Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
25/04/2023, 15:36
Static task
static1
Behavioral task
behavioral1
Sample
AdobePDFReader.msi
Resource
win7-20230220-en
General
-
Target
AdobePDFReader.msi
-
Size
2.2MB
-
MD5
fadc9824c68402143239f764c99bb82d
-
SHA1
7eb72321c2c1e25b11c9d44229af22a179e27ce8
-
SHA256
9890ae69f0a31a5656dbebce11384a70820ac49cabe9b244dfb8a5ed22617ff5
-
SHA512
916b9b9836d5003193cf4f52c501a90ba16f18ca13a05325f9e11a6ee9d05b927013c09524757f33efd153c0e1d25648233e79f9a8eaa81fd69ed79282268ef6
-
SSDEEP
49152:NMU9FgsN+TXYr+LrUcdEL9MklhGUWhe8u/g1PQNPEUI:6gFPgYrordG9t0lepg1P2XI
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1464 readerdc64.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1464 set thread context of 2016 1464 readerdc64.exe 39 -
Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\6cac18.msi msiexec.exe File created C:\Windows\Installer\6cac19.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIAE5A.tmp msiexec.exe File created C:\Windows\Installer\6cac1b.msi msiexec.exe File opened for modification C:\Windows\Installer\6cac19.ipi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\Installer\6cac18.msi msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main readerdc64.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3FF13EC1-E37F-11ED-97FC-F221FC82CB7E} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde readerdc64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 readerdc64.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 972 msiexec.exe 972 msiexec.exe 656 powershell.exe 656 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2000 msiexec.exe Token: SeIncreaseQuotaPrivilege 2000 msiexec.exe Token: SeRestorePrivilege 972 msiexec.exe Token: SeTakeOwnershipPrivilege 972 msiexec.exe Token: SeSecurityPrivilege 972 msiexec.exe Token: SeCreateTokenPrivilege 2000 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2000 msiexec.exe Token: SeLockMemoryPrivilege 2000 msiexec.exe Token: SeIncreaseQuotaPrivilege 2000 msiexec.exe Token: SeMachineAccountPrivilege 2000 msiexec.exe Token: SeTcbPrivilege 2000 msiexec.exe Token: SeSecurityPrivilege 2000 msiexec.exe Token: SeTakeOwnershipPrivilege 2000 msiexec.exe Token: SeLoadDriverPrivilege 2000 msiexec.exe Token: SeSystemProfilePrivilege 2000 msiexec.exe Token: SeSystemtimePrivilege 2000 msiexec.exe Token: SeProfSingleProcessPrivilege 2000 msiexec.exe Token: SeIncBasePriorityPrivilege 2000 msiexec.exe Token: SeCreatePagefilePrivilege 2000 msiexec.exe Token: SeCreatePermanentPrivilege 2000 msiexec.exe Token: SeBackupPrivilege 2000 msiexec.exe Token: SeRestorePrivilege 2000 msiexec.exe Token: SeShutdownPrivilege 2000 msiexec.exe Token: SeDebugPrivilege 2000 msiexec.exe Token: SeAuditPrivilege 2000 msiexec.exe Token: SeSystemEnvironmentPrivilege 2000 msiexec.exe Token: SeChangeNotifyPrivilege 2000 msiexec.exe Token: SeRemoteShutdownPrivilege 2000 msiexec.exe Token: SeUndockPrivilege 2000 