Overview
overview
7Static
static
3SecuriteIn...90.exe
windows7-x64
6SecuriteIn...90.exe
windows10-2004-x64
6SCMx86/SCM...up.msi
windows7-x64
7SCMx86/SCM...up.msi
windows10-2004-x64
7SCMx86/msiexec.exe
windows7-x64
1SCMx86/msiexec.exe
windows10-2004-x64
1SCMx86/setup.exe
windows7-x64
7SCMx86/setup.exe
windows10-2004-x64
7Analysis
- max time kernel
86s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system - submitted
22/01/2024, 12:34
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe
Resource
win7-20231215-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral3
Sample
SCMx86/SCMx86Setup.msi
Resource
win7-20231215-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral4
Sample
SCMx86/SCMx86Setup.msi
Resource
win10v2004-20231215-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral5
Sample
SCMx86/msiexec.exe
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
SCMx86/msiexec.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
SCMx86/setup.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral8
Sample
SCMx86/setup.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe
- Size 3.7MB
- Sample240122-prrm8afdfl
- SHA256 83d48ca1aa2299d974223ddbb4ea182e7064e57d6dd5ead72d0088d71e444ae0
- MD5 3137bbf88d80a164b35def3024ef152a
- SHA1 c0bab2f371cdcd7bd53fd1cff6cadcd3505c4fa1
- SHA512 a59452c610fe845b00feff5a98972ebdc39f8ffbbb3261bed6d54eab5c3066bec5e2fd1c118d4880faf8402ede29d23934d7e98ba6feb9a64efab66c8baf7899
- SSDEEP 98304:uHLi/kJwZwPb9L/0rQq98ZU+LsXCKqRkMccz2938N:XYwgVqWjwCKibB
- MD5 SHA1 SHA512 SSDEEP
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SCM = "C:\\Program Files (x86)\\SCM\\SCM.exe" CloseSCM.exe - Blocklisted process makes network request 1 IoCs
flow pid Process 6 1100 msiexec.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation setup.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\DeviceCount.exe msiexec.exe File created C:\Windows\SysWOW64\msiapcfg.dll msiexec.exe - Drops file in Program Files directory 21 IoCs
description ioc Process File created C:\Program Files (x86)\SCM\EyeTracking\Tobii.EyeX.Client.dll msiexec.exe File created C:\Program Files (x86)\SCM\MSIODD.dll msiexec.exe File created C:\Program Files (x86)\SCM\scm.ico msiexec.exe File created C:\Program Files (x86)\SCM\SCM_Notice.exe msiexec.exe File created C:\Program Files (x86)\SCM\WPFOSD.dll msiexec.exe File created C:\Program Files (x86)\SCM\SCM.exe msiexec.exe File created C:\Program Files (x86)\SCM\EyeTracking\Tobii.EyeX.Client.Net20.DLL msiexec.exe File created C:\Program Files (x86)\SCM\devcon.dll msiexec.exe File created C:\Program Files (x86)\SCM\MSIService.exe msiexec.exe File created C:\Program Files (x86)\SCM\MSIECO.dll msiexec.exe File created C:\Program Files (x86)\SCM\CloseSCM.exe msiexec.exe File created C:\Program Files (x86)\SCM\MSIWmiAcpi.dll msiexec.exe File created C:\Program Files (x86)\SCM\SCM.exe.config msiexec.exe File created C:\Program Files (x86)\SCM\EyeTracking\EyeXFramework.dll msiexec.exe File created C:\Program Files (x86)\SCM\System.Windows.Interactivity.dll msiexec.exe File created C:\Program Files (x86)\SCM\MSIECO\Presentation.eps msiexec.exe File created C:\Program Files (x86)\SCM\EyeTracking\EyeTracking.exe msiexec.exe File created C:\Program Files (x86)\SCM\MSIECO\Movie.eps msiexec.exe File created C:\Program Files (x86)\SCM\MSIECO\Gaming.eps msiexec.exe File created C:\Program Files (x86)\SCM\MSIECO\TurboBattery.eps msiexec.exe File created C:\Program Files (x86)\SCM\MSIECO\Office.eps msiexec.exe - Drops file in Windows directory 16 IoCs
