Analysis
- max time kernel
142s - max time network
143s - platform
windows7_x64 - resource
win7-20240508-en - resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system - submitted
03/06/2024, 08:09
Static task
static1
Behavioral task
behavioral1
Sample
b556bb94e138c7f58cde15b1f1ac7f89ee87e9ccd33250c61cbcbae8db183434.msi
Resource
win7-20240508-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
b556bb94e138c7f58cde15b1f1ac7f89ee87e9ccd33250c61cbcbae8db183434.msi
Resource
win10v2004-20240508-en
windows10-2004-x64
16 signatures
150 seconds
General
- Target b556bb94e138c7f58cde15b1f1ac7f89ee87e9ccd33250c61cbcbae8db183434.msi
- Size 2.2MB
- Sample240603-j2brvsaa68
- SHA256 b556bb94e138c7f58cde15b1f1ac7f89ee87e9ccd33250c61cbcbae8db183434
- MD5 bcfa5c3f6576f10863ff2239ac064526
- SHA1 0989642cbc8b1d7cfe43a55914f03823df1e95a8
- SHA512 b86bee3e14b9c0f25435328501e2ac832aa2d1efa3c00decd2628b6163dac383dbf41c1ba579646987f931c5c009a71712c9a96181e2a8f15ebed6f188d6d7eb
- SSDEEP 49152:+WKRFfV5tLPGYzLFoc25e6+f/8J05wXIARgguIGUMBz5Hx:SlpPG6LfIGU
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
-
pid Process 2484 powershell.exe 1772 powershell.exe 2056 powershell.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: svchost.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\R: svchost.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\E: svchost.exe File opened (read-only) \??\J: svchost.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\L: svchost.exe File opened (read-only) \??\W: svchost.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: svchost.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: svchost.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\K: svchost.exe File opened (read-only) \??\G: svchost.exe File opened (read-only) \??\H: svchost.exe File opened (read-only) \??\M: svchost.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: svchost.exe File opened (read-only) \??\N: svchost.exe File opened (read-only) \??\O: svchost.exe File opened (read-only) \??\V: svchost.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\I: svchost.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: svchost.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Q: svchost.exe File opened (read-only) \??\Z: svchost.exe - Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Windows Defenderr\cc.xml msiexec.exe File created C:\Program Files\Windows Defenderr\svchost.exe msiexec.exe - Drops file in Windows directory 21 IoCs
description ioc Process File created C:\Windows\SystemTemp\msi43F3.txt MsiExec.exe File opened for modification C:\Windows\SystemTemp\Pro43F7.tmp MsiExec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI3CA6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI42D1.tmp msiexec.exe File created C:\Windows\SystemTemp\scr43F5.txt MsiExec.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\MSI3B3E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3987.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI436E.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File created C:\Windows\Installer\f763939.msi msiexec.exe File opened for modification C:\Windows\Installer\f763939.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI3D05.tmp msiexec.exe File created C:\Windows\SystemTemp\scr43F4.ps1 MsiExec.exe File opened for modification C:\Windows\SystemTemp\pss43F6.ps1 MsiExec.exe File opened for modification C:\Windows\Installer\f76393c.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI3AB1.tmp msiexec.exe File created C:\Windows\Installer\f76393c.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI3CA7.tmp msiexec.exe - Executes dropped EXE 1 IoCs
