Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20240221-en -
submitted
07-06-2024 18:59
Behavioral task
behavioral1
Sample
femordial.dll
Resource
win7-20240221-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
femordial.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
femordial.dll
-
Size
36.1MB
-
MD5
38bf550f8d73ea9791d7778d9b6b44a8
-
SHA1
67bf70a4d78f9f18b1af30cd9c85c632b52188c1
-
SHA256
ed6566cd8828d0d9a7bd2bd7731df7703977d9b18fa7ede31bb8b1835b12da78
-
SHA512
cfff6d55b90a42be22d09aaf30eed718b71fff8bfddab2404e968359a18ab8aec679a4ca85e144d3527602fd515a03724e897addd68865e796b0a387f582fd7f
-
SSDEEP
393216:g4S82OrtN+zJkGsF20dH5ZXtpKjzw1QxgvLqmNAmjpy:7OOrtN+zJkGsF2OZZXuv4GcLjp
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
pid Process 1748 powershell.exe 1748 powershell.exe -
Loads dropped DLL 1 IoCs
pid Process 1944 MsiExec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe -
Drops file in Program Files directory 23 IoCs
description ioc Process File created C:\Program Files (x86)\JJSploit\resources\luascripts\general\tptool.lua msiexec.exe File created C:\Program Files (x86)\JJSploit\Uninstall JJSploit.lnk msiexec.exe File created C:\Program Files (x86)\JJSploit\JJSploit.exe msiexec.exe File created C:\Program Files (x86)\JJSploit\resources\luascripts\animations\levitate.lua msiexec.exe File created C:\Program Files (x86)\JJSploit\resources\luascripts\jailbreak\policeesp.lua msiexec.exe File created C:\Program Files (x86)\JJSploit\resources\luascripts\general\teleportto.lua msiexec.exe File created C:\Program Files (x86)\JJSploit\resources\luascripts\beesim\autodig.lua msiexec.exe File created C:\Program Files (x86)\JJSploit\resources\luascripts\general\god.lua msiexec.exe File created C:\Program Files (x86)\JJSploit\resources\luascripts\general\fly.lua msiexec.exe File created C:\Program Files (x86)\JJSploit\resources\luascripts\animations\jumpland.lua msiexec.exe File created C:\Program Files (x86)\JJSploit\resources\luascripts\general\noclip.lua msiexec.exe File created C:\Program Files (x86)\JJSploit\resources\luascripts\jailbreak\removewalls.lua msiexec.exe File created C:\Program Files (x86)\JJSploit\resources\luascripts\general\chattroll.lua msiexec.exe File created C:\Program Files (x86)\JJSploit\resources\luascripts\general\multidimensionalcharacter.lua msiexec.exe File created C:\Program Files (x86)\JJSploit\resources\luascripts\animations\energizegui.lua msiexec.exe File created C:\Program Files (x86)\JJSploit\resources\luascripts\general\aimbot.lua msiexec.exe File opened for modification C:\Program Files (x86)\JJSploit\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File created C:\Program Files (x86)\JJSploit\resources\luascripts\general\infinitejump.lua msiexec.exe File created C:\Program Files (x86)\JJSploit\resources\luascripts\jailbreak\criminalesp.lua msiexec.exe File created C:\Program Files (x86)\JJSploit\resources\luascripts\animations\dab.lua msiexec.exe File created C:\Program Files (x86)\JJSploit\resources\luascripts\general\magnetizeto.lua msiexec.exe File created C:\Program Files (x86)\JJSploit\resources\luascripts\animations\walkthrough.lua msiexec.exe File created C:\Program Files (x86)\JJSploit\resources\luascripts\jailbreak\walkspeed.lua msiexec.exe -
Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\{31543371-3E1F-49AD-AC6D-E72F218E3508}\ProductIcon msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\f77c84e.msi msiexec.exe File opened for modification C:\Windows\Installer\f77c84e.msi msiexec.exe File created C:\Windows\Installer\f77c84f.ipi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\Installer\MSICB1C.tmp msiexec.exe File opened for modification C:\Windows\Installer\{31543371-3E1F-49AD-AC6D-E72F218E3508}\ProductIcon msiexec.exe File created C:\Windows\Installer\f77c851.msi msiexec.exe File opened for modification C:\Windows\Installer\f77c84f.ipi msiexec.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2224 1708 WerFault.exe 37 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe -
Modifies data under HKEY_USERS 46 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe -
