8aa574ba92ef3177d786c519d9f2acc86aa7d16afd44819cb23eddd28720776c

Analysis

max time kernel
154s
max time network
162s
platform
windows7_x64
resource
win7-en-20211208
submitted
13-02-2022 10:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8aa574ba92ef3177d786c519d9f2acc86aa7d16afd44819cb23eddd28720776c.msi
Size

280KB
MD5

2e81921e3cdeddd24b74f59039bde7a0
SHA1

45950947f0cf45583514eebc95a361e55fd479b8
SHA256

8aa574ba92ef3177d786c519d9f2acc86aa7d16afd44819cb23eddd28720776c
SHA512

287fb25c2f96df4cca630deb02e64b021395cb46dddc8fe40d833b1db2bc7c25e379824942e17bf1695c036f6115c5cb518c2811e7b5c4a087fd6914b4ab0c5f

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 4 IoCs

Processes:

MsiExec.exe

flow pid process

4 272 MsiExec.exe
7 272 MsiExec.exe
9 272 MsiExec.exe
13 272 MsiExec.exe
Executes dropped EXE 1 IoCs

Processes:

lc2C28.tmp

pid process

1964 lc2C28.tmp
Loads dropped DLL 5 IoCs

Processes:

MsiExec.exe

pid process

272 MsiExec.exe
272 MsiExec.exe
272 MsiExec.exe
272 MsiExec.exe
272 MsiExec.exe

flow	pid	process
4	272	MsiExec.exe
7	272	MsiExec.exe
9	272	MsiExec.exe
13	272	MsiExec.exe

pid	process
1964	lc2C28.tmp

pid	process
272	MsiExec.exe
272	MsiExec.exe
272	MsiExec.exe
272	MsiExec.exe
272	MsiExec.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Drops file in Windows directory 10 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSI28D5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2B47.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI34F8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7BB9.tmp	msiexec.exe
File created	C:\Windows\Installer\f75fe9a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f75fe9a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI29CF.tmp	msiexec.exe
File created	C:\Windows\Installer\f75fe9c.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\f75fe9c.ipi	msiexec.exe

Modifies Internet Explorer settings 1 TTPs 50 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DOMStorage\adobe.com\Total = "70"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.adobe.com\ = "48"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "70"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.adobe.com\ = "70"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "90"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DOMStorage\adobe.com\Total = "48"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.adobe.com	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "351514123"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000029a8fa03d77d0143b95f148165a5bc9200000000020000000000106600000001000020000000d313ae91376484d6c0675410fc2e84aabdb84317a4193859ee0cffdfec3fba91000000000e8000000002000020000000a564c29f85e493d1250158555e2413b454a7b3df84ee88469af20ce3d21b40ba900000007bd36b3b5cb967b91030fe3a74eca70f99cb46616eaa5b1c4b09430ac8ea887a2cf8e0c3d3fb8950f0fff7ea4ef1296791d705893443e6a528667cb11f007cadee4f5659bd464e69f66d6ee784b0cae66585fcbb01038fdd95535b8f493887045ea762ceb4ab0a1145b9bf9c4be23017e403609a4cbb49830c537422bc954dabe7103803402e8ec6c66b3eb768e53d3a4000000082260eca6a78760b69b3a94817f5d53ebb38650610d46ca1fa1af0528c873a05157545215390d0894231ef6cc9974be0e79c6ef1d9015cb732959b075f27dcc2	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{17601FC1-8CBA-11EC-B57C-DAA6A9DFF92B} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000029a8fa03d77d0143b95f148165a5bc92000000000200000000001066000000010000200000006f65768d83baffc39b9e938790b53a01b9cedc4e22dd31a884ab321306e204f5000000000e80000000020000200000006c8ec1a13955a2ee961345eb2a82a23f0b3abae6aff84368584587f8f182aece2000000071ae478201fc6a8c2fd69737328f3137b9564b2edf7098c7b6aec5408764d64640000000e0dcc499d97d4c27b89af5bc977169113deee6deb1790f6cc6d3c74797303609df4a6b6158c1500f003abf025d3530aebc3a1911a42c1ad0ce971be83388be69	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DOMStorage\adobe.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DOMStorage\adobe.com\Total = "90"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0b86b00c720d801	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.adobe.com\ = "90"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DOMStorage\adobe.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "48"	IEXPLORE.EXE

Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 4 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

msiexec.exe

pid process

1636 msiexec.exe
1636 msiexec.exe

description	flow	ioc
HTTP User-Agent header	4	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

pid	process
1636	msiexec.exe
1636	msiexec.exe

Suspicious use of AdjustPrivilegeToken 52 IoCs

Processes:

msiexec.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	964	msiexec.exe
Token: SeIncreaseQuotaPrivilege	964	msiexec.exe
Token: SeRestorePrivilege	1636	msiexec.exe
Token: SeTakeOwnershipPrivilege	1636	msiexec.exe
Token: SeSecurityPrivilege	1636	msiexec.exe
Token: SeCreateTokenPrivilege	964	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	964	msiexec.exe
Token: SeLockMemoryPrivilege	964	msiexec.exe
Token: SeIncreaseQuotaPrivilege	964	msiexec.exe
Token: SeMachineAccountPrivilege	964	msiexec.exe
Token: SeTcbPrivilege	964	msiexec.exe
Token: SeSecurityPrivilege	964	msiexec.exe
Token: SeTakeOwnershipPrivilege	964	msiexec.exe
Token: SeLoadDriverPrivilege	964	msiexec.exe
Token: SeSystemProfilePrivilege	964	msiexec.exe
Token: SeSystemtimePrivilege	964	msiexec.exe
Token: SeProfSingleProcessPrivilege	964	msiexec.exe
Token: SeIncBasePriorityPrivilege	964	msiexec.exe
Token: SeCreatePagefilePrivilege	964	msiexec.exe
Token: SeCreatePermanentPrivilege	964	msiexec.exe
Token: SeBackupPrivilege	964	msiexec.exe
Token: SeRestorePrivilege	964	msiexec.exe
Token: SeShutdownPrivilege	964	msiexec.exe
Token: SeDebugPrivilege	964	msiexec.exe
Token: SeAuditPrivilege	964	msiexec.exe
Token: SeSystemEnvironmentPrivilege	964	msiexec.exe
Token: SeChangeNotifyPrivilege	964	msiexec.exe
Token: SeRemoteShutdownPrivilege	964	msiexec.exe
Token: SeUndockPrivilege	964	msiexec.exe
Token: SeSyncAgentPrivilege	964	msiexec.exe
Token: SeEnableDelegationPrivilege	964	msiexec.exe
Token: SeManageVolumePrivilege	964	msiexec.exe
Token: SeImpersonatePrivilege	964	msiexec.exe
Token: SeCreateGlobalPrivilege	964	msiexec.exe
Token: SeRestorePrivilege	1636	msiexec.exe
Token: SeTakeOwnershipPrivilege	1636	msiexec.exe
Token: SeRestorePrivilege	1636	msiexec.exe
Token: SeTakeOwnershipPrivilege	1636	msiexec.exe
Token: SeRestorePrivilege	1636	msiexec.exe
Token: SeTakeOwnershipPrivilege	1636	msiexec.exe
Token: SeRestorePrivilege	1636	msiexec.exe
Token: SeTakeOwnershipPrivilege	1636	msiexec.exe
Token: SeRestorePrivilege	1636	msiexec.exe
Token: SeTakeOwnershipPrivilege	1636	msiexec.exe
Token: SeRestorePrivilege	1636	msiexec.exe
Token: SeTakeOwnershipPrivilege	1636	msiexec.exe
Token: SeRestorePrivilege	1636	msiexec.exe
Token: SeTakeOwnershipPrivilege	1636	msiexec.exe
Token: SeRestorePrivilege	1636	msiexec.exe
Token: SeTakeOwnershipPrivilege	1636	msiexec.exe
Token: SeRestorePrivilege	1636	msiexec.exe
Token: SeTakeOwnershipPrivilege	1636	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

msiexec.exeiexplore.exe

pid process

964 msiexec.exe
976 iexplore.exe
964 msiexec.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

976 iexplore.exe
976 iexplore.exe
1072 IEXPLORE.EXE
1072 IEXPLORE.EXE
1072 IEXPLORE.EXE
1072 IEXPLORE.EXE

pid	process
964	msiexec.exe
976	iexplore.exe
964	msiexec.exe

pid	process
976	iexplore.exe
976	iexplore.exe
1072	IEXPLORE.EXE
1072	IEXPLORE.EXE
1072	IEXPLORE.EXE
1072	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