pid Process 2404 svchost.exe - Loads dropped DLL 7 IoCs
pid Process 2548 MsiExec.exe 2548 MsiExec.exe 2548 MsiExec.exe 2548 MsiExec.exe 2548 MsiExec.exe 2740 MsiExec.exe 2740 MsiExec.exe - Modifies data under HKEY_USERS 48 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = b06fd5f591b5da01 powershell.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E msiexec.exe - Suspicious behavior: EnumeratesProcesses 54 IoCs
pid Process 2356 msiexec.exe 2356 msiexec.exe 2484 powershell.exe 1772 powershell.exe 2056 powershell.exe 2404 svchost.exe 2404 svchost.exe 2404 svchost.exe 2404 svchost.exe 2404 svchost.exe 2404 svchost.exe 2404 svchost.exe 2404 svchost.exe 2404 svchost.exe 2404 svchost.exe 2404 svchost.exe 2404 svchost.exe 2404 svchost.exe 2404 svchost.exe 2404 svchost.exe 2404 svchost.exe 2404 svchost.exe 2404 svchost.exe 2404 svchost.exe 2404 svchost.exe 2404 svchost.exe 2404 svchost.exe 2404 svchost.exe 2404 svchost.exe 2404 svchost.exe 2404 svchost.exe 2404 svchost.exe 2404 svchost.exe 2404 svchost.exe 2404 svchost.exe 2404 svchost.exe 2404 svchost.exe 2404 svchost.exe 2404 svchost.exe 2404 svchost.exe 2404 svchost.exe 2404 svchost.exe 2404 svchost.exe 2404 svchost.exe 2404 svchost.exe 2404 svchost.exe 2404 svchost.exe 2404 svchost.exe 2404 svchost.exe 2404 svchost.exe 2404 svchost.exe 2404 svchost.exe 2404 svchost.exe 2404 svchost.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2404 svchost.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2128 msiexec.exe Token: SeIncreaseQuotaPrivilege 2128 msiexec.exe Token: SeRestorePrivilege 2356 msiexec.exe Token: SeTakeOwnershipPrivilege 2356 msiexec.exe Token: SeSecurityPrivilege 2356 msiexec.exe Token: SeCreateTokenPrivilege 2128 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2128 msiexec.exe Token: SeLockMemoryPrivilege 2128 msiexec.exe Token: SeIncreaseQuotaPrivilege 2128 msiexec.exe Token: SeMachineAccountPrivilege 2128 msiexec.exe Token: SeTcbPrivilege 2128 msiexec.exe Token: SeSecurityPrivilege 2128 msiexec.exe Token: SeTakeOwnershipPrivilege 2128 msiexec.exe Token: SeLoadDriverPrivilege 2128 msiexec.exe Token: SeSystemProfilePrivilege 2128 msiexec.exe Token: SeSystemtimePrivilege 2128 msiexec.exe Token: SeProfSingleProcessPrivilege 2128 msiexec.exe Token: SeIncBasePriorityPrivilege 2128 msiexec.exe Token: SeCreatePagefilePrivilege 2128 msiexec.exe Token: SeCreatePermanentPrivilege 2128 msiexec.exe Token: SeBackupPrivilege 2128 msiexec.exe Token: SeRestorePrivilege 2128 msiexec.exe Token: SeShutdownPrivilege 2128 msiexec.exe Token: SeDebugPrivilege 2128 msiexec.exe Token: SeAuditPrivilege 2128 msiexec.exe Token: SeSystemEnvironmentPrivilege 2128 msiexec.exe Token: SeChangeNotifyPrivilege 2128 msiexec.exe Token: SeRemoteShutdownPrivilege 2128 msiexec.exe Token: SeUndockPrivilege 2128 msiexec.exe Token: SeSyncAgentPrivilege 2128 msiexec.exe Token: SeEnableDelegationPrivilege 2128 msiexec.exe Token: SeManageVolumePrivilege 2128 msiexec.exe Token: SeImpersonatePrivilege 2128 