numando | 490548ca84fb78e8d332bcde20b37576b2a532e388232e756d9c746b6baad5bb

Analysis

max time kernel
151s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
06-02-2022 13:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

490548ca84fb78e8d332bcde20b37576b2a532e388232e756d9c746b6baad5bb.msi
Size

2.2MB
MD5

3a8af2810c28d0eac73f55fb5efb63c2
SHA1

fcc72c86caafc640c7ca831bf9e1fbb2341f6895
SHA256

490548ca84fb78e8d332bcde20b37576b2a532e388232e756d9c746b6baad5bb
SHA512

cc490c53a66e13548a20e301616c09ab1e1fabc25b64000b0f9c13dfc570d43c8f4b259f431147ab6dc60a33a837dafb0e356f330fdc796552c33d61232de839

Score

10^/10

numando backdoor persistence spyware stealer trojan

Malware Config

Signatures

Detect Numando Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1688-159-0x0000000008E40000-0x000000000974F000-memory.dmp	family_numando

Numando
Numando is a banking trojan/backdoor targeting Latin America which uses Youtube and Pastebin for C2 communications.
trojan backdoor numando
Blocklisted process makes network request 3 IoCs

Processes:

MsiExec.exe

flow pid process

35 2936 MsiExec.exe
37 2936 MsiExec.exe
39 2936 MsiExec.exe
Executes dropped EXE 2 IoCs

Processes:

MSI5288.tmpEscudo.exe

pid process

2636 MSI5288.tmp
1688 Escudo.exe

flow	pid	process
35	2936	MsiExec.exe
37	2936	MsiExec.exe
39	2936	MsiExec.exe

pid	process
2636	MSI5288.tmp
1688	Escudo.exe

Loads dropped DLL 12 IoCs

Processes:

MsiExec.exeEscudo.exe

pid	process
2936	MsiExec.exe
2936	MsiExec.exe
2936	MsiExec.exe
2936	MsiExec.exe
2936	MsiExec.exe
2936	MsiExec.exe
2936	MsiExec.exe
2936	MsiExec.exe
2936	MsiExec.exe
1688	Escudo.exe
1688	Escudo.exe
1688	Escudo.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

msiexec.exeEscudo.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Windows\CurrentVersion\Run	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Escudo.exe = "C:\\Users\\Admin\\AppData\\Roaming\\eletronics\\Consulta Eletronica\\Escudo.exe"	Escudo.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Windows directory 18 IoCs

Processes:

msiexec.exesvchost.exe

description	ioc	process
File created	C:\Windows\Installer\1cddee4.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE6B4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2D29.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5288.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\1cddee4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI114F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI16EE.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2B63.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5093.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI174C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI23B1.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{F46ED3EE-F38D-4CFF-B944-6D65A29021E4}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2F1E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3180.tmp	msiexec.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat	svchost.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MusNotifyIcon.exe

description	ioc	process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotifyIcon.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotifyIcon.exe

Modifies Internet Explorer settings 1 TTPs 11 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{EDDDEC6C-8755-11EC-82D0-F2D670B75582} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c00000000000000010000000083ffff0083ffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 45 IoCs

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132888027274556270"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4040"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "5.172295"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0"	svchost.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msiexec.exeEscudo.exe

pid	process
1732	msiexec.exe
1732	msiexec.exe
1688	Escudo.exe
1688	Escudo.exe
1688	Escudo.exe
1688	Escudo.exe
1688	Escudo.exe
1688	Escudo.exe
1688	Escudo.exe
1688	Escudo.exe

