Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
03/04/2023, 00:42
Static task
static1
Behavioral task
behavioral1
Sample
Honeygain_install.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Honeygain_install.exe
Resource
win10v2004-20230220-en
General
-
Target
Honeygain_install.exe
-
Size
18.2MB
-
MD5
9f590a9e106e99e74cf3ad869c037830
-
SHA1
909d4f3d99dd0c1dbcc112e5067638cc2ec540c2
-
SHA256
00a0773c3999f1391fb9dc0ec933042669053aa54c7381427d86736967359bc9
-
SHA512
7fc497a524a69d537e392d9365e2c724e2c1c400c4cf4241238cb6de6ce6348ec4fb520a3817fc949eef17e87dcec081ff3fde3121f96923a10300ba74c6e510
-
SSDEEP
393216:2HVeiu9WXR8ObOyPd1qxHnKrcKbGzpNZ5ZenW36eiaCtVLAq8QeMq:2Hwiu9WXR5qXzzpX3GW36eia8fM
Malware Config
Signatures
-
Loads dropped DLL 7 IoCs
pid Process 1932 MsiExec.exe 1932 MsiExec.exe 1932 MsiExec.exe 1932 MsiExec.exe 1932 MsiExec.exe 1932 MsiExec.exe 1932 MsiExec.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: Honeygain_install.exe File opened (read-only) \??\V: Honeygain_install.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\F: Honeygain_install.exe File opened (read-only) \??\H: Honeygain_install.exe File opened (read-only) \??\J: Honeygain_install.exe File opened (read-only) \??\K: Honeygain_install.exe File opened (read-only) \??\S: Honeygain_install.exe File opened (read-only) \??\X: Honeygain_install.exe File opened (read-only) \??\Y: Honeygain_install.exe File opened (read-only) \??\M: Honeygain_install.exe File opened (read-only) \??\N: Honeygain_install.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\P: Honeygain_install.exe File opened (read-only) \??\Q: Honeygain_install.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: Honeygain_install.exe File opened (read-only) \??\R: Honeygain_install.exe File opened (read-only) \??\T: Honeygain_install.exe File opened (read-only) \??\Z: Honeygain_install.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: Honeygain_install.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\O: Honeygain_install.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: Honeygain_install.exe File opened (read-only) \??\E: Honeygain_install.exe File opened (read-only) \??\I: Honeygain_install.exe File opened (read-only) \??\L: Honeygain_install.exe File opened (read-only) \??\W: Honeygain_install.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\U: msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 Honeygain_install.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Honeygain_install.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Honeygain_install.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Honeygain_install.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 Honeygain_install.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 Honeygain_install.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 Honeygain_install.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2024 Honeygain_install.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 1976 msiexec.exe Token: SeTakeOwnershipPrivilege 1976 msiexec.exe Token: SeSecurityPrivilege 1976 msiexec.exe Token: SeCreateTokenPrivilege 2024 Honeygain_install.exe Token: SeAssignPrimaryTokenPrivilege 2024 Honeygain_install.exe Token: SeLockMemoryPrivilege 2024 Honeygain_install.exe Token: SeIncreaseQuotaPrivilege 2024 Honeygain_install.exe Token: SeMachineAccountPrivilege 2024 Honeygain_install.exe Token: SeTcbPrivilege 2024 Honeygain_install.exe Token: SeSecurityPrivilege 2024 Honeygain_install.exe Token: SeTakeOwnershipPrivilege 2024 