Analysis
- max time kernel
357s - max time network
374s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
23/03/2024, 15:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
AgentSetup.exe
Resource
win7-20240319-en
windows7-x64
10 signatures
600 seconds
Behavioral task
behavioral2
Sample
AgentSetup.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
23 signatures
600 seconds
Behavioral task
behavioral3
Sample
$TEMP/AgentSetup.exe
Resource
win7-20240221-en
windows7-x64
10 signatures
600 seconds
Behavioral task
behavioral4
Sample
$TEMP/AgentSetup.exe
Resource
win10v2004-20240319-en
windows10-2004-x64
8 signatures
600 seconds
Behavioral task
behavioral5
Sample
$TEMP/WindowsUpdates.exe
Resource
win7-20240221-en
windows7-x64
16 signatures
600 seconds
General
- Target $TEMP/AgentSetup.exe
- Size 215.8MB
- Sample240323-snmrmsbe6s
- SHA256 84372730101078190450b74595424f2cee64e2563ce8f024fce69e9206ba42e4
- MD5 6f669ab8685bc09de164bdbdd4f378f1
- SHA1 89bccf94119ff5e82e0cbfc22846367b897bb2a9
- SHA512 cc7386cd2e4830ea293e4ef133790ba50ea68318b091ad04bf4cd8d2f84591c21e7e5a7cca4c1560fa84dbadb37c2540cdb36e2ba71ba073e755f3a17316e4a7
- SSDEEP 6291456:OgWtYiMKyaDkSyq1R4YWeKejXQHUX2MP4Xs:TYY9GkSyWPfjgW2MQ8
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 8 IoCs
pid Process 2876 MsiExec.exe 2876 MsiExec.exe 2876 MsiExec.exe 2876 MsiExec.exe 2876 MsiExec.exe 2876 MsiExec.exe 2876 MsiExec.exe 2876 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\U: AgentSetup.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: AgentSetup.exe File opened (read-only) \??\S: AgentSetup.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: AgentSetup.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: AgentSetup.exe File opened (read-only) \??\E: AgentSetup.exe File opened (read-only) \??\O: AgentSetup.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\K: AgentSetup.exe File opened (read-only) \??\X: AgentSetup.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\P: AgentSetup.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\M: AgentSetup.exe File opened (read-only) \??\Q: AgentSetup.exe File opened (read-only) \??\V: AgentSetup.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: AgentSetup.exe File opened (read-only) \??\I: AgentSetup.exe File opened (read-only) \??\J: AgentSetup.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: AgentSetup.exe File opened (read-only) \??\L: AgentSetup.exe File opened (read-only) \??\Z: AgentSetup.exe File opened (read-only) \??\W: AgentSetup.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: AgentSetup.exe File opened (read-only) \??\R: AgentSetup.exe File opened (read-only) \??\T: AgentSetup.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81\Blob = 