Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
09-01-2024 01:10
Static task
static1
Behavioral task
behavioral1
Sample
cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe
Resource
win7-20231129-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe
-
Size
37.0MB
-
MD5
0774bcc9644b63c0671d822bde125dfb
-
SHA1
ca12f671662d9d0d4706b57be7b3ec7ee24f1960
-
SHA256
cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d
-
SHA512
36ae678b414339da320de1e16aa32dd1c3d32dfcc96f2807a8bf086e0c067355edb8584e8e544f877e985f7a91214235b52774763dcb4eaab06f5d9ebfa095f5
-
SSDEEP
786432:3/fOeOXqZ9hZ9uOOYZ9hZ9yOoe7Xu6toZR1nTDT7gCUU6nIarhFkWkX5rRwGdUEx:kRDGwZR1/TcCJGzrz85dwa1x
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe File opened (read-only) \??\S: cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe File opened (read-only) \??\U: cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe File opened (read-only) \??\V: cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\E: cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe File opened (read-only) \??\H: cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe File opened (read-only) \??\T: cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe File opened (read-only) \??\Z: cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\I: cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe File opened (read-only) \??\X: cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\A: cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe File opened (read-only) \??\J: cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe File opened (read-only) \??\K: cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe File opened (read-only) \??\L: cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe File opened (read-only) \??\N: cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe File opened (read-only) \??\O: cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe File opened (read-only) \??\P: cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe File opened (read-only) \??\Y: cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\G: cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe File opened (read-only) \??\M: cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe File opened (read-only) \??\S: msiexec.exe -
Loads dropped DLL 2 IoCs
pid Process 2712 MsiExec.exe 2712 MsiExec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2800 2028 WerFault.exe 27 -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 2624 msiexec.exe Token: SeTakeOwnershipPrivilege 2624 msiexec.exe Token: SeSecurityPrivilege 2624 msiexec.exe Token: SeCreateTokenPrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeAssignPrimaryTokenPrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeLockMemoryPrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeIncreaseQuotaPrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeMachineAccountPrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeTcbPrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeSecurityPrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeTakeOwnershipPrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeLoadDriverPrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeSystemProfilePrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeSystemtimePrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeProfSingleProcessPrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeIncBasePriorityPrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeCreatePagefilePrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeCreatePermanentPrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeBackupPrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeRestorePrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeShutdownPrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeDebugPrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeAuditPrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeSystemEnvironmentPrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeChangeNotifyPrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeRemoteShutdownPrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeUndockPrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeSyncAgentPrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeEnableDelegationPrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeManageVolumePrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeImpersonatePrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeCreateGlobalPrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeCreateTokenPrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeAssignPrimaryTokenPrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeLockMemoryPrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeIncreaseQuotaPrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeMachineAccountPrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeTcbPrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeSecurityPrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeTakeOwnershipPrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeLoadDriverPrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeSystemProfilePrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeSystemtimePrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeProfSingleProcessPrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeIncBasePriorityPrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeCreatePagefilePrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeCreatePermanentPrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeBackupPrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeRestorePrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeShutdownPrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeDebugPrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeAuditPrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeSystemEnvironmentPrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeChangeNotifyPrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeRemoteShutdownPrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeUndockPrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeSyncAgentPrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeEnableDelegationPrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeManageVolumePrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeImpersonatePrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeCreateGlobalPrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeCreateTokenPrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeAssignPrimaryTokenPrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe Token: SeLockMemoryPrivilege 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2624 wrote to memory of 2712 2624 msiexec.exe 29 PID 2624 wrote to memory of 2712 2624 msiexec.exe 29 PID 2624 wrote to memory of 2712 2624 msiexec.exe 29 PID 2624 wrote to memory of 2712 2624 msiexec.exe 29 PID 2624 wrote to memory of 2712 2624 msiexec.exe 29 PID 2624 wrote to memory of 2712 2624 msiexec.exe 29 PID 2624 wrote to memory of 2712 2624 msiexec.exe 29 PID 2028 wrote to memory of 2800 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe 30 PID 2028 wrote to memory of 2800 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe 30 PID 2028 wrote to memory of 2800 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe 30 PID 2028 wrote to memory of 2800 2028 cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe"C:\Users\Admin\AppData\Local\Temp\cd1e7592bd0239f27319691d400d29022d61a096f7da871369beeefc0e19712d.exe"1⤵
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 12522⤵
- Program crash
PID:2800
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 24A0DCDBF54200A8A708E40EA7F8515F C2⤵
- Loads dropped DLL
PID:2712
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
721KB
MD55a1f2196056c0a06b79a77ae981c7761
SHA1a880ae54395658f129e24732800e207ecd0b5603
SHA25652f41817669af7ac55b1516894ee705245c3148f2997fa0e6617e9cc6353e41e
SHA5129afc180ebc10c0ee0d7306f4b7085608a4e69321044d474691587bf7e63f945888781a9fc5e69568d351ac690b0335214bd04bdf5c75fd8a3bd1ec4be5d3475a
-
Filesize
129KB
MD54d9449a39ee0f50249b02d3bcc979ac6
SHA12a16385a61d6342be729807b7f0adec0167e106c
SHA256172f82f86b78a49742ded431a5eb025ed5add64955e532588958af3805fe917d
SHA512aaea35e1653b3dc3890c18aaa8471f0fa7a666d6e33e81f91985c3efa6fe8d752ea7da6a0415ed870a7242749b9123f5f575f6600929705a9b1651a0dcc8935d
-
Filesize
1.9MB
MD53e7ca40590b3ca251863b6fc4fcef43e
SHA16b3042f34ff53e43ab31f9aadddc00ab24cff119
SHA2561b663dfcf52ed976b39371d341af8219bd758306ff2bef05e583c46818d437a2
SHA51228dd97fc9ec8aee8bc7e72cbd46cd7ec5a2b690a90f5ada9650e17a040152a86cdd7acf55e0e89c76dbb93b75c0a47261527f45d7695be864dda96058ed9520d
-
Filesize
838KB
MD54a3f6a4023abd6bba56534de47d20017
SHA102dd888e467143e2e35465d73f39cf3e66afad10
SHA256a8dfdc283ad8d4dc6f500ddfab564e79dadae075c0d54784b50e1ca548709b30
SHA512580c7918ef90eb0020901bab645b72bcaf945ceb5bd56c2e7847f229b31a961bc4cd4ca9cb2583db480947ca8a0880b5ae4bd26717217abcacc9754352aaba28