Overview
overview
7Static
static
3SecuriteIn...90.exe
windows7-x64
6SecuriteIn...90.exe
windows10-2004-x64
6SCMx86/SCM...up.msi
windows7-x64
7SCMx86/SCM...up.msi
windows10-2004-x64
7SCMx86/msiexec.exe
windows7-x64
1SCMx86/msiexec.exe
windows10-2004-x64
1SCMx86/setup.exe
windows7-x64
7SCMx86/setup.exe
windows10-2004-x64
7Analysis
- max time kernel
118s - max time network
120s - platform
windows7_x64 - resource
win7-20231215-en - resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system - submitted
22/01/2024, 12:34
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe
Resource
win7-20231215-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral3
Sample
SCMx86/SCMx86Setup.msi
Resource
win7-20231215-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral4
Sample
SCMx86/SCMx86Setup.msi
Resource
win10v2004-20231215-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral5
Sample
SCMx86/msiexec.exe
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
SCMx86/msiexec.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
SCMx86/setup.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral8
Sample
SCMx86/setup.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe
- Size 3.7MB
- Sample240122-prrm8afdfl
- SHA256 83d48ca1aa2299d974223ddbb4ea182e7064e57d6dd5ead72d0088d71e444ae0
- MD5 3137bbf88d80a164b35def3024ef152a
- SHA1 c0bab2f371cdcd7bd53fd1cff6cadcd3505c4fa1
- SHA512 a59452c610fe845b00feff5a98972ebdc39f8ffbbb3261bed6d54eab5c3066bec5e2fd1c118d4880faf8402ede29d23934d7e98ba6feb9a64efab66c8baf7899
- SSDEEP 98304:uHLi/kJwZwPb9L/0rQq98ZU+LsXCKqRkMccz2938N:XYwgVqWjwCKibB
- MD5 SHA1 SHA512 SSDEEP
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SCM = "C:\\Program Files (x86)\\SCM\\SCM.exe" CloseSCM.exe - Blocklisted process makes network request 3 IoCs
flow pid Process 3 2744 msiexec.exe 5 2744 msiexec.exe 7 2744 msiexec.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\DeviceCount.exe msiexec.exe File created C:\Windows\SysWOW64\msiapcfg.dll msiexec.exe - Drops file in Program Files directory 21 IoCs
description ioc Process File created C:\Program Files (x86)\SCM\EyeTracking\Tobii.EyeX.Client.Net20.DLL msiexec.exe File created C:\Program Files (x86)\SCM\SCM.exe.config msiexec.exe File created C:\Program Files (x86)\SCM\MSIECO\TurboBattery.eps msiexec.exe File created C:\Program Files (x86)\SCM\SCM_Notice.exe msiexec.exe File created C:\Program Files (x86)\SCM\CloseSCM.exe msiexec.exe File created C:\Program Files (x86)\SCM\WPFOSD.dll msiexec.exe File created C:\Program Files (x86)\SCM\MSIECO\Presentation.eps msiexec.exe File created C:\Program Files (x86)\SCM\scm.ico msiexec.exe File created C:\Program Files (x86)\SCM\System.Windows.Interactivity.dll msiexec.exe File created C:\Program Files (x86)\SCM\MSIECO.dll msiexec.exe File created C:\Program Files (x86)\SCM\MSIECO\Office.eps msiexec.exe File created C:\Program Files (x86)\SCM\SCM.exe msiexec.exe File created C:\Program Files (x86)\SCM\MSIWmiAcpi.dll msiexec.exe File created C:\Program Files (x86)\SCM\EyeTracking\Tobii.EyeX.Client.dll msiexec.exe File created C:\Program Files (x86)\SCM\MSIECO\Gaming.eps msiexec.exe File created C:\Program Files (x86)\SCM\MSIODD.dll msiexec.exe File created C:\Program Files (x86)\SCM\EyeTracking\EyeXFramework.dll msiexec.exe File created C:\Program Files (x86)\SCM\MSIService.exe msiexec.exe File created C:\Program Files (x86)\SCM\MSIECO\Movie.eps msiexec.exe File created C:\Program Files (x86)\SCM\devcon.dll msiexec.exe File created C:\Program Files (x86)\SCM\EyeTracking\EyeTracking.exe msiexec.exe - Drops file in Windows directory 15 IoCs