Suspicious use of AdjustPrivilegeToken 60 IoCs

Processes:

msiexec.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	212	msiexec.exe
Token: SeIncreaseQuotaPrivilege	212	msiexec.exe
Token: SeSecurityPrivilege	1732	msiexec.exe
Token: SeCreateTokenPrivilege	212	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	212	msiexec.exe
Token: SeLockMemoryPrivilege	212	msiexec.exe
Token: SeIncreaseQuotaPrivilege	212	msiexec.exe
Token: SeMachineAccountPrivilege	212	msiexec.exe
Token: SeTcbPrivilege	212	msiexec.exe
Token: SeSecurityPrivilege	212	msiexec.exe
Token: SeTakeOwnershipPrivilege	212	msiexec.exe
Token: SeLoadDriverPrivilege	212	msiexec.exe
Token: SeSystemProfilePrivilege	212	msiexec.exe
Token: SeSystemtimePrivilege	212	msiexec.exe
Token: SeProfSingleProcessPrivilege	212	msiexec.exe
Token: SeIncBasePriorityPrivilege	212	msiexec.exe
Token: SeCreatePagefilePrivilege	212	msiexec.exe
Token: SeCreatePermanentPrivilege	212	msiexec.exe
Token: SeBackupPrivilege	212	msiexec.exe
Token: SeRestorePrivilege	212	msiexec.exe
Token: SeShutdownPrivilege	212	msiexec.exe
Token: SeDebugPrivilege	212	msiexec.exe
Token: SeAuditPrivilege	212	msiexec.exe
Token: SeSystemEnvironmentPrivilege	212	msiexec.exe
Token: SeChangeNotifyPrivilege	212	msiexec.exe
Token: SeRemoteShutdownPrivilege	212	msiexec.exe
Token: SeUndockPrivilege	212	msiexec.exe
Token: SeSyncAgentPrivilege	212	msiexec.exe
Token: SeEnableDelegationPrivilege	212	msiexec.exe
Token: SeManageVolumePrivilege	212	msiexec.exe
Token: SeImpersonatePrivilege	212	msiexec.exe
Token: SeCreateGlobalPrivilege	212	msiexec.exe
Token: SeRestorePrivilege	1732	msiexec.exe
Token: SeTakeOwnershipPrivilege	1732	msiexec.exe
Token: SeRestorePrivilege	1732	msiexec.exe
Token: SeTakeOwnershipPrivilege	1732	msiexec.exe
Token: SeRestorePrivilege	1732	msiexec.exe
Token: SeTakeOwnershipPrivilege	1732	msiexec.exe
Token: SeRestorePrivilege	1732	msiexec.exe
Token: SeTakeOwnershipPrivilege	1732	msiexec.exe
Token: SeRestorePrivilege	1732	msiexec.exe
Token: SeTakeOwnershipPrivilege	1732	msiexec.exe
Token: SeRestorePrivilege	1732	msiexec.exe
Token: SeTakeOwnershipPrivilege	1732	msiexec.exe
Token: SeRestorePrivilege	1732	msiexec.exe
Token: SeTakeOwnershipPrivilege	1732	msiexec.exe
Token: SeRestorePrivilege	1732	msiexec.exe
Token: SeTakeOwnershipPrivilege	1732	msiexec.exe
Token: SeRestorePrivilege	1732	msiexec.exe
Token: SeTakeOwnershipPrivilege	1732	msiexec.exe
Token: SeRestorePrivilege	1732	msiexec.exe
Token: SeTakeOwnershipPrivilege	1732	msiexec.exe
Token: SeRestorePrivilege	1732	msiexec.exe
Token: SeTakeOwnershipPrivilege	1732	msiexec.exe
Token: SeRestorePrivilege	1732	msiexec.exe
Token: SeTakeOwnershipPrivilege	1732	msiexec.exe
Token: SeRestorePrivilege	1732	msiexec.exe
Token: SeTakeOwnershipPrivilege	1732	msiexec.exe
Token: SeRestorePrivilege	1732	msiexec.exe
Token: SeTakeOwnershipPrivilege	1732	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

msiexec.exeiexplore.exe

pid process

212 msiexec.exe
212 msiexec.exe
1012 iexplore.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1012 iexplore.exe
1012 iexplore.exe
2004 IEXPLORE.EXE
2004 IEXPLORE.EXE