msiexec.exeMsiExec.execmd.exeiexplore.exe

description	pid	process	target process
PID 1636 wrote to memory of 272	1636	msiexec.exe	MsiExec.exe
PID 1636 wrote to memory of 272	1636	msiexec.exe	MsiExec.exe
PID 1636 wrote to memory of 272	1636	msiexec.exe	MsiExec.exe
PID 1636 wrote to memory of 272	1636	msiexec.exe	MsiExec.exe
PID 1636 wrote to memory of 272	1636	msiexec.exe	MsiExec.exe
PID 1636 wrote to memory of 272	1636	msiexec.exe	MsiExec.exe
PID 1636 wrote to memory of 272	1636	msiexec.exe	MsiExec.exe
PID 272 wrote to memory of 1480	272	MsiExec.exe	cmd.exe
PID 272 wrote to memory of 1480	272	MsiExec.exe	cmd.exe
PID 272 wrote to memory of 1480	272	MsiExec.exe	cmd.exe
PID 272 wrote to memory of 1480	272	MsiExec.exe	cmd.exe
PID 1480 wrote to memory of 976	1480	cmd.exe	iexplore.exe
PID 1480 wrote to memory of 976	1480	cmd.exe	iexplore.exe
PID 1480 wrote to memory of 976	1480	cmd.exe	iexplore.exe
PID 1480 wrote to memory of 976	1480	cmd.exe	iexplore.exe
PID 976 wrote to memory of 1072	976	iexplore.exe	IEXPLORE.EXE
PID 976 wrote to memory of 1072	976	iexplore.exe	IEXPLORE.EXE
PID 976 wrote to memory of 1072	976	iexplore.exe	IEXPLORE.EXE
PID 976 wrote to memory of 1072	976	iexplore.exe	IEXPLORE.EXE
PID 272 wrote to memory of 1964	272	MsiExec.exe	lc2C28.tmp
PID 272 wrote to memory of 1964	272	MsiExec.exe	lc2C28.tmp
PID 272 wrote to memory of 1964	272	MsiExec.exe	lc2C28.tmp
PID 272 wrote to memory of 1964	272	MsiExec.exe	lc2C28.tmp
PID 272 wrote to memory of 1964	272	MsiExec.exe	lc2C28.tmp
PID 272 wrote to memory of 1964	272	MsiExec.exe	lc2C28.tmp
PID 272 wrote to memory of 1964	272	MsiExec.exe	lc2C28.tmp

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\8aa574ba92ef3177d786c519d9f2acc86aa7d16afd44819cb23eddd28720776c.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:964

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1636

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 2E5C427189A857B1C8DCC02922A7E90E
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:272

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C start /MAX https://adobe.ly/2RY5GJR
3⤵
- Suspicious use of WriteProcessMemory
PID:1480

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://adobe.ly/2RY5GJR
4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:976

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:976 CREDAT:275457 /prefetch:2
5⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1072

C:\Users\Admin\AppData\Local\Temp\lc2C28.tmp
"C:\Users\Admin\AppData\Local\Temp\lc2C28.tmp"
3⤵
- Executes dropped EXE
PID:1964

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
e980f8b839620ae894f8cb265c1a2a9f

SHA1
ed8875902c84604619932270c7d4867bb8f94ad9

SHA256
dba4cb8ed94427682d3456c87c55d6d7813848d0941a4cc59e83426b0af00156

SHA512
08d7cbc51085263d1edfd2bccca0cc167b3b7e3da1a94910ac5846ab1832727d16510b0f448b9ada8bdf5b6829a90bf0ceb8ee94e825c85cb8ecbe1fa8736d3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
8cfccf03e9c0f67dd88c16fa526899ac

SHA1
9b5e5fa60d51a7500acb976991a34318b84a441a

SHA256
d5f7abd17408a1555779dd270b7d7a44129f669a7238425c6f8ecd3d689e890e

SHA512
9a5458a0d8066960f65e5fee80ec7a669d529133905b5347f1ceb9fa19e1fa744e102f5e86efcf717dd0f2f97dcf55873756ddf28bc3e26b972811ef6184d1f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\o5rwqiw\imagestore.dat
MD5
c2a350a92279c42de442403e81a4bcad

SHA1
58a056b38a9c28ef5a799210ae54a83ebc745a84

SHA256
7b2ce17ee0f69c538f436a7affc2ac9bc6fc9ad742ed1e1cc58a0def4861c0a7

SHA512
d4e3d72f654ef5c32a8c6d52d3eccd447da9225c90be98f2a48cb66b477d3d9a2282fb0051b0f8619df29b60cacf415e530df9d15ea008a88c3c0244495fa87c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\o5rwqiw\imagestore.dat
MD5
82f2b3b2486832ec182057836a6fab1d

