Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
26/11/2023, 13:33
Static task
static1
Behavioral task
behavioral1
Sample
4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe
Resource
win7-20231023-en
General
-
Target
4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe
-
Size
6.1MB
-
MD5
4a657cf9c1289e3df987268e32961a66
-
SHA1
77167ba7c7adb768ba4a1a0d561a8828e73f5035
-
SHA256
4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579
-
SHA512
3515c161728c0294b822cfb8a313d85dfb9305e6283f533d20b61894468129012991bec1709e001a8067660668aa6c3a2894273a8f251c3cc15cc0d548a88976
-
SSDEEP
98304:QAs++BUHecpbpx+sborjZGS/maM8jwsWjMZd3CuwQ3dm0vZ0QgKuEf:QAKBx4px+sNgHW4H3CkZqEf
Malware Config
Extracted
bumblebee
onkomsi2
-
dga
n64c2akw.life
zefawfb0.life
dph3pby8.life
hx0hysyg.life
1qa3k743.life
luw8ubf2.life
rbvsf6io.life
4huoqrsp.life
8qwcvseh.life
37zi55wc.life
i9f44mju.life
aqnx9c9h.life
3nmeg5wa.life
r5ue5rok.life
et53yjoc.life
tvgco82h.life
0xtmu3tz.life
6xhpschv.life
6o26tws0.life
0oz7923s.life
54y2q50j.life
9hh7hq5r.life
r0ca080m.life
43vtghfz.life
qal55els.life
p5e68m36.life
x698iah6.life
kqn0zkig.life
wq6w8jkq.life
i6n08gx7.life
yykdmh0r.life
is45ipqt.life
btycmaq0.life
bei9dppm.life
3jhcm6ou.life
1q04n1r6.life
10ciy2hb.life
11ou1grl.life
83b0leyy.life
t31jn4t1.life
b24f19ne.life
igak9l9s.life
hkgd9kar.life
02uhomlq.life
zpy1vssg.life
j57fzy12.life
zmlly8xo.life
pe6r5tzc.life
cg4cuoyi.life
pyjijjlm.life
m3vc2ce4.life
p1p97dov.life
ep0kbvph.life
0rlxan4o.life
zdx0i18o.life
7kmzys39.life
e97igyz6.life
hjcbhzd8.life
az77sw77.life
d0k4fdaa.life
c9l8ri53.life
ay03u2te.life
t99iv15x.life
6a1fbhay.life
zna5lybe.life
vxyojl27.life
mddoknvi.life
2z2dl1og.life
vojg90l2.life
awr5omre.life
tcjcv520.life
aqjjchti.life
6qwim2j8.life
1p34o0do.life
8hxwl72r.life
wykpnxcx.life
o10qz4xe.life
7564a2mg.life
aiv8bb2b.life
jwyxm0f3.life
4soexc4m.life
3xqy6csn.life
3k8iq1nb.life
w2hje2t7.life
fra3xqrx.life
4r3inwrt.life
qhfoevow.life
a9nhflze.life
jpngew6a.life
baunjh6t.life
yqofro9q.life
uq034w07.life
oq36weoi.life
vv5sfo80.life
0req10rd.life
m4v4xq2f.life
1p24echu.life
ohwv1vpp.life
z2tp7x2v.life
q65io756.life
-
dga_seed
anjd78ka
-
domain_length
8
-
num_dga_domains
100
-
port
443
Signatures
-
Loads dropped DLL 7 IoCs
pid Process 1912 MsiExec.exe 1912 MsiExec.exe 2720 MsiExec.exe 2720 MsiExec.exe 2720 MsiExec.exe 2484 MsiExec.exe 2720 MsiExec.exe -
Blocklisted process makes network request 4 IoCs
flow pid Process 4 2832 msiexec.exe 5 2564 msiexec.exe 11 2484 MsiExec.exe 13 2484 MsiExec.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe File opened (read-only) \??\S: 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\E: 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe File opened (read-only) \??\V: 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\M: 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe File opened (read-only) \??\Q: 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Y: 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\U: 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe File opened (read-only) \??\R: 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe File opened (read-only) \??\B: 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe File opened (read-only) \??\H: 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Z: 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\N: 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe File opened (read-only) \??\O: 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\L: 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\I: 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe File opened (read-only) \??\J: 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\B: msiexec.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 2484 MsiExec.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI4B2C.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI504B.tmp msiexec.exe File created C:\Windows\Installer\f764357.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI484B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4A20.tmp msiexec.exe File created C:\Windows\Installer\f76435a.ipi msiexec.exe File opened for modification C:\Windows\Installer\f76435a.ipi msiexec.exe File opened for modification C:\Windows\Installer\f764357.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI4619.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4A60.