msiexec.exe Token: SeSyncAgentPrivilege 2000 msiexec.exe Token: SeEnableDelegationPrivilege 2000 msiexec.exe Token: SeManageVolumePrivilege 2000 msiexec.exe Token: SeImpersonatePrivilege 2000 msiexec.exe Token: SeCreateGlobalPrivilege 2000 msiexec.exe Token: SeBackupPrivilege 464 vssvc.exe Token: SeRestorePrivilege 464 vssvc.exe Token: SeAuditPrivilege 464 vssvc.exe Token: SeBackupPrivilege 972 msiexec.exe Token: SeRestorePrivilege 972 msiexec.exe Token: SeRestorePrivilege 776 DrvInst.exe Token: SeRestorePrivilege 776 DrvInst.exe Token: SeRestorePrivilege 776 DrvInst.exe Token: SeRestorePrivilege 776 DrvInst.exe Token: SeRestorePrivilege 776 DrvInst.exe Token: SeRestorePrivilege 776 DrvInst.exe Token: SeRestorePrivilege 776 DrvInst.exe Token: SeLoadDriverPrivilege 776 DrvInst.exe Token: SeLoadDriverPrivilege 776 DrvInst.exe Token: SeLoadDriverPrivilege 776 DrvInst.exe Token: SeRestorePrivilege 972 msiexec.exe Token: SeTakeOwnershipPrivilege 972 msiexec.exe Token: SeRestorePrivilege 972 msiexec.exe Token: SeTakeOwnershipPrivilege 972 msiexec.exe Token: SeRestorePrivilege 972 msiexec.exe Token: SeTakeOwnershipPrivilege 972 msiexec.exe Token: SeRestorePrivilege 972 msiexec.exe Token: SeTakeOwnershipPrivilege 972 msiexec.exe Token: SeRestorePrivilege 972 msiexec.exe Token: SeTakeOwnershipPrivilege 972 msiexec.exe Token: SeRestorePrivilege 972 msiexec.exe Token: SeTakeOwnershipPrivilege 972 msiexec.exe Token: SeRestorePrivilege 972 msiexec.exe Token: SeTakeOwnershipPrivilege 972 msiexec.exe Token: SeRestorePrivilege 972 msiexec.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2000 msiexec.exe 2000 msiexec.exe 848 iexplore.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 1464 readerdc64.exe 1464 readerdc64.exe 1464 readerdc64.exe 1464 readerdc64.exe 848 iexplore.exe 848 iexplore.exe 1896 IEXPLORE.EXE 1896 IEXPLORE.EXE 1896 IEXPLORE.EXE 1896 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 972 wrote to memory of 656 972 msiexec.exe 31 PID 972 wrote to memory of 656 972 msiexec.exe 31 PID 972 wrote to memory of 656 972 msiexec.exe 31 PID 972 wrote to memory of 1464 972 msiexec.exe 33 PID 972 wrote to memory of 1464 972 msiexec.exe 33 PID 972 wrote to memory of 1464 972 msiexec.exe 33 PID 972 wrote to memory of 1464 972 msiexec.exe 33 PID 656 wrote to memory of 1704 656 powershell.exe 34 PID 656 wrote to memory of 1704 656 powershell.exe 34 PID 656 wrote to memory of 1704 656 powershell.exe 34 PID 1704 wrote to memory of 396 1704 csc.exe 36 PID 1704 wrote to memory of 396 1704 csc.exe 36 PID 1704 wrote to memory of 396 1704 csc.exe 36 PID 1464 wrote to memory of 848 1464 readerdc64.exe 38 PID 1464 wrote to memory of 848 1464 readerdc64.exe 38 PID 1464 wrote to memory of 848 1464 readerdc64.exe 38 PID 1464 wrote to memory of 848 1464 readerdc64.exe 38 PID 1464 wrote to memory of 2016 1464 readerdc64.exe 39 PID 1464 wrote to memory of 2016 1464 readerdc64.exe 39 PID 1464 wrote to memory of 2016 1464 readerdc64.exe 39 PID 1464 wrote to memory of 2016 1464 readerdc64.exe 39 PID 1464 wrote to memory of 2016 1464 readerdc64.exe 39 PID 848 wrote to memory of 1896 848 iexplore.exe 40 PID 848 wrote to memory of 1896 848 iexplore.exe 40 PID 848 wrote to memory of 1896 848 iexplore.exe 40 PID 848 wrote to memory of 1896 848 iexplore.exe 40 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\AdobePDFReader.