Honeygain_install.exe Token: SeLoadDriverPrivilege 2024 Honeygain_install.exe Token: SeSystemProfilePrivilege 2024 Honeygain_install.exe Token: SeSystemtimePrivilege 2024 Honeygain_install.exe Token: SeProfSingleProcessPrivilege 2024 Honeygain_install.exe Token: SeIncBasePriorityPrivilege 2024 Honeygain_install.exe Token: SeCreatePagefilePrivilege 2024 Honeygain_install.exe Token: SeCreatePermanentPrivilege 2024 Honeygain_install.exe Token: SeBackupPrivilege 2024 Honeygain_install.exe Token: SeRestorePrivilege 2024 Honeygain_install.exe Token: SeShutdownPrivilege 2024 Honeygain_install.exe Token: SeDebugPrivilege 2024 Honeygain_install.exe Token: SeAuditPrivilege 2024 Honeygain_install.exe Token: SeSystemEnvironmentPrivilege 2024 Honeygain_install.exe Token: SeChangeNotifyPrivilege 2024 Honeygain_install.exe Token: SeRemoteShutdownPrivilege 2024 Honeygain_install.exe Token: SeUndockPrivilege 2024 Honeygain_install.exe Token: SeSyncAgentPrivilege 2024 Honeygain_install.exe Token: SeEnableDelegationPrivilege 2024 Honeygain_install.exe Token: SeManageVolumePrivilege 2024 Honeygain_install.exe Token: SeImpersonatePrivilege 2024 Honeygain_install.exe Token: SeCreateGlobalPrivilege 2024 Honeygain_install.exe Token: SeCreateTokenPrivilege 2024 Honeygain_install.exe Token: SeAssignPrimaryTokenPrivilege 2024 Honeygain_install.exe Token: SeLockMemoryPrivilege 2024 Honeygain_install.exe Token: SeIncreaseQuotaPrivilege 2024 Honeygain_install.exe Token: SeMachineAccountPrivilege 2024 Honeygain_install.exe Token: SeTcbPrivilege 2024 Honeygain_install.exe Token: SeSecurityPrivilege 2024 Honeygain_install.exe Token: SeTakeOwnershipPrivilege 2024 Honeygain_install.exe Token: SeLoadDriverPrivilege 2024 Honeygain_install.exe Token: SeSystemProfilePrivilege 2024 Honeygain_install.exe Token: SeSystemtimePrivilege 2024 Honeygain_install.exe Token: SeProfSingleProcessPrivilege 2024 Honeygain_install.exe Token: SeIncBasePriorityPrivilege 2024 Honeygain_install.exe Token: SeCreatePagefilePrivilege 2024 Honeygain_install.exe Token: SeCreatePermanentPrivilege 2024 Honeygain_install.exe Token: SeBackupPrivilege 2024 Honeygain_install.exe Token: SeRestorePrivilege 2024 Honeygain_install.exe Token: SeShutdownPrivilege 2024 Honeygain_install.exe Token: SeDebugPrivilege 2024 Honeygain_install.exe Token: SeAuditPrivilege 2024 Honeygain_install.exe Token: SeSystemEnvironmentPrivilege 2024 Honeygain_install.exe Token: SeChangeNotifyPrivilege 2024 Honeygain_install.exe Token: SeRemoteShutdownPrivilege 2024 Honeygain_install.exe Token: SeUndockPrivilege 2024 Honeygain_install.exe Token: SeSyncAgentPrivilege 2024 Honeygain_install.exe Token: SeEnableDelegationPrivilege 2024 Honeygain_install.exe Token: SeManageVolumePrivilege 2024 Honeygain_install.exe Token: SeImpersonatePrivilege 2024 Honeygain_install.exe Token: SeCreateGlobalPrivilege 2024 Honeygain_install.exe Token: SeCreateTokenPrivilege 2024 Honeygain_install.exe Token: SeAssignPrimaryTokenPrivilege 2024 Honeygain_install.exe Token: SeLockMemoryPrivilege 2024 Honeygain_install.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2024 Honeygain_install.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1976 wrote to memory of 1932 1976 msiexec.exe 31 PID 1976 wrote to memory of 1932 1976 msiexec.exe 31 PID 1976 wrote to memory of 1932 1976 msiexec.exe 31 PID 1976 wrote to memory of 1932 1976 msiexec.exe 31 PID 1976 wrote to memory of 1932 1976 msiexec.exe 31 PID 1976 wrote to memory of 1932 1976 msiexec.exe 31 PID 1976 wrote to memory of 1932 1976 msiexec.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\Honeygain_install.exe"C:\Users\Admin\AppData\Local\Temp\Honeygain_install.exe"1⤵
