amadey | 85ac0e8244160430f8ca3d4fb031180ccf656a2d524a8fc2c828379c1c7b9e5f

Analysis

max time kernel
123s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
15-02-2024 00:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9c75e5c9f56150d3648691950f544f6b.msi
Size

7.3MB
MD5

9c75e5c9f56150d3648691950f544f6b
SHA1

2008d7c4f9fe4d6e9ad9a328e636ae0b5222fde6
SHA256

85ac0e8244160430f8ca3d4fb031180ccf656a2d524a8fc2c828379c1c7b9e5f
SHA512

5b594257dbdbfc4252fe61d847437d2ba1630d0bc82072ce0f48e840b06cda86b603bac35b7f6be3d52bd4e7f4b7173820e0d1fb2e413199e325edd413236512
SSDEEP

196608:yqumukxXreZ5WXIP14ifwiTlQb3yVgsOyxI8:WCle2X2dIiTl83ympKI

Score

10^/10

amadey babadeda crypter discovery loader trojan upx

Malware Config

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Babadeda
Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.
loader crypter babadeda

Babadeda Crypter 1 IoCs

resource	yara_rule
behavioral1/files/0x000400000001d644-1097.dat	family_babadeda

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
776	ICACLS.EXE
1308	ICACLS.EXE

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0006000000016fd0-200.dat	upx
behavioral1/memory/1608-211-0x0000000002B50000-0x0000000002F38000-memory.dmp	upx
behavioral1/files/0x0006000000016fd0-209.dat	upx
behavioral1/memory/2304-217-0x00000000000A0000-0x0000000000488000-memory.dmp	upx
behavioral1/memory/2304-935-0x00000000000A0000-0x0000000000488000-memory.dmp	upx
behavioral1/memory/2304-1098-0x00000000000A0000-0x0000000000488000-memory.dmp	upx

Blocklisted process makes network request 3 IoCs

flow	pid	Process
3	2460	msiexec.exe
5	2460	msiexec.exe
7	2036	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\f76cab0.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI389C.tmp	msiexec.exe
File created	C:\Windows\Installer\f76caaf.msi	msiexec.exe
File created	C:\Windows\Installer\f76cab0.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID44C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI389B.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\Logs\DPX\setuperr.log	EXPAND.EXE
File opened for modification	C:\Windows\Installer\f76caaf.msi	msiexec.exe
File opened for modification	C:\Windows\Logs\DPX\setupact.log	EXPAND.EXE

Executes dropped EXE 3 IoCs

pid	Process
1608	1setup.exe
2304	irsetup.exe
2764	cmsengine.exe

Loads dropped DLL 19 IoCs

pid	Process
368	MsiExec.exe
368	MsiExec.exe
368	MsiExec.exe
368	MsiExec.exe
368	MsiExec.exe
1608	1setup.exe
1608	1setup.exe
1608	1setup.exe
1608	1setup.exe
2304	irsetup.exe
2304	irsetup.exe
2304	irsetup.exe
2304	irsetup.exe
2304	irsetup.exe
2304	irsetup.exe
2304	irsetup.exe
2304	irsetup.exe
2764	cmsengine.exe
368	MsiExec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2036	msiexec.exe
2036	msiexec.exe