msiexec.exe Token: SeCreateGlobalPrivilege 2128 msiexec.exe Token: SeBackupPrivilege 2068 vssvc.exe Token: SeRestorePrivilege 2068 vssvc.exe Token: SeAuditPrivilege 2068 vssvc.exe Token: SeBackupPrivilege 2356 msiexec.exe Token: SeRestorePrivilege 2356 msiexec.exe Token: SeRestorePrivilege 2632 DrvInst.exe Token: SeRestorePrivilege 2632 DrvInst.exe Token: SeRestorePrivilege 2632 DrvInst.exe Token: SeRestorePrivilege 2632 DrvInst.exe Token: SeRestorePrivilege 2632 DrvInst.exe Token: SeRestorePrivilege 2632 DrvInst.exe Token: SeRestorePrivilege 2632 DrvInst.exe Token: SeLoadDriverPrivilege 2632 DrvInst.exe Token: SeLoadDriverPrivilege 2632 DrvInst.exe Token: SeLoadDriverPrivilege 2632 DrvInst.exe Token: SeRestorePrivilege 2356 msiexec.exe Token: SeTakeOwnershipPrivilege 2356 msiexec.exe Token: SeRestorePrivilege 2356 msiexec.exe Token: SeTakeOwnershipPrivilege 2356 msiexec.exe Token: SeRestorePrivilege 2356 msiexec.exe Token: SeTakeOwnershipPrivilege 2356 msiexec.exe Token: SeRestorePrivilege 2356 msiexec.exe Token: SeTakeOwnershipPrivilege 2356 msiexec.exe Token: SeRestorePrivilege 2356 msiexec.exe Token: SeTakeOwnershipPrivilege 2356 msiexec.exe Token: SeRestorePrivilege 2356 msiexec.exe Token: SeTakeOwnershipPrivilege 2356 msiexec.exe Token: SeRestorePrivilege 2356 msiexec.exe Token: SeTakeOwnershipPrivilege 2356 msiexec.exe Token: SeDebugPrivilege 2484 powershell.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2128 msiexec.exe 2128 msiexec.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2404 svchost.exe - Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 2356 wrote to memory of 2548 2356 msiexec.exe 32 PID 2356 wrote to memory of 2548 2356 msiexec.exe 32 PID 2356 wrote to memory of 2548 2356 msiexec.exe 32 PID 2356 wrote to memory of 2548 2356 msiexec.exe 32 PID 2356 wrote to memory of 2548 2356 msiexec.exe 32 PID 2356 wrote to memory of 2548 2356 msiexec.exe 32 PID 2356 wrote to memory of 2548 2356 msiexec.exe 32 PID 2548 wrote to memory of 2484 2548 MsiExec.exe 33 PID 2548 wrote to memory of 2484 2548 MsiExec.exe 33 PID 2548 wrote to memory of 2484 2548 MsiExec.exe 33 PID 2548 wrote to memory of 2484 2548 MsiExec.exe 33 PID 2356 wrote to memory of 2740 2356 msiexec.exe 35 PID 2356 wrote to memory of 2740 2356 msiexec.exe 35 PID 2356 wrote to memory of 2740 2356 msiexec.exe 35 PID 2356 wrote to memory of 2740 2356 msiexec.exe 35 PID 2356 wrote to memory of 2740 2356 msiexec.exe 35 PID 2356 wrote to memory of 2740 2356 msiexec.exe 35 PID 2356 wrote to memory of 2740 2356 msiexec.exe 35 PID 2740 wrote to memory of 1772 2740 MsiExec.exe 37 PID 2740 wrote to memory of 1772 2740 MsiExec.exe 37 PID 2740 wrote to memory of 1772 2740 MsiExec.exe 37 PID 2740 wrote to memory of 1772 2740 MsiExec.exe 37 PID 1772 wrote to memory of 2056 1772 powershell.exe 39 PID 1772 wrote to memory of 2056 1772 powershell.exe 39 PID 1772 wrote to memory of 2056 1772 powershell.exe 39 PID 1772 wrote to memory of 2056 1772 powershell.exe 39 PID 2736 wrote to memory of 2404 2736 taskeng.exe 42 PID 2736 wrote to memory of 2404 2736 taskeng.exe 42 PID 2736 wrote to memory of 2404 2736 taskeng.exe 42 PID 2736 wrote to memory of 2404 2736 taskeng.exe 42 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\b556bb94e138c7f58cde15b1f1ac7f89ee87e9ccd33250c61cbcbae8db183434.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2128
