Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
19-01-2022 16:33
Static task
static1
Behavioral task
behavioral1
Sample
716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
-
Target
716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe
-
Size
7.5MB
-
MD5
4ec77eb8280485764b6bc22f6cf7d57e
-
SHA1
85215638743eeb6800aaada5d057e96032db6906
-
SHA256
716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25
-
SHA512
770b14b133ac0a7bfee3a973d43a5342cd021a731f1be4d557a332aa4945dbb9be6b25909291feeb766c3fd640ff943780d4172e2fe6f6c77a128585e7914954
Malware Config
Extracted
Family
gozi_ifsb
Botnet
2002
C2
get.updates.avast.cn
huyasos.in
curves.ws
rorobrun.in
tfslld.ws
Attributes
-
base_path
/sreamble/
-
build
250211
-
dga_season
10
-
exe_type
loader
-
extension
.sre
-
server_id
12
rsa_pubkey.plain
serpent.plain
Signatures
-
Babadeda Crypter 2 IoCs
resource yara_rule behavioral1/files/0x000b000000012217-81.dat family_babadeda behavioral1/files/0x00060000000130dd-102.dat family_babadeda -
Blocklisted process makes network request 2 IoCs
flow pid Process 4 956 msiexec.exe 5 456 msiexec.exe -
Executes dropped EXE 1 IoCs
pid Process 1988 plcd-player.exe -
Loads dropped DLL 11 IoCs
pid Process 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe 1072 MsiExec.exe 1072 MsiExec.exe 1940 MsiExec.exe 1940 MsiExec.exe 1940 MsiExec.exe 1940 MsiExec.exe 1940 MsiExec.exe 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe 1988 plcd-player.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\W: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\P: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\I: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\M: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\L: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\T: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\K: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\Z: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\V: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\J: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\R: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\H: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\F: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\O: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\B: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\Installer\f761796.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI2035.tmp msiexec.exe File created C:\Windows\Installer\f761798.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI27A6.tmp msiexec.exe File opened for modification C:\Windows\Installer\f761796.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI1E3E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1F1A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1F98.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI217D.tmp msiexec.exe File opened for modification C:\Windows\Installer\f761798.ipi msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 456 msiexec.exe 456 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 456 msiexec.exe Token: SeTakeOwnershipPrivilege 456 msiexec.exe Token: SeSecurityPrivilege 456 msiexec.exe Token: SeCreateTokenPrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeAssignPrimaryTokenPrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeLockMemoryPrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeIncreaseQuotaPrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeMachineAccountPrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeTcbPrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeSecurityPrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeTakeOwnershipPrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeLoadDriverPrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeSystemProfilePrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeSystemtimePrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeProfSingleProcessPrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeIncBasePriorityPrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeCreatePagefilePrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeCreatePermanentPrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeBackupPrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeRestorePrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeShutdownPrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeDebugPrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeAuditPrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeSystemEnvironmentPrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeChangeNotifyPrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeRemoteShutdownPrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeUndockPrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeSyncAgentPrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeEnableDelegationPrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeManageVolumePrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeImpersonatePrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeCreateGlobalPrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeCreateTokenPrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeAssignPrimaryTokenPrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeLockMemoryPrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeIncreaseQuotaPrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeMachineAccountPrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeTcbPrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeSecurityPrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeTakeOwnershipPrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeLoadDriverPrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeSystemProfilePrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeSystemtimePrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeProfSingleProcessPrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeIncBasePriorityPrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeCreatePagefilePrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeCreatePermanentPrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeBackupPrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeRestorePrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeShutdownPrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeDebugPrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeAuditPrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeSystemEnvironmentPrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeChangeNotifyPrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeRemoteShutdownPrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeUndockPrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeSyncAgentPrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeEnableDelegationPrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeManageVolumePrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeImpersonatePrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeCreateGlobalPrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeCreateTokenPrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeAssignPrimaryTokenPrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeLockMemoryPrivilege 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 956 msiexec.exe 956 msiexec.exe -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 456 wrote to memory of 1072 456 msiexec.exe 28 PID 456 wrote to memory of 1072 456 msiexec.exe 28 PID 456 wrote to memory of 1072 456 msiexec.exe 28 PID 456 wrote to memory of 1072 456 msiexec.exe 28 PID 456 wrote to memory of 1072 456 msiexec.exe 28 PID 456 wrote to memory of 1072 456 msiexec.exe 28 PID 456 wrote to memory of 1072 456 msiexec.exe 28 PID 1396 wrote to memory of 956 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe 29 PID 1396 wrote to memory of 956 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe 29 PID 1396 wrote to memory of 956 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe 29 PID 1396 wrote to memory of 956 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe 29 PID 1396 wrote to memory of 956 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe 29 PID 1396 wrote to memory of 956 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe 29 PID 1396 wrote to memory of 956 1396 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe 29 PID 456 wrote to memory of 1940 456 msiexec.exe 30 PID 456 wrote to memory of 1940 456 msiexec.exe 30 PID 456 wrote to memory of 1940 456 msiexec.exe 30 PID 456 wrote to memory of 1940 456 msiexec.exe 30 PID 456 wrote to memory of 1940 456 msiexec.exe 30 PID 456 wrote to memory of 1940 456 msiexec.exe 30 PID 456 wrote to memory of 1940 456 msiexec.exe 30 PID 456 wrote to memory of 1988 456 msiexec.exe 31 PID 456 wrote to memory of 1988 456 msiexec.exe 31 PID 456 wrote to memory of 1988 456 msiexec.exe 31 PID 456 wrote to memory of 1988 456 msiexec.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe"C:\Users\Admin\AppData\Local\Temp\716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4\adv.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1642354232 " AI_EUIMSI=""2⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
PID:956
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1CA015DDFC20D953F37DB6D076A7B246 C2⤵
- Loads dropped DLL
PID:1072
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9652FC24DB0FC022818D87439D7E3CB22⤵
- Loads dropped DLL
PID:1940
-
-
C:\Users\Admin\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe"C:\Users\Admin\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1988
-