nesciunt\is-27NKJ.tmp Anime-Fighters-Infin_734316524.tmp File created C:\Program Files (x86)\Vel\voluptas\is-NSB6F.tmp Anime-Fighters-Infin_734316524.tmp File created C:\Program Files (x86)\Vel\is-JS3C9.tmp Anime-Fighters-Infin_734316524.tmp File created C:\Program Files (x86)\Vel\is-PSEQH.tmp Anime-Fighters-Infin_734316524.tmp File created C:\Program Files (x86)\Vel\nesciunt\is-TNVQ3.tmp Anime-Fighters-Infin_734316524.tmp File opened for modification C:\Program Files (x86)\Vel\unins000.dat Anime-Fighters-Infin_734316524.tmp -
Drops file in Windows directory 8 IoCs
description ioc Process File created C:\Windows\Installer\f754a1a.msi msiexec.exe File opened for modification C:\Windows\Installer\f754a1a.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI4CFA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4F7A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5065.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI517F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI51DE.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI52D8.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 1 IoCs
pid Process 1872 taskkill.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 KCYg6pTj0.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 KCYg6pTj0.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 KCYg6pTj0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 KCYg6pTj0.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a KCYg6pTj0.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a KCYg6pTj0.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 KCYg6pTj0.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 1888 Anime-Fighters-Infin_734316524.tmp 1888 Anime-Fighters-Infin_734316524.tmp 1364 Expedita.exe 1364 Expedita.exe 1364 Expedita.exe 1384 MsiExec.exe 1456 MsiExec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 1092 msiexec.exe Token: SeTakeOwnershipPrivilege 1092 msiexec.exe Token: SeSecurityPrivilege 1092 msiexec.exe Token: SeCreateTokenPrivilege 1544 KCYg6pTj0.exe Token: SeAssignPrimaryTokenPrivilege 1544 KCYg6pTj0.exe Token: SeLockMemoryPrivilege 1544 KCYg6pTj0.exe Token: SeIncreaseQuotaPrivilege 1544 KCYg6pTj0.exe Token: SeMachineAccountPrivilege 1544 KCYg6pTj0.exe Token: SeTcbPrivilege 1544 KCYg6pTj0.exe Token: SeSecurityPrivilege 1544 KCYg6pTj0.exe Token: SeTakeOwnershipPrivilege 1544 KCYg6pTj0.exe Token: SeLoadDriverPrivilege 1544 KCYg6pTj0.exe Token: SeSystemProfilePrivilege 1544 KCYg6pTj0.exe Token: SeSystemtimePrivilege 1544 KCYg6pTj0.exe Token: SeProfSingleProcessPrivilege 1544 KCYg6pTj0.exe Token: SeIncBasePriorityPrivilege 1544 KCYg6pTj0.exe Token: SeCreatePagefilePrivilege 1544 KCYg6pTj0.exe Token: SeCreatePermanentPrivilege 1544 KCYg6pTj0.exe Token: SeBackupPrivilege 1544 KCYg6pTj0.exe Token: SeRestorePrivilege 1544 KCYg6pTj0.exe Token: SeShutdownPrivilege 1544 KCYg6pTj0.exe Token: SeDebugPrivilege 1544 KCYg6pTj0.exe Token: SeAuditPrivilege 1544 KCYg6pTj0.exe Token: SeSystemEnvironmentPrivilege 1544 KCYg6pTj0.exe Token: SeChangeNotifyPrivilege 1544 KCYg6pTj0.exe Token: SeRemoteShutdownPrivilege 1544 KCYg6pTj0.exe Token: SeUndockPrivilege 1544 KCYg6pTj0.exe Token: