Analysis
-
max time kernel
147s -
max time network
154s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
19/01/2022, 16:33 UTC
Static task
static1
Behavioral task
behavioral1
Sample
1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
-
Target
1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe
-
Size
6.2MB
-
MD5
eaf0414732a32787b8c26e69af59bfa0
-
SHA1
e313935ac46f141a3940236026cfe0eb0f4a1dcc
-
SHA256
1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181
-
SHA512
cc9dda5d5072e3ef01ee3e61fe23d0e753ca5957ff9f15e49377bd84a0be5b1f3606aaca9e6cbc7ff6fb67cf130da2d2174c32c5a2e5911706acf6b085706ab1
Malware Config
Extracted
Family
amadey
Version
2.70
C2
185.215.113.45/g4MbvE/index.php
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 4 744 msiexec.exe 5 1356 msiexec.exe -
Executes dropped EXE 3 IoCs
pid Process 1084 furm-extensions.exe 1132 sqtvvs.exe 1288 sqtvvs.exe -
Loads dropped DLL 14 IoCs
pid Process 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe 1988 MsiExec.exe 1988 MsiExec.exe 288 MsiExec.exe 288 MsiExec.exe 288 MsiExec.exe 288 MsiExec.exe 288 MsiExec.exe 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe 1084 furm-extensions.exe 1084 furm-extensions.exe 1132 sqtvvs.exe 1288 sqtvvs.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\P: 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe File opened (read-only) \??\R: 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe File opened (read-only) \??\S: 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\F: 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe File opened (read-only) \??\Q: 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe File opened (read-only) \??\T: 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\V: 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe File opened (read-only) \??\G: 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe File opened (read-only) \??\I: 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe File opened (read-only) \??\O: 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\L: 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe File opened (read-only) \??\N: 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\U: 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\E: 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe File opened (read-only) \??\H: 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\M: 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\J: 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe File opened (read-only) \??\K: 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe File opened (read-only) \??\Y: 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSIC37.tmp msiexec.exe File created C:\Windows\Installer\f7603da.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI13E7.tmp msiexec.exe File created C:\Windows\Installer\f7603d8.msi msiexec.exe File opened for modification C:\Windows\Installer\f7603d8.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIB6B.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\f7603da.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIA80.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID7F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE2C.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1596 schtasks.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1356 msiexec.exe 1356 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 1356 msiexec.exe Token: SeTakeOwnershipPrivilege 1356 msiexec.exe Token: SeSecurityPrivilege 1356 msiexec.exe Token: SeCreateTokenPrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeAssignPrimaryTokenPrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeLockMemoryPrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeIncreaseQuotaPrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeMachineAccountPrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeTcbPrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeSecurityPrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeTakeOwnershipPrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeLoadDriverPrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeSystemProfilePrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeSystemtimePrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeProfSingleProcessPrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeIncBasePriorityPrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeCreatePagefilePrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeCreatePermanentPrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeBackupPrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeRestorePrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeShutdownPrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeDebugPrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeAuditPrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeSystemEnvironmentPrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeChangeNotifyPrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeRemoteShutdownPrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeUndockPrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeSyncAgentPrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeEnableDelegationPrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeManageVolumePrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeImpersonatePrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeCreateGlobalPrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeCreateTokenPrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeAssignPrimaryTokenPrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeLockMemoryPrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeIncreaseQuotaPrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeMachineAccountPrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeTcbPrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeSecurityPrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeTakeOwnershipPrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeLoadDriverPrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeSystemProfilePrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeSystemtimePrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeProfSingleProcessPrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeIncBasePriorityPrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeCreatePagefilePrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeCreatePermanentPrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeBackupPrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeRestorePrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeShutdownPrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeDebugPrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeAuditPrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeSystemEnvironmentPrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeChangeNotifyPrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeRemoteShutdownPrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeUndockPrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeSyncAgentPrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeEnableDelegationPrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeManageVolumePrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeImpersonatePrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeCreateGlobalPrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeCreateTokenPrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeAssignPrimaryTokenPrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe Token: SeLockMemoryPrivilege 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 744 msiexec.exe 744 msiexec.exe -
Suspicious use of WriteProcessMemory 45 IoCs
description pid Process procid_target PID 1356 wrote to memory of 1988 1356 msiexec.exe 28 PID 1356 wrote to memory of 1988 1356 msiexec.exe 28 PID 1356 wrote to memory of 1988 1356 msiexec.exe 28 PID 1356 wrote to memory of 1988 1356 msiexec.exe 28 PID 1356 wrote to memory of 1988 1356 msiexec.exe 28 PID 1356 wrote to memory of 1988 1356 msiexec.exe 28 PID 1356 wrote to memory of 1988 1356 msiexec.exe 28 PID 1464 wrote to memory of 744 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe 29 PID 1464 wrote to memory of 744 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe 29 PID 1464 wrote to memory of 744 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe 29 PID 1464 wrote to memory of 744 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe 29 PID 1464 wrote to memory of 744 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe 29 PID 1464 wrote to memory of 744 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe 29 PID 1464 wrote to memory of 744 1464 1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe 29 PID 1356 wrote to memory of 288 1356 msiexec.exe 30 PID 1356 wrote to memory of 288 1356 msiexec.exe 30 PID 1356 wrote to memory of 288 1356 msiexec.exe 30 PID 1356 wrote to memory of 288 1356 msiexec.exe 30 PID 1356 wrote to memory of 288 1356 msiexec.exe 30 PID 1356 wrote to memory of 288 1356 msiexec.exe 30 PID 1356 wrote to memory of 288 1356 msiexec.exe 30 PID 1356 wrote to memory of 1084 1356 msiexec.exe 31 PID 1356 wrote to memory of 1084 1356 msiexec.exe 31 PID 1356 wrote to memory of 1084 1356 msiexec.exe 31 PID 1356 wrote to memory of 1084 1356 msiexec.exe 31 PID 1084 wrote to memory of 1132 1084 furm-extensions.exe 34 PID 1084 wrote to memory of 1132 1084 furm-extensions.exe 34 PID 1084 wrote to memory of 1132 1084 furm-extensions.exe 34 PID 1084 wrote to memory of 1132 1084 furm-extensions.exe 34 PID 1132 wrote to memory of 2000 1132 sqtvvs.exe 35 PID 1132 wrote to memory of 2000 1132 sqtvvs.exe 35 PID 1132 wrote to memory of 2000 1132 sqtvvs.exe 35 PID 1132 wrote to memory of 2000 1132 sqtvvs.exe 35 PID 1132 wrote to memory of 1596 1132 sqtvvs.exe 37 PID 1132 wrote to memory of 1596 1132 sqtvvs.exe 37 PID 1132 wrote to memory of 1596 1132 sqtvvs.exe 37 PID 1132 wrote to memory of 1596 1132 sqtvvs.exe 37 PID 2000 wrote to memory of 1692 2000 cmd.exe 38 PID 2000 wrote to memory of 1692 2000 cmd.exe 38 PID 2000 wrote to memory of 1692 2000 cmd.exe 38 PID 2000 wrote to memory of 1692 2000 cmd.exe 38 PID 1992 wrote to memory of 1288 1992 taskeng.exe 43 PID 1992 wrote to memory of 1288 1992 taskeng.exe 43 PID 1992 wrote to memory of 1288 1992 taskeng.exe 43 PID 1992 wrote to memory of 1288 1992 taskeng.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe"C:\Users\Admin\AppData\Local\Temp\1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Geeks3D\Fur Images Converter 3.3.2.0\install\4814FC9\adv.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\1ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1642354238 " AI_EUIMSI=""2⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
PID:744
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding E9F852242E8E5FA73471493FC06EE9CF C2⤵
- Loads dropped DLL
PID:1988
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 7D0ED9B251F4AAD0ADD4D912A7CE51A52⤵
- Loads dropped DLL
PID:288
-
-
C:\Users\Admin\AppData\Local\Temp\603c0340b4\furm-extensions.exe"C:\Users\Admin\AppData\Local\Temp\603c0340b4\furm-extensions.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe"C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\603c0340b4\4⤵
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\603c0340b4\5⤵PID:1692
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN sqtvvs.exe /TR "C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe" /F4⤵
- Creates scheduled task(s)
PID:1596
-
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {255E662F-142B-4E6D-A587-F98C2A5C4167} S-1-5-21-2329389628-4064185017-3901522362-1000:QSKGHMYQ\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1288
-
