0113d8a67b61dd6163b003c806d997f1f26da9df316744571aa1295c7ffb9995

Analysis

max time kernel
154s
max time network
164s
platform
windows7_x64
resource
win7-en-20211208
submitted
13-02-2022 10:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0113d8a67b61dd6163b003c806d997f1f26da9df316744571aa1295c7ffb9995.msi
Size

639KB
MD5

2e299b1fcf357f678bbf00a06ead424f
SHA1

58f5f158f679b5a031dfc0e1323fd7a4dc24c3f4
SHA256

0113d8a67b61dd6163b003c806d997f1f26da9df316744571aa1295c7ffb9995
SHA512

37cb0f8d929b793b5bf20f291de10b863cc63b59d2a990c07b4df4f1c64149ee335bf4961f7ac50390b614516f862fb7b3a38d7162ed4f91ba6e56685b4a1400

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 4 IoCs

Processes:

MsiExec.exe

flow pid process

5 1624 MsiExec.exe
8 1624 MsiExec.exe
11 1624 MsiExec.exe
18 1624 MsiExec.exe
Executes dropped EXE 1 IoCs

Processes:

lc1437.tmp

pid process

1040 lc1437.tmp
Loads dropped DLL 6 IoCs

Processes:

MsiExec.exe

pid process

1624 MsiExec.exe
1624 MsiExec.exe
1624 MsiExec.exe
1624 MsiExec.exe
1624 MsiExec.exe
1624 MsiExec.exe

flow	pid	process
5	1624	MsiExec.exe
8	1624	MsiExec.exe
11	1624	MsiExec.exe
18	1624	MsiExec.exe

pid	process
1040	lc1437.tmp

pid	process
1624	MsiExec.exe
1624	MsiExec.exe
1624	MsiExec.exe
1624	MsiExec.exe
1624	MsiExec.exe
1624	MsiExec.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Drops file in Windows directory 11 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\f75edc8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1305.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI13C2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI15D6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f75edca.ipi	msiexec.exe
File created	C:\Windows\Installer\f75edc8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEEB2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1354.tmp	msiexec.exe
File created	C:\Windows\Installer\f75edca.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2FAD.tmp	msiexec.exe

Modifies Internet Explorer settings 1 TTPs 50 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.adobe.com\ = "90"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "48"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000029a8fa03d77d0143b95f148165a5bc92000000000200000000001066000000010000200000001987a584e0e22f61346459437ff9e89e29630284e9a9f89192acb83a3dc99abb000000000e80000000020000200000008728ad40c1e1147a49d0485777acd73915486ef1536ad6327afdba78b1735e6d20000000f1d1d8ca620bc24352b85b55af0b7a4b5044d29b3c4b650db9480a36d9adc0264000000057774e5f3e7dd824973d9b9175e256cd9d05242660331556b7601d61cc4f4838a5e42e83fdf70eebf1bae3f0941c2aece36c7751548963088f63ae477916193c	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 002d8c2ac720d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4DD35D11-8CBA-11EC-B4D6-D28B0161D193} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DOMStorage\adobe.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DOMStorage\adobe.com\Total = "48"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "70"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DOMStorage\adobe.com\Total = "70"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DOMStorage\adobe.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.adobe.com\ = "70"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.adobe.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.adobe.com\ = "48"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DOMStorage\adobe.com\Total = "90"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000029a8fa03d77d0143b95f148165a5bc9200000000020000000000106600000001000020000000f33e5f8c59548ba47cdf959d0ab87f1f0e4db5b30c140fcfe8fedd7297243d0f000000000e8000000002000020000000671ee7fc711c985e5576f0c45257ff7ded15431a1a8737be58486c516a55bd6990000000b4e4cea58a20ab4e7a395aafbeb5b33f64f90b7a6e9dab705ed8d836cbb0b399e252fed1c4a19685f00fb1a3e75c426a1d5917cb30da6f8ec611e2a360687d047da774d67632d62a834eb1e6ab8e03b0edbb62309f665e370dca2adf647ccde86e552f9e6fd51b7b9979b0779caa10bf501dfb9e01390150aab8a9ac0f75f9125db7f1b49c7fbd399cb4413453bcf4d74000000033f07463614d8ea8050834f2ddc7dc36797eae6581d36ccd9d13819c2b87c9ede5d09614897c613c13c20adeee9de63533348cfc0e5eec5aa57969d908aa2c57	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "90"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "351514210"	iexplore.exe

Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 5 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

msiexec.exe

pid process

588 msiexec.exe
588 msiexec.exe

description	flow	ioc
HTTP User-Agent header	5	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

pid	process
588	msiexec.exe
588	msiexec.exe

Suspicious use of AdjustPrivilegeToken 54 IoCs

Processes:

msiexec.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	1576	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1576	msiexec.exe
Token: SeRestorePrivilege	588	msiexec.exe
Token: SeTakeOwnershipPrivilege	588	msiexec.exe
Token: SeSecurityPrivilege	588	msiexec.exe
Token: SeCreateTokenPrivilege	1576	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1576	msiexec.exe
Token: SeLockMemoryPrivilege	1576	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1576	msiexec.exe
Token: SeMachineAccountPrivilege	1576	msiexec.exe
Token: SeTcbPrivilege	1576	msiexec.exe
Token: SeSecurityPrivilege	1576	msiexec.exe
Token: SeTakeOwnershipPrivilege	1576	msiexec.exe
Token: SeLoadDriverPrivilege	1576	msiexec.exe
Token: SeSystemProfilePrivilege	1576	msiexec.exe
Token: SeSystemtimePrivilege	1576	msiexec.exe
Token: SeProfSingleProcessPrivilege	1576	msiexec.exe
Token: SeIncBasePriorityPrivilege	1576	msiexec.exe
Token: SeCreatePagefilePrivilege	1576	msiexec.exe
Token: SeCreatePermanentPrivilege	1576	msiexec.exe
Token: SeBackupPrivilege	1576	msiexec.exe
Token: SeRestorePrivilege	1576	msiexec.exe
Token: SeShutdownPrivilege	1576	msiexec.exe
Token: SeDebugPrivilege	1576	msiexec.exe
Token: SeAuditPrivilege	1576	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1576	msiexec.exe
Token: SeChangeNotifyPrivilege	1576	msiexec.exe
Token: SeRemoteShutdownPrivilege	1576	msiexec.exe
Token: SeUndockPrivilege	1576	msiexec.exe
Token: SeSyncAgentPrivilege	1576	msiexec.exe
Token: SeEnableDelegationPrivilege	1576	msiexec.exe
Token: SeManageVolumePrivilege	1576	msiexec.exe
Token: SeImpersonatePrivilege	1576	msiexec.exe
Token: SeCreateGlobalPrivilege	1576	msiexec.exe
Token: SeRestorePrivilege	588	msiexec.exe
Token: SeTakeOwnershipPrivilege	588	msiexec.exe
Token: SeRestorePrivilege	588	msiexec.exe
Token: SeTakeOwnershipPrivilege	588	msiexec.exe
Token: SeRestorePrivilege	588	msiexec.exe
Token: SeTakeOwnershipPrivilege	588	msiexec.exe
Token: SeRestorePrivilege	588	msiexec.exe
Token: SeTakeOwnershipPrivilege	588	msiexec.exe
Token: SeRestorePrivilege	588	msiexec.exe
Token: SeTakeOwnershipPrivilege	588	msiexec.exe
Token: SeRestorePrivilege	588	msiexec.exe
Token: SeTakeOwnershipPrivilege	588	msiexec.exe
Token: SeRestorePrivilege	588	msiexec.exe
Token: SeTakeOwnershipPrivilege	588	msiexec.exe
Token: SeRestorePrivilege	588	msiexec.exe
Token: SeTakeOwnershipPrivilege	588	msiexec.exe
Token: SeRestorePrivilege	588	msiexec.exe
Token: SeTakeOwnershipPrivilege	588	msiexec.exe
Token: SeRestorePrivilege	588	msiexec.exe
Token: SeTakeOwnershipPrivilege	588	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

msiexec.exeiexplore.exe

pid process

1576 msiexec.exe
1620 iexplore.exe
1576 msiexec.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1620 iexplore.exe
1620 iexplore.exe
1588 IEXPLORE.EXE
1588 IEXPLORE.EXE
1588 IEXPLORE.EXE
1588 IEXPLORE.EXE

pid	process
1576	msiexec.exe
1620	iexplore.exe
1576	msiexec.exe

pid	process
1620	iexplore.exe
1620	iexplore.exe
1588	IEXPLORE.EXE
1588	IEXPLORE.EXE
1588	IEXPLORE.EXE
1588	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