Suspicious use of AdjustPrivilegeToken 57 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2460	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2460	msiexec.exe
Token: SeRestorePrivilege	2036	msiexec.exe
Token: SeTakeOwnershipPrivilege	2036	msiexec.exe
Token: SeSecurityPrivilege	2036	msiexec.exe
Token: SeCreateTokenPrivilege	2460	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2460	msiexec.exe
Token: SeLockMemoryPrivilege	2460	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2460	msiexec.exe
Token: SeMachineAccountPrivilege	2460	msiexec.exe
Token: SeTcbPrivilege	2460	msiexec.exe
Token: SeSecurityPrivilege	2460	msiexec.exe
Token: SeTakeOwnershipPrivilege	2460	msiexec.exe
Token: SeLoadDriverPrivilege	2460	msiexec.exe
Token: SeSystemProfilePrivilege	2460	msiexec.exe
Token: SeSystemtimePrivilege	2460	msiexec.exe
Token: SeProfSingleProcessPrivilege	2460	msiexec.exe
Token: SeIncBasePriorityPrivilege	2460	msiexec.exe
Token: SeCreatePagefilePrivilege	2460	msiexec.exe
Token: SeCreatePermanentPrivilege	2460	msiexec.exe
Token: SeBackupPrivilege	2460	msiexec.exe
Token: SeRestorePrivilege	2460	msiexec.exe
Token: SeShutdownPrivilege	2460	msiexec.exe
Token: SeDebugPrivilege	2460	msiexec.exe
Token: SeAuditPrivilege	2460	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2460	msiexec.exe
Token: SeChangeNotifyPrivilege	2460	msiexec.exe
Token: SeRemoteShutdownPrivilege	2460	msiexec.exe
Token: SeUndockPrivilege	2460	msiexec.exe
Token: SeSyncAgentPrivilege	2460	msiexec.exe
Token: SeEnableDelegationPrivilege	2460	msiexec.exe
Token: SeManageVolumePrivilege	2460	msiexec.exe
Token: SeImpersonatePrivilege	2460	msiexec.exe
Token: SeCreateGlobalPrivilege	2460	msiexec.exe
Token: SeBackupPrivilege	664	vssvc.exe
Token: SeRestorePrivilege	664	vssvc.exe
Token: SeAuditPrivilege	664	vssvc.exe
Token: SeBackupPrivilege	2036	msiexec.exe
Token: SeRestorePrivilege	2036	msiexec.exe
Token: SeRestorePrivilege	2508	DrvInst.exe
Token: SeRestorePrivilege	2508	DrvInst.exe
Token: SeRestorePrivilege	2508	DrvInst.exe
Token: SeRestorePrivilege	2508	DrvInst.exe
Token: SeRestorePrivilege	2508	DrvInst.exe
Token: SeRestorePrivilege	2508	DrvInst.exe
Token: SeRestorePrivilege	2508	DrvInst.exe
Token: SeLoadDriverPrivilege	2508	DrvInst.exe
Token: SeLoadDriverPrivilege	2508	DrvInst.exe
Token: SeLoadDriverPrivilege	2508	DrvInst.exe
Token: SeRestorePrivilege	2036	msiexec.exe
Token: SeTakeOwnershipPrivilege	2036	msiexec.exe
Token: SeRestorePrivilege	2036	msiexec.exe
Token: SeTakeOwnershipPrivilege	2036	msiexec.exe
Token: SeRestorePrivilege	2036	msiexec.exe
Token: SeTakeOwnershipPrivilege	2036	msiexec.exe
Token: SeRestorePrivilege	2036	msiexec.exe
Token: SeTakeOwnershipPrivilege	2036	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2460	msiexec.exe
2460	msiexec.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2304	irsetup.exe
2304	irsetup.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 368	2036	msiexec.exe	32
PID 2036 wrote to memory of 368	2036	msiexec.exe	32
PID 2036 wrote to memory of 368	2036	msiexec.exe	32
PID 2036 wrote to memory of 368	2036	msiexec.exe	32
PID 2036 wrote to memory of 368	2036	msiexec.exe	32
PID 2036 wrote to memory of 368	2036	msiexec.exe	32
PID 2036 wrote to memory of 368	2036	msiexec.exe	32
PID 368 wrote to memory of 776	368	MsiExec.exe	35
PID 368 wrote to memory of 776	368	MsiExec.exe	35
PID 368 wrote to memory of 776	368	MsiExec.exe	35
PID 368 wrote to memory of 776	368	MsiExec.exe	35
PID 368 wrote to memory of 2232	368	MsiExec.exe	37
PID 368 wrote to memory of 2232	368	MsiExec.exe	37
PID 368 wrote to memory of 2232	368	MsiExec.exe	37
PID 368 wrote to memory of 2232	368	MsiExec.exe	37
PID 368 wrote to memory of 1608	368	MsiExec.exe	39
PID 368 wrote to memory of 1608	368	MsiExec.exe	39
PID 368 wrote to memory of 1608	368	MsiExec.exe	39
PID 368 wrote to memory of 1608	368	MsiExec.exe	39
PID 368 wrote to memory of 1608	368	MsiExec.exe	39
PID 368 wrote to memory of 1608	368	MsiExec.exe	39
PID 368 wrote to memory of 1608	368	MsiExec.exe	39
PID 1608 wrote to memory of 2304	1608	1setup.exe	40
PID 1608 wrote to memory of 2304	1608	1setup.exe	40
PID 1608 wrote to memory of 2304	1608	1setup.exe	40
PID 1608 wrote to memory of 2304	1608	1setup.exe	40
PID 1608 wrote to memory of 2304	1608	1setup.exe	40
PID 1608 wrote to memory of 2304	1608	1setup.exe	40
PID 1608 wrote to memory of 2304	1608	1setup.exe	40
PID 2304 wrote to memory of 2764	2304	irsetup.exe	41
PID 2304 wrote to memory of 2764	2304	irsetup.exe	41
PID 2304 wrote to memory of 2764	2304	irsetup.exe	41
PID 2304 wrote to memory of 2764	2304	irsetup.exe	41
PID 368 wrote to memory of 1308	368	MsiExec.exe	42
PID 368 wrote to memory of 1308	368	MsiExec.exe	42
PID 368 wrote to memory of 1308	368	MsiExec.exe	42
PID 368 wrote to memory of 1308	368	MsiExec.exe	42