pid	process
212	msiexec.exe
212	msiexec.exe
1012	iexplore.exe

pid	process
1012	iexplore.exe
1012	iexplore.exe
2004	IEXPLORE.EXE
2004	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

msiexec.exeEscudo.exeiexplore.exe

description	pid	process	target process
PID 1732 wrote to memory of 2936	1732	msiexec.exe	MsiExec.exe
PID 1732 wrote to memory of 2936	1732	msiexec.exe	MsiExec.exe
PID 1732 wrote to memory of 2936	1732	msiexec.exe	MsiExec.exe
PID 1732 wrote to memory of 2636	1732	msiexec.exe	MSI5288.tmp
PID 1732 wrote to memory of 2636	1732	msiexec.exe	MSI5288.tmp
PID 1732 wrote to memory of 2636	1732	msiexec.exe	MSI5288.tmp
PID 1688 wrote to memory of 1012	1688	Escudo.exe	iexplore.exe
PID 1688 wrote to memory of 1012	1688	Escudo.exe	iexplore.exe
PID 1012 wrote to memory of 2004	1012	iexplore.exe	IEXPLORE.EXE
PID 1012 wrote to memory of 2004	1012	iexplore.exe	IEXPLORE.EXE
PID 1012 wrote to memory of 2004	1012	iexplore.exe	IEXPLORE.EXE

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\490548ca84fb78e8d332bcde20b37576b2a532e388232e756d9c746b6baad5bb.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:212

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DE096E74E5BFC461D87FDF02C69DDB14
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:2936
- C:\Windows\Installer\MSI5288.tmp
  "C:\Windows\Installer\MSI5288.tmp" /DontWait "C:\Users\Admin\AppData\Roaming\eletronics\Consulta Eletronica\Escudo.exe"
  2⤵
  - Executes dropped EXE
  PID:2636

C:\Windows\system32\MusNotifyIcon.exe
%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
1⤵
- Checks processor information in registry
PID:3496

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:3856

C:\Users\Admin\AppData\Roaming\eletronics\Consulta Eletronica\Escudo.exe
"C:\Users\Admin\AppData\Roaming\eletronics\Consulta Eletronica\Escudo.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" %1 "https://bit.ly/3Dp9HzD"
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1012
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1012 CREDAT:17410 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2004

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\eletronics\Consulta Eletronica\Escudo.exe

MD5
04ec4f58a1f4a87b5eeb1f4b7afc48e0

SHA1
58dcb1cbbec071d036a07f0e8feb858e4c5b96e7

SHA256
bd1af3dba56b129e6c624297eeed40c898fa2981fce5caafe467d88a748988a4

SHA512
5b572a504fac599e7e3f726d391e8ffdc2d083745609315a203000e8dc79b94d777fc520eb6530444d84f1ac9aad51406b91b527d8434077a58524feeccbbd80

Download Submit
C:\Users\Admin\AppData\Roaming\eletronics\Consulta Eletronica\dbgeng

MD5
b9a0fbdff8c408ea7c265f2b5f17044f

SHA1
2493df4492892235e2c803ce87e8e22a36b53d93

SHA256
3d9f667d75bdb6cf5536ea98e4d4dcbfeea8d29cdabfc23da4a5ff87c88108ce

SHA512
9814132bd684860e8587b6f77e0bc9316a65c0414076efc919f96b0b8367b59bca70a6635433112b1e752814c9757ea90b66c1376c40df34423770de3e002623

Download Submit
C:\Users\Admin\AppData\Roaming\eletronics\Consulta Eletronica\dbgeng.dll

MD5
073a1ae73a400b4724d25c1fc4d8ee83

SHA1
2c0596a9e6e2bcfcb4ead7c68ef2529c3f677b0e

SHA256
89d2905f3b757ad144075c22607517098f535af59238e06c5f02dc2f0e231a0b

SHA512
177f8a3cf43a64bcf339126e581edc40afb693baf508458571f86d5a2c7665154209ac04a94a3847df35964d67462e1e2b1b993baf58f31878c6d1e249e95230

