Analysis
-
max time kernel
119s -
max time network
114s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
12/06/2024, 07:45
Static task
static1
Behavioral task
behavioral1
Sample
4kvideodownloaderplus_1.7.0_x64_online.exe
Resource
win7-20231129-en
windows7-x64
18 signatures
120 seconds
Behavioral task
behavioral2
Sample
4kvideodownloaderplus_1.7.0_x64_online.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
18 signatures
120 seconds
General
-
Target
4kvideodownloaderplus_1.7.0_x64_online.exe
-
Size
942KB
-
MD5
9b17ab76c97b378a03fbfbf29cabee6f
-
SHA1
faa3ee5621c53bec49892c277149d41c82a12a6c
-
SHA256
9ff0459fc38b2277c8a482cbd19ec030c56d25cde0d6c6e390ae8be902aea052
-
SHA512
a3890c6ff63d389626dfe777d3ae8a03b2f570bfe42ecc58256ae377199e5db1fcde5c2424fbd06d00113c9592f2167ec45c3be7a5e2b34c6780250b1a883cc1
-
SSDEEP
24576:GNsfiTdYSuVzZH9tH1v133W3ZtxEVFx+tBi5:mT2pZ133WpHEVYw
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{4c7a9df0-3fe8-4b93-8934-e8c937646d4e} = "\"C:\\ProgramData\\Package Cache\\{4c7a9df0-3fe8-4b93-8934-e8c937646d4e}\\4kvideodownloaderplus_1.7.0_x64_online.exe\" /burn.runonce" 4kvideodownloaderplus_1.7.0_x64_online.exe -
Blocklisted process makes network request 4 IoCs
flow pid Process 11 1904 msiexec.exe 13 1904 msiexec.exe 16 1904 msiexec.exe 18 1904 msiexec.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Menu.qml msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\qtwebengine_locales\sl.pak msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\qtwebengine_locales\lt.pak msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\Qt\labs\platform\qmldir msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\Qt5Svg.dll msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls.2\ScrollView.qml msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Styles\Desktop\SwitchStyle.qml msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\audio\qtaudio_windows.dll msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Styles\Base\FocusFrameStyle.qml msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\Qt5Qml.dll msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\QtGraphicalEffects\RadialGradient.qml msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Styles\Base\ProgressBarStyle.qml msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\qtwebengine_resources.pak msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Styles\Base\images\needle.png msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Styles\Base\ScrollViewStyle.qml msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Styles\Desktop\ScrollViewStyle.qml msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\qtwebengine_locales\fil.pak msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\imageformats\qico.dll msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\libEGL.dll msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\Qt5QmlModels.dll msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Private\EditMenu_base.qml msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls.2\RangeSlider.qml msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\ComboBox.qml msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Styles\Base\DelayButtonStyle.qml msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\QtWebEngine\Controls1Delegates\ColorDialog.qml msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls.2\CheckBox.qml msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\QtQml\qmldir msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\qtwebengine_locales\he.pak msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\QtGraphicalEffects\private\FastInnerShadow.qml msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\Qt5Network.dll msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\TextField.qml msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Styles\Desktop\GroupBoxStyle.qml msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Private\ContentItem.qml msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\QtGraphicalEffects\FastBlur.qml msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\Qt5WebEngineWidgets.dll msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Styles\Base\ApplicationWindowStyle.qml msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls.2\Action.qml msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\QtWebEngine\Controls2Delegates\qmldir msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Styles\Base\HandleStyle.qml msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Styles\Base\images\arrow-left.png msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\avutil-56.dll msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\QtGraphicalEffects\ColorOverlay.qml msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\qtwebengine_locales\ru.pak msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\qtwebengine_devtools_resources.pak msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\QtGraphicalEffects\private\GaussianInnerShadow.qml msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Styles\Base\images\header.png msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\Qt5QuickControls2.dll msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\qtwebengine_locales\ja.pak msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Styles\Base\images\spinner_large.png msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\qtwebengine_locales\uk.pak msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls.2\Drawer.qml msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\libcrypto-1_1-x64.dll msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Styles\Base\ComboBoxStyle.qml msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\QtWebEngine\Controls1Delegates\TouchHandle.qml msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\qtwebengine_locales\gu.pak msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick.2\plugins.qmltypes msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Styles\Base\images\editbox.png msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Private\ModalPopupBehavior.qml msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\Qt5Quick.dll msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls.2\Tumbler.qml msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\StackViewTransition.qml msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\qtwebengine_locales\sv.pak msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls.2\AbstractButton.qml msiexec.exe File created C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Private\style.js msiexec.exe -
Drops file in Windows directory 16 IoCs
description ioc Process File created C:\Windows\Installer\f76d280.msi msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\f76d27b.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIDAA9.tmp msiexec.exe File opened for modification C:\Windows\Installer\f76d27e.ipi msiexec.exe File opened for modification C:\Windows\WindowsUpdate.log 4kvideodownloaderplus_1.7.0_x64_online.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIDA79.tmp msiexec.exe File created C:\Windows\Installer\{729957EA-F7DB-4A3B-9232-8941C96E2A03}\icon.ico msiexec.exe File opened for modification C:\Windows\Installer\MSIE95D.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\Installer\f76d27b.msi msiexec.exe File opened for modification C:\Windows\Installer\{729957EA-F7DB-4A3B-9232-8941C96E2A03}\icon.ico msiexec.exe File created C:\Windows\Installer\f76d27e.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIDCBE.tmp msiexec.exe -
Executes dropped EXE 5 IoCs
pid Process 2328 4kvideodownloaderplus_1.7.0_x64_online.exe 2616 4kvideodownloaderplus_1.7.0_x64_online.exe 2672 4kvideodownloaderplus_1.7.0_x64_online.exe 2624 4kvideodownloaderplus_1.7.0_x64_online.exe 2848 4kvideodownloaderplus.exe -
Loads dropped DLL 46 IoCs