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\9c75e5c9f56150d3648691950f544f6b.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2460

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5CD7A4D09F0ECF99A4D017DFC5A5DF24
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:368
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-e723d293-6492-467e-b475-155f1dcd074b\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
    3⤵
    - Modifies file permissions
    PID:776
- - C:\Windows\SysWOW64\EXPAND.EXE
    "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
    3⤵
    - Drops file in Windows directory
    PID:2232
- - C:\Users\Admin\AppData\Local\Temp\MW-e723d293-6492-467e-b475-155f1dcd074b\files\1setup.exe
    "C:\Users\Admin\AppData\Local\Temp\MW-e723d293-6492-467e-b475-155f1dcd074b\files\1setup.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1608
  - - C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1798690 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\MW-e723d293-6492-467e-b475-155f1dcd074b\files\1setup.exe" "__IRCT:3" "__IRTSS:0" "__IRSID:S-1-5-21-452311807-3713411997-1028535425-1000"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2304
    - - C:\Users\Admin\AppData\Roaming\BlueIris\cmsengine.exe
        
        "C:\Users\Admin\AppData\Roaming\BlueIris\cmsengine.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2764
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-e723d293-6492-467e-b475-155f1dcd074b\." /SETINTEGRITYLEVEL (CI)(OI)LOW
    3⤵
    - Modifies file permissions
    PID:1308

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:664

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000560" "00000000000002F8"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81acb967818462177c496137c6a6f7bd

SHA1
2c6ffadc2b596e1558e972783bcb8046a734ad4a

SHA256
d644bf3845b23d7d0ba778931aa5efab4acf888f6df903d2aa4590c55545398e

SHA512
ee225b196ed85025665fac3418f36732e244e6a3663ee3b482290ccb4c7c99a879e737c8a0ca259114f4214a53a58bf1b84e8e9973da58de4725b10257db83c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\152145231180

