Analysis
-
max time kernel
71s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
13/07/2023, 06:18
Static task
static1
Behavioral task
behavioral1
Sample
ChatGPT4 V2.msi
Resource
win7-20230712-en
windows7-x64
Behavioral task
behavioral2
Sample
ChatGPT4 V2.msi
Resource
win10v2004-20230703-en
windows10-2004-x64
General
-
Target
ChatGPT4 V2.msi
-
Size
1.3MB
-
MD5
0f77fb52cbe9489be260f739f4cbfce0
-
SHA1
28236b7b22ad00cfb14b7c04940a1dcb75262538
-
SHA256
5396c6c41584959beea2b5058c5e90d776d2908fbdfaeb08cda924c00b9bd9db
-
SHA512
d1debb3fb41df91b1e2173a6784b6be527713c2ca9228f0b22b07e2f4dbf95824652463d2ca767bd5f4d183667925aceabcbcaa5e048162fe60b7c2b33063b71
-
SSDEEP
24576:CHCSlEKSDB8pDESD30TidMgWZ5H1Wruyi4QX851wfM/3F:CHCZDB8pDESD30TimgS5VWha851wfM/1
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 3 2532 msiexec.exe 5 1992 msiexec.exe -
Executes dropped EXE 1 IoCs
pid Process 2416 MSI607F.tmp -
Loads dropped DLL 6 IoCs
pid Process 3068 MsiExec.exe 3068 MsiExec.exe 3068 MsiExec.exe 3068 MsiExec.exe 3068 MsiExec.exe 2436 MsiExec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe -
Drops file in Program Files directory 5 IoCs
description ioc Process File created C:\Program Files (x86)\Open Ai\ChatGPT4 V2\setup.bat msiexec.exe File created C:\Program Files (x86)\Open Ai\ChatGPT4 V2\nmmhkkegccagdldgiimedpiccmgmiedagg4\background.js msiexec.exe File created C:\Program Files (x86)\Open Ai\ChatGPT4 V2\nmmhkkegccagdldgiimedpiccmgmiedagg4\content.js msiexec.exe File created C:\Program Files (x86)\Open Ai\ChatGPT4 V2\nmmhkkegccagdldgiimedpiccmgmiedagg4\favicon.png msiexec.exe File created C:\Program Files (x86)\Open Ai\ChatGPT4 V2\nmmhkkegccagdldgiimedpiccmgmiedagg4\manifest.json msiexec.exe -
Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\f77584e.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI607F.tmp msiexec.exe File created C:\Windows\Installer\f775850.msi msiexec.exe File opened for modification C:\Windows\Installer\f77584e.ipi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File created C:\Windows\Installer\f77584d.msi msiexec.exe File opened for modification C:\Windows\Installer\f77584d.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI5A64.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI5D61.tmp msiexec.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2440 timeout.exe -
Kills process with taskkill 1 IoCs
pid Process 1092 taskkill.exe -
Modifies data under HKEY_USERS 46 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E msiexec.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe -
Modifies registry class 23 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7B6F7C9BB27CDD74D9A0C65B5AAA0D62\Version = "16777216" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7B6F7C9BB27CDD74D9A0C65B5AAA0D62\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B940F20C9C6F90644BB5B4F6D68F8C4D msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B940F20C9C6F90644BB5B4F6D68F8C4D\7B6F7C9BB27CDD74D9A0C65B5AAA0D62 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7B6F7C9BB27CDD74D9A0C65B5AAA0D62\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7B6F7C9BB27CDD74D9A0C65B5AAA0D62\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7B6F7C9BB27CDD74D9A0C65B5AAA0D62\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7B6F7C9BB27CDD74D9A0C65B5AAA0D62 