Analysis
-
max time kernel
152s -
max time network
154s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
25-11-2021 12:35
Static task
static1
Behavioral task
behavioral1
Sample
fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe
Resource
win7-en-20211014
windows7_x64
0 signatures
0 seconds
General
-
Target
fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe
-
Size
8.7MB
-
MD5
29d557e552e133898f5387443792f285
-
SHA1
c33c1d1dbe9b838d916b938741f1ebe9f624293f
-
SHA256
fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464
-
SHA512
ac716245cb2ee2032e6789d1c69ada966603770d1ab950b43d7df61e55ac30a36f27885ec96a53e88f67a84c6c92a9228d57834cf3f36a910af6067b95c7b02b
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1820 hfmonitor.exe -
Loads dropped DLL 12 IoCs
pid Process 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe 4436 MsiExec.exe 4436 MsiExec.exe 4540 MsiExec.exe 4540 MsiExec.exe 4540 MsiExec.exe 4540 MsiExec.exe 4540 MsiExec.exe 4540 MsiExec.exe 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe 1820 hfmonitor.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\L: fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe File opened (read-only) \??\X: fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe File opened (read-only) \??\Z: fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe File opened (read-only) \??\N: fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe File opened (read-only) \??\R: fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\E: fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe File opened (read-only) \??\G: fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe File opened (read-only) \??\J: fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe File opened (read-only) \??\H: fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe File opened (read-only) \??\T: fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\S: fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe File opened (read-only) \??\Y: fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\B: fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe File opened (read-only) \??\K: fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\P: fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\F: fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe File opened (read-only) \??\M: fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\O: fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe File opened (read-only) \??\Q: fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe File opened (read-only) \??\U: fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\F: msiexec.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ꡠ仰 d hfmonitor.exe -
Drops file in Windows directory 13 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSID3B1.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE055.tmp msiexec.exe File created C:\Windows\Installer\f75ccc7.msi msiexec.exe File opened for modification C:\Windows\Installer\f75ccc7.msi msiexec.exe File opened for modification C:\Windows\Installer\MSICE8C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID005.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{42C6DF48-50A5-4E56-B0A4-7FEA16D45053} msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSICF67.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID10F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID1CC.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 hfmonitor.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString hfmonitor.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 424 msiexec.exe 424 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSecurityPrivilege 424 msiexec.exe Token: SeCreateTokenPrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeAssignPrimaryTokenPrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeLockMemoryPrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeIncreaseQuotaPrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeMachineAccountPrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeTcbPrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeSecurityPrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeTakeOwnershipPrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeLoadDriverPrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeSystemProfilePrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeSystemtimePrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeProfSingleProcessPrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeIncBasePriorityPrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeCreatePagefilePrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeCreatePermanentPrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeBackupPrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeRestorePrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeShutdownPrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeDebugPrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeAuditPrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeSystemEnvironmentPrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeChangeNotifyPrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeRemoteShutdownPrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeUndockPrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeSyncAgentPrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeEnableDelegationPrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeManageVolumePrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeImpersonatePrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeCreateGlobalPrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeCreateTokenPrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeAssignPrimaryTokenPrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeLockMemoryPrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeIncreaseQuotaPrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeMachineAccountPrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeTcbPrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeSecurityPrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeTakeOwnershipPrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeLoadDriverPrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeSystemProfilePrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeSystemtimePrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeProfSingleProcessPrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeIncBasePriorityPrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeCreatePagefilePrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeCreatePermanentPrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeBackupPrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeRestorePrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeShutdownPrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeDebugPrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeAuditPrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeSystemEnvironmentPrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeChangeNotifyPrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeRemoteShutdownPrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeUndockPrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeSyncAgentPrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeEnableDelegationPrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeManageVolumePrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeImpersonatePrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeCreateGlobalPrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeCreateTokenPrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeAssignPrimaryTokenPrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeLockMemoryPrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeIncreaseQuotaPrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeMachineAccountPrivilege 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4404 msiexec.exe 4404 msiexec.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 424 wrote to memory of 4436 424 msiexec.exe 71 PID 424 wrote to memory of 4436 424 msiexec.exe 71 PID 424 wrote to memory of 4436 424 msiexec.exe 71 PID 4016 wrote to memory of 4404 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe 72 PID 4016 wrote to memory of 4404 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe 72 PID 4016 wrote to memory of 4404 4016 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe 72 PID 424 wrote to memory of 4540 424 msiexec.exe 73 PID 424 wrote to memory of 4540 424 msiexec.exe 73 PID 424 wrote to memory of 4540 424 msiexec.exe 73 PID 424 wrote to memory of 1820 424 msiexec.exe 74 PID 424 wrote to memory of 1820 424 msiexec.exe 74 PID 424 wrote to memory of 1820 424 msiexec.exe 74
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe"C:\Users\Admin\AppData\Local\Temp\fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\SunlitGreen Software\UAParser 3.1.8.4\install\6D45053\adv1.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1636060142 " AI_EUIMSI=""2⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
PID:4404
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:424 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B54E8180CB5D9D48DC5554287B79FB6A C2⤵
- Loads dropped DLL
PID:4436
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 38D19F83C8A5A11CA1FA76831A88BFD82⤵
- Loads dropped DLL
PID:4540
-
-
C:\Users\Admin\AppData\Roaming\SunlitGreen Software\UAParser\hfmonitor.exe"C:\Users\Admin\AppData\Roaming\SunlitGreen Software\UAParser\hfmonitor.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Checks processor information in registry
PID:1820
-