Filesize
72KB

MD5
2d0135c5c9aeae46c065fd1b18af0434

SHA1
8a78f63647ec455aaa31aebf0c0bba4e4b55e6ed

SHA256
bb612ff30e39cbe6c33c6bd88461df93a56907a4733258b9129420b518843438

SHA512
227c0fe70bd75ae43ae3a2d5bb3cba04c07c40c89232498c2f84721e887cc8e30433f55aa9775585ea04f5eb076e57fe5ae53292fe4315d69afa0ddc32d5460d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5015.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-e723d293-6492-467e-b475-155f1dcd074b\files.cab

Filesize
7.0MB

MD5
7c75eaeabeebc1b3e17a957df0a5ef4a

SHA1
7dcefa6a552b87e05b96a562511d9c103de8ab40

SHA256
5c3a384065bda8b29c805352570c1a75d4e841544093b8ec5cffa96dda61019b

SHA512
a79224ab26ca6a704af37e0588c23c39f24fa9c919aff3ff20eb77683205d4c9842a44b97ac3b9d0faa661c64d46bd94c57d10d18150c18f74f5d2dde094959b

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-e723d293-6492-467e-b475-155f1dcd074b\files\1setup.exe

Filesize
260KB

MD5
3e0c0ba0f453260c5ef718a0a51e2462

SHA1
7b584ec8f73b72d51cfbf60172a9490ed4941c56

SHA256
647cee07d1732181aa3a468c84a9279742531ad9597d2e63f787e86fcb1b8119

SHA512
d0835b1db9a80bc0583ec00d70076728e85e1e25b653922c7615c40df66b9d37e77db4d0686aa3763a5e4e05f617f7dce5aefc4dbf9d8737a3e8c9f297caaaea

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-e723d293-6492-467e-b475-155f1dcd074b\files\1setup.exe

Filesize
7.0MB

MD5
18d15fbb6b9c6178c170106d18ef0e0b

SHA1
177cf1a1a5d3ac67ed8114a104fd6306f61bf2ad

SHA256
300dacb4b2d8e80b33e03bfa5b15a1d6527b58de0c5719f5054b198041a7884b

SHA512
eec1ea5897b1917de1e6c1d4ff3bdc3dbf5022d98e679741157b3edfbcc854771759933a96e2954f3c0623f4e4daa2cc42f1043c1c0f2d8dd250a0aa01a3960e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-e723d293-6492-467e-b475-155f1dcd074b\msiwrapper.ini

Filesize
1KB

MD5
086b2685610ad75da36f5c87150b2a67

SHA1
910f4c0432ee09be00c7f813c3e7c28789e3df8a

SHA256
ca74b00cda52ecc7a6b6e5fa9360ee3092fb06cd678cb6774979d6bac61a1744

SHA512
3266bb5b6c6358d0775c78a1e3ee4567808fdfb198dde78c7fb2b655d10556f2701a21de8a350180b80bd514e2644f9d21089fb8a500d422197f18d0b251ee0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-e723d293-6492-467e-b475-155f1dcd074b\msiwrapper.ini

Filesize
392B

MD5
e8e0a8a7daa3f36c9d60520af49d4a45

SHA1
8885e7a8b7813756af2c659d8f212bab09ade387

SHA256
64fc9ab91e1ac895f655755cf4f5138f92ea2819a44b48c18b8513c79e28acf2

SHA512
b89c9d284449763b168e3e1ad3eaee32edfa8061fc1ce0595ce350e37c4488bd113c935871132a31d7777122c07a7717d120c5bd96f875b59169339716f59f2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-e723d293-6492-467e-b475-155f1dcd074b\msiwrapper.ini

Filesize
1KB

MD5
d4613902dad8f9dbd87b7e1124ef88c6

SHA1
1584c47d78e7727495ee45814770e31bec1621e7

SHA256
73987c5f6a1cc34531f2bcf30760a6159dacaceb24ee3f9816ccbab16f327e30

SHA512
8c35a3cefe093e8db61ac277e4922b78a861e4654f1b43de641429cd16d1f02235c64f735b0cd14ae4b7be4d19d39e25c36086ad015b8b7f34392001be61bc32