0f000000010000001400000085fef11b4f47fe3952f98301c9f98976fefee0ce09000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000002500000030233021060b6086480186f8450107300130123010060a2b0601040182373c0101030200c01400000001000000140000007b5b45cfafcecb7afd31921a6ab6f346eb5748501d00000001000000100000005b3b67000eeb80022e42605b6b3b72400b000000010000000e000000740068006100770074006500000003000000010000001400000091c6d6ee3e8ac86384e548c299295c756c817b812000000001000000240400003082042030820308a0030201020210344ed55720d5edec49f42fce37db2b6d300d06092a864886f70d01010505003081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f74204341301e170d3036313131373030303030305a170d3336303731363233353935395a3081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aca0f0fb8059d49cc7a4cf9da159730910450c0d2c6e68f16c5b4868495937fc0b3319c2777fcc102d95341ce6eb4d09a71cd2b8c9973602b789d4245f06c0cc4494948d02626feb5add118d289a5c8490107a0dbd74662f6a38a0e2d55444eb1d079f07ba6feee9fd4e0b29f53e84a001f19cabf81c7e89a4e8a1d871650da3517beebcd222600db95b9ddfbafc515b0baf98b2e92ee904e86287de2bc8d74ec14c641eddcf8758ba4a4fca68071d1c9d4ac6d52f91cc7c71721cc5c067eb32fdc9925c94da85c09bbf537d2b09f48c9d911f976a52cbde0936a477d87b875044d53e6e2969fb3949261e09a5807b402debe82785c9fe61fd7ee67c971dd59d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147b5b45cfafcecb7afd31921a6ab6f346eb574850300d06092a864886f70d010105050003820101007911c04bb391b6fcf0e967d40d6e45be55e893d2ce033fedda25b01d57cb1e3a76a04cec5076e864720ca4a9f1b88bd6d68784bb32e54111c077d9b3609deb1bd5d16e4444a9a601ec55621d77b85c8e48497c9c3b5711acad73378e2f785c906847d96060e6fc073d222017c4f716e9c4d872f9c8737cdf162f15a93efd6a27b6a1eb5aba981fd5e34d640a9d13c861baf5391c87bab8bd7b227ff6feac4079e5ac106f3d8f1b79768bc437b3211884e53600eb632099b9e9fe3304bb41c8c102f94463209e81ce42d3d63f2c76d3639c59dd8fa6e10ea02e41f72e9547cfbcfd33f3f60b617e7e912b8147c22730eea7105d378f5c392be404f07b8d568c68 AgentSetup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81\Blob = 190000000100000010000000dc73f9b71e16d51d26527d32b11a6a3d03000000010000001400000091c6d6ee3e8ac86384e548c299295c756c817b810b000000010000000e00000074006800610077007400650000001d00000001000000100000005b3b67000eeb80022e42605b6b3b72401400000001000000140000007b5b45cfafcecb7afd31921a6ab6f346eb57485053000000010000002500000030233021060b6086480186f8450107300130123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b060105050703030f000000010000001400000085fef11b4f47fe3952f98301c9f98976fefee0ce2000000001000000240400003082042030820308a0030201020210344ed55720d5edec49f42fce37db2b6d300d06092a864886f70d01010505003081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f74204341301e170d3036313131373030303030305a170d3336303731363233353935395a3081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aca0f0fb8059d49cc7a4cf9da159730910450c0d2c6e68f16c5b4868495937fc0b3319c2777fcc102d95341ce6eb4d09a71cd2b8c9973602b789d4245f06c0cc4494948d02626feb5add118d289a5c8490107a0dbd74662f6a38a0e2d55444eb1d079f07ba6feee9fd4e0b29f53e84a001f19cabf81c7e89a4e8a1d871650da3517beebcd222600db95b9ddfbafc515b0baf98b2e92ee904e86287de2bc8d74ec14c641eddcf8758ba4a4fca68071d1c9d4ac6d52f91cc7c71721cc5c067eb32fdc9925c94da85c09bbf537d2b09f48c9d911f976a52cbde0936a477d87b875044d53e6e2969fb3949261e09a5807b402debe82785c9fe61fd7ee67c971dd59d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147b5b45cfafcecb7afd31921a6ab6f346eb574850300d06092a864886f70d010105050003820101007911c04bb391b6fcf0e967d40d6e45be55e893d2ce033fedda25b01d57cb1e3a76a04cec5076e864720ca4a9f1b88bd6d68784bb32e54111c077d9b3609deb1bd5d16e4444a9a601ec55621d77b85c8e48497c9c3b5711acad73378e2f785c906847d96060e6fc073d222017c4f716e9c4d872f9c8737cdf162f15a93efd6a27b6a1eb5aba981fd5e34d640a9d13c861baf5391c87bab8bd7b227ff6feac4079e5ac106f3d8f1b79768bc437b3211884e53600eb632099b9e9fe3304bb41c8c102f94463209e81ce42d3d63f2c76d3639c59dd8fa6e10ea02e41f72e9547cfbcfd33f3f60b617e7e912b8147c22730eea7105d378f5c392be404f07b8d568c68 