description ioc Process File created C:\Windows\Installer\f7646c0.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI5337.tmp msiexec.exe File created C:\Windows\Installer\f7646c5.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI4CA0.tmp msiexec.exe File opened for modification C:\Windows\Installer\{0975A490-B40D-453C-9725-8ADC88A798AB}\_853F67D554F05449430E7E.exe msiexec.exe File created C:\Windows\Installer\{0975A490-B40D-453C-9725-8ADC88A798AB}\_AD220580923AF41B2768B2.exe msiexec.exe File opened for modification C:\Windows\Installer\{0975A490-B40D-453C-9725-8ADC88A798AB}\_AD220580923AF41B2768B2.exe msiexec.exe File created C:\Windows\Installer\{0975A490-B40D-453C-9725-8ADC88A798AB}\_7AFBD22CCAE1AC02EC4E31.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI4E65.tmp msiexec.exe File created C:\Windows\Installer\f7646c3.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\{0975A490-B40D-453C-9725-8ADC88A798AB}\_853F67D554F05449430E7E.exe msiexec.exe File opened for modification C:\Windows\Installer\f7646c3.ipi msiexec.exe File opened for modification C:\Windows\Installer\f7646c0.msi msiexec.exe File opened for modification C:\Windows\Installer\{0975A490-B40D-453C-9725-8ADC88A798AB}\_7AFBD22CCAE1AC02EC4E31.exe msiexec.exe - Executes dropped EXE 4 IoCs
pid Process 2904 setup.exe 1616 MSIService.exe 2180 MSIService.exe 268 CloseSCM.exe - Loads dropped DLL 5 IoCs
pid Process 1852 SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe 1704 MsiExec.exe 1704 MsiExec.exe 1616 MSIService.exe 2180 MSIService.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E msiexec.exe - Modifies registry class 46 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A896E75C4828C924F986BC4F4E78A17B msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|SCM|EyeTracking|EyeXFramework.dll msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|SCM|EyeTracking|EyeTracking.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\094A5790D04BC3547952A8CD887A89BA\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\094A5790D04BC3547952A8CD887A89BA\SourceList\Media\1 = ";" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\094A5790D04BC3547952A8CD887A89BA\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A896E75C4828C924F986BC4F4E78A17B\094A5790D04BC3547952A8CD887A89BA msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\094A5790D04BC3547952A8CD887A89BA msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\094A5790D04BC3547952A8CD887A89BA\DefaultFeature msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\094A5790D04BC3547952A8CD887A89BA\PackageCode = "23812CD4BD6C5A0408CCE10AB3133F54" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\094A5790D04BC3547952A8CD887A89BA\SourceList\PackageName = "SCMx86Setup.msi" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\094A5790D04BC3547952A8CD887A89BA\Clients = 3a0000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Windows|SysWOW64|DeviceCount.exe\DeviceCount,Version="1.0.2.1",Culture="neutral",ProcessorArchitecture="x86" = 2c0028004c00260026006c007800500039003d004c004b00750073006f0047006e006e00300060003e004f00560071006a004900400040004c0021007a004800260037003d0076002a006f006b007d00600000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|SCM|CloseSCM.