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-e723d293-6492-467e-b475-155f1dcd074b\msiwrapper.ini

Filesize
1KB

MD5
85f1a667bb5bbba512df764372b34752

SHA1
3b483cfaf08b65473f95ef7219a2e5447d13e68b

SHA256
a7f9fafd935b8f74122e0f8d14dafb8e842941ad253a7f8b04b46908c90390a6

SHA512
5c51368007d2eecedafc2701731181099552931d8805ef64fa1d2d431aa5801d84c6086c6c41ac4e9f90ea8595c7688942a80ea2c4be6e99c18415b5199929e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5057.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Roaming\BlueIris\Uninstall\uninstall.xml

Filesize
68KB

MD5
bdeca3910bc9d343a6da69e78c09fb92

SHA1
c524b387384307908bbde2cc83cee0ad1c594946

SHA256
ca5b703c30bfc0af04457ed397b509a87782d16aa760abe8f0ca01b2f73a2cd1

SHA512
cdea0cfc8f9c4fcf06483d2a019047cca76a4662511a5a81c83ce1b3150b4964f40db2a7f0d2a51e401f1d476eada945c309ceaa9a1185d4a9e758b716a44185

Download Submit
C:\Users\Admin\AppData\Roaming\BlueIris\Uninstall\uninstall.xml

Filesize
77KB

MD5
891f47f663af205672ed1d919844f977

SHA1
66d9a515f6b6d1d58725e984cf4948dd1fdcb1f2

SHA256
bf9bfd632dc4897b54293375a2abc6b054fd5db333d3f7ec0e66f5e51016050e

SHA512
b47a71042a1d19099c8a116d908f535e7dc4c8f703b7841ef92761bbf44d4e2e0d7ba9f2f135c146215d9dd9218c4653f55c4dedd8c3347faccb88caf67b12cf

Download Submit
C:\Users\Admin\AppData\Roaming\BlueIris\cmsengine.exe

Filesize
1.1MB

MD5
19037d5fe7a01a342d384b0401b952cc

SHA1
da9b020ca45adf13525ed70f192bb86b8c9cddbb

SHA256
a9893dfafe2a6256768d46142a29e7932fc4d69ce93228bed674399edebf81b3

SHA512
dda1eb87444538285735f3b188793083249fd26e617f706a44def107658e84f8324405ae956323c8f6ec90820961ed56db6a2e91f9f6cc6e720163992859cedf

Download Submit
C:\Users\Admin\AppData\Roaming\BlueIris\libintl-8.dll

Filesize
704KB

MD5
0a25e2b6c8b2cf8b896ac878d48760d1

SHA1
420b3e97129d689e0912d9eda1f38bb31df939fc

SHA256
4e2dbf422c68c6c985be8013da726a63228e4b7dfbd48a967334535546f9a921

SHA512
a31107f345f7d0830920caa637442300ad215c45c99e5319609f2ec2ba0ed5c2b478e2d5558ffaa94cde6fed60746fdf4e47d3fe8eb6cde4c4b1e03e80c53cd6

Download Submit
C:\Users\Admin\AppData\Roaming\BlueIris\res\public\en\html\startpage_banner.html

Filesize
490B

MD5
5d1f7da1c3d95020a0708118145364d0

SHA1
02f630e7ac8b8d400af219bd8811aa3a22f7186e

SHA256
d2d828c2c459b72ee378db6c5ac295315b8a783b7049032f92ed4fcb2a89684a

SHA512
6bbdaaef1478ffd9e9d3a95d300f35b9ac6f3ce6564e80734445a827ad8761233db36c679fac117f363bae27918983520f0e2f408205d3549b001fc4ae4c920c

Download Submit
C:\Users\Admin\AppData\Roaming\BlueIris\res\public\en\html\startpage_connect_to_data_no_mru.html