AgentSetup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\629FEFBAEE7F760ECAF8B77600A62F7D030CE4EB AgentSetup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\629FEFBAEE7F760ECAF8B77600A62F7D030CE4EB\Blob = 0f0000000100000020000000200f0b5a5a6613a83b1f38c1712de9c969d43c009f975340877ff3316d3208f6030000000100000014000000629fefbaee7f760ecaf8b77600a62f7d030ce4eb2000000001000000f9020000308202f5308201dda0030201020210530de82938ef5e0bf368a70c7fe5abe0300d06092a864886f70d01010b050030133111300f06035504031308436c6f75644e6574301e170d3234303331393136303030305a170d3239303331383136303030305a30133111300f06035504031308436c6f75644e657430820122300d06092a864886f70d01010105000382010f003082010a0282010100cb7b61bbf0be0a1f20c957c39135dd9d2aef3580bb6bf8ac1d4aad6fc6dc761636b246437b7ce665ded186bfd6af63a800793b3ec33c726fed686ccfd5d08ad20b1f3ca0073a88c97d829edcc95f3a3dedd935892566d58854d390863ef3ae5dc5503e2c7ec51e07700961a80f11c8174d319bfa6e61bbf3d7d76c8f31056af71cd87c410faeadea6a80f95e573a13abdfb98da92e79a665945e7168c92380b585b2bf0686fedadc5b7ef1225b8ac176042a577c211d4e002e2ea8025ec3361720e2a18d0bf4c729d5eee1a0554aebec0e63b3b867a8049eb06bb680c5e8180b3c2db63a09fcb0972c5ab503799382d33319151ed5b2eb4eeb4c1c83d0dd1dfb0203010001a3453043300e0603551d0f0101ff04040302010630120603551d130101ff040830060101ff020101301d0603551d0e04160414479575ce7b2d81c5f6552dbdec3672ae4bf670ee300d06092a864886f70d01010b050003820101000d8afec036e1176adf39317bc387ca0f6f7d2628049b945cfa6f13c0079e77ec991239c359c066a682cd1086535206fae118f80cc38eb15c776788dac70034719b3664e6969e1f4ea4b3e5c73a76e50751be981997748f9f121e399119aa7e88b2a8bf659d17377ab08014adcfc239bfbd7d2a03583de8a74c2b5d5aa306d56454e39689892b67540420b01ba19f4477ddec7b6db4da68258a47fbca3e02fb0aeb9be7c4df9408799062dd0e31a6902fbbfa1ee084c5e1ef6778af7ccbebedc54704a4760d041a9435cf96da021e6334d764739ac1ec73d46490d654363d8b6a825088fd01d99cd6d8e457c10e9e08d2f4947d8be8c1ea7e9dbbceb4d509c494 AgentSetup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\629FEFBAEE7F760ECAF8B77600A62F7D030CE4EB\Blob = 140000000100000014000000479575ce7b2d81c5f6552dbdec3672ae4bf670ee030000000100000014000000629fefbaee7f760ecaf8b77600a62f7d030ce4eb0f0000000100000020000000200f0b5a5a6613a83b1f38c1712de9c969d43c009f975340877ff3316d3208f62000000001000000f9020000308202f5308201dda0030201020210530de82938ef5e0bf368a70c7fe5abe0300d06092a864886f70d01010b050030133111300f06035504031308436c6f75644e6574301e170d3234303331393136303030305a170d3239303331383136303030305a30133111300f06035504031308436c6f75644e657430820122300d06092a864886f70d01010105000382010f003082010a0282010100cb7b61bbf0be0a1f20c957c39135dd9d2aef3580bb6bf8ac1d4aad6fc6dc761636b246437b7ce665ded186bfd6af63a800793b3ec33c726fed686ccfd5d08ad20b1f3ca0073a88c97d829edcc95f3a3dedd935892566d58854d390863ef3ae5dc5503e2c7ec51e07700961a80f11