- Enumerates connected drives
- Modifies system certificate store
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2024
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 46B25E15FC29C231F463037424865C0E C2⤵
- Loads dropped DLL
PID:1932
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD5e71c8443ae0bc2e282c73faead0a6dd3
SHA10c110c1b01e68edfacaeae64781a37b1995fa94b
SHA25695b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72
SHA512b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c97da6ecdbb53f0dfd4fa831af7565dc
SHA1c39910ca883b295b46bd50489798a3cfca96a48c
SHA256f036a76c82a03c0ce3c456fbc3bbda5deca24269601791b949546bfaae88502b
SHA5128b5b952ea187da19be388bff19e7c4f93d5fe2c456a9ab08e71a470e2a2df048d170eb67a4f1d9243dd629b65ac89b485dee38c897a29016b15dd8d569b8c9db
-
Filesize
15KB
MD592a8f755b579ffc8c3f86ec87076f45e
SHA1cd5536b089a281807eabe2def1e6f4020e2b124b
SHA25671a8107a9f5e4464519fb74b4e83b7f7af86812399210f55a2505870391aec66
SHA51211857b0eefbacc7faf7e1056124319c3acfc82eef0c1769a3ad7945a1019b85757fbd8f620a5bd360652c7f877a8634df744a3cee0fb0f7a07689522024d06fb
-
Filesize
61KB
MD5fc4666cbca561e864e7fdf883a9e6661
SHA12f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5
SHA25610f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b
SHA512c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d
-
Filesize
550KB
MD58259dc74965f3c8e91d152862580a773
SHA1d2d029f9f9be25be3c5526c5a52449c034c673e1
SHA25684f8a39d32775639bb3f8875b8e871e0e2344f2a96c52ab6660e65d5c33fd7f9
SHA51250903688a44609700a84bfb18859b038ebb9ea69d142b1fc23d7bc639879e8be469dab23de777bba8265eb4da8ca7614747f2559034339061236ea7e2b5fd6d0
-
Filesize
550KB
MD58259dc74965f3c8e91d152862580a773
SHA1d2d029f9f9be25be3c5526c5a52449c034c673e1
SHA25684f8a39d32775639bb3f8875b8e871e0e2344f2a96c52ab6660e65d5c33fd7f9
SHA51250903688a44609700a84bfb18859b038ebb9ea69d142b1fc23d7bc639879e8be469dab23de777bba8265eb4da8ca7614747f2559034339061236ea7e2b5fd6d0
-
Filesize
550KB
MD58259dc74965f3c8e91d152862580a773
SHA1d2d029f9f9be25be3c5526c5a52449c034c673e1
SHA25684f8a39d32775639bb3f8875b8e871e0e2344f2a96c52ab6660e65d5c33fd7f9
SHA51250903688a44609700a84bfb18859b038ebb9ea69d142b1fc23d7bc639879e8be469dab23de777bba8265eb4da8ca7614747f2559034339061236ea7e2b5fd6d0
-
Filesize
550KB
MD58259dc74965f3c8e91d152862580a773
SHA1d2d029f9f9be25be3c5526c5a52449c034c673e1
SHA25684f8a39d32775639bb3f8875b8e871e0e2344f2a96c52ab6660e65d5c33fd7f9
SHA51250903688a44609700a84bfb18859b038ebb9ea69d142b1fc23d7bc639879e8be469dab23de777bba8265eb4da8ca7614747f2559034339061236ea7e2b5fd6d0
-
Filesize
550KB
MD58259dc74965f3c8e91d152862580a773
SHA1d2d029f9f9be25be3c5526c5a52449c034c673e1
SHA25684f8a39d32775639bb3f8875b8e871e0e2344f2a96c52ab6660e65d5c33fd7f9
SHA51250903688a44609700a84bfb18859b038ebb9ea69d142b1fc23d7bc639879e8be469dab23de777bba8265eb4da8ca7614747f2559034339061236ea7e2b5fd6d0
-
Filesize
550KB
MD58259dc74965f3c8e91d152862580a773
SHA1d2d029f9f9be25be3c5526c5a52449c034c673e1
SHA25684f8a39d32775639bb3f8875b8e871e0e2344f2a96c52ab6660e65d5c33fd7f9
SHA51250903688a44609700a84bfb18859b038ebb9ea69d142b1fc23d7bc639879e8be469dab23de777bba8265eb4da8ca7614747f2559034339061236ea7e2b5fd6d0
-
Filesize
630KB
MD58ecff5e8777908818edd94721ddc349d
SHA1a3ffcfcffae1b44261c1b1a64917ac898c40b9e2
SHA2561c450659c7681df9df21b20412c9647e7e8e5bf0f2945c48b1ab51f330f2516b
SHA5128418049fe52dcf6e294cf58d200b7a7d8e704ba592b3f59243c4c5a4d661c60f8db97540badd9a1718547a0047b39316ec7917c43ddcb8a71bebad49e7baaf08