Filesize
1KB

MD5
20bbd307866f19a5af3ae9ebd5104018

SHA1
8e03c9b18b9d27e9292ee154b773553493df1157

SHA256
e4fe51c170e02a01f30a4db8b458fb9b8dee13a7740f17765ba4873fac62c5f7

SHA512
420a132ad4ba3a67f5b66a3e463c4fa495b7941d58d6d669a8c984380607a03f0afa1c92bcf1f8d1fc5d93838ea611f7f9cf439bb3ada0142431b119ddfad40d

Download Submit
C:\Users\Admin\AppData\Roaming\BlueIris\res\public\en\html\startpage_connect_to_data_with_mru.html

Filesize
1KB

MD5
e6bc0d078616dd5d5f72d46ab2216e89

SHA1
f70534bb999bcb8f1db0cf25a7279757e794499f

SHA256
e8f50f17c994f394239350951a40c3454e9b52b0ca95cf342f2577828f390a54

SHA512
6ccd6e19ec63f20c86a28ccaffa609a2d0de7991a8eb2d6ea016bcc5d0e9f2fc28c33a15c4af891f28a9e1e4131f38f84f8e1a8859e020d6f267977075f7c66a

Download Submit
C:\Users\Admin\AppData\Roaming\BlueIris\res\public\en\html\startpage_landing.html

Filesize
720B

MD5
0a5b47256c14570b80ef77ecfd2129b7

SHA1
69210a7429c991909c70b6b6b75fe4bc606048ae

SHA256
1934657d800997dedba9f4753150f7d8f96dd5903a9c47ed6885aabf563bf73d

SHA512
5ca22260d26ec5bb1d65c4af3e2f05356d7b144836790ac656bf8c1687dd5c7d67a8a46c7bde374ec9e59a1bedc0298a4609f229d997409a0cc5453ef102ecb2

Download Submit
C:\Users\Admin\AppData\Roaming\BlueIris\res\public\en\html\startpage_topstrip_no_mru.html

Filesize
659B

MD5
eced86c9d5b8952ac5fb817c3ce2b8ba

SHA1
3ca24e69df7a4b81f799527a97282799fcd3f1e2

SHA256
3988afa43d3c716ecbe4e261ff13c32fe67baaaf1718eac790040cff2aa4e44d

SHA512
a21e88968c30f14363a73dfd7801cea34255acb968160fad59d813bb64352583c8c4f6cd9d45811676ca5ca90a4250601a53e80b6f41d6727465f3a57e7423a1

Download Submit
C:\Users\Admin\AppData\Roaming\BlueIris\res\public\en\html\startpage_topstrip_with_mru.html

Filesize
798B

MD5
cc4d8a787ab1950c4e3aac5751c9fcde

SHA1
d026a156723a52c34927b5a951a2bb7d23aa2c45

SHA256
13683e06e737e83ca94505b1cd1cd70f4f8b2cc5e7560f121a6e02ed1a06e7ee

SHA512
e0b01f5ee4da60e35a4eb94490bed815aea00382f3b9822b7c29294cf86a2fe480dba704f086a38f9d7aaf39e8160f49cf806b6b6c44651de56e290249dd9ebe

Download Submit
C:\Users\Admin\AppData\Roaming\BlueIris\res\public\en\stylesheets\start_page.css

Filesize
2KB

MD5
f2ab3e5fb61293ae8656413dbb6e5dc3

SHA1
53b3c3c4b57c3d5e2d9a36272b27786cd60f0eb5

SHA256
06db4d53adf4a1ecbc03ed9962af7f46fd3a54668d45907dc1737125e38ec192

SHA512
2c31cad868e1e5149a4308a149104ac3d88907894699fb0413860c8f578de32f6814b08d518de7a7fe3782f0cea173cb1766da7c25f2bcdddaffae7bc0da927c