description ioc Process File created C:\Windows\Installer\e5741cc.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\{0975A490-B40D-453C-9725-8ADC88A798AB}\_AD220580923AF41B2768B2.exe msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\{0975A490-B40D-453C-9725-8ADC88A798AB}\_853F67D554F05449430E7E.exe msiexec.exe File opened for modification C:\Windows\Installer\{0975A490-B40D-453C-9725-8ADC88A798AB}\_AD220580923AF41B2768B2.exe msiexec.exe File created C:\Windows\Installer\{0975A490-B40D-453C-9725-8ADC88A798AB}\_7AFBD22CCAE1AC02EC4E31.exe msiexec.exe File opened for modification C:\Windows\Installer\{0975A490-B40D-453C-9725-8ADC88A798AB}\_7AFBD22CCAE1AC02EC4E31.exe msiexec.exe File created C:\Windows\Installer\e5741d0.msi msiexec.exe File opened for modification C:\Windows\Installer\e5741cc.msi msiexec.exe File created C:\Windows\Installer\SourceHash{0975A490-B40D-453C-9725-8ADC88A798AB} msiexec.exe File opened for modification C:\Windows\Installer\{0975A490-B40D-453C-9725-8ADC88A798AB}\_853F67D554F05449430E7E.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI4314.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4372.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4400.tmp msiexec.exe - Executes dropped EXE 4 IoCs
pid Process 2992 setup.exe 4864 MSIService.exe 552 MSIService.exe 4832 CloseSCM.exe - Loads dropped DLL 4 IoCs
pid Process 1484 MsiExec.exe 1484 MsiExec.exe 4864 MSIService.exe 552 MSIService.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\22\52C64B7E msiexec.exe - Modifies registry class 46 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|SCM|System.Windows.Interactivity.dll msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|SCM|System.Windows.Interactivity.dll\System.Windows.Interactivity,Version="4.0.0.0",Culture="neutral",PublicKeyToken="31BF3856AD364E35",ProcessorArchitecture="MSIL" = 2c0028004c00260026006c007800500039003d004c004b00750073006f0047006e006e00300060003e004000680057005200610057004600450048005400700037003d00430029003000210021006400660000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|SCM|SCM.exe\SCM,Version="15.16.1221.0",Culture="neutral",ProcessorArchitecture="x86" = 2c0028004c00260026006c007800500039003d004c004b00750073006f0047006e006e00300060003e005e00460057005b00430053002e006c0053002e0028004b00770073006a0056005a0071006800580000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|SCM|CloseSCM.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\094A5790D04BC3547952A8CD887A89BA msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\094A5790D04BC3547952A8CD887A89BA\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A896E75C4828C924F986BC4F4E78A17B msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|SCM|EyeTracking|EyeXFramework.dll msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|SCM|MSIECO.dll\MSIECO,Version="1.0.1308.2003",Culture="neutral",ProcessorArchitecture="x86" = 2c0028004c00260026006c007800500039003d004c004b00750073006f0047006e006e00300060003e007900770058006200780031004b0060004b00290067002d005e00290069002800660029006a00470000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Windows|SysWOW64|DeviceCount.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|SCM|EyeTracking|EyeTracking.