Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
19/01/2022, 16:33
Static task
static1
Behavioral task
behavioral1
Sample
716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
-
Target
716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe
-
Size
7.5MB
-
MD5
4ec77eb8280485764b6bc22f6cf7d57e
-
SHA1
85215638743eeb6800aaada5d057e96032db6906
-
SHA256
716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25
-
SHA512
770b14b133ac0a7bfee3a973d43a5342cd021a731f1be4d557a332aa4945dbb9be6b25909291feeb766c3fd640ff943780d4172e2fe6f6c77a128585e7914954
Malware Config
Extracted
Family
gozi_ifsb
Botnet
2002
C2
get.updates.avast.cn
huyasos.in
curves.ws
rorobrun.in
tfslld.ws
Attributes
-
base_path
/sreamble/
-
build
250211
-
dga_season
10
-
exe_type
loader
-
extension
.sre
-
server_id
12
rsa_pubkey.plain
serpent.plain
Signatures
-
Babadeda Crypter 2 IoCs
resource yara_rule behavioral2/files/0x0009000000022111-163.dat family_babadeda behavioral2/files/0x0006000000022133-201.dat family_babadeda -
Executes dropped EXE 1 IoCs
pid Process 1040 plcd-player.exe -
Loads dropped DLL 12 IoCs
pid Process 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe 3456 MsiExec.exe 3456 MsiExec.exe 392 MsiExec.exe 392 MsiExec.exe 392 MsiExec.exe 392 MsiExec.exe 392 MsiExec.exe 392 MsiExec.exe 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe 1040 plcd-player.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\F: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\T: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Z: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\K: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\X: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\J: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\H: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\R: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Q: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\O: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\U: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\B: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\L: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\P: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\V: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\W: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\G: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\M: 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\E: msiexec.exe -
Drops file in Windows directory 13 IoCs
description ioc Process File opened for modification C:\Windows\Installer\1ce8dc1.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI9312.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI943D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9528.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9A3B.tmp msiexec.exe File created C:\Windows\Installer\1ce8dc1.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI93BF.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI95A6.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{4A523951-0A2F-4D65-A31E-BB22D0CE0CF4} msiexec.exe File opened for modification C:\Windows\Installer\MSI9265.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2972 msiexec.exe 2972 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSecurityPrivilege 2972 msiexec.exe Token: SeCreateTokenPrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeAssignPrimaryTokenPrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeLockMemoryPrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeIncreaseQuotaPrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeMachineAccountPrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeTcbPrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeSecurityPrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeTakeOwnershipPrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeLoadDriverPrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeSystemProfilePrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeSystemtimePrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeProfSingleProcessPrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeIncBasePriorityPrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeCreatePagefilePrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeCreatePermanentPrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeBackupPrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeRestorePrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeShutdownPrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeDebugPrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeAuditPrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeSystemEnvironmentPrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeChangeNotifyPrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeRemoteShutdownPrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeUndockPrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeSyncAgentPrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeEnableDelegationPrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeManageVolumePrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeImpersonatePrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeCreateGlobalPrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeCreateTokenPrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeAssignPrimaryTokenPrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeLockMemoryPrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeIncreaseQuotaPrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeMachineAccountPrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeTcbPrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeSecurityPrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeTakeOwnershipPrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeLoadDriverPrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeSystemProfilePrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeSystemtimePrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeProfSingleProcessPrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeIncBasePriorityPrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeCreatePagefilePrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeCreatePermanentPrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeBackupPrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeRestorePrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeShutdownPrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeDebugPrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeAuditPrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeSystemEnvironmentPrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeChangeNotifyPrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeRemoteShutdownPrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeUndockPrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeSyncAgentPrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeEnableDelegationPrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeManageVolumePrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeImpersonatePrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeCreateGlobalPrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeCreateTokenPrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeAssignPrimaryTokenPrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeLockMemoryPrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeIncreaseQuotaPrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe Token: SeMachineAccountPrivilege 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3348 msiexec.exe 3348 msiexec.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2972 wrote to memory of 3456 2972 msiexec.exe 58 PID 2972 wrote to memory of 3456 2972 msiexec.exe 58 PID 2972 wrote to memory of 3456 2972 msiexec.exe 58 PID 840 wrote to memory of 3348 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe 59 PID 840 wrote to memory of 3348 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe 59 PID 840 wrote to memory of 3348 840 716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe 59 PID 2972 wrote to memory of 392 2972 msiexec.exe 60 PID 2972 wrote to memory of 392 2972 msiexec.exe 60 PID 2972 wrote to memory of 392 2972 msiexec.exe 60 PID 2972 wrote to memory of 1040 2972 msiexec.exe 61 PID 2972 wrote to memory of 1040 2972 msiexec.exe 61 PID 2972 wrote to memory of 1040 2972 msiexec.exe 61
Processes
-
C:\Users\Admin\AppData\Local\Temp\716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe"C:\Users\Admin\AppData\Local\Temp\716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4\adv.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1642583322 " AI_EUIMSI=""2⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
PID:3348
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 691BB2C6AC924C6BE41196DD6B2E50A4 C2⤵
- Loads dropped DLL
PID:3456
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C49DB0D7613F8288239871ECCCA9C94E2⤵
- Loads dropped DLL
PID:392
-
-
C:\Users\Admin\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe"C:\Users\Admin\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1040
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p1⤵PID:3064