Analysis
- max time kernel
74s - max time network
69s - platform
windows7_x64 - resource
win7-en-20210920 - submitted
29/09/2021, 10:17
Static task
static1
Behavioral task
behavioral1
Sample
3c76e12084f57410323212b79c24a4ad.exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
3c76e12084f57410323212b79c24a4ad.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 3c76e12084f57410323212b79c24a4ad.exe
- Size 7.2MB
- Sample210929-mbcs1sefgn
- SHA256 42e369c8a08e42bb7ca81f3b4598b1352766fd602c32adc21cd5f1afab85f7f3
- MD5 3c76e12084f57410323212b79c24a4ad
- SHA1 c2663a2189440deae7a3826109bceacaea3a99d9
- SHA512 e0cfc3ac8407426902e08851db8fa3e75142de3d927ed091e12c4603a896c581a182b9069d04ce4032f974064e66db9a68a83d48ed1982934f6203a7b08964dd
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- suricata: ET MALWARE Amadey CnC Check-In
suricata: ET MALWARE Amadey CnC Check-In
- Blocklisted process makes network request 2 IoCs
flow pid Process 3 560 msiexec.exe 4 968 msiexec.exe - Executes dropped EXE 1 IoCs
pid Process 576 disksyncer.exe - Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\netoptimize.lnk disksyncer.exe - Loads dropped DLL 13 IoCs
pid Process 1424 3c76e12084f57410323212b79c24a4ad.exe 1424 3c76e12084f57410323212b79c24a4ad.exe 656 MsiExec.exe 656 MsiExec.exe 1648 MsiExec.exe 1648 MsiExec.exe 1648 MsiExec.exe 1648 MsiExec.exe 1648 MsiExec.exe 1424 3c76e12084f57410323212b79c24a4ad.exe 576 disksyncer.exe 576 disksyncer.exe 576 disksyncer.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Y: 3c76e12084f57410323212b79c24a4ad.exe File opened (read-only) \??\V: 3c76e12084f57410323212b79c24a4ad.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\B: 3c76e12084f57410323212b79c24a4ad.exe File opened (read-only) \??\R: 3c76e12084f57410323212b79c24a4ad.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\O: 3c76e12084f57410323212b79c24a4ad.exe File opened (read-only) \??\Z: 3c76e12084f57410323212b79c24a4ad.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\H: 3c76e12084f57410323212b79c24a4ad.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: 3c76e12084f57410323212b79c24a4ad.exe File opened (read-only) \??\U: 3c76e12084f57410323212b79c24a4ad.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\I: 3c76e12084f57410323212b79c24a4ad.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: 3c76e12084f57410323212b79c24a4ad.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\X: 3c76e12084f57410323212b79c24a4ad.exe File opened (read-only) \??\L: 3c76e12084f57410323212b79c24a4ad.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: 3c76e12084f57410323212b79c24a4ad.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: 3c76e12084f57410323212b79c24a4ad.exe File opened (read-only) \??\P: 3c76e12084f57410323212b79c24a4ad.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: 3c76e12084f57410323212b79c24a4ad.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\J: 3c76e12084f57410323212b79c24a4ad.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\A: 3c76e12084f57410323212b79c24a4ad.exe File opened (read-only) \??\S: 3c76e12084f57410323212b79c24a4ad.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Q: 3c76e12084f57410323212b79c24a4ad.exe File opened (read-only) \??\W: 3c76e12084f57410323212b79c24a4ad.exe - Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSIB982.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIC5E6.tmp msiexec.exe File opened for modification C:\Windows\Installer\2b6ef.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIBA4E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIBB39.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIBBC6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIBCD1.tmp msiexec.exe File created C:\Windows\Installer\2b6f1.ipi msiexec.exe File opened for modification C:\Windows\Installer\2b6f1.ipi msiexec.exe File created C:\Windows\Installer\2b6ef.msi msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 3c76e12084f57410323212b79c24a4ad.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 3c76e12084f57410323212b79c24a4ad.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 3c76e12084f57410323212b79c24a4ad.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 3c76e12084f57410323212b79c24a4ad.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 968 msiexec.exe 968 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 968 msiexec.exe Token: SeTakeOwnershipPrivilege 968 msiexec.exe Token: SeSecurityPrivilege 968 msiexec.exe Token: SeCreateTokenPrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeAssignPrimaryTokenPrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeLockMemoryPrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeIncreaseQuotaPrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeMachineAccountPrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeTcbPrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeSecurityPrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeTakeOwnershipPrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeLoadDriverPrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeSystemProfilePrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeSystemtimePrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeProfSingleProcessPrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeIncBasePriorityPrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeCreatePagefilePrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeCreatePermanentPrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeBackupPrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeRestorePrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeShutdownPrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeDebugPrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeAuditPrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeSystemEnvironmentPrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeChangeNotifyPrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeRemoteShutdownPrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeUndockPrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeSyncAgentPrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeEnableDelegationPrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeManageVolumePrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeImpersonatePrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeCreateGlobalPrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeCreateTokenPrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeAssignPrimaryTokenPrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeLockMemoryPrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeIncreaseQuotaPrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeMachineAccountPrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeTcbPrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeSecurityPrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeTakeOwnershipPrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeLoadDriverPrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeSystemProfilePrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeSystemtimePrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeProfSingleProcessPrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeIncBasePriorityPrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeCreatePagefilePrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeCreatePermanentPrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeBackupPrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeRestorePrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeShutdownPrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeDebugPrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeAuditPrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeSystemEnvironmentPrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeChangeNotifyPrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeRemoteShutdownPrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeUndockPrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeSyncAgentPrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeEnableDelegationPrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeManageVolumePrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeImpersonatePrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeCreateGlobalPrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeCreateTokenPrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeAssignPrimaryTokenPrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe Token: SeLockMemoryPrivilege 1424 3c76e12084f57410323212b79c24a4ad.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 560 msiexec.exe 560 msiexec.exe - Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 968 wrote to memory of 656 968 msiexec.exe 28 PID 968 wrote to memory of 656 968 msiexec.exe 28 PID 968 wrote to memory of 656 968 msiexec.exe 28 PID 968 wrote to memory of 656 968 msiexec.exe 28 PID 968 wrote to memory of 656 968 msiexec.exe 28 PID 968 wrote to memory of 656 968 msiexec.exe 28 PID 968 wrote to memory of 656 968 msiexec.exe 28 PID 1424 wrote to memory of 560 1424 3c76e12084f57410323212b79c24a4ad.exe 29 PID 1424 wrote to memory of 560 1424 3c76e12084f57410323212b79c24a4ad.exe 29 PID 1424 wrote to memory of 560 1424 3c76e12084f57410323212b79c24a4ad.exe 29 PID 1424 wrote to memory of 560 1424 3c76e12084f57410323212b79c24a4ad.exe 29 PID 1424 wrote to memory of 560 1424 3c76e12084f57410323212b79c24a4ad.exe 29 PID 1424 wrote to memory of 560 1424 3c76e12084f57410323212b79c24a4ad.exe 29 PID 1424 wrote to memory of 560 1424 3c76e12084f57410323212b79c24a4ad.exe 29 PID 968 wrote to memory of 1648 968 msiexec.exe 30 PID 968 wrote to memory of 1648 968 msiexec.exe 30 PID 968 wrote to memory of 1648 968 msiexec.exe 30 PID 968 wrote to memory of 1648 968 msiexec.exe 30 PID 968 wrote to memory of 1648 968 msiexec.exe 30 PID 968 wrote to memory of 1648 968 msiexec.exe 30 PID 968 wrote to memory of 1648 968 msiexec.exe 30 PID 968 wrote to memory of 576 968 msiexec.exe 31 PID 968 wrote to memory of 576 968 msiexec.exe 31 PID 968 wrote to memory of 576 968 msiexec.exe 31 PID 968 wrote to memory of 576 968 msiexec.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c76e12084f57410323212b79c24a4ad.exe"C:\Users\Admin\AppData\Local\Temp\3c76e12084f57410323212b79c24a4ad.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\DB Software Laboratory\Svn Syncronize Management 1.7.3.2\install\97C955F\adv.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\3c76e12084f57410323212b79c24a4ad.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1632910454 " AI_EUIMSI=""2⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
PID:560
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 52A024CEA7F3D466C038D00E8153C4DC C2⤵
- Loads dropped DLL
PID:656
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 00C9DD847DB1C732A70524DC760DB6E92⤵
- Loads dropped DLL
PID:1648
-
-
C:\Users\Admin\AppData\Roaming\DB Software Laboratory\Svn Syncronize Management\disksyncer.exe"C:\Users\Admin\AppData\Roaming\DB Software Laboratory\Svn Syncronize Management\disksyncer.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Loads dropped DLL
PID:576
-