Analysis
-
max time kernel
161s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
13/02/2022, 10:45
Static task
static1
Behavioral task
behavioral1
Sample
42c82a811f4eb41e1a6c613c9b017b7e8abf062c3694cb77e671464954facf3b.msi
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
42c82a811f4eb41e1a6c613c9b017b7e8abf062c3694cb77e671464954facf3b.msi
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
42c82a811f4eb41e1a6c613c9b017b7e8abf062c3694cb77e671464954facf3b.msi
-
Size
639KB
-
MD5
4ab860c4a0b02410cd0f5adf80153c3e
-
SHA1
3983610f2687885b350d259b936a19a3f2c45f6b
-
SHA256
42c82a811f4eb41e1a6c613c9b017b7e8abf062c3694cb77e671464954facf3b
-
SHA512
5c982d65f306efc3a37ea97f7e4dc99d95c1f32b19c20e1872df31349ac25f65bd5a6422aa561ababa745d320f8545c94b20a5e85c1d10638f303414eba713c0
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 53 3972 MsiExec.exe 56 3972 MsiExec.exe -
Executes dropped EXE 1 IoCs
pid Process 920 lc98AA.tmp -
Loads dropped DLL 5 IoCs
pid Process 3972 MsiExec.exe 3972 MsiExec.exe 3972 MsiExec.exe 3972 MsiExec.exe 3972 MsiExec.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe -
Drops file in Windows directory 15 IoCs
description ioc Process File created C:\Windows\Installer\1ce7690.msi msiexec.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\Installer\MSI9232.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9570.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI7D37.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{3E4D8B80-E20E-4E3E-B099-7D88E1340C8A} msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI937B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA81F.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIC368.tmp msiexec.exe File opened for modification C:\Windows\Installer\1ce7690.msi msiexec.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies data under HKEY_USERS 55 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.013123" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "90228624" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "4.999930" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.000000" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132893991719585708" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "1157726" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4056" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "4" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "10.227082" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4096" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4304" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 53 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 672 msiexec.exe 672 msiexec.exe 2320 msedge.exe 2320 msedge.exe 2416 msedge.exe 2416 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 2416 msedge.exe 2416 msedge.exe 2416 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3424 msiexec.exe Token: SeIncreaseQuotaPrivilege 3424 msiexec.exe Token: SeSecurityPrivilege 672 msiexec.exe Token: SeCreateTokenPrivilege 3424 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3424 msiexec.exe Token: SeLockMemoryPrivilege 3424 msiexec.exe Token: SeIncreaseQuotaPrivilege 3424 msiexec.exe Token: SeMachineAccountPrivilege 3424 msiexec.exe Token: SeTcbPrivilege 3424 msiexec.exe Token: SeSecurityPrivilege 3424 msiexec.exe Token: SeTakeOwnershipPrivilege 3424 msiexec.exe Token: SeLoadDriverPrivilege 3424 msiexec.exe Token: SeSystemProfilePrivilege 3424 msiexec.exe Token: SeSystemtimePrivilege 3424 msiexec.exe Token: SeProfSingleProcessPrivilege 3424 msiexec.exe Token: SeIncBasePriorityPrivilege 3424 msiexec.exe Token: SeCreatePagefilePrivilege 3424 msiexec.exe Token: SeCreatePermanentPrivilege 3424 msiexec.exe Token: SeBackupPrivilege 3424 msiexec.exe Token: SeRestorePrivilege 3424 msiexec.exe Token: SeShutdownPrivilege 3424 msiexec.exe Token: SeDebugPrivilege 3424 msiexec.exe Token: SeAuditPrivilege 3424 msiexec.exe Token: SeSystemEnvironmentPrivilege 3424 msiexec.exe Token: SeChangeNotifyPrivilege 3424 msiexec.exe Token: SeRemoteShutdownPrivilege 3424 msiexec.exe Token: SeUndockPrivilege 3424 msiexec.exe Token: SeSyncAgentPrivilege 3424 msiexec.exe Token: SeEnableDelegationPrivilege 3424 msiexec.exe Token: SeManageVolumePrivilege 3424 msiexec.exe Token: SeImpersonatePrivilege 3424 msiexec.exe Token: SeCreateGlobalPrivilege 3424 msiexec.exe Token: SeRestorePrivilege 672 msiexec.exe Token: SeTakeOwnershipPrivilege 672 msiexec.exe Token: SeRestorePrivilege 672 msiexec.exe Token: SeTakeOwnershipPrivilege 672 msiexec.exe Token: SeSecurityPrivilege 772 TiWorker.exe Token: SeRestorePrivilege 772 TiWorker.exe Token: SeBackupPrivilege 772 TiWorker.exe Token: SeBackupPrivilege 772 TiWorker.exe Token: SeRestorePrivilege 772 TiWorker.exe Token: SeSecurityPrivilege 772 TiWorker.exe Token: SeBackupPrivilege 772 TiWorker.exe Token: SeRestorePrivilege 772 TiWorker.exe Token: SeSecurityPrivilege 772 TiWorker.exe Token: SeBackupPrivilege 772 TiWorker.exe Token: SeRestorePrivilege 772 TiWorker.exe Token: SeSecurityPrivilege 772 TiWorker.exe Token: SeBackupPrivilege 772 TiWorker.exe Token: SeRestorePrivilege 772 TiWorker.exe Token: SeSecurityPrivilege 772 TiWorker.exe Token: SeBackupPrivilege 772 TiWorker.exe Token: SeRestorePrivilege 772 TiWorker.exe Token: SeSecurityPrivilege 772 TiWorker.exe Token: SeBackupPrivilege 772 TiWorker.exe Token: SeRestorePrivilege 772 TiWorker.exe Token: SeSecurityPrivilege 772 TiWorker.exe Token: SeBackupPrivilege 772 TiWorker.exe Token: SeRestorePrivilege 772 TiWorker.exe Token: SeSecurityPrivilege 772 TiWorker.exe Token: SeBackupPrivilege 772 TiWorker.exe Token: SeRestorePrivilege 772 TiWorker.exe Token: SeSecurityPrivilege 772 TiWorker.exe Token: SeBackupPrivilege 772 TiWorker.exe -
Suspicious use of FindShellTrayWindow 20 IoCs
pid Process 3424 msiexec.exe 3424 msiexec.exe 2416 msedge.exe 2416 msedge.exe 2416 msedge.exe 2416 msedge.exe 2416 msedge.exe 2416 msedge.exe 2416 msedge.exe 2416 msedge.exe 2416 msedge.exe 2416 msedge.exe 2416 msedge.exe 2416 msedge.exe 2416 msedge.exe 2416 msedge.exe 2416 msedge.exe 2416 msedge.exe 2416 msedge.exe 2416 msedge.exe -
Suspicious use of SendNotifyMessage 16 IoCs
pid Process 2416 msedge.exe 2416 msedge.exe 2416 msedge.exe 2416 msedge.exe 2416 msedge.exe 2416 msedge.exe 2416 msedge.exe 2416 msedge.exe 2416 msedge.exe 2416 msedge.exe 2416 msedge.exe 2416 msedge.exe 2416 msedge.exe 2416 msedge.exe 2416 msedge.exe 2416 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 672 wrote to memory of 3972 672 msiexec.exe 63 PID 672 wrote to memory of 3972 672 msiexec.exe 63 PID 672 wrote to memory of 3972 672 msiexec.exe 63 PID 3972 wrote to memory of 2220 3972 MsiExec.exe 80 PID 3972 wrote to memory of 2220 3972 MsiExec.exe 80 PID 3972 wrote to memory of 2220 3972 MsiExec.exe 80 PID 2220 wrote to memory of 2416 2220 cmd.exe 82 PID 2220 wrote to memory of 2416 2220 cmd.exe 82 PID 3972 wrote to memory of 920 3972 MsiExec.exe 83 PID 3972 wrote to memory of 920 3972 MsiExec.exe 83 PID 3972 wrote to memory of 920 3972 MsiExec.exe 83 PID 2416 wrote to memory of 644 2416 msedge.exe 84 PID 2416 wrote to memory of 644 2416 msedge.exe 84 PID 2416 wrote to memory of 3680 2416 msedge.exe 85 PID 2416 wrote to memory of 3680 2416 msedge.exe 85 PID 2416 wrote to memory of 3680 2416 msedge.exe 85 PID 2416 wrote to memory of 3680 2416 msedge.exe 85 PID 2416 wrote to memory of 3680 2416 msedge.exe 85 PID 2416 wrote to memory of 3680 2416 msedge.exe 85 PID 2416 wrote to memory of 3680 2416 msedge.exe 85 PID 2416 wrote to memory of 3680 2416 msedge.exe 85 PID 2416 wrote to memory of 3680 2416 msedge.exe 85 PID 2416 wrote to memory of 3680 2416 msedge.exe 85 PID 2416 wrote to memory of 3680 2416 msedge.exe 85 PID 2416 wrote to memory of 3680 2416 msedge.exe 85 PID 2416 wrote to memory of 3680 2416 msedge.exe 85 PID 2416 wrote to memory of 3680 2416 msedge.exe 85 PID 2416 wrote to memory of 3680 2416 msedge.exe 85 PID 2416 wrote to memory of 3680 2416 msedge.exe 85 PID 2416 wrote