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|SCM|EyeTracking|Tobii.EyeX.Client.Net20.dll msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|SCM|SCM_Notice.exe msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\094A5790D04BC3547952A8CD887A89BA\ProductName = "SCM" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\094A5790D04BC3547952A8CD887A89BA\PackageCode = "23812CD4BD6C5A0408CCE10AB3133F54" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\094A5790D04BC3547952A8CD887A89BA\Version = "252708037" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\094A5790D04BC3547952A8CD887A89BA\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\094A5790D04BC3547952A8CD887A89BA\SourceList\LastUsedSource = "n;1;C:\\Windows\\TEMP\\DRPTools\\SCMx86\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\094A5790D04BC3547952A8CD887A89BA\DefaultFeature msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\094A5790D04BC3547952A8CD887A89BA msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\094A5790D04BC3547952A8CD887A89BA\ProductIcon = "C:\\Windows\\Installer\\{0975A490-B40D-453C-9725-8ADC88A798AB}\\_853F67D554F05449430E7E.exe" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\094A5790D04BC3547952A8CD887A89BA\AuthorizedLUAApp = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\094A5790D04BC3547952A8CD887A89BA\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\094A5790D04BC3547952A8CD887A89BA\SourceList\Net\1 = "C:\\Windows\\TEMP\\DRPTools\\SCMx86\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\094A5790D04BC3547952A8CD887A89BA\SourceList\Media msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|SCM|WPFOSD.dll\WPFOSD,Version="1.0.0.0",Culture="neutral",ProcessorArchitecture="x86" = 2c0028004c00260026006c007800500039003d004c004b00750073006f0047006e006e00300060003e007b0036004e006b0024006e004b006a006f004d00530056002b0047002d00710073006c0041005e0000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|SCM|MSIODD.dll\MSIODD,Version="1.0.1008.2001",Culture="neutral",ProcessorArchitecture="MSIL" = 2c0028004c00260026006c007800500039003d004c004b00750073006f0047006e006e00300060003e00490071003d0039005500280024004b0046005e002e0061005200250071006d007e00490066005f0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|SCM|SCM.exe msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\094A5790D04BC3547952A8CD887A89BA\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\094A5790D04BC3547952A8CD887A89BA\SourceList\Media\1 = ";" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|SCM|EyeTracking|EyeXFramework.dll\EyeXFramework,Version="1.5.466.0",Culture="neutral",PublicKeyToken="70326046DCDCE6CB",ProcessorArchitecture="x86" = 2c0028004c00260026006c007800500039003d004c004b00750073006f0047006e006e00300060003e003300580031005900380065007d0045004400620075007d006c007d006c0033002600710034005a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|SCM|WPFOSD.dll msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|SCM|CloseSCM.exe\CloseSCM,Version="1.0.0.0",Culture="neutral",ProcessorArchitecture="x86" = 2c0028004c00260026006c007800500039003d004c004b00750073006f0047006e006e00300060003e006c0039006e00640027004c002500670037006a007400600042007e0070006b0063006f006b004b0000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Windows|SysWOW64|DeviceCount.exe\DeviceCount,Version="1.0.2.1",Culture="neutral",ProcessorArchitecture="x86" = 2c0028004c00260026006c007800500039003d004c004b00750073006f0047006e006e00300060003e004f00560071006a004900400040004c0021007a004800260037003d0076002a006f006b007d00600000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|SCM|EyeTracking|Tobii.EyeX.Client.Net20.DLL msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|SCM|EyeTracking|Tobii.EyeX.Client.Net20.DLL\Tobii.EyeX.Client.Net20,Version="1.5.466.0",Culture="neutral",PublicKeyToken="70326046DCDCE6CB",ProcessorArchitecture="x86" = 2c0028004c00260026006c007800500039003d004c004b00750073006f0047006e006e00300060003e002e0064004f002400240049007a0039007d0027005b00490057005d0070004e006f0063007500420000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|SCM|MSIODD.dll msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|SCM|SCM_Notice.exe\SCM_Notice,Version="10.15.10073.0",Culture="neutral",ProcessorArchitecture="MSIL" = 2c0028004c00260026006c007800500039003d004c004b00750073006f0047006e006e00300060003e004f0059004600360025006600380043006e003d00710058007a0069007500670021002b003300680000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A896E75C4828C924F986BC4F4E78A17B\094A5790D04BC3547952A8CD887A89BA msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|SCM|MSIECO.dll msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\094A5790D04BC3547952A8CD887A89BA\Language = "1033" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\094A5790D04BC3547952A8CD887A89BA\SourceList\PackageName = "SCMx86Setup.msi" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|SCM|EyeTracking|EyeTracking.exe\EyeTracking,Version="1.0.0.0",Culture="neutral",ProcessorArchitecture="x86" = 2c0028004c00260026006c007800500039003d004c004b00750073006f0047006e006e00300060003e006a00560074005e0058004a005e004b002c0037007a00370075006c00360047004d00620046005a0000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\094A5790D04BC3547952A8CD887A89BA\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\094A5790D04BC3547952A8CD887A89BA\SourceList msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\094A5790D04BC3547952A8CD887A89BA\Clients = 3a0000000000 msiexec.exe - Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1100 msiexec.exe 1100 msiexec.exe 4832 CloseSCM.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4352 msiexec.exe Token: SeIncreaseQuotaPrivilege 4352 msiexec.exe Token: SeSecurityPrivilege 1100 msiexec.exe Token: SeCreateTokenPrivilege 4352 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4352 msiexec.exe Token: SeLockMemoryPrivilege 4352 msiexec.exe Token: SeIncreaseQuotaPrivilege 4352 msiexec.exe Token: SeMachineAccountPrivilege 4352 msiexec.exe Token: SeTcbPrivilege 4352 msiexec.exe Token: SeSecurityPrivilege 4352 msiexec.exe Token: SeTakeOwnershipPrivilege 4352 msiexec.exe Token: SeLoadDriverPrivilege 4352 msiexec.exe Token: SeSystemProfilePrivilege 4352 msiexec.exe Token: SeSystemtimePrivilege 4352 msiexec.exe Token: SeProfSingleProcessPrivilege 4352 msiexec.exe Token: SeIncBasePriorityPrivilege 4352 msiexec.exe Token: SeCreatePagefilePrivilege 4352 msiexec.exe Token: SeCreatePermanentPrivilege 4352 msiexec.exe Token: SeBackupPrivilege 4352 msiexec.exe Token: SeRestorePrivilege 4352 msiexec.exe Token: SeShutdownPrivilege 4352 msiexec.exe Token: SeDebugPrivilege 4352 msiexec.exe Token: SeAuditPrivilege 4352 msiexec.exe Token: SeSystemEnvironmentPrivilege 4352 msiexec.exe Token: SeChangeNotifyPrivilege 4352 msiexec.exe Token: SeRemoteShutdownPrivilege 4352 msiexec.exe Token: SeUndockPrivilege 4352 msiexec.exe Token: SeSyncAgentPrivilege 4352 msiexec.exe Token: SeEnableDelegationPrivilege 4352 