c8174d319bfa6e61bbf3d7d76c8f31056af71cd87c410faeadea6a80f95e573a13abdfb98da92e79a665945e7168c92380b585b2bf0686fedadc5b7ef1225b8ac176042a577c211d4e002e2ea8025ec3361720e2a18d0bf4c729d5eee1a0554aebec0e63b3b867a8049eb06bb680c5e8180b3c2db63a09fcb0972c5ab503799382d33319151ed5b2eb4eeb4c1c83d0dd1dfb0203010001a3453043300e0603551d0f0101ff04040302010630120603551d130101ff040830060101ff020101301d0603551d0e04160414479575ce7b2d81c5f6552dbdec3672ae4bf670ee300d06092a864886f70d01010b050003820101000d8afec036e1176adf39317bc387ca0f6f7d2628049b945cfa6f13c0079e77ec991239c359c066a682cd1086535206fae118f80cc38eb15c776788dac70034719b3664e6969e1f4ea4b3e5c73a76e50751be981997748f9f121e399119aa7e88b2a8bf659d17377ab08014adcfc239bfbd7d2a03583de8a74c2b5d5aa306d56454e39689892b67540420b01ba19f4477ddec7b6db4da68258a47fbca3e02fb0aeb9be7c4df9408799062dd0e31a6902fbbfa1ee084c5e1ef6778af7ccbebedc54704a4760d041a9435cf96da021e6334d764739ac1ec73d46490d654363d8b6a825088fd01d99cd6d8e457c10e9e08d2f4947d8be8c1ea7e9dbbceb4d509c494 AgentSetup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\629FEFBAEE7F760ECAF8B77600A62F7D030CE4EB\Blob = 190000000100000010000000be9880cffc89824021a16495b95aef4b0f0000000100000020000000200f0b5a5a6613a83b1f38c1712de9c969d43c009f975340877ff3316d3208f6030000000100000014000000629fefbaee7f760ecaf8b77600a62f7d030ce4eb140000000100000014000000479575ce7b2d81c5f6552dbdec3672ae4bf670ee2000000001000000f9020000308202f5308201dda0030201020210530de82938ef5e0bf368a70c7fe5abe0300d06092a864886f70d01010b050030133111300f06035504031308436c6f75644e6574301e170d3234303331393136303030305a170d3239303331383136303030305a30133111300f06035504031308436c6f75644e657430820122300d06092a864886f70d01010105000382010f003082010a0282010100cb7b61bbf0be0a1f20c957c39135dd9d2aef3580bb6bf8ac1d4aad6fc6dc761636b246437b7ce665ded186bfd6af63a800793b3ec33c726fed686ccfd5d08ad20b1f3ca0073a88c97d829edcc95f3a3dedd935892566d58854d390863ef3ae5dc5503e2c7ec51e07700961a80f11c8174d319bfa6e61bbf3d7d76c8f31056af71cd87c410faeadea6a80f95e573a13abdfb98da92e79a665945e7168c92380b585b2bf0686fedadc5b7ef1225b8ac176042a577c211d4e002e2ea8025ec3361720e2a18d0bf4c729d5eee1a0554aebec0e63b3b867a8049eb06bb680c5e8180b3c2db63a09fcb0972c5ab503799382d33319151ed5b2eb4eeb4c1c83d0dd1dfb0203010001a3453043300e0603551d0f0101ff04040302010630120603551d130101ff040830060101ff020101301d0603551d0e04160414479575ce7b2d81c5f6552dbdec3672ae4bf670ee300d06092a864886f70d01010b050003820101000d8afec036e1176adf39317bc387ca0f6f7d2628049b945cfa6f13c0079e77ec991239c359c066a682cd1086535206fae118f80cc38eb15c776788dac70034719b3664e6969e1f4ea4b3e5c73a76e50751be981997748f9f121e399119aa7e88b2a8bf659d17377ab08014adcfc239bfbd7d2a03583de8a74c2b5d5aa306d56454e39689892b67540420b01ba19f4477ddec7b6db4da68258a47fbca3e02fb0aeb9be7c4df9408799062dd0e31a6902fbbfa1ee084c5e1ef6778af7ccbebedc54704a4760d041a9435cf96da021e6334d764739ac1ec73d46490d654363d8b6a825088fd01d99cd6d8e457c10e9e08d2f4947d8be8c1ea7e9dbbceb4d509c494 AgentSetup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81 AgentSetup.exe - Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 984 powershell.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2708 AgentSetup.