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Windows|SysWOW64|DeviceCount.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|SCM|EyeTracking|Tobii.EyeX.Client.Net20.dll msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\094A5790D04BC3547952A8CD887A89BA\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\094A5790D04BC3547952A8CD887A89BA\SourceList\LastUsedSource = "n;1;C:\\Windows\\TEMP\\DRPTools\\SCMx86\\" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|SCM|EyeTracking|EyeXFramework.dll\EyeXFramework,Version="1.5.466.0",Culture="neutral",PublicKeyToken="70326046DCDCE6CB",ProcessorArchitecture="x86" = 2c0028004c00260026006c007800500039003d004c004b00750073006f0047006e006e00300060003e003300580031005900380065007d0045004400620075007d006c007d006c0033002600710034005a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|SCM|MSIECO.dll msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|SCM|EyeTracking|EyeTracking.exe\EyeTracking,Version="1.0.0.0",Culture="neutral",ProcessorArchitecture="x86" = 2c0028004c00260026006c007800500039003d004c004b00750073006f0047006e006e00300060003e006a00560074005e0058004a005e004b002c0037007a00370075006c00360047004d00620046005a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|SCM|SCM_Notice.exe msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\094A5790D04BC3547952A8CD887A89BA\SourceList\Net\1 = "C:\\Windows\\TEMP\\DRPTools\\SCMx86\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|SCM|EyeTracking|Tobii.EyeX.Client.Net20.DLL msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|SCM|EyeTracking|Tobii.EyeX.Client.Net20.DLL\Tobii.EyeX.Client.Net20,Version="1.5.466.0",Culture="neutral",PublicKeyToken="70326046DCDCE6CB",ProcessorArchitecture="x86" = 2c0028004c00260026006c007800500039003d004c004b00750073006f0047006e006e00300060003e002e0064004f002400240049007a0039007d0027005b00490057005d0070004e006f0063007500420000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|SCM|SCM_Notice.exe\SCM_Notice,Version="10.15.10073.0",Culture="neutral",ProcessorArchitecture="MSIL" = 2c0028004c00260026006c007800500039003d004c004b00750073006f0047006e006e00300060003e004f0059004600360025006600380043006e003d00710058007a0069007500670021002b003300680000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|SCM|SCM.exe msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|SCM|CloseSCM.exe\CloseSCM,Version="1.0.0.0",Culture="neutral",ProcessorArchitecture="x86" = 2c0028004c00260026006c007800500039003d004c004b00750073006f0047006e006e00300060003e006c0039006e00640027004c002500670037006a007400600042007e0070006b0063006f006b004b0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|SCM|WPFOSD.dll msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|SCM|MSIODD.dll msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\094A5790D04BC3547952A8CD887A89BA msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\094A5790D04BC3547952A8CD887A89BA\ProductName = "SCM" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\094A5790D04BC3547952A8CD887A89BA\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\094A5790D04BC3547952A8CD887A89BA\Version = "252708037" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\094A5790D04BC3547952A8CD887A89BA\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\094A5790D04BC3547952A8CD887A89BA\AuthorizedLUAApp = "0" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|SCM|WPFOSD.dll\WPFOSD,Version="1.0.0.0",Culture="neutral",ProcessorArchitecture="x86" = 2c0028004c00260026006c007800500039003d004c004b00750073006f0047006e006e00300060003e007b0036004e006b0024006e004b006a006f004d00530056002b0047002d00710073006c0041005e0000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|SCM|SCM.exe\SCM,Version="15.16.1221.0",Culture="neutral",ProcessorArchitecture="x86" = 2c0028004c00260026006c007800500039003d004c004b00750073006f0047006e006e00300060003e005e00460057005b00430053002e006c0053002e0028004b00770073006a0056005a0071006800580000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\094A5790D04BC3547952A8CD887A89BA\SourceList\Media msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|SCM|System.Windows.Interactivity.dll\System.Windows.Interactivity,Version="4.0.0.0",Culture="neutral",PublicKeyToken="31BF3856AD364E35",ProcessorArchitecture="MSIL" = 2c0028004c00260026006c007800500039003d004c004b00750073006f0047006e006e00300060003e004000680057005200610057004600450048005400700037003d00430029003000210021006400660000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|SCM|MSIODD.dll\MSIODD,Version="1.0.1008.2001",Culture="neutral",ProcessorArchitecture="MSIL" = 2c0028004c00260026006c007800500039003d004c004b00750073006f0047006e006e00300060003e00490071003d0039005500280024004b0046005e002e0061005200250071006d007e00490066005f0000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\094A5790D04BC3547952A8CD887A89BA\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\094A5790D04BC3547952A8CD887A89BA\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\094A5790D04BC3547952A8CD887A89BA\ProductIcon = "C:\\Windows\\Installer\\{0975A490-B40D-453C-9725-8ADC88A798AB}\\_853F67D554F05449430E7E.exe" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|SCM|MSIECO.dll\MSIECO,Version="1.0.1308.2003",Culture="neutral",ProcessorArchitecture="x86" = 2c0028004c00260026006c007800500039003d004c004b00750073006f0047006e006e00300060003e007900770058006200780031004b0060004b00290067002d005e00290069002800660029006a00470000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|SCM|System.Windows.Interactivity.dll msiexec.exe - Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2744 msiexec.exe 2744 msiexec.exe 268 CloseSCM.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2680 msiexec.exe Token: SeIncreaseQuotaPrivilege 2680 msiexec.exe Token: SeRestorePrivilege 2744 msiexec.exe Token: SeTakeOwnershipPrivilege 2744 msiexec.exe Token: SeSecurityPrivilege 2744 msiexec.exe Token: SeCreateTokenPrivilege 2680 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2680 msiexec.exe Token: SeLockMemoryPrivilege 2680 msiexec.exe Token: SeIncreaseQuotaPrivilege 2680 msiexec.exe Token: SeMachineAccountPrivilege 2680 msiexec.exe Token: SeTcbPrivilege 2680 msiexec.exe Token: SeSecurityPrivilege 2680 msiexec.exe Token: SeTakeOwnershipPrivilege 2680 msiexec.exe Token: SeLoadDriverPrivilege 2680 msiexec.exe Token: SeSystemProfilePrivilege 2680 msiexec.exe Token: SeSystemtimePrivilege 2680 msiexec.exe Token: SeProfSingleProcessPrivilege 2680 msiexec.exe Token: SeIncBasePriorityPrivilege 2680 msiexec.exe Token: SeCreatePagefilePrivilege 2680 msiexec.exe Token: SeCreatePermanentPrivilege 2680 msiexec.exe Token: SeBackupPrivilege 2680 msiexec.exe Token: SeRestorePrivilege 2680 msiexec.exe Token: SeShutdownPrivilege 2680 msiexec.exe Token: SeDebugPrivilege 2680 msiexec.exe Token: SeAuditPrivilege 2680 msiexec.exe Token: SeSystemEnvironmentPrivilege 2680 msiexec.exe Token: SeChangeNotifyPrivilege 2680 msiexec.exe Token: SeRemoteShutdownPrivilege 2680 msiexec.exe Token: SeUndockPrivilege 2680 msiexec.exe Token: SeSyncAgentPrivilege 2680 msiexec.exe Token: SeEnableDelegationPrivilege 2680 msiexec.exe Token: SeManageVolumePrivilege 2680 msiexec.exe Token: SeImpersonatePrivilege 2680 msiexec.exe Token: SeCreateGlobalPrivilege 2680 msiexec.exe Token: SeRestorePrivilege 2744 msiexec.exe Token: SeTakeOwnershipPrivilege 2744 msiexec.exe Token: SeRestorePrivilege 2744 msiexec.exe Token: SeTakeOwnershipPrivilege 2744 msiexec.exe Token: SeRestorePrivilege 2744 msiexec.exe Token: SeTakeOwnershipPrivilege 2744 msiexec.exe Token: SeRestorePrivilege 2744 msiexec.exe Token: SeTakeOwnershipPrivilege 2744 msiexec.exe Token: SeRestorePrivilege 2744 msiexec.exe Token: SeTakeOwnershipPrivilege 2744 msiexec.exe Token: SeDebugPrivilege 268 CloseSCM.exe Token: SeRestorePrivilege 2744 msiexec.exe Token: SeTakeOwnershipPrivilege 2744 msiexec.exe Token: SeRestorePrivilege 2744 msiexec.exe Token: SeTakeOwnershipPrivilege 2744 msiexec.exe Token: SeRestorePrivilege 2744 msiexec.exe Token: SeTakeOwnershipPrivilege 2744 msiexec.exe Token: SeRestorePrivilege 2744 msiexec.exe Token: SeTakeOwnershipPrivilege 2744 msiexec.exe Token: SeRestorePrivilege 2744 msiexec.exe Token: SeTakeOwnershipPrivilege 2744 msiexec.exe Token: SeRestorePrivilege 2744 msiexec.exe Token: SeTakeOwnershipPrivilege 2744 msiexec.exe Token: SeRestorePrivilege 2744 msiexec.exe Token: SeTakeOwnershipPrivilege 2744 msiexec.exe Token: SeRestorePrivilege 2744 msiexec.exe Token: SeTakeOwnershipPrivilege 2744 msiexec.exe Token: SeRestorePrivilege 2744 msiexec.exe Token: SeTakeOwnershipPrivilege 2744 msiexec.exe Token: SeRestorePrivilege 2744 msiexec.exe - Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 1852 wrote to memory of 2904 1852 SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe 28 PID 1852 wrote to memory of 2904 1852 SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe 28 PID 1852 wrote to memory of 2904 1852 SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe 28 PID 1852 wrote to memory of 2904 1852 SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe 28 PID 1852 wrote to memory of 2904 1852 SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe 28 PID 1852 wrote to memory of 2904 1852 SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe 28 PID 1852 wrote to memory of 2904 1852 SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe 28 PID 2904 wrote to memory of 2680 2904 setup.exe 29 PID 2904 wrote to memory of 2680 2904 setup.exe 29 PID 2904 wrote to memory of 2680 2904 setup.exe 29 PID 2904 wrote to memory of 2680 2904 setup.exe 29 PID 2904 wrote to memory of 2680 2904 setup.exe 29 PID 2904 wrote to memory of 2680 2904 setup.exe 29 PID 2904 wrote to memory of 2680 2904 setup.exe 29 PID 2744 wrote to memory of 1704 2744 msiexec.exe 31 PID 2744 wrote to memory of 1704 2744 msiexec.exe 31 PID 2744 wrote to memory of 1704 2744 