Download Submit
C:\Users\Admin\AppData\Roaming\eletronics\Consulta Eletronica\dbgeng.dll

MD5
073a1ae73a400b4724d25c1fc4d8ee83

SHA1
2c0596a9e6e2bcfcb4ead7c68ef2529c3f677b0e

SHA256
89d2905f3b757ad144075c22607517098f535af59238e06c5f02dc2f0e231a0b

SHA512
177f8a3cf43a64bcf339126e581edc40afb693baf508458571f86d5a2c7665154209ac04a94a3847df35964d67462e1e2b1b993baf58f31878c6d1e249e95230

Download Submit
C:\Users\Admin\AppData\Roaming\eletronics\Consulta Eletronica\libeay32.dll

MD5
1f3d6ea5e7dab4126b5315261785408b

SHA1
5a138f31b36fa689f783bb1325a34566fa725865

SHA256
fc66f65545e6f8d875e82509bcb4ed4bd3df1869734d8f4fd206c9b7e8726499

SHA512
d37237baf8d0054c87b303758941e7180fcd40b63dea44c3e66c3e0d9bf9d23f8ea0bb47dd7cb0edb73c56e471c71520d9aaf8bbc36850e6a6ffd45bc794af48

Download Submit
C:\Users\Admin\AppData\Roaming\eletronics\Consulta Eletronica\libeay32.dll

MD5
1f3d6ea5e7dab4126b5315261785408b

SHA1
5a138f31b36fa689f783bb1325a34566fa725865

SHA256
fc66f65545e6f8d875e82509bcb4ed4bd3df1869734d8f4fd206c9b7e8726499

SHA512
d37237baf8d0054c87b303758941e7180fcd40b63dea44c3e66c3e0d9bf9d23f8ea0bb47dd7cb0edb73c56e471c71520d9aaf8bbc36850e6a6ffd45bc794af48

Download Submit
C:\Users\Admin\AppData\Roaming\eletronics\Consulta Eletronica\ssleay32.dll

MD5
a71bb55be452a69f69a67df2fe7c4097

SHA1
d2ab6d7acf2647827155d9bd3d9d4eca57eb2fce

SHA256
ff6c7f1c9dcff3b3a90cf57a9b4341dda0d76adb9e8667b4a3f75e15a2b7a832

SHA512
d0f7342266d9f9fa34b47564181a169dcf3fb518406f418bf0622c0e1ed5d849fa4c7816c0fe1542fc41e266bf3182ed2ffa49ac8247054a0b60f96b2ba4661a

Download Submit
C:\Users\Admin\AppData\Roaming\eletronics\Consulta Eletronica\ssleay32.dll

MD5
a71bb55be452a69f69a67df2fe7c4097

SHA1
d2ab6d7acf2647827155d9bd3d9d4eca57eb2fce

SHA256
ff6c7f1c9dcff3b3a90cf57a9b4341dda0d76adb9e8667b4a3f75e15a2b7a832

SHA512
d0f7342266d9f9fa34b47564181a169dcf3fb518406f418bf0622c0e1ed5d849fa4c7816c0fe1542fc41e266bf3182ed2ffa49ac8247054a0b60f96b2ba4661a