msiexec.exeMsiExec.execmd.exeiexplore.exe

description	pid	process	target process
PID 588 wrote to memory of 1624	588	msiexec.exe	MsiExec.exe
PID 588 wrote to memory of 1624	588	msiexec.exe	MsiExec.exe
PID 588 wrote to memory of 1624	588	msiexec.exe	MsiExec.exe
PID 588 wrote to memory of 1624	588	msiexec.exe	MsiExec.exe
PID 588 wrote to memory of 1624	588	msiexec.exe	MsiExec.exe
PID 588 wrote to memory of 1624	588	msiexec.exe	MsiExec.exe
PID 588 wrote to memory of 1624	588	msiexec.exe	MsiExec.exe
PID 1624 wrote to memory of 604	1624	MsiExec.exe	cmd.exe
PID 1624 wrote to memory of 604	1624	MsiExec.exe	cmd.exe
PID 1624 wrote to memory of 604	1624	MsiExec.exe	cmd.exe
PID 1624 wrote to memory of 604	1624	MsiExec.exe	cmd.exe
PID 604 wrote to memory of 1620	604	cmd.exe	iexplore.exe
PID 604 wrote to memory of 1620	604	cmd.exe	iexplore.exe
PID 604 wrote to memory of 1620	604	cmd.exe	iexplore.exe
PID 604 wrote to memory of 1620	604	cmd.exe	iexplore.exe
PID 1620 wrote to memory of 1588	1620	iexplore.exe	IEXPLORE.EXE
PID 1620 wrote to memory of 1588	1620	iexplore.exe	IEXPLORE.EXE
PID 1620 wrote to memory of 1588	1620	iexplore.exe	IEXPLORE.EXE
PID 1620 wrote to memory of 1588	1620	iexplore.exe	IEXPLORE.EXE
PID 1624 wrote to memory of 1040	1624	MsiExec.exe	lc1437.tmp
PID 1624 wrote to memory of 1040	1624	MsiExec.exe	lc1437.tmp
PID 1624 wrote to memory of 1040	1624	MsiExec.exe	lc1437.tmp
PID 1624 wrote to memory of 1040	1624	MsiExec.exe	lc1437.tmp
PID 1624 wrote to memory of 1040	1624	MsiExec.exe	lc1437.tmp
PID 1624 wrote to memory of 1040	1624	MsiExec.exe	lc1437.tmp
PID 1624 wrote to memory of 1040	1624	MsiExec.exe	lc1437.tmp

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\0113d8a67b61dd6163b003c806d997f1f26da9df316744571aa1295c7ffb9995.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1576

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:588

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 3156C0DEFCDB5E5FCEA4A1810303A429
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1624

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C start /MAX https://adobe.ly/2RY5GJR
3⤵
- Suspicious use of WriteProcessMemory
PID:604

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://adobe.ly/2RY5GJR
4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1620

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1620 CREDAT:275457 /prefetch:2
5⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1588

C:\Users\Admin\AppData\Local\Temp\lc1437.tmp
"C:\Users\Admin\AppData\Local\Temp\lc1437.tmp"
3⤵
- Executes dropped EXE
PID:1040

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
75f68662f23f67b556cf98831427e87f

SHA1
180a69b2768e5312bbcdbf17d173d004db3af969

SHA256
186aa0a7330fe806ae0d49486d820940d112da3567aeaf606fb3a8656b560779

SHA512
59e2746352eaf3ab1fd6d54b6d6b61e4d8a7982d0fcb3899e39ea3067b7122d6de4180d50394d99086e0727f2d41c67dbd9a958b718e1637fcb2632a0a0c1b85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
e23a238e8f27b2b2bf902ca1d5ed8a6c

SHA1
c51ef5a9a72a41f40a6d2546c53532239e71957e

SHA256
9785e4464dae9437be62ff2356108b4cb53d795bb2a31ae09154a7bebff27adf

SHA512
1320624dc6c0576051476311659e6372e0daa7830d2d676ceadb85e1e4b5d25ee613f5fdf09bc21d1980054682e3f2207ca403f1159621b5b51764ad37c3cc0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\o5rwqiw\imagestore.dat
MD5
5f2482f440fc241c9948297ec59b10cd

SHA1
5d36fec186ed54dc355ec5ed17022f4ef9b69b3d

SHA256
78f04169f25ae8c9775349fd7e1b77649116e00ec81a3b201ab32b74824f61d4

SHA512
1ba8e81dbc65ac7c19cb872851c9327feb75838c6f0b9f95317d2ea8977b7732dab6f38350858a3534dddb53a26f3488d9df6f3a58d9dc74ec737780f6d86d27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\o5rwqiw\imagestore.dat
MD5
65d3dc6a7d397fdd62dd1b395cd2f903

SHA1
655796ad595eb8e5fa2b404d71dbbd53c5099425

SHA256
8c7e3221aa2dd091f8718e7fad8d5265a155376d36593eb982d5dbb061deeda8

SHA512
409b953f83c4314e8222ebefda200fc1f09cc7e1c91828829703471d4c711343337aa432a1425e4888c00d9b121593400d2d8dab89ab8f75d756b55224d3e318

Download Submit
C:\Users\Admin\AppData\Local\Temp\lc1437.tmp
MD5
55ffee241709ae96cf64cb0b9a96f0d7

SHA1
b191810094dd2ee6b13c0d33458fafcd459681ae

SHA256
64bc6cf6b6e9850cea2a36cabc88982b0b936dd7f0bc169a2f6dd2a5d1e86abf

SHA512
01d05a5f34be950ec660af9e1de5c7d3c0e473f7815c2e13157c0b7bf162ca5a6b34fabc3704ba6e4fb339a53b1a20862fe984e16feca81f45cf4a0f98e01c07