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2564 msiexec.exe 2564 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2832 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 2564 msiexec.exe Token: SeTakeOwnershipPrivilege 2564 msiexec.exe Token: SeSecurityPrivilege 2564 msiexec.exe Token: SeCreateTokenPrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeAssignPrimaryTokenPrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeLockMemoryPrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeIncreaseQuotaPrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeMachineAccountPrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeTcbPrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeSecurityPrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeTakeOwnershipPrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeLoadDriverPrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeSystemProfilePrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeSystemtimePrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeProfSingleProcessPrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeIncBasePriorityPrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeCreatePagefilePrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeCreatePermanentPrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeBackupPrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeRestorePrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeShutdownPrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeDebugPrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeAuditPrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeSystemEnvironmentPrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeChangeNotifyPrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeRemoteShutdownPrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeUndockPrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeSyncAgentPrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeEnableDelegationPrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeManageVolumePrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeImpersonatePrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeCreateGlobalPrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeCreateTokenPrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeAssignPrimaryTokenPrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeLockMemoryPrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeIncreaseQuotaPrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeMachineAccountPrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeTcbPrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeSecurityPrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeTakeOwnershipPrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeLoadDriverPrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeSystemProfilePrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeSystemtimePrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeProfSingleProcessPrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeIncBasePriorityPrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeCreatePagefilePrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeCreatePermanentPrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeBackupPrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeRestorePrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeShutdownPrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeDebugPrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeAuditPrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeSystemEnvironmentPrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeChangeNotifyPrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeRemoteShutdownPrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeUndockPrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeSyncAgentPrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeEnableDelegationPrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeManageVolumePrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeImpersonatePrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeCreateGlobalPrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeCreateTokenPrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeAssignPrimaryTokenPrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe Token: SeLockMemoryPrivilege 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2832 msiexec.