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2000
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -file "C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\ad.ps1"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:656 -
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\eaauz5-i.cmdline"3⤵
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBFC8.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCBFB8.tmp"4⤵PID:396
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\readerdc64.exe"C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\readerdc64.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://get.adobe.com/reader/completion/adm/?exitcode=-1&type=install&workflow=643⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:848 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1896
-
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\system32\explorer.exe"3⤵PID:2016
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:464
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000328" "0000000000000570"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:776
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD5c202ac7ce44ad9049155be7aea0d6280
SHA1d842adf921da737153eedf17fe1a7a98770aae74
SHA2568c21e3d04917c9ae667ada9b8e5a30ebacdb8149b86c0497aa255f50230d2c28
SHA5129e273fe135d2724584b0b23f9f75a8b72a1c38590e5b4762e0ec6574fe07ada54781b62ffa31780f8fa82fcb2adc811b4ec531ce808a2f0d8d9b5cd9360ac923
-
Filesize
61KB
MD5e71c8443ae0bc2e282c73faead0a6dd3
SHA10c110c1b01e68edfacaeae64781a37b1995fa94b
SHA25695b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72
SHA512b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6
-
Filesize
61KB
MD5e71c8443ae0bc2e282c73faead0a6dd3
SHA10c110c1b01e68edfacaeae64781a37b1995fa94b
SHA25695b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72
SHA512b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51b26f2b54244f5a96b95f6782a4cb1b5
SHA151a67738ece2112253ebc1a3d129e2e08007eed6
SHA25690fde25ba67e39035a0296fab275c0c34c9613015338f25aa140193ae71add4e
SHA512921dadd0e4bb45caa75fc70311360cc54b34b3d8f892bc86397999b3d1f6f73055ae094fecb7b7bde20281a4f3c7c998ec997f5136607bd7ca63a52e381b44e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5774f1d5c7fbc0c55daf58af222dea8d1
SHA1482ce19acf31bcebe02118c689a149cdc899cbb7
SHA256e2faef82e5aa076067a10967781711062dd6c320b6ad866b5a339b31151e5764
SHA51281af879f270eb20a4ad4b570661519a5ee27e53cbf0e764ccabde00e32eb1454ea197ff979176c6a597300d3cfceaa2d879b2d850c65631494cdb3842261c6d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5611ff205d8e9b087db8297b27d1a0f24