to memory of 3680 2416 msedge.exe 85 PID 2416 wrote to memory of 3680 2416 msedge.exe 85 PID 2416 wrote to memory of 3680 2416 msedge.exe 85 PID 2416 wrote to memory of 3680 2416 msedge.exe 85 PID 2416 wrote to memory of 3680 2416 msedge.exe 85 PID 2416 wrote to memory of 3680 2416 msedge.exe 85 PID 2416 wrote to memory of 3680 2416 msedge.exe 85 PID 2416 wrote to memory of 3680 2416 msedge.exe 85 PID 2416 wrote to memory of 3680 2416 msedge.exe 85 PID 2416 wrote to memory of 3680 2416 msedge.exe 85 PID 2416 wrote to memory of 3680 2416 msedge.exe 85 PID 2416 wrote to memory of 3680 2416 msedge.exe 85 PID 2416 wrote to memory of 3680 2416 msedge.exe 85 PID 2416 wrote to memory of 3680 2416 msedge.exe 85 PID 2416 wrote to memory of 3680 2416 msedge.exe 85 PID 2416 wrote to memory of 3680 2416 msedge.exe 85 PID 2416 wrote to memory of 3680 2416 msedge.exe 85 PID 2416 wrote to memory of 3680 2416 msedge.exe 85 PID 2416 wrote to memory of 3680 2416 msedge.exe 85 PID 2416 wrote to memory of 3680 2416 msedge.exe 85 PID 2416 wrote to memory of 3680 2416 msedge.exe 85 PID 2416 wrote to memory of 3680 2416 msedge.exe 85 PID 2416 wrote to memory of 3680 2416 msedge.exe 85 PID 2416 wrote to memory of 3680 2416 msedge.exe 85 PID 2416 wrote to memory of 2320 2416 msedge.exe 86 PID 2416 wrote to memory of 2320 2416 msedge.exe 86 PID 2416 wrote to memory of 3392 2416 msedge.exe 87 PID 2416 wrote to memory of 3392 2416 msedge.exe 87 PID 2416 wrote to memory of 3392 2416 msedge.exe 87 PID 2416 wrote to memory of 3392 2416 msedge.exe 87 PID 2416 wrote to memory of 3392 2416 msedge.exe 87 PID 2416 wrote to memory of 3392 2416 msedge.exe 87 PID 2416 wrote to memory of 3392 2416 msedge.exe 87 PID 2416 wrote to memory of 3392 2416 msedge.exe 87 PID 2416 wrote to memory of 3392 2416 msedge.exe 87
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\42c82a811f4eb41e1a6c613c9b017b7e8abf062c3694cb77e671464954facf3b.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3424
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
PID:2280
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:672 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1BBF251AE53A85E843445533C9EA676A2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C start /MAX https://adobe.ly/2RY5GJR3⤵
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://adobe.ly/2RY5GJR4⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe65ae46f8,0x7ffe65ae4708,0x7ffe65ae47185⤵PID:644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,12291705424316491589,18408188821323590599,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:25⤵PID:3680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,12291705424316491589,18408188821323590599,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:35⤵
- Suspicious behavior: EnumeratesProcesses
PID:2320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,12291705424316491589,18408188821323590599,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:85⤵PID:3392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,12291705424316491589,18408188821323590599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3956 /prefetch:15⤵PID:2708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,12291705424316491589,18408188821323590599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3960 /prefetch:15⤵PID:2108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2180,12291705424316491589,18408188821323590599,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5448 /prefetch:85⤵PID:2276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,12291705424316491589,18408188821323590599,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:15⤵PID:2892
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\lc98AA.tmp"C:\Users\Admin\AppData\Local\Temp\lc98AA.tmp"3⤵
- Executes dropped EXE
PID:920
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1360
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:772
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3112