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 89AA1B518685430FD071240E855EB1DF2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe-NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss3EF7.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msi3EE4.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scr3EE5.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scr3EE6.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2484
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9652C4C029A486A7ADF1EA4D56DFF93C M Global\MSI00002⤵
- Drops file in Windows directory
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe-NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Windows\SystemTemp\pss43F6.ps1" -propFile "C:\Windows\SystemTemp\msi43F3.txt" -scriptFile "C:\Windows\SystemTemp\scr43F4.ps1" -scriptArgsFile "C:\Windows\SystemTemp\scr43F5.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command Add-MpPreference -ExclusionPath "C:\Program` Files\Windows` Defenderr"4⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2056
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2068
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot18" "" "" "6792c44eb" "0000000000000000" "00000000000003C8" "0000000000000514"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2632
-
C:\Windows\system32\taskeng.exetaskeng.exe {3650BD24-3139-4C8F-8CCC-7716F3908796} S-1-5-21-3691908287-3775019229-3534252667-1000:UOTHCPHQ\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Program Files\Windows Defenderr\svchost.exe"C:\Program Files\Windows Defenderr\svchost.exe"2⤵
- Enumerates connected drives
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2404
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\f76393d.rbs
- Size 217KB
- SHA256 53367d312678c2627a719094b36a25c81a147e87459cef40806cd03fc1534199
- MD5 1c10facd1d673ddc419f101d546b61d8
- SHA1 02b4426ba4ce97e7ae4e77fc16cac3f133061f54
- SHA512 7989beac549c2d047655236c2ac4981121bc5e0de1f147bebbfd680317142557b5aa5047527241af4ed3aaef2125e4d780ee5e7c19bb75bf54fa8ea0e37baa3d
- SSDEEP 3072:+MQfq2SlI4cSYPeK9J2SLYetgjsmCr1MVys84ahCdlAKAk3k5DdhHeLdI3QFxB5t:vPAi584ld3nk5D2nV5vgQz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Windows Defenderr\cc.xml
- Size 2KB
- SHA256 1854d65dbe82f3b882bdba70f2a68ce2036481cb5495247aa0bbe20258f756ca
- MD5 6545a6580ae9527fdd498a5f115b919e
- SHA1 41a7469766e1259382b66b6dd779ae81c7cddca6
- SHA512 d3faacb670200a744a4bedb32b7466949f291cca1310eb3b53c7ac9f556c22fc6e80c36dd4d9ab0bb9523d8c825aaf7f71fee4124499bc0be52bc31e1e99409e
- MD5 SHA1 SHA512
- Path C:\Program Files\Windows Defenderr\svchost.exe
- Size 102KB
- SHA256 d3449e60c02258d03b42b06c5eb0a2f759dd7b1433b565d5cd9a6be7ccc523ea
- MD5 c8de233601e5dd254517522a275b661c
- SHA1 15eef70b3ada2b55aebd526446be9a32fd41a796
- SHA512 a16d0a59029455b1b6d8d9d165b6ab10a9eb4cff2c7bdbf6738e9be6badbfa8ab12d39fa94b7b4f8705c69b56d89ea71a2c55e649f27e9c8baf35c7b50bc3cde
- SSDEEP 1536:vai5iT1lccXYry49iO9u3yUyJCb8SLz7ZOh:vabzccMy49nKhK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\pss3EF7.ps1
- Size 6KB
- SHA256 53094df6fa4e57a3265ff04bc1e970c10bcdb3d4094ad6dd610c05b7a8b79e0f
- MD5 30c30ef2cb47e35101d13402b5661179
- SHA1 25696b2aab86a9233f19017539e2dd83b2f75d4e
