Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-en-20211104 -
submitted
25-11-2021 12:40
Static task
static1
Behavioral task
behavioral1
Sample
716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe
Resource
win7-en-20211104
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe
Resource
win10-en-20211014
windows10_x64
0 signatures
0 seconds
General
-
Target
716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe
-
Size
7.5MB
-
MD5
4ec77eb8280485764b6bc22f6cf7d57e
-
SHA1
85215638743eeb6800aaada5d057e96032db6906
-
SHA256
716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25
-
SHA512
770b14b133ac0a7bfee3a973d43a5342cd021a731f1be4d557a332aa4945dbb9be6b25909291feeb766c3fd640ff943780d4172e2fe6f6c77a128585e7914954
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 4 1152 msiexec.exe 5 1888 msiexec.exe -
Executes dropped EXE 1 IoCs
pid Process 1600 plcd-player.exe -
Loads dropped DLL 11 IoCs
pid Process 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe 2008 MsiExec.exe 2008 MsiExec.exe 1820 MsiExec.exe 1820 MsiExec.exe 1820 MsiExec.exe 1820 MsiExec.exe 1820 MsiExec.exe 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe 1600 plcd-player.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\W: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\B: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\F: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\J: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\K: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\R: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\Y: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\P: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\U: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\V: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\M: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\N: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\O: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\S: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\X: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\Z: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\H: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\I: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\L: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\f75ca53.ipi msiexec.exe File created C:\Windows\Installer\f75ca51.msi msiexec.exe File opened for modification C:\Windows\Installer\MSICDC0.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSICF76.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID0DE.tmp msiexec.exe File created C:\Windows\Installer\f75ca53.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIDC44.tmp msiexec.exe File opened for modification C:\Windows\Installer\f75ca51.msi msiexec.exe File opened for modification C:\Windows\Installer\MSICC77.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSICE2E.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1888 msiexec.exe 1888 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 1888 msiexec.exe Token: SeTakeOwnershipPrivilege 1888 msiexec.exe Token: SeSecurityPrivilege 1888 msiexec.exe Token: SeCreateTokenPrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeAssignPrimaryTokenPrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeLockMemoryPrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeIncreaseQuotaPrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeMachineAccountPrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeTcbPrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeSecurityPrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeTakeOwnershipPrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeLoadDriverPrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeSystemProfilePrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeSystemtimePrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeProfSingleProcessPrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeIncBasePriorityPrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeCreatePagefilePrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeCreatePermanentPrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeBackupPrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeRestorePrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeShutdownPrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeDebugPrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeAuditPrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeSystemEnvironmentPrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeChangeNotifyPrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeRemoteShutdownPrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeUndockPrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeSyncAgentPrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeEnableDelegationPrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeManageVolumePrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeImpersonatePrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeCreateGlobalPrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeCreateTokenPrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeAssignPrimaryTokenPrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeLockMemoryPrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeIncreaseQuotaPrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeMachineAccountPrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeTcbPrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeSecurityPrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeTakeOwnershipPrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeLoadDriverPrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeSystemProfilePrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeSystemtimePrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeProfSingleProcessPrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeIncBasePriorityPrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeCreatePagefilePrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeCreatePermanentPrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeBackupPrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeRestorePrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeShutdownPrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeDebugPrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeAuditPrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeSystemEnvironmentPrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeChangeNotifyPrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeRemoteShutdownPrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeUndockPrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeSyncAgentPrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeEnableDelegationPrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeManageVolumePrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeImpersonatePrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeCreateGlobalPrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeCreateTokenPrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeAssignPrimaryTokenPrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeLockMemoryPrivilege 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1152 msiexec.exe 1152 msiexec.exe -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 1888 wrote to memory of 2008 1888 msiexec.exe 29 PID 1888 wrote to memory of 2008 1888 msiexec.exe 29 PID 1888 wrote to memory of 2008 1888 msiexec.exe 29 PID 1888 wrote to memory of 2008 1888 msiexec.exe 29 PID 1888 wrote to memory of 2008 1888 msiexec.exe 29 PID 1888 wrote to memory of 2008 1888 msiexec.exe 29 PID 1888 wrote to memory of 2008 1888 msiexec.exe 29 PID 764 wrote to memory of 1152 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe 30 PID 764 wrote to memory of 1152 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe 30 PID 764 wrote to memory of 1152 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe 30 PID 764 wrote to memory of 1152 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe 30 PID 764 wrote to memory of 1152 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe 30 PID 764 wrote to memory of 1152 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe 30 PID 764 wrote to memory of 1152 764 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe 30 PID 1888 wrote to memory of 1820 1888 msiexec.exe 31 PID 1888 wrote to memory of 1820 1888 msiexec.exe 31 PID 1888 wrote to memory of 1820 1888 msiexec.exe 31 PID 1888 wrote to memory of 1820 1888 msiexec.exe 31 PID 1888 wrote to memory of 1820 1888 msiexec.exe 31 PID 1888 wrote to memory of 1820 1888 msiexec.exe 31 PID 1888 wrote to memory of 1820 1888 msiexec.exe 31 PID 1888 wrote to memory of 1600 1888 msiexec.exe 32 PID 1888 wrote to memory of 1600 1888 msiexec.exe 32 PID 1888 wrote to memory of 1600 1888 msiexec.exe 32 PID 1888 wrote to memory of 1600 1888 msiexec.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe"C:\Users\Admin\AppData\Local\Temp\716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4\adv.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1637584428 " AI_EUIMSI=""2⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
PID:1152
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 865CF8C0C1FC5176321C4E3CDB18313F C2⤵
- Loads dropped DLL
PID:2008
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 2E2A330396B420D98E5FB71502B1D4542⤵
- Loads dropped DLL
PID:1820
-
-
C:\Users\Admin\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe"C:\Users\Admin\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600
-