SHA197ba2c2005a58dde726318c71dcfb1f407206e3a
SHA256e948e992b7a224d8ef62d70e89ab9d12392197efb4d337f318b788c472d1a5f1
SHA512739cc0ca6143115076a16960f3b3295f6c5464b8e6e370a1d6d6ec8d9d4c9b8a7b17ea9305c186773f548157af693499e0415f50968358e0be369a867a9b6269
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD588b4b8b01f67c9dede6782035856189c
SHA1da673ad57c29467fa7ea3536bc98078c17b7dfe5
SHA256e2c5b5390c587fc49fc6f5d2084cfbc809e5d7e9ef18337a6d267905817fff9b
SHA5127dce8feaaf0d9b7e5b959efd268a4997df5600d677fb02a94906091ba75095c0cea06e61dedbcdde11a9f83d607dfd5788478ac00852dedcf40aca28a1f6571f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5042acd3ac4cd7d055d9195daffc8bd2c
SHA130c37eed425ad6b588118ec346e0b78a0e54b73e
SHA25611194d4bc3cc9c9c894c334bc8eb656e6943d8ad06b61963e3b86aa096bca641
SHA5127f9da9d81c901a504163dad3e1947f4e642954bad04768f841d248c3a7c4de4ceaa4af0a596e828fd5823e4d16a071580c264df3aebb0917ccbabe9504db91ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c0296f91b42a47564af9bf05ed0c3344
SHA11c9a9c766f538bf7a5a4e00dbfde5934819caa59
SHA2560a6bff3bace3c37974e40df4b35dee86201caf1e046c4c77c0746f6c4284aae2
SHA5124665868a0b8c54c4270ec1987055bcc53ea9a54e50766a0d2b8c0b13b9efdfb23a944adfb587d3a3d77ddd5290f35b96d5c740f6a4650a5e6e4f40baecde3b0d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b1bf78c52932c3f88d103ed54f119de4
SHA18c8090fac68057b6cb5dbe03e2f504b27b6eb5fd
SHA256f04d91b5fa17a4afbbea209e522ea606cf349b4f8fec0aebc2d1f3523f0fac02
SHA512fc5177e26e75427dd596a4b6cb8923a64d840003a41c41f4f7526e00d39046317d2a121be8b787b0c872f52583ad52f4436f152d25385ed54e6bb4949de115a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aea769c7b9f269b773bba878a5e7525e
SHA1e7f903709dad860b779d3c01b59f44fb726a1ac3
SHA256240d5e500dffd87553f61d5db25d131f845a85feb92a4f562a985e5c43ae09d6
SHA5124cc315eb84d7878fc62ee8500b03e35008e161d2d0354bc59714b26018dc19fbf3b7bd1ab4f6402f2e825695b74eff45af8c3c99d0b0a176ad24dcccb832658a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57dee8a0d0bae81002e1037fbb7327636
SHA18a7eaecec811a93fece27b7383e72c29293a5342
SHA256956ad8c413f79eb864174e5ba4e3dfe944fcfb17f28208f082a111529fabc210
SHA512e6a66fd90e2036594c75be00ad82068a23c5aa8b7f49d414c702542519abd87609b75adf0a1ae93dde82fefb2cf963c8af96836b20b8574156e1cb41ebab47a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fe4728fec2e8519f9b7cdc67668026b7
SHA114473d71421674105a7a332d0ccb5ae9c528ba26
SHA256372efe5345bcc8e5859166a0dcb7c5a8bea06220a32c047df8d019a052a8949f
SHA512a0f898355c4abfc7990b35a8c7cd7547ca68544a6f94abd96f9e2187469fc632980c155545c32952491f780b594f589f9dbe89a0cd52067bc37a52b974f9b6b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD514881e8e4dca68c20fb8e4869603e6ab
SHA1bfd5458d83c7c6daf0064a2f0d66b9f104d63f80
SHA2565bce94cbfe3711d54f617410de4136faf30703ec9e09c53d6e60a6be2ca97451
