lampion | f085588cf016993e6298640bf797c1d31b61a8087a3240d517a53a5a58474987

Analysis

max time kernel
55s
max time network
125s
platform
windows7_x64
resource
win7-en-20211208
submitted
13-02-2022 11:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f085588cf016993e6298640bf797c1d31b61a8087a3240d517a53a5a58474987.msi
Size

951KB
MD5

e2c5416931f1c9369fb55e7adcf6364b
SHA1

57c960dc13b433a3fe3225b884fcbccc01c00c36
SHA256

f085588cf016993e6298640bf797c1d31b61a8087a3240d517a53a5a58474987
SHA512

96e666f61ad0e1e1c9146b31ea94622004e9dcdd082372e5ae7dada1c3aa28538d506c870502be8b381170a2d60ea470e196141de0affab232d8a106fa4ca51e

Score

10^/10

lampion banker trojan

Malware Config

Signatures

Lampion
Lampion is a banking trojan, targeting Portuguese speaking countries.
trojan banker lampion
Blocklisted process makes network request 2 IoCs

Processes:

WScript.exe

flow pid process

5 1508 WScript.exe
7 1508 WScript.exe
Executes dropped EXE 1 IoCs

Processes:

MSI655E.tmp

pid process

1264 MSI655E.tmp
Drops startup file 1 IoCs

Processes:

wscript.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zjgrquagjip.lnk wscript.exe
Loads dropped DLL 3 IoCs

Processes:

MsiExec.exe

pid process

1472 MsiExec.exe
1472 MsiExec.exe
1472 MsiExec.exe

flow	pid	process
5	1508	WScript.exe
7	1508	WScript.exe

pid	process
1264	MSI655E.tmp

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zjgrquagjip.lnk	wscript.exe

pid	process
1472	MsiExec.exe
1472	MsiExec.exe
1472	MsiExec.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Drops file in Program Files directory 1 IoCs

Processes:

msiexec.exe

description ioc process

File created C:\Program Files (x86)\Firefox_2020-3547\Firefox_2020-3547\658615508460043140_16.vbs msiexec.exe

description	ioc	process
File created	C:\Program Files (x86)\Firefox_2020-3547\Firefox_2020-3547\658615508460043140_16.vbs	msiexec.exe

Drops file in Windows directory 14 IoCs

Processes:

msiexec.exeDrvInst.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSI5A12.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5E95.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6432.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\Installer\f765947.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5F22.tmp	msiexec.exe
File created	C:\Windows\Installer\f765949.ipi	msiexec.exe
File created	C:\Windows\Installer\f76594b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f765949.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\f765947.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI655E.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 46 IoCs

Processes:

DrvInst.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe

Modifies registry class 23 IoCs

Processes:

msiexec.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EDB541E5CD9D3A43A1F8533C0554EA2\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EDB541E5CD9D3A43A1F8533C0554EA2\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EDB541E5CD9D3A43A1F8533C0554EA2\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EDB541E5CD9D3A43A1F8533C0554EA2\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EDB541E5CD9D3A43A1F8533C0554EA2\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EDB541E5CD9D3A43A1F8533C0554EA2\ProductName = "Firefox_2020-3547"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EDB541E5CD9D3A43A1F8533C0554EA2\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EDB541E5CD9D3A43A1F8533C0554EA2\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0EDB541E5CD9D3A43A1F8533C0554EA2\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EDB541E5CD9D3A43A1F8533C0554EA2	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EDB541E5CD9D3A43A1F8533C0554EA2\Version = "16777216"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EDB541E5CD9D3A43A1F8533C0554EA2\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\37358B2CE7DD8A04A99FF6AEEDC0C75C\0EDB541E5CD9D3A43A1F8533C0554EA2	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EDB541E5CD9D3A43A1F8533C0554EA2\SourceList\PackageName = "f085588cf016993e6298640bf797c1d31b61a8087a3240d517a53a5a58474987.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EDB541E5CD9D3A43A1F8533C0554EA2\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EDB541E5CD9D3A43A1F8533C0554EA2\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0EDB541E5CD9D3A43A1F8533C0554EA2	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EDB541E5CD9D3A43A1F8533C0554EA2\PackageCode = "4583136C67326D54F8B3AA1D53E6048F"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EDB541E5CD9D3A43A1F8533C0554EA2\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EDB541E5CD9D3A43A1F8533C0554EA2\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\37358B2CE7DD8A04A99FF6AEEDC0C75C	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EDB541E5CD9D3A43A1F8533C0554EA2\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EDB541E5CD9D3A43A1F8533C0554EA2\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msiexec.exeMSI655E.tmp

pid	process
576	msiexec.exe
576	msiexec.exe
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp
1264	MSI655E.tmp