Download Submit
C:\Windows\Installer\MSI114F.tmp

MD5
305a50c391a94b42a68958f3f89906fb

SHA1
4110d68d71f3594f5d3bdfca91a1c759ab0105d4

SHA256
f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f

SHA512
fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7

Download Submit
C:\Windows\Installer\MSI114F.tmp

MD5
305a50c391a94b42a68958f3f89906fb

SHA1
4110d68d71f3594f5d3bdfca91a1c759ab0105d4

SHA256
f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f

SHA512
fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7

Download Submit
C:\Windows\Installer\MSI16EE.tmp

MD5
305a50c391a94b42a68958f3f89906fb

SHA1
4110d68d71f3594f5d3bdfca91a1c759ab0105d4

SHA256
f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f

SHA512
fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7

Download Submit
C:\Windows\Installer\MSI16EE.tmp

MD5
305a50c391a94b42a68958f3f89906fb

SHA1
4110d68d71f3594f5d3bdfca91a1c759ab0105d4

SHA256
f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f

SHA512
fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7

Download Submit
C:\Windows\Installer\MSI174C.tmp

MD5
7e68b9d86ff8fafe995fc9ea0a2bff44

SHA1
06afc5448037dc419013c3055f61836875bc5e02

SHA256
fb4ff113ee64dd8d9aa92a3b5c1d1cd0896a1cc8b4c3768d1cacde2f52f41d58

SHA512
6e22afd350f376969de823b033394324d3c2433c196515624a84b8e5160ea228fdaac0699e76466ae1f30155fc44f61697efb9e1eca9a67670aff25e6ee67a5c

Download Submit
C:\Windows\Installer\MSI174C.tmp

MD5
7e68b9d86ff8fafe995fc9ea0a2bff44

SHA1
06afc5448037dc419013c3055f61836875bc5e02

SHA256
fb4ff113ee64dd8d9aa92a3b5c1d1cd0896a1cc8b4c3768d1cacde2f52f41d58

SHA512
6e22afd350f376969de823b033394324d3c2433c196515624a84b8e5160ea228fdaac0699e76466ae1f30155fc44f61697efb9e1eca9a67670aff25e6ee67a5c

Download Submit
C:\Windows\Installer\MSI23B1.tmp

MD5
305a50c391a94b42a68958f3f89906fb

SHA1
4110d68d71f3594f5d3bdfca91a1c759ab0105d4

SHA256
f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f

SHA512
fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7

Download Submit
C:\Windows\Installer\MSI23B1.tmp

MD5
305a50c391a94b42a68958f3f89906fb

SHA1
4110d68d71f3594f5d3bdfca91a1c759ab0105d4

SHA256
f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f

SHA512
fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7

Download Submit
C:\Windows\Installer\MSI2D29.tmp

MD5
dd777abc5e3abff6e35f866470fd8d2d

SHA1
11d68b3cf2f9628729622e76e82ce58f3b8d4561

SHA256
c1c922e7b8addf20a1f8c01fb7333e4341e5bd43ea90b82025e4402cd016d3ed

SHA512
aa21b5d920ac9260eb35a421f071c95e83c31a5545762ca12f2b8a05a543d4ac90095ace83c37aa3b3c69135dee091e0be7e38a2bca45a474362da479c3b0c1e

Download Submit
C:\Windows\Installer\MSI2D29.tmp

MD5
dd777abc5e3abff6e35f866470fd8d2d

SHA1
11d68b3cf2f9628729622e76e82ce58f3b8d4561

SHA256
c1c922e7b8addf20a1f8c01fb7333e4341e5bd43ea90b82025e4402cd016d3ed

SHA512
aa21b5d920ac9260eb35a421f071c95e83c31a5545762ca12f2b8a05a543d4ac90095ace83c37aa3b3c69135dee091e0be7e38a2bca45a474362da479c3b0c1e

Download Submit
C:\Windows\Installer\MSI2F1E.tmp

MD5
dd777abc5e3abff6e35f866470fd8d2d

SHA1
11d68b3cf2f9628729622e76e82ce58f3b8d4561

SHA256
c1c922e7b8addf20a1f8c01fb7333e4341e5bd43ea90b82025e4402cd016d3ed

SHA512
aa21b5d920ac9260eb35a421f071c95e83c31a5545762ca12f2b8a05a543d4ac90095ace83c37aa3b3c69135dee091e0be7e38a2bca45a474362da479c3b0c1e

