Analysis
-
max time kernel
151s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
06-02-2022 13:04
Static task
static1
Behavioral task
behavioral1
Sample
490548ca84fb78e8d332bcde20b37576b2a532e388232e756d9c746b6baad5bb.msi
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
-
Target
490548ca84fb78e8d332bcde20b37576b2a532e388232e756d9c746b6baad5bb.msi
-
Size
2.2MB
-
MD5
3a8af2810c28d0eac73f55fb5efb63c2
-
SHA1
fcc72c86caafc640c7ca831bf9e1fbb2341f6895
-
SHA256
490548ca84fb78e8d332bcde20b37576b2a532e388232e756d9c746b6baad5bb
-
SHA512
cc490c53a66e13548a20e301616c09ab1e1fabc25b64000b0f9c13dfc570d43c8f4b259f431147ab6dc60a33a837dafb0e356f330fdc796552c33d61232de839
Malware Config
Signatures
-
Detect Numando Payload 1 IoCs
resource yara_rule behavioral2/memory/1688-159-0x0000000008E40000-0x000000000974F000-memory.dmp family_numando -
Blocklisted process makes network request 3 IoCs
flow pid Process 35 2936 MsiExec.exe 37 2936 MsiExec.exe 39 2936 MsiExec.exe -
Executes dropped EXE 2 IoCs
pid Process 2636 MSI5288.tmp 1688 Escudo.exe -
Loads dropped DLL 12 IoCs
pid Process 2936 MsiExec.exe 2936 MsiExec.exe 2936 MsiExec.exe 2936 MsiExec.exe 2936 MsiExec.exe 2936 MsiExec.exe 2936 MsiExec.exe 2936 MsiExec.exe 2936 MsiExec.exe 1688 Escudo.exe 1688 Escudo.exe 1688 Escudo.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Windows\CurrentVersion\Run msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Escudo.exe = "C:\\Users\\Admin\\AppData\\Roaming\\eletronics\\Consulta Eletronica\\Escudo.exe" Escudo.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\N: msiexec.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in Windows directory 18 IoCs
description ioc Process File created C:\Windows\Installer\1cddee4.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIE6B4.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI2D29.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5288.tmp msiexec.exe File opened for modification C:\Windows\Installer\1cddee4.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI114F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI16EE.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI2B63.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5093.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI174C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI23B1.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{F46ED3EE-F38D-4CFF-B944-6D65A29021E4} msiexec.exe File opened for modification C:\Windows\Installer\MSI2F1E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3180.tmp msiexec.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat svchost.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{EDDDEC6C-8755-11EC-82D0-F2D670B75582} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c00000000000000010000000083ffff0083ffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe -
Modifies data under HKEY_USERS 45 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132888027274556270" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4040" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "5.172295" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1732 msiexec.exe 1732 msiexec.exe 1688 Escudo.exe 1688 Escudo.exe 1688 Escudo.exe 1688 Escudo.exe 1688 Escudo.exe 1688 Escudo.exe 1688 Escudo.exe 1688 Escudo.exe -
Suspicious use of AdjustPrivilegeToken 60 IoCs
description pid Process Token: SeShutdownPrivilege 212 msiexec.exe Token: SeIncreaseQuotaPrivilege 212 msiexec.exe Token: SeSecurityPrivilege 1732 msiexec.exe Token: SeCreateTokenPrivilege 212 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 212 msiexec.exe Token: SeLockMemoryPrivilege 212 msiexec.exe Token: SeIncreaseQuotaPrivilege 212 msiexec.exe Token: SeMachineAccountPrivilege 212 msiexec.exe Token: SeTcbPrivilege 212 msiexec.exe Token: SeSecurityPrivilege 212 msiexec.exe Token: SeTakeOwnershipPrivilege 212 msiexec.exe Token: SeLoadDriverPrivilege 212 msiexec.exe Token: SeSystemProfilePrivilege 212 msiexec.exe