Download Submit
C:\Users\Admin\AppData\Roaming\BlueIris\res\public\en\stylesheets\start_page_landing.css

Filesize
282B

MD5
49617add7303a8fbd24e1ad16ba715d8

SHA1
31772218ccf51fe5955625346c12e00c0f2e539a

SHA256
b3a99eea19c469dab3b727d1324ed87d10999133d3268ed0fadd5a5c8d182907

SHA512
9d1198ca13a0c1f745b01aabc23b60b8e0df4f12d7fdf17e87e750f021fc3800ea808af6c875848b3850061070dfd54c2e34d92cea4e8a2bf4736fbcfd129d1e

Download Submit
C:\Users\Admin\AppData\Roaming\BlueIris\ui.xml

Filesize
256KB

MD5
ca51e82ed2a00fcd5d62653283f45a4c

SHA1
6cd6b698a207918aece598552db698ee6b7da2b3

SHA256
328860f1f6f9dfca55f907868de3a39963b56d0e1864f151ebe14f4e058e83cb

SHA512
6289470dffd0c19ab2321aaa64006406010ce762e23a90dc80b1f476f1557c5597ffa6e5e9904bdde849586cd6daaaef33be258295dddb86e12cbb13635892be

Download Submit
C:\Windows\Installer\MSID44C.tmp

Filesize
208KB

MD5
4caaa03e0b59ca60a3d34674b732b702

SHA1
ee80c8f4684055ac8960b9720fb108be07e1d10c

SHA256
d01af2b8c692dffb04a5a04e3ccd0d0a3b2c67c8fc45a4b68c0a065b4e64cc3d

SHA512
25888848871286bdd1f9c43a0fba35640edb5bafbe0c6aa2f9708a070ea4e5b16745b7c4f744ae4f5643f75ef47f196d430bf70921ed27715f712825ec590a34

Download Submit
\Users\Admin\AppData\Local\Temp\MW-e723d293-6492-467e-b475-155f1dcd074b\files\1setup.exe

Filesize
4.6MB

MD5
0d20ee198ffc853a5ca9279023ca5a0c

SHA1
77d387656b54d133fd623762312152cf38ebe8bd

SHA256
2577843f81210344af8ccea7c2c27d51c4bae4a613b22a3dd760d2c943509a99

SHA512
3e9e26fe8cbd398af6001ea1971a525d4cfdcf0032f313ca42068835ae1a43af6c3b6dfb3454ba293649176617b3f8139a8ada58e007d006ff18805febe7241c

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
1.2MB

MD5
05b2516ee6bb26e13b8363302affb3ad

SHA1
8d1c151d9579cb89dc83c64143b043ce15d4b23d

SHA256
1d3863336184c6d98211c88b5e9a8abd1be1c4dffdde7cd2628a21c50b4ad2d5

SHA512
e0b46c27149d03d5e9d69d8e4fde36851f505d1361e6cfb53582ae411e13103030c71d57b73a1244d67ff40de52d5c99a0700c63e6e702c05f8d7b00a28faf10

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

Filesize
1.3MB

MD5
ac23d03c4b8d531016a3c1ebfa2bc91c

SHA1
11383627d5515ed2257f594db7fbce3a4b9106f8

SHA256
0ddd10f3c8a3268237117f08a94c52ead801a76286bb76d0f521b56689801d06

SHA512
bb649ab787a05dba410ce43a592b7f122c71f1fdc69bbb8789c57a3e64018189eebb9b46669a2d6a1b156818bb59beed130aeae6e1928108dee16168445659c1

Download Submit
\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

Filesize
326KB

MD5
e7a789232ef503dcb4929791673009a3

SHA1
8bc28bce4c9d8b4a6e360100441ba54a878de4c1

SHA256
89daa79b558055f6f893abf38a0f17d3e1e0193d59dafbdf98d72d4e5961c2a1

SHA512
6439a2ec5e9d486c15a37a736bc8d36d8e5f6ecb6a354d0fdd7efc9dccd3fb6bdb208a051b0d81f101669169826e07f9b4ddd79259c79c1e03856af5a9442b87