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exeDrvInst.exe

description	pid	process
Token: SeShutdownPrivilege	1624	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1624	msiexec.exe
Token: SeRestorePrivilege	576	msiexec.exe
Token: SeTakeOwnershipPrivilege	576	msiexec.exe
Token: SeSecurityPrivilege	576	msiexec.exe
Token: SeCreateTokenPrivilege	1624	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1624	msiexec.exe
Token: SeLockMemoryPrivilege	1624	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1624	msiexec.exe
Token: SeMachineAccountPrivilege	1624	msiexec.exe
Token: SeTcbPrivilege	1624	msiexec.exe
Token: SeSecurityPrivilege	1624	msiexec.exe
Token: SeTakeOwnershipPrivilege	1624	msiexec.exe
Token: SeLoadDriverPrivilege	1624	msiexec.exe
Token: SeSystemProfilePrivilege	1624	msiexec.exe
Token: SeSystemtimePrivilege	1624	msiexec.exe
Token: SeProfSingleProcessPrivilege	1624	msiexec.exe
Token: SeIncBasePriorityPrivilege	1624	msiexec.exe
Token: SeCreatePagefilePrivilege	1624	msiexec.exe
Token: SeCreatePermanentPrivilege	1624	msiexec.exe
Token: SeBackupPrivilege	1624	msiexec.exe
Token: SeRestorePrivilege	1624	msiexec.exe
Token: SeShutdownPrivilege	1624	msiexec.exe
Token: SeDebugPrivilege	1624	msiexec.exe
Token: SeAuditPrivilege	1624	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1624	msiexec.exe
Token: SeChangeNotifyPrivilege	1624	msiexec.exe
Token: SeRemoteShutdownPrivilege	1624	msiexec.exe
Token: SeUndockPrivilege	1624	msiexec.exe
Token: SeSyncAgentPrivilege	1624	msiexec.exe
Token: SeEnableDelegationPrivilege	1624	msiexec.exe
Token: SeManageVolumePrivilege	1624	msiexec.exe
Token: SeImpersonatePrivilege	1624	msiexec.exe
Token: SeCreateGlobalPrivilege	1624	msiexec.exe
Token: SeBackupPrivilege	564	vssvc.exe
Token: SeRestorePrivilege	564	vssvc.exe
Token: SeAuditPrivilege	564	vssvc.exe
Token: SeBackupPrivilege	576	msiexec.exe
Token: SeRestorePrivilege	576	msiexec.exe
Token: SeRestorePrivilege	1996	DrvInst.exe
Token: SeRestorePrivilege	1996	DrvInst.exe
Token: SeRestorePrivilege	1996	DrvInst.exe
Token: SeRestorePrivilege	1996	DrvInst.exe
Token: SeRestorePrivilege	1996	DrvInst.exe
Token: SeRestorePrivilege	1996	DrvInst.exe
Token: SeRestorePrivilege	1996	DrvInst.exe
Token: SeLoadDriverPrivilege	1996	DrvInst.exe
Token: SeLoadDriverPrivilege	1996	DrvInst.exe
Token: SeLoadDriverPrivilege	1996	DrvInst.exe
Token: SeRestorePrivilege	576	msiexec.exe
Token: SeTakeOwnershipPrivilege	576	msiexec.exe
Token: SeRestorePrivilege	576	msiexec.exe
Token: SeTakeOwnershipPrivilege	576	msiexec.exe
Token: SeRestorePrivilege	576	msiexec.exe
Token: SeTakeOwnershipPrivilege	576	msiexec.exe
Token: SeRestorePrivilege	576	msiexec.exe
Token: SeTakeOwnershipPrivilege	576	msiexec.exe
Token: SeRestorePrivilege	576	msiexec.exe
Token: SeTakeOwnershipPrivilege	576	msiexec.exe
Token: SeRestorePrivilege	576	msiexec.exe
Token: SeTakeOwnershipPrivilege	576	msiexec.exe
Token: SeRestorePrivilege	576	msiexec.exe
Token: SeTakeOwnershipPrivilege	576	msiexec.exe
Token: SeRestorePrivilege	576	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