-
Filesize
550KB
MD58259dc74965f3c8e91d152862580a773
SHA1d2d029f9f9be25be3c5526c5a52449c034c673e1
SHA25684f8a39d32775639bb3f8875b8e871e0e2344f2a96c52ab6660e65d5c33fd7f9
SHA51250903688a44609700a84bfb18859b038ebb9ea69d142b1fc23d7bc639879e8be469dab23de777bba8265eb4da8ca7614747f2559034339061236ea7e2b5fd6d0
-
Filesize
161KB
MD573b4b714b42fc9a6aaefd0ae59adb009
SHA1efdaffd5b0ad21913d22001d91bf6c19ecb4ac41
SHA256c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd
SHA51273af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd
-
Filesize
161KB
MD5be2bec6e8c5653136d3e72fe53c98aa3
SHA1a8182d6db17c14671c3d5766c72e58d87c0810de
SHA2561919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd
SHA5120d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff
-
Filesize
7B
MD578aae9060bf4218e648229dee8043b32
SHA1719071049ccc9bdd1320caaaf816b13ce8ce93d8
SHA25686723f4df73be2f5f3730dcd36d2adff4992ffdc33bea3578298cbfb526c7edf
SHA512e42f594030a9164d7994d986e21150a482d488864a0503eb4cbe7cec2417fa8fd5eda122ee5d3459dcec0679f90fa4bf765f00dd1696e7b6b49416a134869699
-
Filesize
4.5MB
MD5c0edb2713685835202136a941619b901
SHA18c79db3984cc8dc9510e7f19631daa2d1d1423db
SHA2568cdb757d2de4cd6bba8e632cd81871c30f8d5a0e256fc3da6a238b7761faadbe
SHA51211f28940f719a378a8adfc6dd1c28d74ce46c3f016b977fc26fbbea06ad1fbd9f9ad860fdc3fdb83cf8a986d0a4fe2ece59cc9049248cc7aa2225a85b535dd76
-
Filesize
550KB
MD58259dc74965f3c8e91d152862580a773
SHA1d2d029f9f9be25be3c5526c5a52449c034c673e1
SHA25684f8a39d32775639bb3f8875b8e871e0e2344f2a96c52ab6660e65d5c33fd7f9
SHA51250903688a44609700a84bfb18859b038ebb9ea69d142b1fc23d7bc639879e8be469dab23de777bba8265eb4da8ca7614747f2559034339061236ea7e2b5fd6d0
-
Filesize
550KB
MD58259dc74965f3c8e91d152862580a773
SHA1d2d029f9f9be25be3c5526c5a52449c034c673e1
SHA25684f8a39d32775639bb3f8875b8e871e0e2344f2a96c52ab6660e65d5c33fd7f9
SHA51250903688a44609700a84bfb18859b038ebb9ea69d142b1fc23d7bc639879e8be469dab23de777bba8265eb4da8ca7614747f2559034339061236ea7e2b5fd6d0
-
Filesize
550KB
MD58259dc74965f3c8e91d152862580a773
SHA1d2d029f9f9be25be3c5526c5a52449c034c673e1
SHA25684f8a39d32775639bb3f8875b8e871e0e2344f2a96c52ab6660e65d5c33fd7f9
SHA51250903688a44609700a84bfb18859b038ebb9ea69d142b1fc23d7bc639879e8be469dab23de777bba8265eb4da8ca7614747f2559034339061236ea7e2b5fd6d0
-
Filesize
550KB
MD58259dc74965f3c8e91d152862580a773
SHA1d2d029f9f9be25be3c5526c5a52449c034c673e1
SHA25684f8a39d32775639bb3f8875b8e871e0e2344f2a96c52ab6660e65d5c33fd7f9
SHA51250903688a44609700a84bfb18859b038ebb9ea69d142b1fc23d7bc639879e8be469dab23de777bba8265eb4da8ca7614747f2559034339061236ea7e2b5fd6d0
-
Filesize
550KB
MD58259dc74965f3c8e91d152862580a773
SHA1d2d029f9f9be25be3c5526c5a52449c034c673e1
SHA25684f8a39d32775639bb3f8875b8e871e0e2344f2a96c52ab6660e65d5c33fd7f9
SHA51250903688a44609700a84bfb18859b038ebb9ea69d142b1fc23d7bc639879e8be469dab23de777bba8265eb4da8ca7614747f2559034339061236ea7e2b5fd6d0
-
Filesize
630KB
MD58ecff5e8777908818edd94721ddc349d
SHA1a3ffcfcffae1b44261c1b1a64917ac898c40b9e2
SHA2561c450659c7681df9df21b20412c9647e7e8e5bf0f2945c48b1ab51f330f2516b
SHA5128418049fe52dcf6e294cf58d200b7a7d8e704ba592b3f59243c4c5a4d661c60f8db97540badd9a1718547a0047b39316ec7917c43ddcb8a71bebad49e7baaf08
-
Filesize
550KB
MD58259dc74965f3c8e91d152862580a773
SHA1d2d029f9f9be25be3c5526c5a52449c034c673e1
SHA25684f8a39d32775639bb3f8875b8e871e0e2344f2a96c52ab6660e65d5c33fd7f9
SHA51250903688a44609700a84bfb18859b038ebb9ea69d142b1fc23d7bc639879e8be469dab23de777bba8265eb4da8ca7614747f2559034339061236ea7e2b5fd6d0