msiexec.exe Token: SeManageVolumePrivilege 4352 msiexec.exe Token: SeImpersonatePrivilege 4352 msiexec.exe Token: SeCreateGlobalPrivilege 4352 msiexec.exe Token: SeRestorePrivilege 1100 msiexec.exe Token: SeTakeOwnershipPrivilege 1100 msiexec.exe Token: SeRestorePrivilege 1100 msiexec.exe Token: SeTakeOwnershipPrivilege 1100 msiexec.exe Token: SeRestorePrivilege 1100 msiexec.exe Token: SeTakeOwnershipPrivilege 1100 msiexec.exe Token: SeRestorePrivilege 1100 msiexec.exe Token: SeTakeOwnershipPrivilege 1100 msiexec.exe Token: SeDebugPrivilege 4832 CloseSCM.exe Token: SeRestorePrivilege 1100 msiexec.exe Token: SeTakeOwnershipPrivilege 1100 msiexec.exe Token: SeRestorePrivilege 1100 msiexec.exe Token: SeTakeOwnershipPrivilege 1100 msiexec.exe Token: SeRestorePrivilege 1100 msiexec.exe Token: SeTakeOwnershipPrivilege 1100 msiexec.exe Token: SeRestorePrivilege 1100 msiexec.exe Token: SeTakeOwnershipPrivilege 1100 msiexec.exe Token: SeRestorePrivilege 1100 msiexec.exe Token: SeTakeOwnershipPrivilege 1100 msiexec.exe Token: SeRestorePrivilege 1100 msiexec.exe Token: SeTakeOwnershipPrivilege 1100 msiexec.exe Token: SeRestorePrivilege 1100 msiexec.exe Token: SeTakeOwnershipPrivilege 1100 msiexec.exe Token: SeRestorePrivilege 1100 msiexec.exe Token: SeTakeOwnershipPrivilege 1100 msiexec.exe Token: SeRestorePrivilege 1100 msiexec.exe Token: SeTakeOwnershipPrivilege 1100 msiexec.exe Token: SeRestorePrivilege 1100 msiexec.exe Token: SeTakeOwnershipPrivilege 1100 msiexec.exe Token: SeRestorePrivilege 1100 msiexec.exe Token: SeTakeOwnershipPrivilege 1100 msiexec.exe Token: SeRestorePrivilege 1100 msiexec.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1404 wrote to memory of 2992 1404 SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe 89 PID 1404 wrote to memory of 2992 1404 SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe 89 PID 1404 wrote to memory of 2992 1404 SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe 89 PID 2992 wrote to memory of 4352 2992 setup.exe 90 PID 2992 wrote to memory of 4352 2992 setup.exe 90 PID 2992 wrote to memory of 4352 2992 setup.exe 90 PID 1100 wrote to memory of 1484 1100 msiexec.exe 93 PID 1100 wrote to memory of 1484 1100 msiexec.exe 93 PID 1100 wrote to memory of 1484 1100 msiexec.exe 93 PID 1100 wrote to memory of 4864 1100 msiexec.exe 94 PID 1100 wrote to memory of 4864 1100 msiexec.exe 94 PID 1100 wrote to memory of 4864 1100 msiexec.exe 94 PID 1100 wrote to memory of 4832 1100 msiexec.exe 98 PID 1100 wrote to memory of 4832 1100 msiexec.exe 98 PID 1100 wrote to memory of 4832 1100 msiexec.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Program.Unwanted.4468.24384.5290.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Windows\TEMP\DRPTools\SCMx86\setup.exeC:\Windows\TEMP\DRPTools\SCMx86\setup.exe /quiet /norestart2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe" -I "C:\Windows\TEMP\DRPTools\SCMx86\SCMx86Setup.msi" /quiet /norestart3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4352
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6C7B4B293193C1C6D10BB40F91E377E62⤵
- Loads dropped DLL
PID:1484
-
-
C:\Program Files (x86)\SCM\MSIService.exe"C:\Program Files (x86)\SCM\MSIService.exe" -install2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4864
-
-
C:\Program Files (x86)\SCM\CloseSCM.exe"C:\Program Files (x86)\SCM\CloseSCM.exe" install2⤵
- Adds Run key to start application
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4832