SeSyncAgentPrivilege 1544 KCYg6pTj0.exe Token: SeEnableDelegationPrivilege 1544 KCYg6pTj0.exe Token: SeManageVolumePrivilege 1544 KCYg6pTj0.exe Token: SeImpersonatePrivilege 1544 KCYg6pTj0.exe Token: SeCreateGlobalPrivilege 1544 KCYg6pTj0.exe Token: SeCreateTokenPrivilege 1544 KCYg6pTj0.exe Token: SeAssignPrimaryTokenPrivilege 1544 KCYg6pTj0.exe Token: SeLockMemoryPrivilege 1544 KCYg6pTj0.exe Token: SeIncreaseQuotaPrivilege 1544 KCYg6pTj0.exe Token: SeMachineAccountPrivilege 1544 KCYg6pTj0.exe Token: SeTcbPrivilege 1544 KCYg6pTj0.exe Token: SeSecurityPrivilege 1544 KCYg6pTj0.exe Token: SeTakeOwnershipPrivilege 1544 KCYg6pTj0.exe Token: SeLoadDriverPrivilege 1544 KCYg6pTj0.exe Token: SeSystemProfilePrivilege 1544 KCYg6pTj0.exe Token: SeSystemtimePrivilege 1544 KCYg6pTj0.exe Token: SeProfSingleProcessPrivilege 1544 KCYg6pTj0.exe Token: SeIncBasePriorityPrivilege 1544 KCYg6pTj0.exe Token: SeCreatePagefilePrivilege 1544 KCYg6pTj0.exe Token: SeCreatePermanentPrivilege 1544 KCYg6pTj0.exe Token: SeBackupPrivilege 1544 KCYg6pTj0.exe Token: SeRestorePrivilege 1544 KCYg6pTj0.exe Token: SeShutdownPrivilege 1544 KCYg6pTj0.exe Token: SeDebugPrivilege 1544 KCYg6pTj0.exe Token: SeAuditPrivilege 1544 KCYg6pTj0.exe Token: SeSystemEnvironmentPrivilege 1544 KCYg6pTj0.exe Token: SeChangeNotifyPrivilege 1544 KCYg6pTj0.exe Token: SeRemoteShutdownPrivilege 1544 KCYg6pTj0.exe Token: SeUndockPrivilege 1544 KCYg6pTj0.exe Token: SeSyncAgentPrivilege 1544 KCYg6pTj0.exe Token: SeEnableDelegationPrivilege 1544 KCYg6pTj0.exe Token: SeManageVolumePrivilege 1544 KCYg6pTj0.exe Token: SeImpersonatePrivilege 1544 KCYg6pTj0.exe Token: SeCreateGlobalPrivilege 1544 KCYg6pTj0.exe Token: SeCreateTokenPrivilege 1544 KCYg6pTj0.exe Token: SeAssignPrimaryTokenPrivilege 1544 KCYg6pTj0.exe Token: SeLockMemoryPrivilege 1544 KCYg6pTj0.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1888 Anime-Fighters-Infin_734316524.tmp 1544 KCYg6pTj0.exe -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 1920 wrote to memory of 1888 1920 Anime-Fighters-Infin_734316524.exe 26 PID 1920 wrote to memory of 1888 1920 Anime-Fighters-Infin_734316524.exe 26 PID 1920 wrote to memory of 1888 1920 Anime-Fighters-Infin_734316524.exe 26 PID 1920 wrote to memory of 1888 1920 Anime-Fighters-Infin_734316524.exe 26 PID 1920 wrote to memory of 1888 1920 Anime-Fighters-Infin_734316524.exe 26 PID 1920 wrote to memory of 1888 1920 Anime-Fighters-Infin_734316524.exe 26 PID 1920 wrote to memory of 1888 1920 Anime-Fighters-Infin_734316524.exe 26 PID 1888 wrote to memory of 1364 1888 Anime-Fighters-Infin_734316524.tmp 27 PID 1888 wrote to memory of 1364 1888 Anime-Fighters-Infin_734316524.tmp 27 PID 1888 wrote to memory of 1364 1888 Anime-Fighters-Infin_734316524.tmp 27 PID 1888 wrote to memory of 1364 1888 Anime-Fighters-Infin_734316524.tmp 27 PID 1364 wrote to memory of 1648 1364 Expedita.exe 34 PID 1364 wrote to memory of 1648 1364 Expedita.exe 34 PID 1364 wrote to memory of 1648 1364 Expedita.exe 34 PID 1364 wrote to memory of 1648 1364 Expedita.exe 34 PID 1364 wrote to memory of 1544 1364 Expedita.exe 35 PID 1364 wrote to memory of 1544 1364 Expedita.exe 35 PID 1364 wrote to memory of 1544 1364 