Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24/02/2024, 12:30
Static task
static1
Behavioral task
behavioral1
Sample
liquidlauncher_0.2.1_x64_en-US.msi
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
liquidlauncher_0.2.1_x64_en-US.msi
Resource
win10v2004-20240221-en
windows10-2004-x64
21 signatures
150 seconds
General
-
Target
liquidlauncher_0.2.1_x64_en-US.msi
-
Size
6.9MB
-
MD5
93394562e845b91d2795b2c18fe4c451
-
SHA1
62f10d528e54a6e33e35ef0657a452e73bca036f
-
SHA256
e3b541059a8d1ddc386fd2a31934148de3574ba80247df751d33c6d8a167b215
-
SHA512
5fae28e482ea37c4629fbf63dc7698180c19e5d7b66853f7fae63c253e68404eb92af3fa8b02c57c9d15f41443e00ad10edd52c550ee3e8d2f82c3f50eb2b50b
-
SSDEEP
196608:XcQlpq6HQ4IXRBPT68xVq9YRG9UYvkJYcO:M6XqRZG8vq9YE8O
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\liquidlauncher\liquidlauncher.exe msiexec.exe File created C:\Program Files\liquidlauncher\Uninstall liquidlauncher.lnk msiexec.exe File opened for modification C:\Program Files\liquidlauncher\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\f76e659.msi msiexec.exe File opened for modification C:\Windows\Installer\{56CD17D2-94F2-4B09-80AD-8939F9CC840D}\ProductIcon msiexec.exe File opened for modification C:\Windows\Installer\f76e65a.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIEABC.tmp msiexec.exe File created C:\Windows\Installer\{56CD17D2-94F2-4B09-80AD-8939F9CC840D}\ProductIcon msiexec.exe File created C:\Windows\Installer\f76e65c.msi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File created C:\Windows\Installer\f76e659.msi msiexec.exe File created C:\Windows\Installer\f76e65a.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe -
Loads dropped DLL 7 IoCs
pid Process 2576 MsiExec.exe 1292 msiexec.exe 1292 msiexec.exe 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found -
Modifies data under HKEY_USERS 46 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe -
Modifies registry class 35 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2D71DC652F4990B408DA98939FCC48D0 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2D71DC652F4990B408DA98939FCC48D0\Environment = "MainProgram" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\2693D3A556A2F4757975715DD16BC1A4\2D71DC652F4990B408DA98939FCC48D0 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D71DC652F4990B408DA98939FCC48D0\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D71DC652F4990B408DA98939FCC48D0\SourceList\PackageName = "liquidlauncher_0.2.1_x64_en-US.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D71DC652F4990B408DA98939FCC48D0\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2D71DC652F4990B408DA98939FCC48D0\External msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D71DC652F4990B408DA98939FCC48D0\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D71DC652F4990B408DA98939FCC48D0\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\2693D3A556A2F4757975715DD16BC1A4 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Products\2D71DC652F4990B408DA98939FCC48D0 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D71DC652F4990B408DA98939FCC48D0\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Products\2D71DC652F4990B408DA98939FCC48D0\SourceList msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D71DC652F4990B408DA98939FCC48D0\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D71DC652F4990B408DA98939FCC48D0\PackageCode = "50E5BDD93EB8FB748999F8EF663B6DAD" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D71DC652F4990B408DA98939FCC48D0\Clients = 3a0000000000 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D71DC652F4990B408DA98939FCC48D0\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D71DC652F4990B408DA98939FCC48D0\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D71DC652F4990B408DA98939FCC48D0\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D71DC652F4990B408DA98939FCC48D0\SourceList\Media msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D71DC652F4990B408DA98939FCC48D0 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D71DC652F4990B408DA98939FCC48D0\Language = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D71DC652F4990B408DA98939FCC48D0\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D71DC652F4990B408DA98939FCC48D0\ProductIcon = "C:\\Windows\\Installer\\{56CD17D2-94F2-4B09-80AD-8939F9CC840D}\\ProductIcon" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D71DC652F4990B408DA98939FCC48D0\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Features\2D71DC652F4990B408DA98939FCC48D0 