-
-
C:\Program Files (x86)\SCM\MSIService.exe"C:\Program Files (x86)\SCM\MSIService.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:552
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5741cf.rbs
- Size 18KB
- SHA256 86271dded56843dbc601f6f900ea514ebcd087213d461cc5c5a1b27cddf95469
- MD5 427847415f4e0ff17144d6d57afb3fba
- SHA1 adeb6bd327660e15c4c2c5a644872cdf7229cccb
- SHA512 403fe4f2fef1f1840106ad5ed2d92b33433d2a1555ef5b86361fb97749a67921ae823daa6366b9bcec8373080fdf1372aefba672995ede57b0e31b74606be7b9
- SSDEEP 384:IEmHsAy8yj85LN7T3thjd3J3SwHLKtv8CSulJjvZ3M3:IEmMAdku53
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\SCM\CloseSCM.exe
- Size 8KB
- SHA256 fb1f08fb9992ecbb977c21ba40a7a2dc16a098fcc8d78d19327e48b88386ff7e
- MD5 16d77bf2c6331c2534e814d4b343d6d1
- SHA1 491be2c10bdd605d5b46bd880b336253856e72c1
- SHA512 e8dce39a6e061beab0cfdb49776ce2fbd6b9f6a4514726620ff32586baf237de2c99bda75e9e88304793fe6db05810d65e8971ebeec178c8d24fa558c1a9c326
- SSDEEP 96:Wi2gVnvwLPvH6RBZd6ZaQh0NdMYvfyqoFmsk3ojWNtAiYcqQBQmMTwa2:WfgaLPSvLhMcFoF5kRmiYchQmMc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\SCM\MSIService.exe
- Size 115KB
- SHA256 f6b07dfc1394cfe8a3afa0fda00f266f7f5e31387bdd82c3e668e5783f0cc17e
- MD5 d5381716c2491bbcf184f546abeb5ada
- SHA1 25506ece67e05bf2643d02cae3dd88504fb85c87
- SHA512 87eef4e7117990599d9de515eade621d4d0d5847153de56f9a9f3b8e8dfea3e856649308d108e6a8977cdb9e87000f153859460777349454731f22e2f0a9c208
- SSDEEP 1536:pM5UhOltDj99L0+xrL7FY9DlZth1p9cxB5cJEMdg+nOlMAi9okWnK4pMjON1BUq9:ZhOl5RrL7FY9RGm8fKSjBTZ1b1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\SCM\MSIService.exe
- Size 69KB
- SHA256 25908abee6b57ef2949befbfe7bdb4c0c2d2c81559f9c813c2d74b853665b09e
- MD5 aa3f6a2feebe7341df923ff953d89e9c
- SHA1 1dd674edeee0ec9fa7343089f2928fc136584439
- SHA512 4f5502ffe52bd66553bfa300af3a4680fab3c1da624fa97397ca9f1a12a5479fa9f092c45a3ba3991134dc9ac3cd28f3f57cbdfee244ce3b355f02e80ad88ed8
- SSDEEP 1536:pM5UhOltDj99L0+xrL7FY9DlZth1p9cxB5cJEMdg+nOlMAi9okWnKI:ZhOl5RrL7FY9RGm8fKI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\SCM\MSIService.exe
- Size 49KB
- SHA256 30b14ac8f0796a6485d40b50493d05b55777707ac5fc264bf801879a16c05a6d
- MD5 512a266384168bda5ccebad7eecb64ef
- SHA1 b0e9ab4c0d3f2a1f309d84e005eebb7a1539fe94
- SHA512 2bb7b64ac5c273a245363f5aa5cadc2e62163b97d0a8d8bd7a9de233badf36a8713b301cb5a08c168cadd0736e5364c5979786c198a8e3396e58a119cad418c8
- SSDEEP 1536:pM5UhOltDj99L0+xrL7FY9DlZth1p9cxB5cJEMdg+nOlMAl:ZhOl5RrL7FY9RGm8t
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\SCM\MSIWmiAcpi.dll
- Size 91KB
- SHA256 d5bac8399ab3bbdf63b42107938601400e8dbf3320159a848e139947584832b7
- MD5 cb0798c86b9f108ad6d430cf253a51bc
- SHA1 673f269b592e02ad932d9543465e7c8492bdfee9
- SHA512 917f392a353687f1ac71326cee8b47beb48d18fe9cb4652fde4f16ff475c034b2db42c4eaddbb236e7cd2fa5d2945522f0b00413b9ff546ffed328a851e111b8
- SSDEEP 1536:K6JB0RUVCjrdZWdDpdTPJhhVblZth1p9cxB5cJEGGYyVx3s9ix64l52zEBDBQGIT:K6J+RUsPWBvTPJhhVnGIL4r2wDQGIpmO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\SCM\MSIWmiAcpi.dll
- Size 56KB
- SHA256 6920c4edda3469ab1223daa9de070dcb3bfa40616102e6050d55de0e2f54dc0d
- MD5 0ba2739c7ada04baffeda218989feac8
- SHA1 08a2d7bc27d8a5c6c7702a45aace2ea3ff854034
- SHA512 eb054526c5cbda60a20c9f80009586755ca551780aeb4f3998ebccb14dbe1d173fe4e317935b9d36f12e6b1ffb0fd1bafbfa268ad09324f4fb29911405d66b32
- SSDEEP 1536:K6JB0RUVCjrdZWdDpdTPJhhVblZth1p9cxB5cJEGGYyVx3s9ix64d:K6J+RUsPWBvTPJhhVnGIL4d