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 2732 msiexec.exe Token: SeTakeOwnershipPrivilege 2732 msiexec.exe Token: SeSecurityPrivilege 2732 msiexec.exe Token: SeCreateTokenPrivilege 2708 AgentSetup.exe Token: SeAssignPrimaryTokenPrivilege 2708 AgentSetup.exe Token: SeLockMemoryPrivilege 2708 AgentSetup.exe Token: SeIncreaseQuotaPrivilege 2708 AgentSetup.exe Token: SeMachineAccountPrivilege 2708 AgentSetup.exe Token: SeTcbPrivilege 2708 AgentSetup.exe Token: SeSecurityPrivilege 2708 AgentSetup.exe Token: SeTakeOwnershipPrivilege 2708 AgentSetup.exe Token: SeLoadDriverPrivilege 2708 AgentSetup.exe Token: SeSystemProfilePrivilege 2708 AgentSetup.exe Token: SeSystemtimePrivilege 2708 AgentSetup.exe Token: SeProfSingleProcessPrivilege 2708 AgentSetup.exe Token: SeIncBasePriorityPrivilege 2708 AgentSetup.exe Token: SeCreatePagefilePrivilege 2708 AgentSetup.exe Token: SeCreatePermanentPrivilege 2708 AgentSetup.exe Token: SeBackupPrivilege 2708 AgentSetup.exe Token: SeRestorePrivilege 2708 AgentSetup.exe Token: SeShutdownPrivilege 2708 AgentSetup.exe Token: SeDebugPrivilege 2708 AgentSetup.exe Token: SeAuditPrivilege 2708 AgentSetup.exe Token: SeSystemEnvironmentPrivilege 2708 AgentSetup.exe Token: SeChangeNotifyPrivilege 2708 AgentSetup.exe Token: SeRemoteShutdownPrivilege 2708 AgentSetup.exe Token: SeUndockPrivilege 2708 AgentSetup.exe Token: SeSyncAgentPrivilege 2708 AgentSetup.exe Token: SeEnableDelegationPrivilege 2708 AgentSetup.exe Token: SeManageVolumePrivilege 2708 AgentSetup.exe Token: SeImpersonatePrivilege 2708 AgentSetup.exe Token: SeCreateGlobalPrivilege 2708 AgentSetup.exe Token: SeCreateTokenPrivilege 2708 AgentSetup.exe Token: SeAssignPrimaryTokenPrivilege 2708 AgentSetup.exe Token: SeLockMemoryPrivilege 2708 AgentSetup.exe Token: SeIncreaseQuotaPrivilege 2708 AgentSetup.exe Token: SeMachineAccountPrivilege 2708 AgentSetup.exe Token: SeTcbPrivilege 2708 AgentSetup.exe Token: SeSecurityPrivilege 2708 AgentSetup.exe Token: SeTakeOwnershipPrivilege 2708 AgentSetup.exe Token: SeLoadDriverPrivilege 2708 AgentSetup.exe Token: SeSystemProfilePrivilege 2708 AgentSetup.exe Token: SeSystemtimePrivilege 2708 AgentSetup.exe Token: SeProfSingleProcessPrivilege 2708 AgentSetup.exe Token: SeIncBasePriorityPrivilege 2708 AgentSetup.exe Token: SeCreatePagefilePrivilege 2708 AgentSetup.exe Token: SeCreatePermanentPrivilege 2708 AgentSetup.exe Token: SeBackupPrivilege 2708 AgentSetup.exe Token: SeRestorePrivilege 2708 AgentSetup.exe Token: SeShutdownPrivilege 2708 AgentSetup.exe Token: SeDebugPrivilege 2708 AgentSetup.exe Token: SeAuditPrivilege 2708 AgentSetup.exe Token: SeSystemEnvironmentPrivilege 2708 AgentSetup.exe Token: SeChangeNotifyPrivilege 2708 AgentSetup.exe Token: SeRemoteShutdownPrivilege 2708 AgentSetup.exe Token: SeUndockPrivilege 2708 AgentSetup.exe Token: SeSyncAgentPrivilege 2708 AgentSetup.exe Token: SeEnableDelegationPrivilege 2708 AgentSetup.exe Token: SeManageVolumePrivilege 2708 AgentSetup.exe Token: SeImpersonatePrivilege 2708 AgentSetup.exe Token: SeCreateGlobalPrivilege 2708 AgentSetup.exe Token: SeCreateTokenPrivilege 2708 AgentSetup.exe Token: SeAssignPrimaryTokenPrivilege 2708 AgentSetup.exe Token: SeLockMemoryPrivilege 2708 AgentSetup.