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\FS5ODZAY.txt
MD5
b9f9bc0818c00bad4aeb8b68fec58021

SHA1
70eded0c83d7bc1b4b1c4b8851471e8b74dc96d7

SHA256
80555ec57a9bb861e634bcc36255de5834338a70a799f2db0411980fcb2bbfb3

SHA512
7f49cea632f1ffc39ba318f3913306e8449df5f3dd19e4cae4ce63868def52fda43f1f4d3d4e54ae83b0e07be55d7d567a16936a9548074a8519cf73a545e628

Download Submit
C:\Windows\Installer\MSI1305.tmp
MD5
9f1e5d66c2889018daef4aef604eebc4

SHA1
b80294261c8a1635e16e14f55a3d76889ff2c857

SHA256
02a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222

SHA512
8f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b

Download Submit
C:\Windows\Installer\MSI1354.tmp
MD5
9f1e5d66c2889018daef4aef604eebc4

SHA1
b80294261c8a1635e16e14f55a3d76889ff2c857

SHA256
02a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222

SHA512
8f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b

Download Submit
C:\Windows\Installer\MSI13C2.tmp
MD5
9f1e5d66c2889018daef4aef604eebc4

SHA1
b80294261c8a1635e16e14f55a3d76889ff2c857

SHA256
02a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222

SHA512
8f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b

Download Submit
C:\Windows\Installer\MSI15D6.tmp
MD5
9f1e5d66c2889018daef4aef604eebc4

SHA1
b80294261c8a1635e16e14f55a3d76889ff2c857

SHA256
02a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222

SHA512
8f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b

Download Submit
C:\Windows\Installer\MSIEEB2.tmp
MD5
318dea4099b577bc51ae5e21eb8c566d

SHA1
e3a4d3245bc40ca956c3a5081dcfd74e98fb1510

SHA256
f335e99ea0a95b99e32d6b60c67621db8e5d096e9d77a0c8f2defcde8f32f54f

SHA512
65d4886bc19c9b9f36d68c07b83f687cdb75f95cde5f5ef02289502518c58f77c99ef2548d25f69bff6f0bfefe7fc7bb18fd010c4341c15114675f80f3d85844

Download Submit
\Users\Admin\AppData\Local\Temp\lc1437.tmp
MD5
55ffee241709ae96cf64cb0b9a96f0d7

SHA1
b191810094dd2ee6b13c0d33458fafcd459681ae

SHA256
64bc6cf6b6e9850cea2a36cabc88982b0b936dd7f0bc169a2f6dd2a5d1e86abf

SHA512
01d05a5f34be950ec660af9e1de5c7d3c0e473f7815c2e13157c0b7bf162ca5a6b34fabc3704ba6e4fb339a53b1a20862fe984e16feca81f45cf4a0f98e01c07

Download Submit
\Windows\Installer\MSI1305.tmp
MD5
9f1e5d66c2889018daef4aef604eebc4

SHA1
b80294261c8a1635e16e14f55a3d76889ff2c857

SHA256
02a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222

SHA512
8f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b

Download Submit
\Windows\Installer\MSI1354.tmp
MD5
9f1e5d66c2889018daef4aef604eebc4

SHA1
b80294261c8a1635e16e14f55a3d76889ff2c857

SHA256
02a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222

SHA512
8f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b

Download Submit
\Windows\Installer\MSI13C2.tmp
MD5
9f1e5d66c2889018daef4aef604eebc4

SHA1
b80294261c8a1635e16e14f55a3d76889ff2c857

SHA256
02a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222

SHA512
8f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b

Download Submit
\Windows\Installer\MSI15D6.tmp
MD5
9f1e5d66c2889018daef4aef604eebc4

SHA1
b80294261c8a1635e16e14f55a3d76889ff2c857

SHA256
02a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222

SHA512
8f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b

Download Submit
\Windows\Installer\MSIEEB2.tmp
MD5
318dea4099b577bc51ae5e21eb8c566d

SHA1
e3a4d3245bc40ca956c3a5081dcfd74e98fb1510

SHA256
f335e99ea0a95b99e32d6b60c67621db8e5d096e9d77a0c8f2defcde8f32f54f

SHA512
65d4886bc19c9b9f36d68c07b83f687cdb75f95cde5f5ef02289502518c58f77c99ef2548d25f69bff6f0bfefe7fc7bb18fd010c4341c15114675f80f3d85844

Download Submit
memory/1576-54-0x000007FEFB571000-0x000007FEFB573000-memory.dmp

Filesize
8KB

Download
memory/1624-56-0x00000000754B1000-0x00000000754B3000-memory.dmp

Filesize
8KB

Download