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\SCM\MSIWmiAcpi.dll
- Size 38KB
- SHA256 e0c84c8fe1c96776e6e483a864ed4dead8e474c8ed6fbe5a021423aa8c3bace0
- MD5 f994ee76b4c6c6e12eb89605b402c0a8
- SHA1 3ab2a51941c22ae748b0b161aee9d717e6b10030
- SHA512 1f93618ec6e5cb3997499e51144d333d6d8659364a0c77fd1cff2a001bde570044988c78543e71cf66f355e40ae7fd488c1358c58e83ada15a05497c90bac20d
- SSDEEP 768:K6JB0RUEEvqTXr0R2XpXmdDpdhiQVutHKyah1z8t:K6JB0RUVCjrdZWdDpdTPJhhw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\SCM\SCM.exe
- Size 103KB
- SHA256 d664e43b7d02f116eddd3751b4ed2ff736e71ed99d76c1ea7b80a1d43a62144d
- MD5 9c522d0738ca453e156eee766af8950d
- SHA1 1dd2cf4493a15e7368227638904ea233025add58
- SHA512 3726cd807668d02bb1165115d5d2ae0b9e1fb127104d9dce27be2cb09518f66488b2af115da8a67d7553818a33ffa491e89c6e27be3368c6734182d95eb2858e
- SSDEEP 3072:5bCFgqmRyXuOFs+sQz2HGdX/Le15ja+6uu5R:5bCSFR1r+sQzrdX/Le+num
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI4314.tmp
- Size 231KB
- SHA256 82bba027d920fac29385c1a6752f2337a3ae4b1944a29a72d2864017abeaa8d9
- MD5 def1669123bc5bd8e9a3a93e7f68b58c
- SHA1 101e1f6e9795672319543b9e69f9cb62a3d55055
- SHA512 b4ff0e4dc094575ceb1be891a767ab5e5dc0a3f137f9e6863324942277ff35acc75f92f7105779f33f3e68d3e56a1bb5d82f2f87a03c0aaae600478602f15d8c
- SSDEEP 3072:A7jfONyT4c8Di/LCTcwALEBiWZPY9yPoKmr0o3au46KcqThxaMn7YObxnKbIzyYS:IRzCLbY92NLmPUj/u4yQ7wJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\e5741d0.msi
- Size 271KB
- SHA256 c79efe7da7a651cf34b62f55891ea6823ee3177d940ce3f25efa1b64cf9d3a12
- MD5 e89fa33b6c2790f0bc5b8a9d5b7219ae
- SHA1 69a0b7a7690bef001c007c5cef4fcc98d8318a7e
- SHA512 674f0712b8f3ce963af1b9799e372d91b812345e27b86f62444e3a515babd139f641ba5f4f1e6b372d5c980d2156091f6115ec94fb7a4f3a2d8ac800e05c4140
- SSDEEP 3072:fCZXtbz9k97jfONyT4c8Di/LCTcwALEBiWZPY9yPoKmr0o3au46KcqThxaMn7YOg:fedbz9+RzCLbY92NLmPUj/u4yQ+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\{0975A490-B40D-453C-9725-8ADC88A798AB}\_7AFBD22CCAE1AC02EC4E31.exe
- Size 124KB
- SHA256 f072de7b5918e6c828a8713df4e53c8c0003fcdee6be4404a0f758b38369539c
- MD5 0cbe3a7eb39a686d259a7cf50bb8a0be
- SHA1 2a2b8f5cb15b0b3ddd50cd398190e2e79d736499
- SHA512 7030089cba8f9b94d24ed39a112fd044b4dbec6b3ab70e44d55a1bb0708573cf994d276d5ef7ea1bae77cd90fec2fd94c99f4facc919704890fd99fa01eb93f6
- SSDEEP 3072:tFgqmRyXJOFs+sQz2HGdX/Lem5ja+6uu5M/YbpmxA9Nkg:tSFRqr+sQzrdX/LeNnuUNmxAQg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Temp\DRPTools\SCMx86\SCMx86Setup.msi
- Size 1.9MB
- SHA256 c90cc31d3a9f42e011b8280ae47cd370573ccc1527ca41a9516e083b575bffe8
- MD5 1dfad14635668b4f986eb754ca07b31e
- SHA1 9ce145526cdaf8447133876770cc12f2ae1b5cb6
- SHA512 47258415e8e1d7ba4848c8242e28651e9fac09747989ac4b8e0aa4e61ea10b982c0c283802b32ee9fb6107a70c6f66def6680913132bd752e9732b1fa5d92cbc
- SSDEEP 49152:Gd8zCDukHWlc2KBqHWlc29HWlc2YlzR7NWwtmMPVJiRds+:lCDukHWlcMHWlcuHWlcHl/fiRds+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Temp\DRPTools\SCMx86\setup.exe
- Size 420KB
- SHA256 f0fbc759f323f60f4253516b95c31a3f9062f68c26551fdb5ba842483d2fadb6
- MD5 5152547409903834c5f329a69f1e3872
- SHA1 70034442230bc3b29040a51a24edfac20976ba88
- SHA512 5eaa18284588e5b87e653101204a00b25e47aee184249f663cd4bd7b56d71c8b1dabcc15fef95eb8ac5835312c2f608f66cd85cc17f9e836bea970fe6f841b54
- SSDEEP 6144:gqIpd/w8ylWKxavR+dJ1oMBClrbMAo+nhmuFfvY0SHZvuD3RojDuUlX2eO3:g7IRWDvFa+nhmuF3Y0scReDuUlXba
- MD5 SHA1 SHA512 SSDEEP