SHA512c63f5a7ef1a60fe3b13001f9557b4449bfcca315d4b25c08a11ce50131678184d62a19895f54573585adbcfa11c329d627d6423a625dd91e91a9de02eacd9622
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a4f1756107cccaed3f87fb65b3c73aa3
SHA1e6ec3967cc54a4fe8d4a4e4626285673ebc67aa5
SHA256bf883357d82fca565b977dfc5dcab0e861ae568dcfcd7034168f64799f94593c
SHA5124c4da3f3d28b2a501a43aaa8e734134104c8dbd2e5d706d958aa17fb68cf3fd96b37ffb25b541363703bd41c59996665cbb89a8cdb7d07b2b577119523909b0f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ee53670dbbb8c45d35e58c339a60c96b
SHA1c2470bd014428228659c277bc36daaf79aef1ae1
SHA25617427885d57830fa5565df9935f5bdf6c637f0154d91989aabb069727bacc51f
SHA51259b20ccbcb6ee11ab4777bedbe7770d0885a4645e3134a82327e9dd6e96a90b51fefb4ee184fa5d822566ab107c01cb5e602d0fe61121487ce789ba8ffd41004
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c7fe3bc92dd1c69e6d7ca3464aaa9b46
SHA161a436c02b1fc6e9ebaf7bd45e40d3050c74d03d
SHA25630bf62e65e8f5b28382cd744301856dec7e9b6e990aa4e541c55ea2725045af2
SHA51287b950e9fdd754aa84c7086d9a10054fa71b78af469135f2ee39468575b014144586f1478b9c256c17d2e99e136ab797fc40b80d4827799bc4499de3cf23504b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e32e6524a0b8a41b78f6bd4216418a4f
SHA1b356fc3e5df4dba6bb5fa88419c72d3c3c8e7b71
SHA256abbb1b7af991ce9d6c9e5a829fac299dc9b35f03aefa3c081ca867c613f83889
SHA5125b3060f626d29ef7af321a1d0b451bab8136352138ba60379c9716d579ee1f9a3d3c2d72df8dc96e0355be0ca4530d551a53a6f9242f67dc7a165c1dd92dcc90
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD597a8a7495f4fa70afa06c9d9c03614df
SHA15c1475fbca43f275b741627e15645b44c285e2af
SHA256fd836c77f7d41988d3a5155e989455d502e3ab587d1f7308d812126444f10928
SHA512bca4b01e529227db43e731a3d1e74d48f5daef33820385d0960c6800c2f5e47d9b62920b56ffcee20e57291794f7f45541e8e07eaa842cb1ad8e68eb656c8199
-
Filesize
390B
MD56f60d1db224a4bb89e8ffaa43d1d806b
SHA1f9ec6e27204218910cff8b9cc5d3afcbafb01aed
SHA256e0a238d0593993d8537ba234d6061e548783d72471f3cd6d85b417bca07301ec
SHA512a68d75d59610ad146a78fbeebc2739adb1a2279acebcf6ac1ac7fa19c77241227f16e4bf353a83a36fe5c46afa828b7ab38b370ca36c436b07c0756aff428d41
-
Filesize
61KB
MD5fc4666cbca561e864e7fdf883a9e6661
SHA12f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5
SHA25610f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b
SHA512c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d
-
Filesize
2.2MB
MD54e0e85a590f4972732f1f0de81aa5507
SHA18e1bcab1ac25c59c1203d808f04b53b1db5fd7eb
SHA256bde15453821fff0d2ed08a8c10885c9ab4ec1ccc6b4b23a41e9e324e4e80a195
SHA5122b874cf59cdc7298b7fcf6712db3ec4013fcd87b7c7bb44400a789821b35bc57e3ff4e98ccfe93bc4cb420d25b2d3e6967eab2e98abf43bb16543f454cef8953
-
Filesize
1.2MB
MD5eb17c8572700a9b7bbfb6c1142ad443e
SHA174022bd63cf919ac44af0dcbe0e4c14756c34b2e
SHA256302b598ae57ca91ba4b4b59e926f2e07a073ab9afcb98eccde02f5e84cdfef52
SHA512e7660219d815bc40741fd6737c092c8f442ebbec4f18981fbf261a269c4e2e162dc0349f76eb7b03a78529021fdab9b84322de7683685ab5d512ac7b4a5a63b0
-
Filesize