pid Process 836 4kvideodownloaderplus_1.7.0_x64_online.exe 2328 4kvideodownloaderplus_1.7.0_x64_online.exe 2616 4kvideodownloaderplus_1.7.0_x64_online.exe 2672 4kvideodownloaderplus_1.7.0_x64_online.exe 2672 4kvideodownloaderplus_1.7.0_x64_online.exe 1124 MsiExec.exe 2940 MsiExec.exe 1904 msiexec.exe 1904 msiexec.exe 1372 Process not Found 1372 Process not Found 1372 Process not Found 1372 Process not Found 1124 MsiExec.exe 2848 4kvideodownloaderplus.exe 2848 4kvideodownloaderplus.exe 2848 4kvideodownloaderplus.exe 2848 4kvideodownloaderplus.exe 2848 4kvideodownloaderplus.exe 2848 4kvideodownloaderplus.exe 2848 4kvideodownloaderplus.exe 2848 4kvideodownloaderplus.exe 2848 4kvideodownloaderplus.exe 2848 4kvideodownloaderplus.exe 2848 4kvideodownloaderplus.exe 2848 4kvideodownloaderplus.exe 2848 4kvideodownloaderplus.exe 2848 4kvideodownloaderplus.exe 2848 4kvideodownloaderplus.exe 2848 4kvideodownloaderplus.exe 2848 4kvideodownloaderplus.exe 2848 4kvideodownloaderplus.exe 2848 4kvideodownloaderplus.exe 2848 4kvideodownloaderplus.exe 2848 4kvideodownloaderplus.exe 2848 4kvideodownloaderplus.exe 2848 4kvideodownloaderplus.exe 2848 4kvideodownloaderplus.exe 2848 4kvideodownloaderplus.exe 2848 4kvideodownloaderplus.exe 2848 4kvideodownloaderplus.exe 2848 4kvideodownloaderplus.exe 2848 4kvideodownloaderplus.exe 2848 4kvideodownloaderplus.exe 2848 4kvideodownloaderplus.exe 2848 4kvideodownloaderplus.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 46 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E msiexec.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D msiexec.exe -
Modifies registry class 36 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{4c7a9df0-3fe8-4b93-8934-e8c937646d4e}\Dependents\{4c7a9df0-3fe8-4b93-8934-e8c937646d4e} 4kvideodownloaderplus_1.7.0_x64_online.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\AE759927BD7FB3A4292398149CE6A230\Complete msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{4c7a9df0-3fe8-4b93-8934-e8c937646d4e}\DisplayName = "4K Video Downloader+" 4kvideodownloaderplus_1.7.0_x64_online.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AE759927BD7FB3A4292398149CE6A230\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AE759927BD7FB3A4292398149CE6A230\ProductIcon = "C:\\Windows\\Installer\\{729957EA-F7DB-4A3B-9232-8941C96E2A03}\\icon.ico" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AE759927BD7FB3A4292398149CE6A230\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{4c7a9df0-3fe8-4b93-8934-e8c937646d4e} 4kvideodownloaderplus_1.7.0_x64_online.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\AE759927BD7FB3A4292398149CE6A230 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AE759927BD7FB3A4292398149CE6A230 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AE759927BD7FB3A4292398149CE6A230\ProductName = "4K Video Downloader+" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AE759927BD7FB3A4292398149CE6A230\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AE759927BD7FB3A4292398149CE6A230\SourceList\PackageName = "4kvideodownloaderplus_1.7.0_x64.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AE759927BD7FB3A4292398149CE6A230\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{729957EA-F7DB-4A3B-9232-8941C96E2A03}v1.7.0.0096\\" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AE759927BD7FB3A4292398149CE6A230\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{4c7a9df0-3fe8-4b93-8934-e8c937646d4e}\ = "{4c7a9df0-3fe8-4b93-8934-e8c937646d4e}" 4kvideodownloaderplus_1.7.0_x64_online.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AE759927BD7FB3A4292398149CE6A230\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5A0DD6B5535352E4082B644C603BE688 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{729957EA-F7DB-4A3B-9232-8941C96E2A03}\ = "{729957EA-F7DB-4A3B-9232-8941C96E2A03}" 4kvideodownloaderplus_1.7.0_x64_online.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AE759927BD7FB3A4292398149CE6A230\Version = "17235968" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5A0DD6B5535352E4082B644C603BE688\AE759927BD7FB3A4292398149CE6A230 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AE759927BD7FB3A4292398149CE6A230\SourceList msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{729957EA-F7DB-4A3B-9232-8941C96E2A03} 4kvideodownloaderplus_1.7.0_x64_online.