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2708 AgentSetup.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2732 wrote to memory of 2876 2732 msiexec.exe 29 PID 2732 wrote to memory of 2876 2732 msiexec.exe 29 PID 2732 wrote to memory of 2876 2732 msiexec.exe 29 PID 2732 wrote to memory of 2876 2732 msiexec.exe 29 PID 2732 wrote to memory of 2876 2732 msiexec.exe 29 PID 2732 wrote to memory of 2876 2732 msiexec.exe 29 PID 2732 wrote to memory of 2876 2732 msiexec.exe 29 PID 2876 wrote to memory of 984 2876 MsiExec.exe 30 PID 2876 wrote to memory of 984 2876 MsiExec.exe 30 PID 2876 wrote to memory of 984 2876 MsiExec.exe 30 PID 2876 wrote to memory of 984 2876 MsiExec.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\$TEMP\AgentSetup.exe"C:\Users\Admin\AppData\Local\Temp\$TEMP\AgentSetup.exe"1⤵
- Enumerates connected drives
- Modifies system certificate store
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2708
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B60389D4B74D12A703C4348515CF7DA7 C2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe-NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss8632.ps1"3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:984
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- Size 3B
- SHA256 ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
- MD5 8a80554c91d9fca8acb82f023de02f11
- SHA1 5f36b2ea290645ee34d943220a14b54ee5ea5be5
- SHA512 ca4b6defb8adcc010050bc8b1bb8f8092c4928b8a0fba32146abcfb256e4d91672f88ca2cdf6210e754e5b8ac5e23fb023806ccd749ac8b701f79a691f03c87a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2708\dialog
- Size 11KB
- SHA256 f1fcb09df932aef09b24eea796286ceaedcbceccd4d8f4536345163c4d3d9ff7
- MD5 553df955cb4b2e7be5cef99cb8ec9254
- SHA1 370c2f61e886e53d8faf9537040daaafed330137
- SHA512 d31d4fc9080c794901b9fa3d3aec998a1b274f4c11c02362b30d2fbaf013b877198b08bb6d96fda68c7e9e329740090609a7d65249bc7e6209ace24fcfe3c34b
- SSDEEP 192:wgJIgsBpS7BU//bnrB1AHe8vq7feTiE436hV0BHh0DZ3QOE+RKGjG1Q02Dn1:wCPsBpIqbnoVKfUf4F0DZ3QyRKU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Cab7B0B.tmp
- Size 65KB
- SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
- MD5 ac05d27423a85adc1622c714f2cb6184
- SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
- SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
- SSDEEP 1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qgNzU:drVDJSeaDqV0FJwLhVkr282fF5U
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI8301.tmp
- Size 373KB
- SHA256 58e954de5dbec06179e7c749f321555520c8fcfbd9d3b05cc2b0110573a507d4
- MD5 f21b7303582dc0bf18fc734df1245043
- SHA1 306de4746ec0fa5fd6f67127060640abb26f2a9e
- SHA512 0170f83e53e28ad09dcf00649aa7e4c3d9e8cead49b54971df594c60062f8f4ed5b3c18588942fc038337a1f2478fb039e213fbadb55fe5091fdaaf28d9911b4
- SSDEEP 6144:ctZm0/CeltYyKrpN3j+hvoeN6Lt1slDAbYC+GuFnjK+SPVIIAOXKVKvtZjMTJRra:ctQelELt1slkbY4uFnjKFnlKVoMTJRra
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI8469.tmp
- Size 823KB
- SHA256 479a7e0f97f95193547cdea9de3637ec28e815527cefaeaf03ae3319abb61c89
- MD5 a4dc5a2f1ec789a2d113980f2f104497