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 2564 wrote to memory of 1912 2564 msiexec.exe 29 PID 2564 wrote to memory of 1912 2564 msiexec.exe 29 PID 2564 wrote to memory of 1912 2564 msiexec.exe 29 PID 2564 wrote to memory of 1912 2564 msiexec.exe 29 PID 2564 wrote to memory of 1912 2564 msiexec.exe 29 PID 2564 wrote to memory of 1912 2564 msiexec.exe 29 PID 2564 wrote to memory of 1912 2564 msiexec.exe 29 PID 2136 wrote to memory of 2832 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe 30 PID 2136 wrote to memory of 2832 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe 30 PID 2136 wrote to memory of 2832 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe 30 PID 2136 wrote to memory of 2832 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe 30 PID 2136 wrote to memory of 2832 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe 30 PID 2136 wrote to memory of 2832 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe 30 PID 2136 wrote to memory of 2832 2136 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe 30 PID 2564 wrote to memory of 2720 2564 msiexec.exe 31 PID 2564 wrote to memory of 2720 2564 msiexec.exe 31 PID 2564 wrote to memory of 2720 2564 msiexec.exe 31 PID 2564 wrote to memory of 2720 2564 msiexec.exe 31 PID 2564 wrote to memory of 2720 2564 msiexec.exe 31 PID 2564 wrote to memory of 2720 2564 msiexec.exe 31 PID 2564 wrote to memory of 2720 2564 msiexec.exe 31 PID 2564 wrote to memory of 2484 2564 msiexec.exe 32 PID 2564 wrote to memory of 2484 2564 msiexec.exe 32 PID 2564 wrote to memory of 2484 2564 msiexec.exe 32 PID 2564 wrote to memory of 2484 2564 msiexec.exe 32 PID 2564 wrote to memory of 2484 2564 msiexec.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe"C:\Users\Admin\AppData\Local\Temp\4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe"1⤵
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\security update\security update 1.5.2.3\install\A6B488A\security update.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1700746217 " AI_EUIMSI=""2⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:2832
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 71AA1B5FA7C1B2A5B74EBAC0B117FC54 C2⤵
- Loads dropped DLL
PID:1912
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 99D0D946745E815224388EDB299FA3E92⤵
- Loads dropped DLL
PID:2720
-
-
C:\Windows\system32\MsiExec.exeC:\Windows\system32\MsiExec.exe -Embedding 96E871CECFE934F827221C5EF47BD0242⤵
- Loads dropped DLL
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
PID:2484
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD576b08e4b08885d87820c1dac252d4efa
SHA1f0b6a12d23723d3f4831bf6e99abd24d9aef41c8
SHA256b4196524af4b4cbb83411e3e6e70831e0b852e4a423cf0415e3b681d15d18f93
SHA51260d67a36ab719ec4f7cdafa5e27311c9d78e77d2c593b299174c2b9ef54c617e8b970db4e376c3b57355d0336e71f932a6ac48059417ba4bceedd4656f5dca1f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5438375c1c7998ce493279f1a93138a90
SHA19473d884c9359abebd8bce18951472e64d992c8f
SHA256e152a08069f1bae9229108b2863318ffc3f5884bf4a9574c226f1dde5ece8ce8
SHA51225243ded0db84434f30e271cd2dea92945cf2f424db9d92d029dbcd860db3ed242bbcc5d5c17a6867c1ca1c9043cf791d342457dcf97abb33000f57475128a4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b06e59eeefff1da3d68e34a2971c5a14
SHA111a3f4259b668f664d27c4a8f8bb5782ed7ef4f0
SHA25694d0cbbd81a2da331d9c21046e455b9cdfc812daeb4aab24bef831053c59cac4
SHA5125210cf81423ac2cf465972ad3b8440920c65cf4334a280bc1ae1fdcdec1525fcb89624837581b23bc5beb1f2fe6202a320d319e7bf20536c18ca0e83c6eac4d0
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
Filesize
721KB
MD55a1f2196056c0a06b79a77ae981c7761
SHA1a880ae54395658f129e24732800e207ecd0b5603
SHA25652f41817669af7ac55b1516894ee705245c3148f2997fa0e6617e9cc6353e41e
SHA5129afc180ebc10c0ee0d7306f4b7085608a4e69321044d474691587bf7e63f945888781a9fc5e69568d351ac690b0335214bd04bdf5c75fd8a3bd1ec4be5d3475a
-
Filesize
721KB
MD55a1f2196056c0a06b79a77ae981c7761
SHA1a880ae54395658f129e24732800e207ecd0b5603
SHA25652f41817669af7ac55b1516894ee705245c3148f2997fa0e6617e9cc6353e41e
SHA5129afc180ebc10c0ee0d7306f4b7085608a4e69321044d474691587bf7e63f945888781a9fc5e69568d351ac690b0335214bd04bdf5c75fd8a3bd1ec4be5d3475a
-
Filesize
163KB
MD59441737383d21192400eca82fda910ec
SHA1725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA5127608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf
-
C:\Users\Admin\AppData\Roaming\security update\security update 1.5.2.3\install\A6B488A\security update.msi
Filesize7.8MB
MD5cbce77f88d5fd1df590d5172bbb83a2c
SHA165bd87e1c512e9cd60a3952e0712d0f67aa952e1
SHA2568ae7694001a73e0eebf0ea394396cd1aacc3a817e1e321da288e445f4feb1465