msiexec.exe

pid process

1624 msiexec.exe

pid	process
1624	msiexec.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

msiexec.exeWScript.exewscript.execmd.exe

description	pid	process	target process
PID 576 wrote to memory of 1472	576	msiexec.exe	MsiExec.exe
PID 576 wrote to memory of 1472	576	msiexec.exe	MsiExec.exe
PID 576 wrote to memory of 1472	576	msiexec.exe	MsiExec.exe
PID 576 wrote to memory of 1472	576	msiexec.exe	MsiExec.exe
PID 576 wrote to memory of 1472	576	msiexec.exe	MsiExec.exe
PID 576 wrote to memory of 1472	576	msiexec.exe	MsiExec.exe
PID 576 wrote to memory of 1472	576	msiexec.exe	MsiExec.exe
PID 576 wrote to memory of 1264	576	msiexec.exe	MSI655E.tmp
PID 576 wrote to memory of 1264	576	msiexec.exe	MSI655E.tmp
PID 576 wrote to memory of 1264	576	msiexec.exe	MSI655E.tmp
PID 576 wrote to memory of 1264	576	msiexec.exe	MSI655E.tmp
PID 576 wrote to memory of 1264	576	msiexec.exe	MSI655E.tmp
PID 576 wrote to memory of 1264	576	msiexec.exe	MSI655E.tmp
PID 576 wrote to memory of 1264	576	msiexec.exe	MSI655E.tmp
PID 1508 wrote to memory of 1760	1508	WScript.exe	wscript.exe
PID 1508 wrote to memory of 1760	1508	WScript.exe	wscript.exe
PID 1508 wrote to memory of 1760	1508	WScript.exe	wscript.exe
PID 1760 wrote to memory of 920	1760	wscript.exe	cmd.exe
PID 1760 wrote to memory of 920	1760	wscript.exe	cmd.exe
PID 1760 wrote to memory of 920	1760	wscript.exe	cmd.exe
PID 920 wrote to memory of 2032	920	cmd.exe	shutdown.exe
PID 920 wrote to memory of 2032	920	cmd.exe	shutdown.exe
PID 920 wrote to memory of 2032	920	cmd.exe	shutdown.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\f085588cf016993e6298640bf797c1d31b61a8087a3240d517a53a5a58474987.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1624

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:576
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 312447BBDBB6D0C0851CE9D9A9A52227
  2⤵
  - Loads dropped DLL
  PID:1472
- C:\Windows\Installer\MSI655E.tmp
  "C:\Windows\Installer\MSI655E.tmp" "C:\Program Files (x86)\Firefox_2020-3547\Firefox_2020-3547\658615508460043140_16.vbs"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1264

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:564

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot14" "" "" "60919e20f" "0000000000000000" "00000000000005A4" "0000000000000510"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1996

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Firefox_2020-3547\Firefox_2020-3547\658615508460043140_16.vbs"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Windows\System32\wscript.exe
  wscript.exe C:\Users\Admin\AppData\Roaming\zjgrquagjip.vbs
  2⤵
  - Drops startup file
  - Suspicious use of WriteProcessMemory
  PID:1760
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c shutdown /r /t 0 /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:920
  - - C:\Windows\system32\shutdown.exe
      shutdown /r /t 0 /f
      4⤵
      PID:2032

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:1984

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:1836

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Firefox_2020-3547\Firefox_2020-3547\658615508460043140_16.vbs