msiexec.exe 31 PID 2744 wrote to memory of 1704 2744 msiexec.exe 31 PID 2744 wrote to memory of 1704 2744 msiexec.exe 31 PID 2744 wrote to memory of 1704 2744 msiexec.exe 31 PID 2744 wrote to memory of 1704 2744 msiexec.exe 31 PID 2744 wrote to memory of 1616 2744 msiexec.exe 32 PID 2744 wrote to memory of 1616 2744 msiexec.exe 32 PID 2744 wrote to memory of 1616 2744 msiexec.exe 32 PID 2744 wrote to memory of 1616 2744 msiexec.exe 32 PID 2744 wrote to memory of 268 2744 msiexec.exe 35 PID 2744 wrote to memory of 268 2744 msiexec.exe 35 PID 2744 wrote to memory of 268 2744 msiexec.exe 35 PID 2744 wrote to memory of 268 2744 msiexec.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Windows\TEMP\DRPTools\SCMx86\setup.exeC:\Windows\TEMP\DRPTools\SCMx86\setup.exe /quiet /norestart2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe" -I "C:\Windows\TEMP\DRPTools\SCMx86\SCMx86Setup.msi" /quiet /norestart3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2680
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding E99F15542EDE126359A100B12220A8182⤵
- Loads dropped DLL
PID:1704
-
-
C:\Program Files (x86)\SCM\MSIService.exe"C:\Program Files (x86)\SCM\MSIService.exe" -install2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1616
-
-
C:\Program Files (x86)\SCM\CloseSCM.exe"C:\Program Files (x86)\SCM\CloseSCM.exe" install2⤵
- Adds Run key to start application
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:268
-
-
C:\Program Files (x86)\SCM\MSIService.exe"C:\Program Files (x86)\SCM\MSIService.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2180
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\f7646c4.rbs
- Size 17KB
- SHA256 92e8b159868b92c501dc2348d03e8dfeb352d8df91d47352f35f064547bbff49
- MD5 3ea2ad0e07b323c71fbd73fc0f388a45
- SHA1 4399c1616fb3efd28a05544c7ac5a48e8ce568b0
- SHA512 2e218ea4b3eb25076ea9d7bcbf88b305f3c2798b4c49880bbccf5c3fc3363dbd8a8add8f21ad8e8ba75534816815fc769087cf2075bbf54366d7fe2303558b23
- SSDEEP 384:mE6Hcy1yjN5LN7T3thjd3J3SwHLKtv8CSulJjvZ3M3:mE68YkX53
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\SCM\CloseSCM.exe
- Size 8KB
- SHA256 fb1f08fb9992ecbb977c21ba40a7a2dc16a098fcc8d78d19327e48b88386ff7e
- MD5 16d77bf2c6331c2534e814d4b343d6d1
- SHA1 491be2c10bdd605d5b46bd880b336253856e72c1
- SHA512 e8dce39a6e061beab0cfdb49776ce2fbd6b9f6a4514726620ff32586baf237de2c99bda75e9e88304793fe6db05810d65e8971ebeec178c8d24fa558c1a9c326
- SSDEEP 96:Wi2gVnvwLPvH6RBZd6ZaQh0NdMYvfyqoFmsk3ojWNtAiYcqQBQmMTwa2:WfgaLPSvLhMcFoF5kRmiYchQmMc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\SCM\MSIService.exe
- Size 157KB
- SHA256 455175332156939b3cda4511a2a6c213abbfdb85eeeca98b6ab014c994f532c4
- MD5 71c6748ee8de938532057ef10b4b7e44
- SHA1 38e69392f154f30bffeb35b4672628f04afa1a8d
- SHA512 f72523e2a2e10d2293833f79d4dc288176b6b8745364d1489da09823c91fc38aa73f3d3bf6ccbbf9b40fcf4956770fedb0bd68e768fcc44536de65340b108070
- SSDEEP 3072:ZhOl5RrL7FY9RGm8fKSjBTZ1byGKPGLQNJC:bMRrL7FMRGmYvdTZ1bHO4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\SCM\MSIWmiAcpi.dll
- Size 1.5MB
- SHA256 feb03b0e9402c7fb2cf42932e45c6e981a508fd907c2790df592d9af2c799364
- MD5 bf99516240783951c995cc6342bd0bbb
- SHA1 aa68987c52ab594ba78d9c50faefd98107dc6d89
- SHA512 441ac61cae8db5e659375551197eda1362dfed873012576475c86f8db82fb8b46d5de04bcaba8a1753324d3f786474cef096f8691df0d1de3d540a3a18eb2d4f