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7B6F7C9BB27CDD74D9A0C65B5AAA0D62\ProductName = "ChatGPT4 V2" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7B6F7C9BB27CDD74D9A0C65B5AAA0D62\PackageCode = "846C96C5E5C401947806700C3F630CB3" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7B6F7C9BB27CDD74D9A0C65B5AAA0D62\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7B6F7C9BB27CDD74D9A0C65B5AAA0D62\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7B6F7C9BB27CDD74D9A0C65B5AAA0D62\AuthorizedLUAApp = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7B6F7C9BB27CDD74D9A0C65B5AAA0D62\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7B6F7C9BB27CDD74D9A0C65B5AAA0D62\SourceList\PackageName = "ChatGPT4 V2.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7B6F7C9BB27CDD74D9A0C65B5AAA0D62\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7B6F7C9BB27CDD74D9A0C65B5AAA0D62\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7B6F7C9BB27CDD74D9A0C65B5AAA0D62\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7B6F7C9BB27CDD74D9A0C65B5AAA0D62\MainFeature msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7B6F7C9BB27CDD74D9A0C65B5AAA0D62\SourceList\Media msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7B6F7C9BB27CDD74D9A0C65B5AAA0D62\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7B6F7C9BB27CDD74D9A0C65B5AAA0D62 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7B6F7C9BB27CDD74D9A0C65B5AAA0D62\Assignment = "1" msiexec.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1992 msiexec.exe 1992 msiexec.exe 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp 2416 MSI607F.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2532 msiexec.exe Token: SeIncreaseQuotaPrivilege 2532 msiexec.exe Token: SeRestorePrivilege 1992 msiexec.exe Token: SeTakeOwnershipPrivilege 1992 msiexec.exe Token: SeSecurityPrivilege 1992 msiexec.exe Token: SeCreateTokenPrivilege 2532 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2532 msiexec.exe Token: SeLockMemoryPrivilege 2532 msiexec.exe Token: SeIncreaseQuotaPrivilege 2532 msiexec.exe Token: SeMachineAccountPrivilege 2532 msiexec.exe Token: SeTcbPrivilege 2532 msiexec.exe Token: SeSecurityPrivilege 2532 msiexec.exe Token: SeTakeOwnershipPrivilege 2532 msiexec.exe Token: SeLoadDriverPrivilege 2532 msiexec.exe Token: SeSystemProfilePrivilege 2532 msiexec.exe Token: SeSystemtimePrivilege 2532 msiexec.exe Token: SeProfSingleProcessPrivilege 2532 msiexec.exe Token: SeIncBasePriorityPrivilege 2532 msiexec.exe Token: SeCreatePagefilePrivilege 2532 msiexec.exe Token: SeCreatePermanentPrivilege 2532 msiexec.exe Token: SeBackupPrivilege 2532 msiexec.exe Token: SeRestorePrivilege 2532 msiexec.exe Token: SeShutdownPrivilege 2532 msiexec.exe Token: SeDebugPrivilege 2532 msiexec.exe Token: SeAuditPrivilege 2532 msiexec.exe Token: SeSystemEnvironmentPrivilege 2532 msiexec.exe Token: SeChangeNotifyPrivilege 2532 msiexec.exe Token: SeRemoteShutdownPrivilege 2532 msiexec.exe Token: SeUndockPrivilege 2532 msiexec.exe Token: SeSyncAgentPrivilege 2532 msiexec.exe Token: SeEnableDelegationPrivilege 2532 msiexec.exe Token: SeManageVolumePrivilege 2532 msiexec.exe Token: SeImpersonatePrivilege 2532 msiexec.exe Token: SeCreateGlobalPrivilege 2532 msiexec.exe Token: SeCreateTokenPrivilege 2532 