Analysis
-
max time kernel
119s -
max time network
133s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
19-01-2022 16:34
Static task
static1
Behavioral task
behavioral1
Sample
fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
-
Target
fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe
-
Size
8.7MB
-
MD5
29d557e552e133898f5387443792f285
-
SHA1
c33c1d1dbe9b838d916b938741f1ebe9f624293f
-
SHA256
fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464
-
SHA512
ac716245cb2ee2032e6789d1c69ada966603770d1ab950b43d7df61e55ac30a36f27885ec96a53e88f67a84c6c92a9228d57834cf3f36a910af6067b95c7b02b
Malware Config
Extracted
Family
cryptbot
C2
veoixa45.top
moruhx04.top
Attributes
-
payload_url
http://tynauk05.top/download.php?file=lv.exe
Signatures
-
Babadeda Crypter 1 IoCs
resource yara_rule behavioral1/files/0x000600000001390e-82.dat family_babadeda -
Blocklisted process makes network request 2 IoCs
flow pid Process 4 1268 msiexec.exe 5 1400 msiexec.exe -
Executes dropped EXE 1 IoCs
pid Process 1084 hfmonitor.exe -
Loads dropped DLL 11 IoCs
pid Process 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe 396 MsiExec.exe 396 MsiExec.exe 1836 MsiExec.exe 1836 MsiExec.exe 1836 MsiExec.exe 1836 MsiExec.exe 1836 MsiExec.exe 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe 1084 hfmonitor.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe File opened (read-only) \??\U: fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe File opened (read-only) \??\Y: fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe File opened (read-only) \??\X: fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\V: fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\K: fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe File opened (read-only) \??\L: fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Q: fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\S: fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\F: fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\H: fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe File opened (read-only) \??\P: fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\O: fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe File opened (read-only) \??\I: fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\N: fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe File opened (read-only) \??\G: fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe File opened (read-only) \??\J: fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\,㱴瞧㲣瞧枇磮ˀZƔ hfmonitor.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\Installer\f768759.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI8A1B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8CDC.tmp msiexec.exe File created C:\Windows\Installer\f76875b.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\f76875b.ipi msiexec.exe File opened for modification C:\Windows\Installer\f768759.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI8B63.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8BC2.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8D3A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9BFA.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 hfmonitor.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString hfmonitor.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 1980 timeout.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1400 msiexec.exe 1400 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 1400 msiexec.exe Token: SeTakeOwnershipPrivilege 1400 msiexec.exe Token: SeSecurityPrivilege 1400 msiexec.exe Token: SeCreateTokenPrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeAssignPrimaryTokenPrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeLockMemoryPrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeIncreaseQuotaPrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeMachineAccountPrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeTcbPrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeSecurityPrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeTakeOwnershipPrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeLoadDriverPrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeSystemProfilePrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeSystemtimePrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeProfSingleProcessPrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeIncBasePriorityPrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeCreatePagefilePrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeCreatePermanentPrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeBackupPrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeRestorePrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeShutdownPrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeDebugPrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeAuditPrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeSystemEnvironmentPrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeChangeNotifyPrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeRemoteShutdownPrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeUndockPrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeSyncAgentPrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeEnableDelegationPrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeManageVolumePrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeImpersonatePrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeCreateGlobalPrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeCreateTokenPrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeAssignPrimaryTokenPrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeLockMemoryPrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeIncreaseQuotaPrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeMachineAccountPrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeTcbPrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeSecurityPrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeTakeOwnershipPrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeLoadDriverPrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeSystemProfilePrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeSystemtimePrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeProfSingleProcessPrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeIncBasePriorityPrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeCreatePagefilePrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeCreatePermanentPrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeBackupPrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeRestorePrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeShutdownPrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeDebugPrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeAuditPrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeSystemEnvironmentPrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeChangeNotifyPrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeRemoteShutdownPrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeUndockPrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeSyncAgentPrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeEnableDelegationPrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeManageVolumePrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeImpersonatePrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeCreateGlobalPrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeCreateTokenPrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeAssignPrimaryTokenPrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe Token: SeLockMemoryPrivilege 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1268 msiexec.exe 1268 msiexec.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 1400 wrote to memory of 396 1400 msiexec.exe 28 PID 1400 wrote to memory of 396 1400 msiexec.exe 28 PID 1400 wrote to memory of 396 1400 msiexec.exe 28 PID 1400 wrote to memory of 396 1400 msiexec.exe 28 PID 1400 wrote to memory of 396 1400 msiexec.exe 28 PID 1400 wrote to memory of 396 1400 msiexec.exe 28 PID 1400 wrote to memory of 396 1400 msiexec.exe 28 PID 1668 wrote to memory of 1268 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe 29 PID 1668 wrote to memory of 1268 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe 29 PID 1668 wrote to memory of 1268 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe 29 PID 1668 wrote to memory of 1268 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe 29 PID 1668 wrote to memory of 1268 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe 29 PID 1668 wrote to memory of 1268 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe 29 PID 1668 wrote to memory of 1268 1668 fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe 29 PID 1400 wrote to memory of 1836 1400 msiexec.exe 30 PID 1400 wrote to memory of 1836 1400 msiexec.exe 30 PID 1400 wrote to memory of 1836 1400 msiexec.exe 30 PID 1400 wrote to memory of 1836 1400 msiexec.exe 30 PID 1400 wrote to memory of 1836 1400 msiexec.exe 30 PID 1400 wrote to memory of 1836 1400 msiexec.exe 30 PID 1400 wrote to memory of 1836 1400 msiexec.exe 30 PID 1400 wrote to memory of 1084 1400 msiexec.exe 31 PID 1400 wrote to memory of 1084 1400 msiexec.exe 31 PID 1400 wrote to memory of 1084 1400 msiexec.exe 31 PID 1400 wrote to memory of 1084 1400 msiexec.exe 31 PID 1084 wrote to memory of 1644 1084 hfmonitor.exe 34 PID 1084 wrote to memory of 1644 1084 hfmonitor.exe 34 PID 1084 wrote to memory of 1644 1084 hfmonitor.exe 34 PID 1084 wrote to memory of 1644 1084 hfmonitor.exe 34 PID 1644 wrote to memory of 1980 1644 cmd.exe 36 PID 1644 wrote to memory of 1980 1644 cmd.exe 36 PID 1644 wrote to memory of 1980 1644 cmd.exe 36 PID 1644 wrote to memory of 1980 1644 cmd.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe"C:\Users\Admin\AppData\Local\Temp\fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\SunlitGreen Software\UAParser 3.1.8.4\install\6D45053\adv1.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e29464.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1642354294 " AI_EUIMSI=""2⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
PID:1268
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B603C9C00554D0A0D0F5716ED93C42DF C2⤵
- Loads dropped DLL
PID:396
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 71A833818685C18EA47649153F1763002⤵
- Loads dropped DLL
PID:1836
-
-
C:\Users\Admin\AppData\Roaming\SunlitGreen Software\UAParser\hfmonitor.exe"C:\Users\Admin\AppData\Roaming\SunlitGreen Software\UAParser\hfmonitor.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\wYTlwaHxqIGi & timeout 4 & del /f /q "C:\Users\Admin\AppData\Roaming\SunlitGreen Software\UAParser\hfmonitor.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Windows\SysWOW64\timeout.exetimeout 44⤵
- Delays execution with timeout.exe
PID:1980
-
-
-