SHA1
059ae1e39aec7bdfa6a09f744079eb8f1b0a0c66

SHA256
4abda4ea55faab1d467f84d67d8bacb2b9ae778c58c691f7355c9479ac7d6410

SHA512
afa1419efed946df86e1529cbccd4164814bdc607d7efbccbb6b53d6263e42efaff8fe8e4e525c1cb26dc50d4aecd37149ecd3cd883721cd3e556f7ebabea06c

Download Submit
C:\Users\Admin\AppData\Local\Temp\lc2C28.tmp
MD5
55ffee241709ae96cf64cb0b9a96f0d7

SHA1
b191810094dd2ee6b13c0d33458fafcd459681ae

SHA256
64bc6cf6b6e9850cea2a36cabc88982b0b936dd7f0bc169a2f6dd2a5d1e86abf

SHA512
01d05a5f34be950ec660af9e1de5c7d3c0e473f7815c2e13157c0b7bf162ca5a6b34fabc3704ba6e4fb339a53b1a20862fe984e16feca81f45cf4a0f98e01c07

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\X511TN78.txt
MD5
340a6ce4e0409dafead1c1cbf79e1a6c

SHA1
a1f93fcef0a382b542c951b1dee5c8bc1f946d2f

SHA256
22fb174f7cba7f139829f16dffdf32b8375c8ae3d3f059c68f8ade498345112f

SHA512
a34040ebecd69e5e1323346d3b07acb3abac25e8fb70b25cf9e1a64511a72fa9ea84968cf5d6e816fc8a9ae92591f51c1b098969656fbc3431c2e58b1c51ee40

Download Submit
C:\Windows\Installer\MSI28D5.tmp
MD5
9f1e5d66c2889018daef4aef604eebc4

SHA1
b80294261c8a1635e16e14f55a3d76889ff2c857

SHA256
02a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222

SHA512
8f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b

Download Submit
C:\Windows\Installer\MSI29CF.tmp
MD5
9f1e5d66c2889018daef4aef604eebc4

SHA1
b80294261c8a1635e16e14f55a3d76889ff2c857

SHA256
02a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222

SHA512
8f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b

Download Submit
C:\Windows\Installer\MSI2B47.tmp
MD5
9f1e5d66c2889018daef4aef604eebc4

SHA1
b80294261c8a1635e16e14f55a3d76889ff2c857

SHA256
02a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222

SHA512
8f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b

Download Submit
C:\Windows\Installer\MSI34F8.tmp
MD5
9f1e5d66c2889018daef4aef604eebc4

SHA1
b80294261c8a1635e16e14f55a3d76889ff2c857

SHA256
02a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222

SHA512
8f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b

Download Submit
\Users\Admin\AppData\Local\Temp\lc2C28.tmp
MD5
55ffee241709ae96cf64cb0b9a96f0d7

SHA1
b191810094dd2ee6b13c0d33458fafcd459681ae

SHA256
64bc6cf6b6e9850cea2a36cabc88982b0b936dd7f0bc169a2f6dd2a5d1e86abf

SHA512
01d05a5f34be950ec660af9e1de5c7d3c0e473f7815c2e13157c0b7bf162ca5a6b34fabc3704ba6e4fb339a53b1a20862fe984e16feca81f45cf4a0f98e01c07

Download Submit
\Windows\Installer\MSI28D5.tmp
MD5
9f1e5d66c2889018daef4aef604eebc4

SHA1
b80294261c8a1635e16e14f55a3d76889ff2c857

SHA256
02a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222

SHA512
8f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b

Download Submit
\Windows\Installer\MSI29CF.tmp
MD5
9f1e5d66c2889018daef4aef604eebc4

SHA1
b80294261c8a1635e16e14f55a3d76889ff2c857

SHA256
02a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222

SHA512
8f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b

Download Submit
\Windows\Installer\MSI2B47.tmp
MD5
9f1e5d66c2889018daef4aef604eebc4

SHA1
b80294261c8a1635e16e14f55a3d76889ff2c857

SHA256
02a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222

SHA512
8f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b

Download Submit
\Windows\Installer\MSI34F8.tmp
MD5
9f1e5d66c2889018daef4aef604eebc4

SHA1
b80294261c8a1635e16e14f55a3d76889ff2c857

SHA256
02a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222

SHA512
8f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b

Download Submit
memory/272-56-0x0000000075341000-0x0000000075343000-memory.dmp

Filesize
8KB

Download
memory/964-54-0x000007FEFBAD1000-0x000007FEFBAD3000-memory.dmp

Filesize
8KB

Download