Download Submit
C:\Windows\Installer\MSI2F1E.tmp

MD5
dd777abc5e3abff6e35f866470fd8d2d

SHA1
11d68b3cf2f9628729622e76e82ce58f3b8d4561

SHA256
c1c922e7b8addf20a1f8c01fb7333e4341e5bd43ea90b82025e4402cd016d3ed

SHA512
aa21b5d920ac9260eb35a421f071c95e83c31a5545762ca12f2b8a05a543d4ac90095ace83c37aa3b3c69135dee091e0be7e38a2bca45a474362da479c3b0c1e

Download Submit
C:\Windows\Installer\MSI3180.tmp

MD5
dd777abc5e3abff6e35f866470fd8d2d

SHA1
11d68b3cf2f9628729622e76e82ce58f3b8d4561

SHA256
c1c922e7b8addf20a1f8c01fb7333e4341e5bd43ea90b82025e4402cd016d3ed

SHA512
aa21b5d920ac9260eb35a421f071c95e83c31a5545762ca12f2b8a05a543d4ac90095ace83c37aa3b3c69135dee091e0be7e38a2bca45a474362da479c3b0c1e

Download Submit
C:\Windows\Installer\MSI3180.tmp

MD5
dd777abc5e3abff6e35f866470fd8d2d

SHA1
11d68b3cf2f9628729622e76e82ce58f3b8d4561

SHA256
c1c922e7b8addf20a1f8c01fb7333e4341e5bd43ea90b82025e4402cd016d3ed

SHA512
aa21b5d920ac9260eb35a421f071c95e83c31a5545762ca12f2b8a05a543d4ac90095ace83c37aa3b3c69135dee091e0be7e38a2bca45a474362da479c3b0c1e

Download Submit
C:\Windows\Installer\MSI5093.tmp

MD5
dd777abc5e3abff6e35f866470fd8d2d

SHA1
11d68b3cf2f9628729622e76e82ce58f3b8d4561

SHA256
c1c922e7b8addf20a1f8c01fb7333e4341e5bd43ea90b82025e4402cd016d3ed

SHA512
aa21b5d920ac9260eb35a421f071c95e83c31a5545762ca12f2b8a05a543d4ac90095ace83c37aa3b3c69135dee091e0be7e38a2bca45a474362da479c3b0c1e

Download Submit
C:\Windows\Installer\MSI5093.tmp

MD5
dd777abc5e3abff6e35f866470fd8d2d

SHA1
11d68b3cf2f9628729622e76e82ce58f3b8d4561

SHA256
c1c922e7b8addf20a1f8c01fb7333e4341e5bd43ea90b82025e4402cd016d3ed

SHA512
aa21b5d920ac9260eb35a421f071c95e83c31a5545762ca12f2b8a05a543d4ac90095ace83c37aa3b3c69135dee091e0be7e38a2bca45a474362da479c3b0c1e

Download Submit
C:\Windows\Installer\MSI5288.tmp

MD5
a34d4f165087b11d9e06781d52262868

SHA1
1b7b6a5bb53b7c12fb45325f261ad7a61b485ce1

SHA256
55ad26c17f4aac71e6db6a6edee6ebf695510dc7e533e3fee64afc3eb06291e5

SHA512
aa62ff3b601ddb83133dd3659b0881f523454dc7eea921da7cfefc50426e70bb36b4ebc337a8f16620da610784a81a8e4aa1cf5e0959d28aa155d1f026a81aaf

Download Submit
C:\Windows\Installer\MSIE6B4.tmp

MD5
305a50c391a94b42a68958f3f89906fb

SHA1
4110d68d71f3594f5d3bdfca91a1c759ab0105d4

SHA256
f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f

SHA512
fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7

Download Submit
C:\Windows\Installer\MSIE6B4.tmp

MD5
305a50c391a94b42a68958f3f89906fb

SHA1
4110d68d71f3594f5d3bdfca91a1c759ab0105d4

SHA256
f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f

SHA512
fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7

Download Submit
memory/1688-159-0x0000000008E40000-0x000000000974F000-memory.dmp

Filesize
9.1MB

Download
memory/1688-164-0x0000000006E90000-0x0000000006E91000-memory.dmp

Filesize
4KB

Download