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2D71DC652F4990B408DA98939FCC48D0 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2D71DC652F4990B408DA98939FCC48D0\MainProgram msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D71DC652F4990B408DA98939FCC48D0 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D71DC652F4990B408DA98939FCC48D0\ProductName = "liquidlauncher" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D71DC652F4990B408DA98939FCC48D0\Version = "131073" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2D71DC652F4990B408DA98939FCC48D0\ShortcutsFeature = "MainProgram" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D71DC652F4990B408DA98939FCC48D0\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2D71DC652F4990B408DA98939FCC48D0\DeploymentFlags = "3" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\2693D3A556A2F4757975715DD16BC1A4 msiexec.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1292 msiexec.exe 1292 msiexec.exe 1796 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1152 msiexec.exe Token: SeIncreaseQuotaPrivilege 1152 msiexec.exe Token: SeRestorePrivilege 1292 msiexec.exe Token: SeTakeOwnershipPrivilege 1292 msiexec.exe Token: SeSecurityPrivilege 1292 msiexec.exe Token: SeCreateTokenPrivilege 1152 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1152 msiexec.exe Token: SeLockMemoryPrivilege 1152 msiexec.exe Token: SeIncreaseQuotaPrivilege 1152 msiexec.exe Token: SeMachineAccountPrivilege 1152 msiexec.exe Token: SeTcbPrivilege 1152 msiexec.exe Token: SeSecurityPrivilege 1152 msiexec.exe Token: SeTakeOwnershipPrivilege 1152 msiexec.exe Token: SeLoadDriverPrivilege 1152 msiexec.exe Token: SeSystemProfilePrivilege 1152 msiexec.exe Token: SeSystemtimePrivilege 1152 msiexec.exe Token: SeProfSingleProcessPrivilege 1152 msiexec.exe Token: SeIncBasePriorityPrivilege 1152 msiexec.exe Token: SeCreatePagefilePrivilege 1152 msiexec.exe Token: SeCreatePermanentPrivilege 1152 msiexec.exe Token: SeBackupPrivilege 1152 msiexec.exe Token: SeRestorePrivilege 1152 msiexec.exe Token: SeShutdownPrivilege 1152 msiexec.exe Token: SeDebugPrivilege 1152 msiexec.exe Token: SeAuditPrivilege 1152 msiexec.exe Token: SeSystemEnvironmentPrivilege 1152 msiexec.exe Token: SeChangeNotifyPrivilege 1152 msiexec.exe Token: SeRemoteShutdownPrivilege 1152 msiexec.exe Token: SeUndockPrivilege 1152 msiexec.exe Token: SeSyncAgentPrivilege 1152 msiexec.exe Token: SeEnableDelegationPrivilege 1152 msiexec.exe Token: SeManageVolumePrivilege 1152 msiexec.exe Token: SeImpersonatePrivilege 1152 msiexec.exe Token: SeCreateGlobalPrivilege 1152 msiexec.exe Token: SeCreateTokenPrivilege 1152 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1152 msiexec.exe Token: SeLockMemoryPrivilege 1152 msiexec.exe Token: SeIncreaseQuotaPrivilege 1152 msiexec.exe Token: SeMachineAccountPrivilege 1152 msiexec.exe Token: SeTcbPrivilege 1152 msiexec.exe Token: SeSecurityPrivilege 1152 msiexec.exe Token: SeTakeOwnershipPrivilege 1152 msiexec.exe Token: SeLoadDriverPrivilege 1152 msiexec.exe Token: SeSystemProfilePrivilege 1152 msiexec.exe Token: SeSystemtimePrivilege 1152 msiexec.exe Token: SeProfSingleProcessPrivilege 1152 msiexec.exe Token: SeIncBasePriorityPrivilege 1152 msiexec.exe Token: SeCreatePagefilePrivilege 1152 msiexec.exe Token: SeCreatePermanentPrivilege 1152 msiexec.exe Token: SeBackupPrivilege 1152 msiexec.exe Token: SeRestorePrivilege 1152 msiexec.exe Token: SeShutdownPrivilege 1152 msiexec.exe Token: SeDebugPrivilege 1152 msiexec.exe Token: SeAuditPrivilege 1152 msiexec.exe Token: SeSystemEnvironmentPrivilege 1152 msiexec.exe Token: SeChangeNotifyPrivilege 1152 msiexec.exe Token: SeRemoteShutdownPrivilege 1152 msiexec.exe Token: SeUndockPrivilege 1152 msiexec.exe Token: SeSyncAgentPrivilege 1152 msiexec.exe Token: SeEnableDelegationPrivilege 1152 msiexec.exe Token: SeManageVolumePrivilege 1152 msiexec.exe Token: SeImpersonatePrivilege 1152 msiexec.exe Token: SeCreateGlobalPrivilege 1152 msiexec.exe Token: SeCreateTokenPrivilege 1152 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1152 msiexec.exe 1152 msiexec.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1292 wrote to memory of 2576 1292 msiexec.exe 29 PID 1292 wrote to memory of 2576 1292 msiexec.exe 29 PID 1292 wrote to memory of 2576 1292 msiexec.exe 29 PID 1292 wrote to memory of 2576 1292 msiexec.exe 29 PID 1292 wrote to memory of 2576 1292 msiexec.exe 29 PID 1292 wrote to memory of 2576 1292 msiexec.exe 29 PID 1292 wrote to memory of 2576 1292 msiexec.exe 29 PID 1292 wrote to memory of 1796 1292 msiexec.exe 35 PID 1292 wrote to memory of 1796 1292 msiexec.exe 35 PID 1292 wrote to memory of 1796 1292 msiexec.exe 35 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\liquidlauncher_0.2.1_x64_en-US.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1152