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AE759927BD7FB3A4292398149CE6A230\PackageCode = "D5C8753C4C6A56945805F8908A7A0D99" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AE759927BD7FB3A4292398149CE6A230\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AE759927BD7FB3A4292398149CE6A230\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AE759927BD7FB3A4292398149CE6A230\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AE759927BD7FB3A4292398149CE6A230\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{729957EA-F7DB-4A3B-9232-8941C96E2A03}v1.7.0.0096\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{4c7a9df0-3fe8-4b93-8934-e8c937646d4e}\Version = "1.7.0.96" 4kvideodownloaderplus_1.7.0_x64_online.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{4c7a9df0-3fe8-4b93-8934-e8c937646d4e}\Dependents 4kvideodownloaderplus_1.7.0_x64_online.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{729957EA-F7DB-4A3B-9232-8941C96E2A03}\DisplayName = "4K Video Downloader+" 4kvideodownloaderplus_1.7.0_x64_online.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AE759927BD7FB3A4292398149CE6A230\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AE759927BD7FB3A4292398149CE6A230\SourceList\Media\2 = ";" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{729957EA-F7DB-4A3B-9232-8941C96E2A03}\Dependents\{4c7a9df0-3fe8-4b93-8934-e8c937646d4e} 4kvideodownloaderplus_1.7.0_x64_online.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{729957EA-F7DB-4A3B-9232-8941C96E2A03}\Dependents 4kvideodownloaderplus_1.7.0_x64_online.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{729957EA-F7DB-4A3B-9232-8941C96E2A03}\Version = "1.7.0.0096" 4kvideodownloaderplus_1.7.0_x64_online.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AE759927BD7FB3A4292398149CE6A230\Language = "1033" msiexec.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 4kvideodownloaderplus_1.7.0_x64_online.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 4kvideodownloaderplus_1.7.0_x64_online.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2848 4kvideodownloaderplus.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1904 msiexec.exe 1904 msiexec.exe 1124 MsiExec.exe 1124 MsiExec.exe 2940 MsiExec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeBackupPrivilege 2220 vssvc.exe Token: SeRestorePrivilege 2220 vssvc.exe Token: SeAuditPrivilege 2220 vssvc.exe Token: SeRestorePrivilege 1688 DrvInst.exe Token: SeRestorePrivilege 1688 DrvInst.exe Token: SeRestorePrivilege 1688 DrvInst.exe Token: SeRestorePrivilege 1688 DrvInst.exe Token: SeRestorePrivilege 1688 DrvInst.exe Token: SeRestorePrivilege 1688 DrvInst.exe Token: SeRestorePrivilege 1688 DrvInst.exe Token: SeLoadDriverPrivilege 1688 DrvInst.exe Token: SeLoadDriverPrivilege 1688 DrvInst.exe Token: SeLoadDriverPrivilege 1688 DrvInst.exe Token: SeShutdownPrivilege 2624 4kvideodownloaderplus_1.7.0_x64_online.exe Token: SeIncreaseQuotaPrivilege 2624 4kvideodownloaderplus_1.7.0_x64_online.exe Token: SeRestorePrivilege 1904 msiexec.exe Token: SeTakeOwnershipPrivilege 1904 msiexec.exe Token: SeSecurityPrivilege 1904 msiexec.exe Token: SeCreateTokenPrivilege 2624 4kvideodownloaderplus_1.7.0_x64_online.exe Token: SeAssignPrimaryTokenPrivilege 2624 4kvideodownloaderplus_1.7.0_x64_online.exe Token: SeLockMemoryPrivilege 2624 4kvideodownloaderplus_1.7.0_x64_online.exe Token: SeIncreaseQuotaPrivilege 2624 4kvideodownloaderplus_1.7.0_x64_online.exe Token: SeMachineAccountPrivilege 2624 4kvideodownloaderplus_1.7.0_x64_online.exe Token: SeTcbPrivilege 2624 4kvideodownloaderplus_1.7.0_x64_online.exe Token: SeSecurityPrivilege 2624 4kvideodownloaderplus_1.7.0_x64_online.exe Token: SeTakeOwnershipPrivilege 2624 4kvideodownloaderplus_1.7.0_x64_online.exe Token: SeLoadDriverPrivilege 2624 4kvideodownloaderplus_1.7.0_x64_online.exe Token: SeSystemProfilePrivilege 2624 4kvideodownloaderplus_1.7.0_x64_online.exe Token: SeSystemtimePrivilege 2624 4kvideodownloaderplus_1.7.0_x64_online.exe Token: SeProfSingleProcessPrivilege 2624 4kvideodownloaderplus_1.7.0_x64_online.exe Token: SeIncBasePriorityPrivilege 2624 4kvideodownloaderplus_1.7.0_x64_online.exe Token: SeCreatePagefilePrivilege 2624 4kvideodownloaderplus_1.7.0_x64_online.exe Token: SeCreatePermanentPrivilege 2624 4kvideodownloaderplus_1.7.0_x64_online.exe Token: SeBackupPrivilege 2624 4kvideodownloaderplus_1.7.0_x64_online.exe Token: SeRestorePrivilege 2624 4kvideodownloaderplus_1.7.0_x64_online.exe Token: SeShutdownPrivilege 2624 4kvideodownloaderplus_1.7.0_x64_online.exe Token: SeDebugPrivilege 2624 4kvideodownloaderplus_1.7.0_x64_online.exe Token: SeAuditPrivilege 2624 4kvideodownloaderplus_1.7.0_x64_online.exe Token: SeSystemEnvironmentPrivilege 2624 4kvideodownloaderplus_1.7.0_x64_online.exe Token: SeChangeNotifyPrivilege 2624 4kvideodownloaderplus_1.7.0_x64_online.exe Token: SeRemoteShutdownPrivilege 2624 4kvideodownloaderplus_1.7.0_x64_online.exe Token: SeUndockPrivilege 2624 4kvideodownloaderplus_1.7.0_x64_online.exe Token: SeSyncAgentPrivilege 2624 4kvideodownloaderplus_1.7.0_x64_online.exe Token: SeEnableDelegationPrivilege 2624 4kvideodownloaderplus_1.7.0_x64_online.exe Token: SeManageVolumePrivilege 2624 4kvideodownloaderplus_1.7.0_x64_online.exe Token: SeImpersonatePrivilege 2624 4kvideodownloaderplus_1.7.0_x64_online.exe Token: SeCreateGlobalPrivilege 2624 4kvideodownloaderplus_1.7.0_x64_online.exe Token: SeRestorePrivilege 1904 msiexec.exe Token: SeTakeOwnershipPrivilege 1904 msiexec.exe Token: SeRestorePrivilege 1904 msiexec.exe Token: SeTakeOwnershipPrivilege 1904 msiexec.exe Token: SeRestorePrivilege 1904 msiexec.exe Token: SeTakeOwnershipPrivilege 1904 msiexec.exe Token: SeRestorePrivilege 1904 msiexec.exe Token: SeTakeOwnershipPrivilege 1904 msiexec.exe Token: SeRestorePrivilege 1904 msiexec.exe Token: SeTakeOwnershipPrivilege 1904 msiexec.exe Token: SeRestorePrivilege 1904 msiexec.exe Token: SeTakeOwnershipPrivilege 1904 msiexec.exe Token: SeRestorePrivilege 1904 msiexec.exe Token: SeTakeOwnershipPrivilege 1904 msiexec.exe Token: SeRestorePrivilege 1904 msiexec.exe Token: SeTakeOwnershipPrivilege 1904 msiexec.exe Token: SeRestorePrivilege 1904 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2672 4kvideodownloaderplus_1.7.0_x64_online.exe -
Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 836 wrote to memory of 2328 836 4kvideodownloaderplus_1.7.0_x64_online.exe 28 PID 836 wrote to memory of 2328 836 4kvideodownloaderplus_1.7.0_x64_online.exe 28 PID 836 wrote to memory of 2328 836 4kvideodownloaderplus_1.7.0_x64_online.exe 28 PID 836 wrote to memory of 2328 836 4kvideodownloaderplus_1.7.0_x64_online.exe 28 PID 836 wrote to memory of 2328 836 4kvideodownloaderplus_1.7.0_x64_online.exe 28 PID 836 wrote to memory of 2328 836 4kvideodownloaderplus_1.7.0_x64_online.exe 28 PID 836 wrote to memory of 2328 836 4kvideodownloaderplus_1.7.0_x64_online.exe 28 PID 2616 wrote to memory of 2672 2616 4kvideodownloaderplus_1.7.0_x64_online.exe 30 PID 2616 wrote to memory of 2672 2616 4kvideodownloaderplus_1.7.0_x64_online.exe 30 PID 2616 wrote to memory of 2672 2616 4kvideodownloaderplus_1.7.0_x64_online.exe 30 PID 2616 wrote to memory of 2672 2616 4kvideodownloaderplus_1.7.0_x64_online.exe 30 PID 2616 wrote to memory of 2672 2616 4kvideodownloaderplus_1.7.0_x64_online.exe 30 PID 2616 wrote to memory of 2672 2616 4kvideodownloaderplus_1.7.0_x64_online.exe 30 PID 2616 wrote to memory of 2672 2616 4kvideodownloaderplus_1.7.0_x64_online.exe 30 PID 2672 wrote to memory of 2624 2672 4kvideodownloaderplus_1.7.0_x64_online.exe 31 PID 2672 wrote to memory of 2624 2672 4kvideodownloaderplus_1.7.0_x64_online.exe 31 PID 2672 wrote to memory of 2624 2672 4kvideodownloaderplus_1.7.0_x64_online.exe 31 PID 2672 wrote to memory of 2624 2672 4kvideodownloaderplus_1.7.0_x64_online.exe 31 PID 2672 wrote to memory of 2624 2672 4kvideodownloaderplus_1.7.0_x64_online.exe 31 PID 2672 wrote to memory of 2624 2672 4kvideodownloaderplus_1.7.0_x64_online.exe 31 PID 2672 wrote to memory of 2624 2672 4kvideodownloaderplus_1.7.0_x64_online.exe 31 PID 1904 wrote to memory of 1124 1904 msiexec.exe 41 PID 1904 wrote to memory of 1124 1904 msiexec.exe 41 PID 1904 wrote to memory of 1124 1904 msiexec.exe 41 PID 1904 wrote to memory of 1124 1904 msiexec.exe 41 PID 1904 wrote to memory of 1124 1904 msiexec.exe 41 PID 1904 wrote to memory of 1124 1904 msiexec.exe 41 PID 1904 wrote to memory of 1124 1904 msiexec.exe 41 PID 1904 wrote to memory of 2940 1904 msiexec.exe 42 PID 1904 wrote to memory of 2940 1904 msiexec.exe 