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2532 msiexec.exe Token: SeLockMemoryPrivilege 2532 msiexec.exe Token: SeIncreaseQuotaPrivilege 2532 msiexec.exe Token: SeMachineAccountPrivilege 2532 msiexec.exe Token: SeTcbPrivilege 2532 msiexec.exe Token: SeSecurityPrivilege 2532 msiexec.exe Token: SeTakeOwnershipPrivilege 2532 msiexec.exe Token: SeLoadDriverPrivilege 2532 msiexec.exe Token: SeSystemProfilePrivilege 2532 msiexec.exe Token: SeSystemtimePrivilege 2532 msiexec.exe Token: SeProfSingleProcessPrivilege 2532 msiexec.exe Token: SeIncBasePriorityPrivilege 2532 msiexec.exe Token: SeCreatePagefilePrivilege 2532 msiexec.exe Token: SeCreatePermanentPrivilege 2532 msiexec.exe Token: SeBackupPrivilege 2532 msiexec.exe Token: SeRestorePrivilege 2532 msiexec.exe Token: SeShutdownPrivilege 2532 msiexec.exe Token: SeDebugPrivilege 2532 msiexec.exe Token: SeAuditPrivilege 2532 msiexec.exe Token: SeSystemEnvironmentPrivilege 2532 msiexec.exe Token: SeChangeNotifyPrivilege 2532 msiexec.exe Token: SeRemoteShutdownPrivilege 2532 msiexec.exe Token: SeUndockPrivilege 2532 msiexec.exe Token: SeSyncAgentPrivilege 2532 msiexec.exe Token: SeEnableDelegationPrivilege 2532 msiexec.exe Token: SeManageVolumePrivilege 2532 msiexec.exe Token: SeImpersonatePrivilege 2532 msiexec.exe Token: SeCreateGlobalPrivilege 2532 msiexec.exe Token: SeCreateTokenPrivilege 2532 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2532 msiexec.exe 2532 msiexec.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 1992 wrote to memory of 3068 1992 msiexec.exe 29 PID 1992 wrote to memory of 3068 1992 msiexec.exe 29 PID 1992 wrote to memory of 3068 1992 msiexec.exe 29 PID 1992 wrote to memory of 3068 1992 msiexec.exe 29 PID 1992 wrote to memory of 3068 1992 msiexec.exe 29 PID 1992 wrote to memory of 3068 1992 msiexec.exe 29 PID 1992 wrote to memory of 3068 1992 msiexec.exe 29 PID 1992 wrote to memory of 2436 1992 msiexec.exe 35 PID 1992 wrote to memory of 2436 1992 msiexec.exe 35 PID 1992 wrote to memory of 2436 1992 msiexec.exe 35 PID 1992 wrote to memory of 2436 1992 msiexec.exe 35 PID 1992 wrote to memory of 2436 1992 msiexec.exe 35 PID 1992 wrote to memory of 2436 1992 msiexec.exe 35 PID 1992 wrote to memory of 2436 1992 msiexec.exe 35 PID 1992 wrote to memory of 2416 1992 msiexec.exe 36 PID 1992 wrote to memory of 2416 1992 msiexec.exe 36 PID 1992 wrote to memory of 2416 1992 msiexec.exe 36 PID 1992 wrote to memory of 2416 1992 msiexec.exe 36 PID 1992 wrote to memory of 2416 1992 msiexec.exe 36 PID 1992 wrote to memory of 2416 1992 msiexec.exe 36 PID 1992 wrote to memory of 2416 1992 msiexec.exe 36 PID 1680 wrote to memory of 1092 1680 cmd.exe 39 PID 1680 wrote to memory of 1092 1680 cmd.exe 39 PID 1680 wrote to memory of 1092 1680 cmd.exe 39 PID 1680 wrote to memory of 2440 1680 cmd.exe 41 PID 1680 wrote to memory of 2440 1680 cmd.exe 41 PID 1680 wrote to memory of 2440 1680 cmd.exe 41 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\ChatGPT4 V2.msi"1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2532
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 99537101B429E120CEFC009F03DFC0A4 C2⤵
- Loads dropped DLL
PID:3068
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding AD814ECF5F5218B6A1FC27AADCDDA7592⤵
- Loads dropped DLL
PID:2436
-
-