Modifies registry class 35 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\17334513F1E3DA94CAD67EF212E85380\InstanceType = "0" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\17334513F1E3DA94CAD67EF212E85380\SourceList\Media msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\17334513F1E3DA94CAD67EF212E85380\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Products\17334513F1E3DA94CAD67EF212E85380 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\17334513F1E3DA94CAD67EF212E85380\MainProgram msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\17334513F1E3DA94CAD67EF212E85380\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\17334513F1E3DA94CAD67EF212E85380\SourceList\PackageName = "JJSploit_7.3.0_x86_en-US.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\17334513F1E3DA94CAD67EF212E85380\SourceList\Net\1 = "C:\\Users\\Admin\\Downloads\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\17334513F1E3DA94CAD67EF212E85380\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Products\17334513F1E3DA94CAD67EF212E85380\SourceList msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\17334513F1E3DA94CAD67EF212E85380\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\17334513F1E3DA94CAD67EF212E85380\ShortcutsFeature = "MainProgram" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\1B5BE67603097495AB20AEE6179D01CA\17334513F1E3DA94CAD67EF212E85380 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\17334513F1E3DA94CAD67EF212E85380\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\17334513F1E3DA94CAD67EF212E85380\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\Downloads\\" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\17334513F1E3DA94CAD67EF212E85380\SourceList msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\1B5BE67603097495AB20AEE6179D01CA msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\17334513F1E3DA94CAD67EF212E85380\ProductIcon = "C:\\Windows\\Installer\\{31543371-3E1F-49AD-AC6D-E72F218E3508}\\ProductIcon" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\17334513F1E3DA94CAD67EF212E85380\PackageCode = "19403D63BCD23974184F1D0CF7151CBF" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\17334513F1E3DA94CAD67EF212E85380\Version = "117637120" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\17334513F1E3DA94CAD67EF212E85380\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\17334513F1E3DA94CAD67EF212E85380\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\17334513F1E3DA94CAD67EF212E85380\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\17334513F1E3DA94CAD67EF212E85380\Environment = "MainProgram" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\1B5BE67603097495AB20AEE6179D01CA msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\17334513F1E3DA94CAD67EF212E85380 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\17334513F1E3DA94CAD67EF212E85380 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\17334513F1E3DA94CAD67EF212E85380 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\17334513F1E3DA94CAD67EF212E85380\ProductName = "JJSploit" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\17334513F1E3DA94CAD67EF212E85380\Language = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\17334513F1E3DA94CAD67EF212E85380\AdvertiseFlags = "388" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\17334513F1E3DA94CAD67EF212E85380\Clients = 3a0000000000 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\17334513F1E3DA94CAD67EF212E85380 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Features\17334513F1E3DA94CAD67EF212E85380 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\17334513F1E3DA94CAD67EF212E85380\External msiexec.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2760 msiexec.exe 2760 msiexec.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 1748 powershell.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2976 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2920 msiexec.exe Token: SeIncreaseQuotaPrivilege 2920 msiexec.exe Token: SeRestorePrivilege 2760 msiexec.exe Token: SeTakeOwnershipPrivilege 2760 msiexec.exe Token: SeSecurityPrivilege 2760 msiexec.exe Token: SeCreateTokenPrivilege 2920 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2920 msiexec.exe Token: SeLockMemoryPrivilege 2920 msiexec.exe Token: SeIncreaseQuotaPrivilege 2920 msiexec.exe Token: SeMachineAccountPrivilege 2920 msiexec.exe Token: SeTcbPrivilege 2920 msiexec.exe Token: SeSecurityPrivilege 2920 msiexec.exe Token: SeTakeOwnershipPrivilege 2920 msiexec.exe Token: SeLoadDriverPrivilege 2920 msiexec.exe Token: SeSystemProfilePrivilege 2920 msiexec.exe Token: SeSystemtimePrivilege 2920 