1.2MB
MD5eb17c8572700a9b7bbfb6c1142ad443e
SHA174022bd63cf919ac44af0dcbe0e4c14756c34b2e
SHA256302b598ae57ca91ba4b4b59e926f2e07a073ab9afcb98eccde02f5e84cdfef52
SHA512e7660219d815bc40741fd6737c092c8f442ebbec4f18981fbf261a269c4e2e162dc0349f76eb7b03a78529021fdab9b84322de7683685ab5d512ac7b4a5a63b0
-
Filesize
1KB
MD54e2ef1891a0018b7e271dfa3167292e6
SHA1022e59f7aa63cbe1630f83697b406820aaffc62a
SHA256dc79f1ccca3c53b7f32835369cdfe30b6da5a408242c9041aecfc39b583dbf61
SHA512e7af228984f046de8709a238d72f274700de6fd1f356f68ff3a37d7b97e936e0a99f57738a9f206e6d878894ae6f5aafaf994fff251976d8e04b0e259487ceb2
-
Filesize
161KB
MD5be2bec6e8c5653136d3e72fe53c98aa3
SHA1a8182d6db17c14671c3d5766c72e58d87c0810de
SHA2561919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd
SHA5120d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff
-
Filesize
3KB
MD558ff8f71c90be4f784ceb23d0bdbfbb7
SHA12f5ae9453ec102c8d0f0a15f6f711b41a750f4b8
SHA256089327d0b0da22c71e1304acdf8ee098feaff4de1e9973fe16b7c7d17c96a5f9
SHA512dad0cff11fca93fcc9a5f355140023fa6c8570b2a5b7a44a10aab1259d20cf6e43eebbc45124e7969cd4f408fc28ef602734b0d4fcbe183b15fea4df4e2f8bb8
-
Filesize
7KB
MD5ab283f0e07dee45af6cd38f73d77f768
SHA14519f0ca922eb9f849cc7e3cfd606e0008b2c952
SHA256c46f84b38c548a8b20cd99ab74f6bc3256bb26f70f3add0fa4bea835b30b0c8a
SHA512367dec43448b870d77e28b8a63e7a6abeba8995262d49a4cdf234fc9125363b4cb6edfd2e5114b9ff84f90b57bc94fcb91c46c13ecefad0527db9a0714f9487f
-
Filesize
110B
MD5e41f536c69612747967fdc5f70c1a01c
SHA1de70740a40dc55f8b7b56830eca9dd394dc5ffb6
SHA256629435256d56ea73aedf18b51f7791fe2cfd80e1d4c7ff99443cde61b7f3b6b9
SHA51207c84bc90fe425c3234796855f7a0c136aa6e656de3bc8d718af11e01cc458553c05b07a8ac887530edf9ba888a77d420c519aa6148af46537afd655e77e2adc
-
Filesize
2.2MB
MD5fadc9824c68402143239f764c99bb82d
SHA17eb72321c2c1e25b11c9d44229af22a179e27ce8
SHA2569890ae69f0a31a5656dbebce11384a70820ac49cabe9b244dfb8a5ed22617ff5
SHA512916b9b9836d5003193cf4f52c501a90ba16f18ca13a05325f9e11a6ee9d05b927013c09524757f33efd153c0e1d25648233e79f9a8eaa81fd69ed79282268ef6
-
Filesize
652B
MD5176dc4af1edf9274d89d04b0949b3605
SHA130fad7d4db5276cab5df2944bf424055cb118b43
SHA256ab2cb422661c678d54052513aa1c80fa258627479f44cf5f83a38a64d96cd701
SHA512eee3b21666cd140c0d4057959c66a596ce6f39cd00d6bb2ae48d55a67a0e7a79ccf19c83743580e3825b27c205a4892ea82fe2671befb23f822b86ab5a9357cc
-
Filesize
203B
MD5b611be9282deb44eed731f72bcbb2b82
SHA1cc1d606d853bbabd5fef87255356a0d54381c289
SHA256ee09fdd61a05266e4e09f418fc6a452f1205d9f29afba6b8a1579333dc3ff3b6
SHA51263b5ad7b65fd4866fb8841e4eee567e4f1e7888bb9fda8dd5c8dca3461d084d3f80ce920ae321609e4ff32ba13a55b7320282ce7201bb74a793d4700240360a4
-
Filesize
309B
MD51196f9786bba46e5479b404d0e57f846
SHA164645e62041328c50af9ebd1d97e13a6f4fb07bf
SHA256612ecda5fed43b8c1d598abea59d80d813fa5b84700f6fe89bca5f56dd3f93bd
SHA5126ede8b91b5d2593b3305552142491f26365045397543ab78330fd271131865ad4822cc9aef8499d5bdb63dee8421d6fc07ab458223b3cfb08f346cbc5614ee62