C:\Windows\Installer\MSI607F.tmp"C:\Windows\Installer\MSI607F.tmp" "C:\Program Files (x86)\Open Ai\ChatGPT4 V2\setup.bat"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2416
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:3048
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "000000000000032C" "000000000000055C"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1828
-
C:\Windows\system32\cmd.execmd /c ""C:\Program Files (x86)\Open Ai\ChatGPT4 V2\setup.bat" "1⤵
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\system32\taskkill.exetaskkill /F /IM chrome.exe2⤵
- Kills process with taskkill
PID:1092
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:2440
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
434KB
MD506bca07547665f9ad4169ad8122b5b1a
SHA199007b1d44fa4f80baefdfb17897ae8f6adde560
SHA25671a6374ecb59de4a38143e76d52f6f56a107fc68e76763d8fcdf595bf1dab2d2
SHA512ab9ca6c3a17655031a6e0f83bee8fa142a03c6540d714e49d08fa1f97cefd6bf84bd64914eefccfe559d51c6b8e23f23458eb9c51e4e95b5fb6db8567515ad6b
-
Filesize
147B
MD522e11974dc91658dd48aed713dda5e4d
SHA17df4fd1039b112ec1e1af0a2cb814bb1664b437f
SHA256dc34a35e5d0a47ab2735990842d248687881a0e72a48cfa38633ad4121ae6841
SHA512d696eb075bac6f7d41e6b66e3fef94f78b5be8c793e41ce6fb8bb60fd26bf3de4cbb03bae1f6c492620ac7747b9e21787eb467b86c28cdfbb531066125b1dd29
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52071e44cc599bde28f502ed788b7c196
SHA16b77d6078acbf4c3b05bae6f7dfd1c16790c33b2
SHA25609f2a32f133df766aa64233bd438e6b38291a34168425b12291673e2dbb1aeee
SHA51221b75d907cb19161e3593d098a26aedb0e3e45209c3084ae3bc3d9ace647be18ef62c69720eb9b654ba669324d77c11061cafce9fab6ab93e1d58d1817269b5a
-
Filesize
62KB
MD53ac860860707baaf32469fa7cc7c0192
SHA1c33c2acdaba0e6fa41fd2f00f186804722477639
SHA256d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904
SHA512d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c
-
Filesize
587KB
MD5c7fbd5ee98e32a77edf1156db3fca622
SHA13e534fc55882e9fb940c9ae81e6f8a92a07125a0
SHA256e140990b509dd6884a5742bde64f2cdaa10012d472b0b32de43ebecbc83242b6
SHA5128691ac8b214cc1e4f34a3ab2bbc0c2391f7f11ebbe5db0dc82825195b5fe5a05310ed1e14d253a9b74a64050d2f2a6623dd2fcd912f80fef51e51845ef1e3a1a
-
Filesize
587KB
MD5c7fbd5ee98e32a77edf1156db3fca622
SHA13e534fc55882e9fb940c9ae81e6f8a92a07125a0
SHA256e140990b509dd6884a5742bde64f2cdaa10012d472b0b32de43ebecbc83242b6
SHA5128691ac8b214cc1e4f34a3ab2bbc0c2391f7f11ebbe5db0dc82825195b5fe5a05310ed1e14d253a9b74a64050d2f2a6623dd2fcd912f80fef51e51845ef1e3a1a
-
Filesize
587KB
MD5c7fbd5ee98e32a77edf1156db3fca622
SHA13e534fc55882e9fb940c9ae81e6f8a92a07125a0
SHA256e140990b509dd6884a5742bde64f2cdaa10012d472b0b32de43ebecbc83242b6
SHA5128691ac8b214cc1e4f34a3ab2bbc0c2391f7f11ebbe5db0dc82825195b5fe5a05310ed1e14d253a9b74a64050d2f2a6623dd2fcd912f80fef51e51845ef1e3a1a
-
Filesize
587KB
MD5c7fbd5ee98e32a77edf1156db3fca622
SHA13e534fc55882e9fb940c9ae81e6f8a92a07125a0
SHA256e140990b509dd6884a5742bde64f2cdaa10012d472b0b32de43ebecbc83242b6
SHA5128691ac8b214cc1e4f34a3ab2bbc0c2391f7f11ebbe5db0dc82825195b5fe5a05310ed1e14d253a9b74a64050d2f2a6623dd2fcd912f80fef51e51845ef1e3a1a
-
Filesize
587KB
MD5c7fbd5ee98e32a77edf1156db3fca622
SHA13e534fc55882e9fb940c9ae81e6f8a92a07125a0
SHA256e140990b509dd6884a5742bde64f2cdaa10012d472b0b32de43ebecbc83242b6
SHA5128691ac8b214cc1e4f34a3ab2bbc0c2391f7f11ebbe5db0dc82825195b5fe5a05310ed1e14d253a9b74a64050d2f2a6623dd2fcd912f80fef51e51845ef1e3a1a