- SSDEEP 49152:VfJwZ41oe4MeteLe9CNwwO7BOPEuIJgilGDH1XGv3mo+tJ4qlxeH:jE41oFMetetNwwGBOPEu4giEDVXZVtJq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\SCM\SCM.exe
- Size 291KB
- SHA256 9d88d81ba91b75cfdfc75f7529fbaeaea40cb962a25e1d1986d5906cc745a140
- MD5 d0132a4610b289f7870443f1be1d9e5c
- SHA1 057c4c42febc4cdea296c7b39e3fbdcc97a5ab01
- SHA512 11bd336163016733cf30f659acb6636ac906fd95d0d50a277d97c07a375a7ef8c2917e2ff592a6c979b6fabe6b8c2f581a9dbecd3f2e5bc0688d2e0be033ff14
- SSDEEP 6144:5bCSFR1r+sQzrdX/Le+nuUNmxAQH6q9lSFR9r+sQzrdX/LM+nuU9mxAQ:5WSFr0zl7nVgjagSFX0zlVnVQj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Cab4980.tmp
- Size 65KB
- SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
- MD5 ac05d27423a85adc1622c714f2cb6184
- SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
- SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
- SSDEEP 1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qgNzU:drVDJSeaDqV0FJwLhVkr282fF5U
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar4ACB.tmp
- Size 171KB
- SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
- MD5 9c0c641c06238516f27941aa1166d427
- SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
- SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
- SSDEEP 1536:+AuJ+lCUs0RvWqgCyPW5BXNWdm1wpyru2/3EwjYoz0VDTrubmt6mJp:+9J+q0RuXCyfdmAyru2/RAKtgp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI4CA0.tmp
- Size 231KB
- SHA256 82bba027d920fac29385c1a6752f2337a3ae4b1944a29a72d2864017abeaa8d9
- MD5 def1669123bc5bd8e9a3a93e7f68b58c
- SHA1 101e1f6e9795672319543b9e69f9cb62a3d55055
- SHA512 b4ff0e4dc094575ceb1be891a767ab5e5dc0a3f137f9e6863324942277ff35acc75f92f7105779f33f3e68d3e56a1bb5d82f2f87a03c0aaae600478602f15d8c
- SSDEEP 3072:A7jfONyT4c8Di/LCTcwALEBiWZPY9yPoKmr0o3au46KcqThxaMn7YObxnKbIzyYS:IRzCLbY92NLmPUj/u4yQ7wJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\{0975A490-B40D-453C-9725-8ADC88A798AB}\_7AFBD22CCAE1AC02EC4E31.exe
- Size 124KB
- SHA256 f072de7b5918e6c828a8713df4e53c8c0003fcdee6be4404a0f758b38369539c
- MD5 0cbe3a7eb39a686d259a7cf50bb8a0be
- SHA1 2a2b8f5cb15b0b3ddd50cd398190e2e79d736499
- SHA512 7030089cba8f9b94d24ed39a112fd044b4dbec6b3ab70e44d55a1bb0708573cf994d276d5ef7ea1bae77cd90fec2fd94c99f4facc919704890fd99fa01eb93f6
- SSDEEP 3072:tFgqmRyXJOFs+sQz2HGdX/Lem5ja+6uu5M/YbpmxA9Nkg:tSFRqr+sQzrdX/LeNnuUNmxAQg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Temp\DRPTools\SCMx86\SCMx86Setup.msi
- Size 3.9MB
- SHA256 4a846fe82a937531ad8d929c3eed01f1f7d5bc5b45225e5fa75d01a6f345c1da
- MD5 c1a5783c1222e92e7aa8382dcffc8d87
- SHA1 c9f9de33cedba3505dbe2955f97000db73376779
- SHA512 ed49fafe367ecbe84af003b7637a4264fef0252efe24f2ea247ec93e9a7bc48c9a43f19574fce94504fae786584206be5134058d7cf017fa5c4bedba7575d8aa
- SSDEEP 98304:lCDukHWlcMHWlcuHWlcHl/fiRdsWR70E6KIq+8fSuj2THA3G:Wuk2lb2lN2ls8Rp+q+MS2OEG
- MD5 SHA1 SHA512 SSDEEP
- Path \Windows\Temp\DRPTools\SCMx86\setup.exe
- Size 420KB
- SHA256 f0fbc759f323f60f4253516b95c31a3f9062f68c26551fdb5ba842483d2fadb6
- MD5 5152547409903834c5f329a69f1e3872
- SHA1 70034442230bc3b29040a51a24edfac20976ba88
- SHA512 5eaa18284588e5b87e653101204a00b25e47aee184249f663cd4bd7b56d71c8b1dabcc15fef95eb8ac5835312c2f608f66cd85cc17f9e836bea970fe6f841b54
- SSDEEP 6144:gqIpd/w8ylWKxavR+dJ1oMBClrbMAo+nhmuFfvY0SHZvuD3RojDuUlX2eO3:g7IRWDvFa+nhmuF3Y0scReDuUlXba
- MD5 SHA1 SHA512 SSDEEP