msiexec.exe Token: SeProfSingleProcessPrivilege 2920 msiexec.exe Token: SeIncBasePriorityPrivilege 2920 msiexec.exe Token: SeCreatePagefilePrivilege 2920 msiexec.exe Token: SeCreatePermanentPrivilege 2920 msiexec.exe Token: SeBackupPrivilege 2920 msiexec.exe Token: SeRestorePrivilege 2920 msiexec.exe Token: SeShutdownPrivilege 2920 msiexec.exe Token: SeDebugPrivilege 2920 msiexec.exe Token: SeAuditPrivilege 2920 msiexec.exe Token: SeSystemEnvironmentPrivilege 2920 msiexec.exe Token: SeChangeNotifyPrivilege 2920 msiexec.exe Token: SeRemoteShutdownPrivilege 2920 msiexec.exe Token: SeUndockPrivilege 2920 msiexec.exe Token: SeSyncAgentPrivilege 2920 msiexec.exe Token: SeEnableDelegationPrivilege 2920 msiexec.exe Token: SeManageVolumePrivilege 2920 msiexec.exe Token: SeImpersonatePrivilege 2920 msiexec.exe Token: SeCreateGlobalPrivilege 2920 msiexec.exe Token: SeCreateTokenPrivilege 2920 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2920 msiexec.exe Token: SeLockMemoryPrivilege 2920 msiexec.exe Token: SeIncreaseQuotaPrivilege 2920 msiexec.exe Token: SeMachineAccountPrivilege 2920 msiexec.exe Token: SeTcbPrivilege 2920 msiexec.exe Token: SeSecurityPrivilege 2920 msiexec.exe Token: SeTakeOwnershipPrivilege 2920 msiexec.exe Token: SeLoadDriverPrivilege 2920 msiexec.exe Token: SeSystemProfilePrivilege 2920 msiexec.exe Token: SeSystemtimePrivilege 2920 msiexec.exe Token: SeProfSingleProcessPrivilege 2920 msiexec.exe Token: SeIncBasePriorityPrivilege 2920 msiexec.exe Token: SeCreatePagefilePrivilege 2920 msiexec.exe Token: SeCreatePermanentPrivilege 2920 msiexec.exe Token: SeBackupPrivilege 2920 msiexec.exe Token: SeRestorePrivilege 2920 msiexec.exe Token: SeShutdownPrivilege 2920 msiexec.exe Token: SeDebugPrivilege 2920 msiexec.exe Token: SeAuditPrivilege 2920 msiexec.exe Token: SeSystemEnvironmentPrivilege 2920 msiexec.exe Token: SeChangeNotifyPrivilege 2920 msiexec.exe Token: SeRemoteShutdownPrivilege 2920 msiexec.exe Token: SeUndockPrivilege 2920 msiexec.exe Token: SeSyncAgentPrivilege 2920 msiexec.exe Token: SeEnableDelegationPrivilege 2920 msiexec.exe Token: SeManageVolumePrivilege 2920 msiexec.exe Token: SeImpersonatePrivilege 2920 msiexec.exe Token: SeCreateGlobalPrivilege 2920 msiexec.exe Token: SeCreateTokenPrivilege 2920 msiexec.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2920 msiexec.exe 2920 msiexec.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe 2976 taskmgr.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2140 wrote to memory of 1708 2140 rundll32.exe 37 PID 2140 wrote to memory of 1708 2140 rundll32.exe 37 PID 2140 wrote to memory of 1708 2140 rundll32.exe 37 PID 2140 wrote to memory of 1708 2140 rundll32.exe 37 PID 2140 wrote to memory of 1708 2140 rundll32.exe 37 PID 2140 wrote to memory of 1708 2140 rundll32.exe 37 PID 2140 wrote to memory of 1708 2140 rundll32.exe 37 PID 1708 wrote to memory of 2224 1708 rundll32.exe 42 PID 1708 wrote to memory of 2224 1708 rundll32.exe 42 PID 1708 wrote to memory of 2224 1708 rundll32.exe 42 PID 1708 wrote to memory of 2224 1708 rundll32.exe 42 PID 2760 wrote to memory of 1944 2760 msiexec.exe 62 PID 2760 wrote to memory of 1944 2760 msiexec.exe 62 PID 2760 wrote to memory of 1944 2760 msiexec.exe 62 PID 2760 wrote to memory of 1944 2760 msiexec.exe 62 PID 2760 wrote to memory of 1944 2760 msiexec.exe 62 PID 2760 wrote to memory of 1944 2760 msiexec.exe 62 PID 2760 wrote to memory of 1944 2760 msiexec.exe 62 PID 2760 wrote to memory of 1748 2760 msiexec.exe 67 PID 2760 wrote to memory of 1748 2760 msiexec.exe 67 PID 2760 wrote to memory of 1748 2760 msiexec.exe 67 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\femordial.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\femordial.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 2683⤵
- Program crash
PID:2224
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1296 --field-trial-handle=1192,i,17039147612780266031,14761863587135020153,131072 /prefetch:21⤵PID:2980
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --mojo-platform-channel-handle=3216 --field-trial-handle=1192,i,17039147612780266031,14761863587135020153,131072 /prefetch:11⤵PID:948
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3452 --field-trial-handle=1192,i,17039147612780266031,14761863587135020153,131072 /prefetch:81⤵PID:1944
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3600 --field-trial-handle=1192,i,17039147612780266031,14761863587135020153,131072 /prefetch:81⤵PID:1616