-
Filesize
587KB
MD5c7fbd5ee98e32a77edf1156db3fca622
SHA13e534fc55882e9fb940c9ae81e6f8a92a07125a0
SHA256e140990b509dd6884a5742bde64f2cdaa10012d472b0b32de43ebecbc83242b6
SHA5128691ac8b214cc1e4f34a3ab2bbc0c2391f7f11ebbe5db0dc82825195b5fe5a05310ed1e14d253a9b74a64050d2f2a6623dd2fcd912f80fef51e51845ef1e3a1a
-
Filesize
164KB
MD54ff65ad929cd9a367680e0e5b1c08166
SHA1c0af0d4396bd1f15c45f39d3b849ba444233b3a2
SHA256c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6
SHA512f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27
-
Filesize
587KB
MD5c7fbd5ee98e32a77edf1156db3fca622
SHA13e534fc55882e9fb940c9ae81e6f8a92a07125a0
SHA256e140990b509dd6884a5742bde64f2cdaa10012d472b0b32de43ebecbc83242b6
SHA5128691ac8b214cc1e4f34a3ab2bbc0c2391f7f11ebbe5db0dc82825195b5fe5a05310ed1e14d253a9b74a64050d2f2a6623dd2fcd912f80fef51e51845ef1e3a1a
-
Filesize
426KB
MD5535e793419b64095926beb728f4dea71
SHA1b5d357c2ae4bb8cf1fca80f6a44ad3bbe5b31c49
SHA256268fece297ae16ec1706ba1ab8ffdce8e9db4ee8d73b7728a0df97cecd26930f
SHA5128facff499bfeeaa85884e1169ffdd0059d0c2bf1edcd17c4b118d3de3eeae79267451cee9d3bb2d8a5478d414e6d831d8f9f9e602a9452f3df4505dcc8b2cbe4
-
Filesize
1.3MB
MD50f77fb52cbe9489be260f739f4cbfce0
SHA128236b7b22ad00cfb14b7c04940a1dcb75262538
SHA2565396c6c41584959beea2b5058c5e90d776d2908fbdfaeb08cda924c00b9bd9db
SHA512d1debb3fb41df91b1e2173a6784b6be527713c2ca9228f0b22b07e2f4dbf95824652463d2ca767bd5f4d183667925aceabcbcaa5e048162fe60b7c2b33063b71
-
Filesize
587KB
MD5c7fbd5ee98e32a77edf1156db3fca622
SHA13e534fc55882e9fb940c9ae81e6f8a92a07125a0
SHA256e140990b509dd6884a5742bde64f2cdaa10012d472b0b32de43ebecbc83242b6
SHA5128691ac8b214cc1e4f34a3ab2bbc0c2391f7f11ebbe5db0dc82825195b5fe5a05310ed1e14d253a9b74a64050d2f2a6623dd2fcd912f80fef51e51845ef1e3a1a
-
Filesize
587KB
MD5c7fbd5ee98e32a77edf1156db3fca622
SHA13e534fc55882e9fb940c9ae81e6f8a92a07125a0
SHA256e140990b509dd6884a5742bde64f2cdaa10012d472b0b32de43ebecbc83242b6
SHA5128691ac8b214cc1e4f34a3ab2bbc0c2391f7f11ebbe5db0dc82825195b5fe5a05310ed1e14d253a9b74a64050d2f2a6623dd2fcd912f80fef51e51845ef1e3a1a
-
Filesize
587KB
MD5c7fbd5ee98e32a77edf1156db3fca622
SHA13e534fc55882e9fb940c9ae81e6f8a92a07125a0
SHA256e140990b509dd6884a5742bde64f2cdaa10012d472b0b32de43ebecbc83242b6
SHA5128691ac8b214cc1e4f34a3ab2bbc0c2391f7f11ebbe5db0dc82825195b5fe5a05310ed1e14d253a9b74a64050d2f2a6623dd2fcd912f80fef51e51845ef1e3a1a
-
Filesize
587KB
MD5c7fbd5ee98e32a77edf1156db3fca622
SHA13e534fc55882e9fb940c9ae81e6f8a92a07125a0
SHA256e140990b509dd6884a5742bde64f2cdaa10012d472b0b32de43ebecbc83242b6
SHA5128691ac8b214cc1e4f34a3ab2bbc0c2391f7f11ebbe5db0dc82825195b5fe5a05310ed1e14d253a9b74a64050d2f2a6623dd2fcd912f80fef51e51845ef1e3a1a
-
Filesize
587KB
MD5c7fbd5ee98e32a77edf1156db3fca622
SHA13e534fc55882e9fb940c9ae81e6f8a92a07125a0
SHA256e140990b509dd6884a5742bde64f2cdaa10012d472b0b32de43ebecbc83242b6
SHA5128691ac8b214cc1e4f34a3ab2bbc0c2391f7f11ebbe5db0dc82825195b5fe5a05310ed1e14d253a9b74a64050d2f2a6623dd2fcd912f80fef51e51845ef1e3a1a
-
Filesize
587KB
MD5c7fbd5ee98e32a77edf1156db3fca622
SHA13e534fc55882e9fb940c9ae81e6f8a92a07125a0
SHA256e140990b509dd6884a5742bde64f2cdaa10012d472b0b32de43ebecbc83242b6
SHA5128691ac8b214cc1e4f34a3ab2bbc0c2391f7f11ebbe5db0dc82825195b5fe5a05310ed1e14d253a9b74a64050d2f2a6623dd2fcd912f80fef51e51845ef1e3a1a