- SHA512 882be2768138bb75ff7dde7d5ca4c2e024699398baacd0ce1d4619902402e054297e4f464d8cb3c22b2f35d3dabc408122c207facad64ec8014f2c54834cf458
- SSDEEP 96:5Wb5VNkKmeHn/V2BVrIovmgNlGjxcj6BngOcvjb:5WbyZ/gVyvb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\scr3EE5.ps1
- Size 134B
- SHA256 a56cba74db063b4996549de89fec07432fb7470724ec292dab8b97e73c567c51
- MD5 7ef79aff6608fd03a304a1a87344c576
- SHA1 9c57ed39cec3a1c0278ff50d536da34d55f52162
- SHA512 36c5fd4a6d3c875cb311b8b454c39952a36146f2f000926324e0cf16c162409f49c675c575479222a7c28ce26390f473474107859073b37a1813c6aae0e617e6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\DN1YUXQXL7PLKD27W2KJ.temp
- Size 7KB
- SHA256 6ff32469ca520ed9f0e35841787c46a75bf3de7b2504b3e4ce19c6b2e0b1863c
- MD5 7309e9d39f691d80d606c75e1f634832
- SHA1 c761b9f41d7ab19bf0def6be86ffd146132f41e9
- SHA512 856d4c1653f13e06e562557e0bf35f391e5b21182f84707cd0469b79ab27fe94c34ed2e693edddd8615d684cda8a0baa20f86f738ef01a2259ab7d8007f6f515
- SSDEEP 96:gJOCIQM8inqvsqvJCwodJOCIQM8inqvsEHyqvJCworJEsSIQHlgm1g7EKXlUVg:A2QeUob2QeAHnorJJYgCg7EKj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
- Size 7KB
- SHA256 58fe72fa176441de99628ee36073ba55a185087551388b036847403fbc6abfb0
- MD5 917e2cbe31ccfbe6bd772fe26b28ab3c
- SHA1 5e3dc7f73ecec3ab2a153bcd188b1ea6ad8600da
- SHA512 58e3261a68812d154bbc00a708ecba8d3dc7c3e1915ac32f86bae7039ddf70cb9b067bdcebe3910ef5200f2dc0c45ef4cb0e30096bca53f0b6572f8a111ea627
- SSDEEP 96:gJOCIQM8inqvsqvJCwodJOCIQM8inqvsEHyqvJCworlIsSIQHlgm1g7s2XlUVg:A2QeUob2QeAHnorltYgCg7s2j
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI3987.tmp
- Size 738KB
- SHA256 118a551eef23bf842ed470316aa1a50bf17b6d656652879802d4acc0184608ca
- MD5 ee45c6dffaf86ed2a76d8f969c390c08
- SHA1 ff5b2942ffa7d28ed3f72208e8e76391b2991b5a
- SHA512 a92bc7aff5da3dc33263ea3d43cf617d47a2a6c589118f7ee3c5f293d63171778a7a37815ec23cb426558546cf0a1e694c67c7cbc36cca92677de566d1d71664
- SSDEEP 12288:UCw0mKFlJ/FFhmNKxhjszLF9lph0lhSMXlez0yw5v2cX+f/8O:U70fnJ/PhmNKnYzLFhh0lhSMXlM0yw50
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI3CA7.tmp
- Size 215KB
- SHA256 d058a04e0b5550db64d816485d9d25411fba27d3b9a4ef1d2dfe47e98c4a054b
- MD5 fa6cf27d72756d6a0794c65d1133befa
- SHA1 90949a22d68347f6834c581abc88faf63e7cb8c0
- SHA512 6ecc9b610325f015659c2a79deaac50f879f0261236a54c76468150f5194ae8c1a7ff284d13818908fae26ea2a2077f982e97ecc5d7264d7c77d74610ad1dede
- SSDEEP 3072:2MQfq2SlI4cSYPeK9J2SLYetgjsmCr1MVys84ahCdlAKAk3k5DdhHeLdI3QFxB5+:HPAi584ld3nk5D2nV5vgQ4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI3D05.tmp
- Size 758KB
- SHA256 58800c0b1f916f5ac032ab6e9410d2e5d687eebc95c2955bded68ac97dacd639
- MD5 743c67416aa1d2568679f45ef36e0179
- SHA1 dc7163deb7e0d0e493f0ced46fb2fd0b29e19910
- SHA512 f35f5a19aa3fe6fc723b771e7199e35cff4de5ed26a5a0a86377288f9487875bbdb19231743f2a7a019642f59ab57ed7cc02e7b4b9a6ec3c11b595596aa6066c
- SSDEEP 12288:9o3WB4nkFwLMfa5c8kBLMzwAPWIARggu3nc/G5AA5cjph0lhSMXleSeA5FBxk:+3W1Fw555wXIARgguX4G+AyVh0lhSMXU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SystemTemp\scr43F4.ps1
- Size 220B
- SHA256 3e51b88f2e7f6d26e2b6b1a6403044af1d8b6c1805affee19848bf0d1b3a03e5
- MD5 0a4a4ecab6e633aa2b189c9fdca38f1f
- SHA1 81d0d5e4f77de2c33cd72d812b7a5d3b7b02b2ad
- SHA512 ee53f855d8ca9cf72b76bde7f4cf5e674201f85095ee60f4f515e49ce12e08d5303932e364338be2d9206a37ec84e874f2f458afa36164fc7d1a35d460fd702e
- MD5 SHA1 SHA512