SHA5124d579a70782b99c4fb19398f9d7b430cbe5f9ee5b67dbf360f543fecd010aba373a43266b63b5e7bbe00f8636cdd7d9346806cdaffbaa02608c08310cd752ded
-
C:\Users\Admin\AppData\Roaming\security update\security update 1.5.2.3\install\A6B488A\security update.msi
Filesize7.8MB
MD5cbce77f88d5fd1df590d5172bbb83a2c
SHA165bd87e1c512e9cd60a3952e0712d0f67aa952e1
SHA2568ae7694001a73e0eebf0ea394396cd1aacc3a817e1e321da288e445f4feb1465
SHA5124d579a70782b99c4fb19398f9d7b430cbe5f9ee5b67dbf360f543fecd010aba373a43266b63b5e7bbe00f8636cdd7d9346806cdaffbaa02608c08310cd752ded
-
Filesize
721KB
MD55a1f2196056c0a06b79a77ae981c7761
SHA1a880ae54395658f129e24732800e207ecd0b5603
SHA25652f41817669af7ac55b1516894ee705245c3148f2997fa0e6617e9cc6353e41e
SHA5129afc180ebc10c0ee0d7306f4b7085608a4e69321044d474691587bf7e63f945888781a9fc5e69568d351ac690b0335214bd04bdf5c75fd8a3bd1ec4be5d3475a
-
Filesize
721KB
MD55a1f2196056c0a06b79a77ae981c7761
SHA1a880ae54395658f129e24732800e207ecd0b5603
SHA25652f41817669af7ac55b1516894ee705245c3148f2997fa0e6617e9cc6353e41e
SHA5129afc180ebc10c0ee0d7306f4b7085608a4e69321044d474691587bf7e63f945888781a9fc5e69568d351ac690b0335214bd04bdf5c75fd8a3bd1ec4be5d3475a
-
Filesize
721KB
MD55a1f2196056c0a06b79a77ae981c7761
SHA1a880ae54395658f129e24732800e207ecd0b5603
SHA25652f41817669af7ac55b1516894ee705245c3148f2997fa0e6617e9cc6353e41e
SHA5129afc180ebc10c0ee0d7306f4b7085608a4e69321044d474691587bf7e63f945888781a9fc5e69568d351ac690b0335214bd04bdf5c75fd8a3bd1ec4be5d3475a
-
Filesize
2.1MB
MD5bedb0f369ebb79dbcf856379ecb6566c
SHA14a8c27c1a2f0be31b73fdad222782648c9ce6b0c
SHA256189046093d0018570c1d9a12ad4aca14d4ccd65fb63d228275fd7067c24d2ecd
SHA51206a3d60bf011453711d2f1df385b28edc3815f6e108567169690821b3085b8fda526a123cfbacb6e42290a0576fa878c41cdebef77609367965df12a159a02ee
-
Filesize
721KB
MD55a1f2196056c0a06b79a77ae981c7761
SHA1a880ae54395658f129e24732800e207ecd0b5603
SHA25652f41817669af7ac55b1516894ee705245c3148f2997fa0e6617e9cc6353e41e
SHA5129afc180ebc10c0ee0d7306f4b7085608a4e69321044d474691587bf7e63f945888781a9fc5e69568d351ac690b0335214bd04bdf5c75fd8a3bd1ec4be5d3475a
-
Filesize
838KB
MD54a3f6a4023abd6bba56534de47d20017
SHA102dd888e467143e2e35465d73f39cf3e66afad10
SHA256a8dfdc283ad8d4dc6f500ddfab564e79dadae075c0d54784b50e1ca548709b30
SHA512580c7918ef90eb0020901bab645b72bcaf945ceb5bd56c2e7847f229b31a961bc4cd4ca9cb2583db480947ca8a0880b5ae4bd26717217abcacc9754352aaba28
-
Filesize
721KB
MD55a1f2196056c0a06b79a77ae981c7761
SHA1a880ae54395658f129e24732800e207ecd0b5603
SHA25652f41817669af7ac55b1516894ee705245c3148f2997fa0e6617e9cc6353e41e
SHA5129afc180ebc10c0ee0d7306f4b7085608a4e69321044d474691587bf7e63f945888781a9fc5e69568d351ac690b0335214bd04bdf5c75fd8a3bd1ec4be5d3475a
-
Filesize
721KB
MD55a1f2196056c0a06b79a77ae981c7761
SHA1a880ae54395658f129e24732800e207ecd0b5603
SHA25652f41817669af7ac55b1516894ee705245c3148f2997fa0e6617e9cc6353e41e
SHA5129afc180ebc10c0ee0d7306f4b7085608a4e69321044d474691587bf7e63f945888781a9fc5e69568d351ac690b0335214bd04bdf5c75fd8a3bd1ec4be5d3475a
-
Filesize
721KB
MD55a1f2196056c0a06b79a77ae981c7761
SHA1a880ae54395658f129e24732800e207ecd0b5603
SHA25652f41817669af7ac55b1516894ee705245c3148f2997fa0e6617e9cc6353e41e
SHA5129afc180ebc10c0ee0d7306f4b7085608a4e69321044d474691587bf7e63f945888781a9fc5e69568d351ac690b0335214bd04bdf5c75fd8a3bd1ec4be5d3475a
-
Filesize
721KB
MD55a1f2196056c0a06b79a77ae981c7761
SHA1a880ae54395658f129e24732800e207ecd0b5603
SHA25652f41817669af7ac55b1516894ee705245c3148f2997fa0e6617e9cc6353e41e
SHA5129afc180ebc10c0ee0d7306f4b7085608a4e69321044d474691587bf7e63f945888781a9fc5e69568d351ac690b0335214bd04bdf5c75fd8a3bd1ec4be5d3475a
-
Filesize
2.1MB
MD5bedb0f369ebb79dbcf856379ecb6566c
SHA14a8c27c1a2f0be31b73fdad222782648c9ce6b0c
SHA256189046093d0018570c1d9a12ad4aca14d4ccd65fb63d228275fd7067c24d2ecd
SHA51206a3d60bf011453711d2f1df385b28edc3815f6e108567169690821b3085b8fda526a123cfbacb6e42290a0576fa878c41cdebef77609367965df12a159a02ee
-
Filesize
721KB
MD55a1f2196056c0a06b79a77ae981c7761
SHA1a880ae54395658f129e24732800e207ecd0b5603
SHA25652f41817669af7ac55b1516894ee705245c3148f2997fa0e6617e9cc6353e41e
SHA5129afc180ebc10c0ee0d7306f4b7085608a4e69321044d474691587bf7e63f945888781a9fc5e69568d351ac690b0335214bd04bdf5c75fd8a3bd1ec4be5d3475a
-
Filesize
838KB
MD54a3f6a4023abd6bba56534de47d20017
SHA102dd888e467143e2e35465d73f39cf3e66afad10
SHA256a8dfdc283ad8d4dc6f500ddfab564e79dadae075c0d54784b50e1ca548709b30
SHA512580c7918ef90eb0020901bab645b72bcaf945ceb5bd56c2e7847f229b31a961bc4cd4ca9cb2583db480947ca8a0880b5ae4bd26717217abcacc9754352aaba28