MD5
6726ce7753803c58bb7136216dd3378f

SHA1
eb6faf34ce5a9c9a6bc5eba32cb51b88cdda3f2d

SHA256
0a0bce3a1809e225be4a123e894e01a3f8eb805ebbea1bcd0172c2b104600f04

SHA512
320b9c6ffedac662290482f6c73e8b8b2242bf8a359da91baa06d37c165596668157a8e89199f81c132f9434b8ad202c4ce6735f654d5e8d353104786abae9a7

Download Submit
C:\Users\Admin\AppData\Roaming\50728321969508\jrscbxlamkbcoqeoa73404836535453.exe

MD5
31b3fa3be13c3eca988b6647cf274003

SHA1
713779818be4a9956a02f8e16231750a9e0c3eb8

SHA256
881aa5538ac02efb941f6cbef4e784f5e4a4a0c70611cc6b7e7e461f21c65f97

SHA512
ba1fddaaa64e0bdc2418d615b2a34683167fc336d12109e29574c3cec51a93d16908bf155b96d0d8c4537b185caa7ee29c3eb6a84074ef366cd161b0fe8eb1bf

Download Submit
C:\Users\Admin\AppData\Roaming\zjgrquagjip.vbs

MD5
4fcbedd04fc2c59cabcf9e15b02c41e1

SHA1
750d0c0a93e5cb5543f5c133b655f9e69cd0b9e4

SHA256
6a25c5a919f4adec5ea7cd4da243bbeb81f88fb49ac43737572b0205acfc6d1c

SHA512
110b1093debfaf34ab62df267a22bfa846c8b8f19b5037fb731099644549b7be5ec0edfd1a76b90663cef602738d3f634f57a09dfa01ef7a9289754c5f29c2f9

Download Submit
C:\Windows\Installer\MSI5A12.tmp

MD5
c39daeba173815516c180ca4361f7895

SHA1
db3ae54329834baa954569a35be5b947c86dc25e

SHA256
a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc

SHA512
e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929

Download Submit
C:\Windows\Installer\MSI5E95.tmp

MD5
c39daeba173815516c180ca4361f7895

SHA1
db3ae54329834baa954569a35be5b947c86dc25e

SHA256
a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc

SHA512
e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929

Download Submit
C:\Windows\Installer\MSI5F22.tmp

MD5
c39daeba173815516c180ca4361f7895

SHA1
db3ae54329834baa954569a35be5b947c86dc25e

SHA256
a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc

SHA512
e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929

Download Submit
C:\Windows\Installer\MSI655E.tmp

MD5
867b627b008d149f15e8df90d2648d41

SHA1
543fc2763f98378c5777f0dc1f11f54ee3a71733

SHA256
51d309734f25d009714a0e4d428ffee3f42bfaa3eaf21da68369405f3a0a8233

SHA512
9c3beb4c8c5319f1f584c49fa66b1ee704b6ecb56184af0024a4e363979466c2933a99fa0662532b0ac8ca22536b1717de8214cd828094bbc38f9d8bb3d2da44

Download Submit
\Windows\Installer\MSI5A12.tmp

MD5
c39daeba173815516c180ca4361f7895

SHA1
db3ae54329834baa954569a35be5b947c86dc25e

SHA256
a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc

SHA512
e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929

Download Submit
\Windows\Installer\MSI5E95.tmp

MD5
c39daeba173815516c180ca4361f7895

SHA1
db3ae54329834baa954569a35be5b947c86dc25e

SHA256
a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc

SHA512
e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929

Download Submit
\Windows\Installer\MSI5F22.tmp

MD5
c39daeba173815516c180ca4361f7895

SHA1
db3ae54329834baa954569a35be5b947c86dc25e

SHA256
a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc

SHA512
e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929

Download Submit
memory/1264-65-0x0000000000160000-0x0000000000162000-memory.dmp

Filesize
8KB

Download
memory/1472-56-0x0000000076071000-0x0000000076073000-memory.dmp

Filesize
8KB

Download
memory/1624-54-0x000007FEFC511000-0x000007FEFC513000-memory.dmp

Filesize
8KB

Download
memory/1836-74-0x00000000026E0000-0x00000000026E1000-memory.dmp

Filesize
4KB

Download
memory/1984-72-0x0000000002840000-0x0000000002841000-memory.dmp

Filesize
4KB

Download