Download Submit
\Users\Admin\AppData\Roaming\BlueIris\cmsengine.exe

Filesize
1.5MB

MD5
9cd33ba3d98926bf3de9239ec56e8902

SHA1
89eaeefc0fe686508fa642ea292284783b0ee4fe

SHA256
17965dec2585f8e63381a68413eb449baf3fef0b5c2edfabe22780535c0e4764

SHA512
7a45e301b8f2554b7ff5cea5cfc9c0614a4fdc3401a78d14f2bf8690d4cfcb832120ea1bd3db27cbd10e3b6284d6f1bcce31a810ffbcb4e20ce1eeeda291c05b

Download Submit
\Users\Admin\AppData\Roaming\BlueIris\cmsengine.exe

Filesize
960KB

MD5
1a4c1bc8ddb635f4057b02af4addae5f

SHA1
30270bde7ffe0837cd403d5676eff9b264a10f7f

SHA256
df669cb9ecf1354a9c16ad44f9aefa631c0eb8d0119a19d5575c22a2bfa25e25

SHA512
c0dcb2d2959dc5908c62e3ea278165fc097a661f43821ada5922e020e731d9e80c7cb190fca6f974174b149df6a5007f6b34aa79c880de96e3211031acb4fc97

Download Submit
\Users\Admin\AppData\Roaming\BlueIris\cmsengine.exe

Filesize
951KB

MD5
6df4c119e13922a0d554ed9762cad06f

SHA1
aeedf17a8cb4ed43103a4a30fb4b815ecd543a99

SHA256
1d8c0805d15dd29d663bc1f3a31c3576a464cc55fc03763f1ccf8ed491c55170

SHA512
82fb6ab50883a73a411d4667734e53cd3f5cc18440380c4df89cd55c6f31b3f0edb73f1528a84f05ad9d6d754dd3491f3f57f8bddfb99eac1125b1744dbc5408

Download Submit
\Users\Admin\AppData\Roaming\BlueIris\libintl-8.dll

Filesize
320KB

MD5
876f24a9ce1bca4062cea3672d130d26

SHA1
801105866a802204b97f9547cbd636d2275a67e6

SHA256
61baa749ec902239ff25668685ef47f26372880f5425726c7b583d2ada3c49aa

SHA512
feea39f504d62ee5f87266a3cd0d55912dd1dfc5145775a0afa30c9a81fe2beb429613ee2400436dc567ca105132d9ae76c2603c7bcfe6fa5ce9e993266cb423

Download Submit
memory/1608-216-0x0000000002B50000-0x0000000002F38000-memory.dmp

Filesize
3.9MB

Download
memory/1608-212-0x0000000002B50000-0x0000000002F38000-memory.dmp

Filesize
3.9MB

Download
memory/1608-211-0x0000000002B50000-0x0000000002F38000-memory.dmp

Filesize
3.9MB

Download
memory/2304-1077-0x0000000000A40000-0x0000000000A50000-memory.dmp

Filesize
64KB

Download
memory/2304-1095-0x0000000004960000-0x0000000005190000-memory.dmp

Filesize
8.2MB

Download
memory/2304-1099-0x0000000004960000-0x0000000005190000-memory.dmp

Filesize
8.2MB

Download
memory/2304-1098-0x00000000000A0000-0x0000000000488000-memory.dmp

Filesize
3.9MB

Download
memory/2304-217-0x00000000000A0000-0x0000000000488000-memory.dmp

Filesize
3.9MB

Download
memory/2304-935-0x00000000000A0000-0x0000000000488000-memory.dmp

Filesize
3.9MB

Download
memory/2764-1100-0x00000000012B0000-0x0000000001AE0000-memory.dmp

Filesize
8.2MB

Download