Expedita.exe 35 PID 1364 wrote to memory of 1544 1364 Expedita.exe 35 PID 1364 wrote to memory of 1544 1364 Expedita.exe 35 PID 1364 wrote to memory of 1544 1364 Expedita.exe 35 PID 1364 wrote to memory of 1544 1364 Expedita.exe 35 PID 1092 wrote to memory of 1384 1092 msiexec.exe 37 PID 1092 wrote to memory of 1384 1092 msiexec.exe 37 PID 1092 wrote to memory of 1384 1092 msiexec.exe 37 PID 1092 wrote to memory of 1384 1092 msiexec.exe 37 PID 1092 wrote to memory of 1384 1092 msiexec.exe 37 PID 1092 wrote to memory of 1384 1092 msiexec.exe 37 PID 1092 wrote to memory of 1384 1092 msiexec.exe 37 PID 1544 wrote to memory of 1112 1544 KCYg6pTj0.exe 38 PID 1544 wrote to memory of 1112 1544 KCYg6pTj0.exe 38 PID 1544 wrote to memory of 1112 1544 KCYg6pTj0.exe 38 PID 1544 wrote to memory of 1112 1544 KCYg6pTj0.exe 38 PID 1544 wrote to memory of 1112 1544 KCYg6pTj0.exe 38 PID 1544 wrote to memory of 1112 1544 KCYg6pTj0.exe 38 PID 1544 wrote to memory of 1112 1544 KCYg6pTj0.exe 38 PID 1092 wrote to memory of 1456 1092 msiexec.exe 39 PID 1092 wrote to memory of 1456 1092 msiexec.exe 39 PID 1092 wrote to memory of 1456 1092 msiexec.exe 39 PID 1092 wrote to memory of 1456 1092 msiexec.exe 39 PID 1092 wrote to memory of 1456 1092 msiexec.exe 39 PID 1092 wrote to memory of 1456 1092 msiexec.exe 39 PID 1092 wrote to memory of 1456 1092 msiexec.exe 39 PID 1456 wrote to memory of 1872 1456 MsiExec.exe 40 PID 1456 wrote to memory of 1872 1456 MsiExec.exe 40 PID 1456 wrote to memory of 1872 1456 MsiExec.exe 40 PID 1456 wrote to memory of 1872 1456 MsiExec.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\Anime-Fighters-Infin_734316524.exe"C:\Users\Admin\AppData\Local\Temp\Anime-Fighters-Infin_734316524.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\is-0G7EG.tmp\Anime-Fighters-Infin_734316524.tmp"C:\Users\Admin\AppData\Local\Temp\is-0G7EG.tmp\Anime-Fighters-Infin_734316524.tmp" /SL5="$8015C,3656070,140800,C:\Users\Admin\AppData\Local\Temp\Anime-Fighters-Infin_734316524.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Program Files (x86)\Vel\magnam\Expedita.exe"C:\Program Files (x86)\Vel/\magnam\Expedita.exe" 32cb7aca069a0c8bb8d51fccce1d38263⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\q5XC3eLZ\tQX8KOqP9O.exeC:\Users\Admin\AppData\Local\Temp\q5XC3eLZ\tQX8KOqP9O.exe /usthree SUB=32cb7aca069a0c8bb8d51fccce1d38264⤵
- Executes dropped EXE
PID:1648
-
-
C:\Users\Admin\AppData\Local\Temp\CKUXqKGI\KCYg6pTj0.exeC:\Users\Admin\AppData\Local\Temp\CKUXqKGI\KCYg6pTj0.exe /qn CAMPAIGN="642"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=642 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\CKUXqKGI\KCYg6pTj0.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\CKUXqKGI\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1630350882 /qn CAMPAIGN=""642"" " CAMPAIGN="642"5⤵PID:1112
-
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 2E4D24B3B18C24DCC7DD15DB00F885C2 C2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1384
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 894E29D581178576C9D0913CB686A04F2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f3⤵
- Kills process with taskkill
PID:1872
-
-