- SHA1 5202b40f78daddbf2614d58bcf9eab6d505f5e97
- SHA512 3b793f203030321e61e4caed8752cbd334bc93b22948cb51f1b1563b3dfb063689f3aa230d07043eaa6bf9020def0d2695012d622291285f7dca90b0a08ad3d6
- SSDEEP 24576:R5QiSCqJ5EQeRHH1jzvVtuRXrPcZUoYoUElcegA:+CwEQeRHHBzvVtqXrPcZUoYoUElcegA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI8620.tmp
- Size 566KB
- SHA256 27c9a65a7e28e458fb5dfa6e7a7aba9a89af2d353c3068c646d4afda44a34f2b
- MD5 529af33cbd8677c4e0efd827274bfae4
- SHA1 cd4fe719b3b04ab4edd920335825ce157409cc75
- SHA512 9403b88d76e63a0aab551409f8cf9294034dd90168935fb19c9fa828ca1efaaa2554d297a9cedaa39787b7f4fe5f3ac9879d278350b383bdf19f3438896581c9
- SSDEEP 12288:+A0DgYdgDb0y4emFkwdHGBlFtHQc7LJOEL7quHi9z05SLlSQg8IZh4wcd7CU44u/:+LK0dH+FtQc7LJOA7quCQwxSp8IKG3t
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSI911C.tmp
- Size 532KB
- SHA256 9cb59f48ad2bba9765282f52a62a820b3c2a541f7b66a7073a52c7b72546b5c8
- MD5 378a7a638a288c872eed3af1d0690e04
- SHA1 73ce4b56c5d2cb0eaa819caa293f1ac88794e4f5
- SHA512 29f91f4abaecf71983bc889e72f6541dfe7073b1b2b0431b11a5d91d57bf03cc36fe2c247e2aa904b15c491f05b4b2a72a240ab3f461801af5158066e5c1be84
- SSDEEP 12288:9YSQNju69oj2axuyxNxbPSw1YPmLAGS0juflVMnRWqXWuwk8moVQySXCPbWwZU:UaMMNxb6uymzWS81VQySXCPbWwZU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\pss8631.ps1
- Size 2KB
- SHA256 a95df6d17d94865fdb7ac3bfb64a2557804e45d68b4b0641dff377ef08404e67
- MD5 2b2a9bc51b7d0607cfac5464c09adabe
- SHA1 6b796b9203d5acf863c455888a0c9907f82576ff
- SHA512 f437b58ab5706c6f5cfef0c55eae0e6975a476085a3a83fc457a00835c8a4e6edcf338cfde5304ab01d5247946d56a5a5976a82348571efa7cb80ed53780f6cc
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\pss8632.ps1
- Size 5KB
- SHA256 80743ab7de1d052355e874e9f69cae2bc82a24f5ba055fdfd46ee61ef83977d8
- MD5 4dc46c18308b8e597c5663474a5e08b0
- SHA1 9d81839c2fabc62f585336ae1cf470e82ce9eafe
- SHA512 47faccc256926bb79c4d05c93c647fc209e2e38176f3631c940c7823635b89e695590753afa5e44d664ea9b028b9b357dc6ef061ef4f250b5e56ebf589a6a931
- SSDEEP 24:QCGTRuARQvAD5V4zzLFAmhm/YMMtEzfug/Au6+w7uVIj9u92VFo1OWGvFnpVAlH8:QTocPVRm7tGDckFgc/jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Acunetix Limited\Acunetix 360 Agent 1.7.1\install\AgentSetup.msi
- Size 2.6MB
- SHA256 e971a74aa37222ff7f4d3a44ec46e3982f5529a89ce7389fc0d0c6d025fdb648
- MD5 fb7b3f0eab32b475324ef3c8ff1ac3c4
- SHA1 40e9dde19179bc55cd1bad09fe6e847b5cdc6fa6
- SHA512 3e7fa1664c95e4a7be3080718f8a4f0aaf6566c93197bbc63a96659b88ad2a886ead0aba0a00f79d1c10efb42793cb6ada91fc72edd5c77bb0799508aaaf8dd5
- SSDEEP 49152:yXbYAYzVLTXrKAUCwEQeRHHBzvVtqXrPcZUoYoUElcegraMMzbWmzL81VQySXCPC:GYAY4A9zBzvGbcMgamLjWNQ98Iz7
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\MSI8620.tmp
- Size 616KB
- SHA256 9f0cac1777e484e2881afdfcffcc165d8626adee19d22e4e55f0c35a6419a7f1
- MD5 fa165dda00cf758cf5e320fccf7ea135
- SHA1 56cc03c7cbb959d0fb63f99e8e9dfd4fae3f9a37
- SHA512 1bde9f59d75bcd594d838bd01363c83dc941fb4024780e05dadf4d93a7c238b8c168cb5ce6ce07437adbe554bce91fea137301e36b186ab8670163ad0e36bd17
- SSDEEP 12288:+A0DgYdgDb0y4emFkwdHGBlFtHQc7LJOEL7quHi9z05SLlSQg8IZh4wcd7CU44ut:+LK0dH+FtQc7LJOA7quCQwxSp8IKG3SE
- MD5 SHA1 SHA512 SSDEEP