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 331B8CD4A7DC34B27DB73CE081F89631 C2⤵
- Loads dropped DLL
PID:2576
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -windowstyle hidden try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 } catch {}; Invoke-WebRequest -Uri "https://go.microsoft.com/fwlink/p/?LinkId=2124703" -OutFile "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" ; Start-Process -FilePath "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" -ArgumentList ('/silent', '/install') -Wait2⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:1796
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:2504
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000304" "000000000000057C"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2448
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
75KB
MD52465f30ca7c5e82b514f7046bcc58587
SHA1ebabbe9602882012abb881294f3c9f408ee85be0
SHA256af13197d8c1418bdf4ad72631438976aba4a2c961a6b8877af953416e875070b
SHA51299b672972a97128ff8f59005c40bc249c8eaac4af65135d8ac347f728761b12bfc3e8ead4b5f83d813198434d240816914a6e45a2731cf88cefa666e8ca3366d
-
Filesize
2KB
MD599f487492b77fbf0343de191834fb664
SHA1658c84399a767df070613afd39ef5727c3036f74
SHA256013d012064965f4d953cea44f9ab1777d53ae255850af8ceaa01a6deed55b0c6
SHA512c30bf6cfdab80f6eab4089e5839bc97861e296d8fac53bfddd372e00ab95f1f91344683cca27c19d803746dc5d5a5cf9bf8da46bc5129ebb4e3cd0b8ea38b10b
-
Filesize
113KB
MD54fdd16752561cf585fed1506914d73e0
SHA1f00023b9ae3c8ce5b7bb92f25011eaebe6f9d424
SHA256aecd2d2fe766f6d439acc2bbf1346930ecc535012cf5ad7b3273d2875237b7e7
SHA5123695e7eb1e35ec959243a91ab5b4454eb59aeef0f2699aa5de8e03de8fbb89f756a89130526da5c08815408cb700284a17936522ad2cad594c3e6e9d18a3f600
-
Filesize
34KB
MD5e998f8228de623082c568fb063f58582
SHA1de3a65af16a38d14487c8c6c7d75bf123be1f6a5
SHA256dd0bffaa09e01a808d3cf8c9440b2f65fadbc3f3d3c789292ee91cb519c6ffd3
SHA512573490b7c6bbadeddab4269c602b1bce49b1d7785658270fea44798012b74e4d8b830080eca7977126e15512ea38d30bbd77cfbd018dd43e6ce4f65c0e0835a9
-
Filesize
430KB
MD5fb4a213143568e983da1a07dbc56d755
SHA1bfa55e7bb796d96b08b328bff02b48ec9bec2969
SHA2560dc01558cfd2ac03f4b6f233d1b6d4563f83c3a8a6fe4c1d659f2d844e151a91
SHA51286d39867d5105fdd1b9d9e367b84673ddab00240c8a19f00508245dd4b5e0a82e357f18f69088927adf14e03e2ccc423df4e14d1f0afe913391d986eac692979
-
Filesize
256KB
MD583c2b2638d2e996265a1c9eb38c80677
SHA186d13be7a853c1f0d6b632082a09cc1598d248cf
SHA25638184a6a9a2028092fb41f5449312b3ef29664b4ee92d1c30a94394903804b74
SHA512a2025fb7576ae3b510b62b47390bdf2eca7d5fb8e24e27c934b6cf853c2dd76887cc9895c657cde8531b1112db1ea11062261b38578ba563b6898bb4ce693ea5
-
Filesize
623KB
MD5499ddf3414f6d435a6f0a4bd3143e688
SHA18610bc4f759413f8e09de34658438bc5611925f2
SHA256204fe8e0e8f623336b9025b7e68057b994639a0524d55c19da2590efdc1ce198
SHA512bddc6e58a69c0f125971f09f1cc89ce29e70d8a8e5a9be3f1b0779e7a75f68647e7c6733fe68068b5b21accbc6d1869ebda2b077cf6cb29e14b91e14f4ee4506
-
Filesize
688KB
MD58ae8214d1275567ad1c47e04bd9be8fe
SHA148b859366f68bb99fb9e92d7c1a5567b2502a100
SHA256e4a21343db86f8908bddb35a3efac5248c8fadaa91135d5812e2953fa6dc26c4
SHA51230280aae3ea8b745b9c9929e28b158712c475f7dd11fee92330091110b8952f050af36cae3ff158120ad6550b5c763b8570a04d2315d901c66cd1c409f6f7a1e
-
Filesize
592KB
MD521aa10f4a7b680b41a8d6f11c4f0a3c7
SHA1ebfe68e90bcc642ac17d8f9441c336f57b9fa825
SHA2569781059f54177f9de3086467655dbbb4d1b400ed13f444c5907c791bb4a2f96f
SHA5121def04c67e3deb739d5cba4cdf50bda0254d59d91b0028c66817d43af02db50e3fc06a2d3e5cc24b8af444deef46715336ca41633f9f91dffcc3b83ee6a713cf
-
Filesize
519KB
MD5202507ee2022cb2b438df866f49a0ce6
SHA1babc9544a361496d2817e52bdaa6292a268f1d33
SHA256a6dd176494f60fcc8a312ae4b41583a7b68fe7cadfbdbe2094baf8af71e62689
SHA512c6df6bd14391c2f2b765d73884a4cd7bde56bea66a04c01fe209e05016a063154be923f7dd6326b586f548526eba21fcb1de8010585e222610e0335af63a41e0