Token: SeSystemtimePrivilege 212 msiexec.exe Token: SeProfSingleProcessPrivilege 212 msiexec.exe Token: SeIncBasePriorityPrivilege 212 msiexec.exe Token: SeCreatePagefilePrivilege 212 msiexec.exe Token: SeCreatePermanentPrivilege 212 msiexec.exe Token: SeBackupPrivilege 212 msiexec.exe Token: SeRestorePrivilege 212 msiexec.exe Token: SeShutdownPrivilege 212 msiexec.exe Token: SeDebugPrivilege 212 msiexec.exe Token: SeAuditPrivilege 212 msiexec.exe Token: SeSystemEnvironmentPrivilege 212 msiexec.exe Token: SeChangeNotifyPrivilege 212 msiexec.exe Token: SeRemoteShutdownPrivilege 212 msiexec.exe Token: SeUndockPrivilege 212 msiexec.exe Token: SeSyncAgentPrivilege 212 msiexec.exe Token: SeEnableDelegationPrivilege 212 msiexec.exe Token: SeManageVolumePrivilege 212 msiexec.exe Token: SeImpersonatePrivilege 212 msiexec.exe Token: SeCreateGlobalPrivilege 212 msiexec.exe Token: SeRestorePrivilege 1732 msiexec.exe Token: SeTakeOwnershipPrivilege 1732 msiexec.exe Token: SeRestorePrivilege 1732 msiexec.exe Token: SeTakeOwnershipPrivilege 1732 msiexec.exe Token: SeRestorePrivilege 1732 msiexec.exe Token: SeTakeOwnershipPrivilege 1732 msiexec.exe Token: SeRestorePrivilege 1732 msiexec.exe Token: SeTakeOwnershipPrivilege 1732 msiexec.exe Token: SeRestorePrivilege 1732 msiexec.exe Token: SeTakeOwnershipPrivilege 1732 msiexec.exe Token: SeRestorePrivilege 1732 msiexec.exe Token: SeTakeOwnershipPrivilege 1732 msiexec.exe Token: SeRestorePrivilege 1732 msiexec.exe Token: SeTakeOwnershipPrivilege 1732 msiexec.exe Token: SeRestorePrivilege 1732 msiexec.exe Token: SeTakeOwnershipPrivilege 1732 msiexec.exe Token: SeRestorePrivilege 1732 msiexec.exe Token: SeTakeOwnershipPrivilege 1732 msiexec.exe Token: SeRestorePrivilege 1732 msiexec.exe Token: SeTakeOwnershipPrivilege 1732 msiexec.exe Token: SeRestorePrivilege 1732 msiexec.exe Token: SeTakeOwnershipPrivilege 1732 msiexec.exe Token: SeRestorePrivilege 1732 msiexec.exe Token: SeTakeOwnershipPrivilege 1732 msiexec.exe Token: SeRestorePrivilege 1732 msiexec.exe Token: SeTakeOwnershipPrivilege 1732 msiexec.exe Token: SeRestorePrivilege 1732 msiexec.exe Token: SeTakeOwnershipPrivilege 1732 msiexec.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 212 msiexec.exe 212 msiexec.exe 1012 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1012 iexplore.exe 1012 iexplore.exe 2004 IEXPLORE.EXE 2004 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1732 wrote to memory of 2936 1732 msiexec.exe 62 PID 1732 wrote to memory of 2936 1732 msiexec.exe 62 PID 1732 wrote to memory of 2936 1732 msiexec.exe 62 PID 1732 wrote to memory of 2636 1732 msiexec.exe 70 PID 1732 wrote to memory of 2636 1732 msiexec.exe 70 PID 1732 wrote to memory of 2636 1732 msiexec.exe 70 PID 1688 wrote to memory of 1012 1688 Escudo.exe 72 PID 1688 wrote to memory of 1012 1688 Escudo.exe 72 PID 1012 wrote to memory of 2004 1012 iexplore.exe 73 PID 1012 wrote to memory of 2004 1012 iexplore.exe 73 PID 1012 wrote to memory of 2004 1012 iexplore.exe 73
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\490548ca84fb78e8d332bcde20b37576b2a532e388232e756d9c746b6baad5bb.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:212
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding DE096E74E5BFC461D87FDF02C69DDB142⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:2936
-
-
C:\Windows\Installer\MSI5288.tmp"C:\Windows\Installer\MSI5288.tmp" /DontWait "C:\Users\Admin\AppData\Roaming\eletronics\Consulta Eletronica\Escudo.exe"2⤵
- Executes dropped EXE
PID:2636
-
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
PID:3496
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:3856
-
C:\Users\Admin\AppData\Roaming\eletronics\Consulta Eletronica\Escudo.exe"C:\Users\Admin\AppData\Roaming\eletronics\Consulta Eletronica\Escudo.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" %1 "https://bit.ly/3Dp9HzD"2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1012 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2004
-
-