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2744 --field-trial-handle=1192,i,17039147612780266031,14761863587135020153,131072 /prefetch:81⤵PID:1488
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --mojo-platform-channel-handle=3720 --field-trial-handle=1192,i,17039147612780266031,14761863587135020153,131072 /prefetch:11⤵PID:568
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --mojo-platform-channel-handle=3868 --field-trial-handle=1192,i,17039147612780266031,14761863587135020153,131072 /prefetch:11⤵PID:1960
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --mojo-platform-channel-handle=2724 --field-trial-handle=1192,i,17039147612780266031,14761863587135020153,131072 /prefetch:11⤵PID:1684
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3536 --field-trial-handle=1192,i,17039147612780266031,14761863587135020153,131072 /prefetch:81⤵PID:768
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --mojo-platform-channel-handle=3544 --field-trial-handle=1192,i,17039147612780266031,14761863587135020153,131072 /prefetch:11⤵PID:1192
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --mojo-platform-channel-handle=3728 --field-trial-handle=1192,i,17039147612780266031,14761863587135020153,131072 /prefetch:11⤵PID:2984
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4320 --field-trial-handle=1192,i,17039147612780266031,14761863587135020153,131072 /prefetch:81⤵PID:2680
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --mojo-platform-channel-handle=4284 --field-trial-handle=1192,i,17039147612780266031,14761863587135020153,131072 /prefetch:11⤵PID:1972
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --mojo-platform-channel-handle=4080 --field-trial-handle=1192,i,17039147612780266031,14761863587135020153,131072 /prefetch:11⤵PID:1148
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --mojo-platform-channel-handle=4016 --field-trial-handle=1192,i,17039147612780266031,14761863587135020153,131072 /prefetch:11⤵PID:472
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --mojo-platform-channel-handle=2728 --field-trial-handle=1192,i,17039147612780266031,14761863587135020153,131072 /prefetch:11⤵PID:1672
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --mojo-platform-channel-handle=3756 --field-trial-handle=1192,i,17039147612780266031,14761863587135020153,131072 /prefetch:11⤵PID:1992
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --mojo-platform-channel-handle=4124 --field-trial-handle=1192,i,17039147612780266031,14761863587135020153,131072 /prefetch:11⤵PID:2248
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5112 --field-trial-handle=1192,i,17039147612780266031,14761863587135020153,131072 /prefetch:81⤵PID:2676
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 --field-trial-handle=1192,i,17039147612780266031,14761863587135020153,131072 /prefetch:81⤵PID:2272
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\JJSploit_7.3.0_x86_en-US.msi"1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2920
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 898124D0002E27ADC4DBC72717815A5E C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1944
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -windowstyle hidden try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 } catch {}; Invoke-WebRequest -Uri "https://go.microsoft.com/fwlink/p/?LinkId=2124703" -OutFile "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" ; Start-Process -FilePath "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" -ArgumentList ('/silent', '/install') -Wait2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:1748
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:2140
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2976
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005B8" "000000000000059C"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2016
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:1948
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x49c1⤵PID:2612
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
113KB
MD54fdd16752561cf585fed1506914d73e0
SHA1f00023b9ae3c8ce5b7bb92f25011eaebe6f9d424
SHA256aecd2d2fe766f6d439acc2bbf1346930ecc535012cf5ad7b3273d2875237b7e7
SHA5123695e7eb1e35ec959243a91ab5b4454eb59aeef0f2699aa5de8e03de8fbb89f756a89130526da5c08815408cb700284a17936522ad2cad594c3e6e9d18a3f600