Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
10-05-2024 22:03
Static task
static1
Behavioral task
behavioral1
Sample
Form_W-9_Ver-083_030913350-67084228u8857-460102.js
Resource
win7-20240508-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
Form_W-9_Ver-083_030913350-67084228u8857-460102.js
Resource
win10v2004-20240426-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
Form_W-9_Ver-083_030913350-67084228u8857-460102.js
-
Size
467KB
-
MD5
6682dc1281579bd8789a8d2c09ca4251
-
SHA1
67bb21c9665fc12d8dc6ef2ac775c3f6274bd0ed
-
SHA256
937d07239cbfee2d34b7f1fae762ac72b52fb2b710e87e02fa758f452aa62913
-
SHA512
629219ec7dd6d1ca529daabeffe7b4430467d089054876c203d7be9979c32bb6d01901d018d88a81699ae18ba1be1421ec5fcbea6610f3e96953b1ab07b048bb
-
SSDEEP
6144:I/sTY54eD0MDV96cPh7siYttNfIR3zKEyX90q+jTEkyZxUwwkykmQmByuPatD/ey:8uu96FjIR3MN24Uk1
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 64 IoCs
flow pid Process 3 1668 wscript.exe 5 1668 wscript.exe 6 1960 msiexec.exe 11 1456 rundll32.exe 13 1456 rundll32.exe 15 1456 rundll32.exe 17 1456 rundll32.exe 18 1456 rundll32.exe 19 1456 rundll32.exe 20 1456 rundll32.exe 22 1456 rundll32.exe 23 1456 rundll32.exe 24 1456 rundll32.exe 25 1456 rundll32.exe 26 1456 rundll32.exe 27 1456 rundll32.exe 28 1456 rundll32.exe 29 1456 rundll32.exe 32 1456 rundll32.exe 33 1456 rundll32.exe 34 1456 rundll32.exe 35 1456 rundll32.exe 36 1456 rundll32.exe 38 1456 rundll32.exe 39 1456 rundll32.exe 40 1456 rundll32.exe 41 1456 rundll32.exe 42 1456 rundll32.exe 43 1456 rundll32.exe 45 1456 rundll32.exe 46 1456 rundll32.exe 47 1456 rundll32.exe 48 1456 rundll32.exe 53 1456 rundll32.exe 54 1456 rundll32.exe 55 1456 rundll32.exe 56 1456 rundll32.exe 57 1456 rundll32.exe 58 1456 rundll32.exe 59 1456 rundll32.exe 60 1456 rundll32.exe 61 1456 rundll32.exe 62 1456 rundll32.exe 63 1456 rundll32.exe 64 1456 rundll32.exe 65 1456 rundll32.exe 66 1456 rundll32.exe 67 1456 rundll32.exe 68 1456 rundll32.exe 69 1456 rundll32.exe 70 1456 rundll32.exe 71 1456 rundll32.exe 72 1456 rundll32.exe 73 1456 rundll32.exe 74 1456 rundll32.exe 75 1456 rundll32.exe 76 1456 rundll32.exe 77 1456 rundll32.exe 78 1456 rundll32.exe 79 1456 rundll32.exe 80 1456 rundll32.exe 81 1456 rundll32.exe 82 1456 rundll32.exe 83 1456 rundll32.exe -
Executes dropped EXE 1 IoCs
pid Process 2192 MSI2745.tmp -
Loads dropped DLL 7 IoCs
pid Process 1188 MsiExec.exe 1188 MsiExec.exe 1188 MsiExec.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe -
Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI1D41.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2473.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI257D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI25BC.tmp msiexec.exe File created C:\Windows\Installer\f7625ea.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI2705.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2745.tmp msiexec.exe -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 wscript.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 wscript.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 wscript.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 wscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 rundll32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1960 msiexec.exe 1960 msiexec.exe 2192 MSI2745.tmp 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe 1456 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeShutdownPrivilege 1668 wscript.exe Token: SeIncreaseQuotaPrivilege 1668 wscript.exe Token: SeRestorePrivilege 1960 msiexec.exe Token: SeTakeOwnershipPrivilege 1960 msiexec.exe Token: SeSecurityPrivilege 1960 msiexec.exe Token: SeCreateTokenPrivilege 1668 wscript.exe Token: SeAssignPrimaryTokenPrivilege 1668 wscript.exe Token: SeLockMemoryPrivilege 1668 wscript.exe Token: SeIncreaseQuotaPrivilege 1668 wscript.exe Token: SeMachineAccountPrivilege 1668 wscript.exe Token: SeTcbPrivilege 1668 wscript.exe Token: SeSecurityPrivilege 1668 wscript.exe Token: SeTakeOwnershipPrivilege 1668 wscript.exe Token: SeLoadDriverPrivilege 1668 wscript.exe Token: SeSystemProfilePrivilege 1668 wscript.exe Token: SeSystemtimePrivilege 1668 wscript.exe Token: SeProfSingleProcessPrivilege 1668 wscript.exe Token: SeIncBasePriorityPrivilege 1668 wscript.exe Token: SeCreatePagefilePrivilege 1668 wscript.exe Token: SeCreatePermanentPrivilege 1668 wscript.exe Token: SeBackupPrivilege 1668 wscript.exe Token: SeRestorePrivilege 1668 wscript.exe Token: SeShutdownPrivilege 1668 wscript.exe Token: SeDebugPrivilege 1668 wscript.exe Token: SeAuditPrivilege 1668 wscript.exe Token: SeSystemEnvironmentPrivilege 1668 wscript.exe Token: SeChangeNotifyPrivilege 1668 wscript.exe Token: SeRemoteShutdownPrivilege 1668 wscript.exe Token: SeUndockPrivilege 1668 wscript.exe Token: SeSyncAgentPrivilege 1668 wscript.exe Token: SeEnableDelegationPrivilege 1668 wscript.exe Token: SeManageVolumePrivilege 1668 wscript.exe Token: SeImpersonatePrivilege 1668 wscript.exe Token: SeCreateGlobalPrivilege 1668 wscript.exe Token: SeRestorePrivilege 1960 msiexec.exe Token: SeTakeOwnershipPrivilege 1960 msiexec.exe Token: SeRestorePrivilege 1960 msiexec.exe Token: SeTakeOwnershipPrivilege 1960 msiexec.exe Token: SeRestorePrivilege 1960 msiexec.exe Token: SeTakeOwnershipPrivilege 1960 msiexec.exe Token: SeRestorePrivilege 1960 msiexec.exe Token: SeTakeOwnershipPrivilege 1960 msiexec.exe Token: SeRestorePrivilege 1960 msiexec.exe Token: SeTakeOwnershipPrivilege 1960 msiexec.exe Token: SeRestorePrivilege 1960 msiexec.exe Token: SeTakeOwnershipPrivilege 1960 msiexec.exe Token: SeRestorePrivilege 1960 msiexec.exe Token: SeTakeOwnershipPrivilege 1960 msiexec.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1960 wrote to memory of 1188 1960 msiexec.exe 29 PID 1960 wrote to memory of 1188 1960 msiexec.exe 29 PID 1960 wrote to memory of 1188 1960 msiexec.exe 29 PID 1960 wrote to memory of 1188 1960 msiexec.exe 29 PID 1960 wrote to memory of 1188 1960 msiexec.exe 29 PID 1960 wrote to memory of 1188 1960 msiexec.exe 29 PID 1960 wrote to memory of 1188 1960 msiexec.exe 29 PID 1960 wrote to memory of 2192 1960 msiexec.exe 30 PID 1960 wrote to memory of 2192 1960 msiexec.exe 30 PID 1960 wrote to memory of 2192 1960 msiexec.exe 30 PID 1960 wrote to memory of 2192 1960 msiexec.exe 30 PID 1960 wrote to memory of 2192 1960 msiexec.exe 30 PID 1960 wrote to memory of 2192 1960 msiexec.exe 30 PID 1960 wrote to memory of 2192 1960 msiexec.exe 30
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\Form_W-9_Ver-083_030913350-67084228u8857-460102.js1⤵
- Blocklisted process makes network request
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:1668
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 3152710E5E24FC33C06E85C0BA29575C2⤵
- Loads dropped DLL
PID:1188
-
-
C:\Windows\Installer\MSI2745.tmp"C:\Windows\Installer\MSI2745.tmp" C:/Windows/System32/rundll32.exe C:\Users\Admin\AppData\Roaming\upfilles.dll, stow2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2192
-
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\upfilles.dll, stow1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:1456
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5190058c1ad89f117873189a87eb167d8
SHA1aa5354acee3cf684f76dfa585b50f39e63c10c13
SHA25622eb26d3d891e21651fcc3a41f9240b110ce38168d5b259e5ea0c5b3026a5dd2
SHA5127e127106adeacebfc6bb430c82cac10d3c616e43147a1a2ab9a3d4e2b0e449ac1a09d3e5c702afc338b82dd756e06fa818ffd669059bfecca4de2f66db390062
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
Filesize
508KB
MD5ccb6d3cb020f56758622911ddd2f1fcb
SHA14a013f752c2bf84ca37e418175e0d9b6f61f636d
SHA256f4cb6b684ea097f867d406a978b3422bbf2ecfea39236bf3ab99340996b825de
SHA5126ed929967005eaa6407e273b53a1fedcb2b084d775bed17272fd05b1ce143dbf921ac201246dfbfdbe663c7351e44c12f162e6f03343548b69b5d4598bb3492e
-
Filesize
1.5MB
MD5b4a482a7e96cfdef632a7af286120156
SHA173e3639a9388af84b9c0f172b3aeaf3823014596
SHA256ead5ebf464c313176174ff0fdc3360a3477f6361d0947221d31287eeb04691b3
SHA51215661f1dc751a48f5d213ec99c046e0b9fa1a2201d238d26bee0f15341e9d84611c30f152c463368c6d59f3e7cccb5ae991b1f3127ad65eb3a2ea7823d3b598b
-
Filesize
436KB
MD5475d20c0ea477a35660e3f67ecf0a1df
SHA167340739f51e1134ae8f0ffc5ae9dd710e8e3a08
SHA256426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
SHA51299525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
-
Filesize
389KB
MD5b9545ed17695a32face8c3408a6a3553
SHA1f6c31c9cd832ae2aebcd88e7b2fa6803ae93fc83
SHA2561e0e63b446eecf6c9781c7d1cae1f46a3bb31654a70612f71f31538fb4f4729a
SHA512f6d6dc40dcba5ff091452d7cc257427dcb7ce2a21816b4fec2ee249e63246b64667f5c4095220623533243103876433ef8c12c9b612c0e95fdfffe41d1504e04