42 PID 1904 wrote to memory of 2940 1904 msiexec.exe 42 PID 1904 wrote to memory of 2940 1904 msiexec.exe 42 PID 1904 wrote to memory of 2940 1904 msiexec.exe 42 PID 1904 wrote to memory of 2940 1904 msiexec.exe 42 PID 1904 wrote to memory of 2940 1904 msiexec.exe 42 PID 2672 wrote to memory of 2848 2672 4kvideodownloaderplus_1.7.0_x64_online.exe 44 PID 2672 wrote to memory of 2848 2672 4kvideodownloaderplus_1.7.0_x64_online.exe 44 PID 2672 wrote to memory of 2848 2672 4kvideodownloaderplus_1.7.0_x64_online.exe 44 PID 2672 wrote to memory of 2848 2672 4kvideodownloaderplus_1.7.0_x64_online.exe 44 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\4kvideodownloaderplus_1.7.0_x64_online.exe"C:\Users\Admin\AppData\Local\Temp\4kvideodownloaderplus_1.7.0_x64_online.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Windows\Temp\{8EA2BD58-9D66-4D13-B58B-F55260F701BC}\.cr\4kvideodownloaderplus_1.7.0_x64_online.exe"C:\Windows\Temp\{8EA2BD58-9D66-4D13-B58B-F55260F701BC}\.cr\4kvideodownloaderplus_1.7.0_x64_online.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\4kvideodownloaderplus_1.7.0_x64_online.exe" -burn.filehandle.attached=180 -burn.filehandle.self=1882⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2328
-
-
C:\Windows\Temp\{8EA2BD58-9D66-4D13-B58B-F55260F701BC}\.cr\4kvideodownloaderplus_1.7.0_x64_online.exe"C:\Windows\Temp\{8EA2BD58-9D66-4D13-B58B-F55260F701BC}\.cr\4kvideodownloaderplus_1.7.0_x64_online.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\Temp\{96331A59-A2B6-4B49-8DB5-D513429A5150}\.cr\4kvideodownloaderplus_1.7.0_x64_online.exe"C:\Windows\Temp\{96331A59-A2B6-4B49-8DB5-D513429A5150}\.cr\4kvideodownloaderplus_1.7.0_x64_online.exe" -burn.clean.room="C:\Windows\Temp\{8EA2BD58-9D66-4D13-B58B-F55260F701BC}\.cr\4kvideodownloaderplus_1.7.0_x64_online.exe" -burn.filehandle.attached=180 -burn.filehandle.self=1882⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\Temp\{BA2901CA-3A2E-4BFA-A6D6-901EB32C19D6}\.be\4kvideodownloaderplus_1.7.0_x64_online.exe"C:\Windows\Temp\{BA2901CA-3A2E-4BFA-A6D6-901EB32C19D6}\.be\4kvideodownloaderplus_1.7.0_x64_online.exe" -q -burn.elevated BurnPipe.{9D49DCFD-671C-424F-86F2-D1A2342740A1} {803B8A41-CF0E-4744-A142-82DB78CEE8AF} 26723⤵
- Adds Run key to start application
- Drops file in Windows directory
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2624
-
-
C:\Program Files\4KDownload\4kvideodownloaderplus\4kvideodownloaderplus.exe"C:\Program Files\4KDownload\4kvideodownloaderplus\4kvideodownloaderplus.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
PID:2848
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2220
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005B8" "00000000000003A4"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1688
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1CDFDE8C20B79F460F15B6FCAD054DE52⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1124
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 85C042DC31A471C2DB03DC81A35686A7 M Global\MSI00002⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2940
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124KB
MD575b256362e8ad365202c63aa75cbd2a5
SHA1a977ea5e86ed845e502a31f7fc222e687828af5f
SHA25651f5b42b30e50de3e2b0898cbc89a9206d40dd2efd72765077270e30cccd8488
SHA5122a885afccb7a50f75265755a2afdd0a80a0179e4327539e3a33f3bf4d84951ff7af419947269bbae20e8f311f00d441a0998a385b40b224fe36e3f1b8732f202
-
Filesize
20KB
MD598b9690c6be606696ffa742b54eb1324
SHA1f719b07c360e98a3835d645d6b1d4451a97c0e56
SHA256267c58546c73a33c402b2fd80186e6b161fbd27163c77821bc2acfe58e8090e5
SHA51285146bdbbaa0e2fd01b85bcf49c33f71c4e1f93bdc50216e03b811de491a21ac7b688582904535e8e33265de6155b153cce721da297195667eb8b05cff43a11d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5090c095c162df097d3a089638eaf501c
SHA1721d9d0a31471281fb6cf97c7baa62a7e1a14499
SHA256cbc2695385479c4f928aee74f45735447eda075fb67482a51d2a978be1c66e53
SHA51274eb608294ffd3782028e32c895389a1c4d9d3bcdcf749d1a94d31912ba69e16a469b92cd80b92fe6b9b10d6155ec2b422e5fe9e7694c9c14270b40de29655e8
-
Filesize
2KB
MD5956fdf41cc1adca06d09918a6be4ec67
SHA1c3183cfb7d5716323199ea19c0be6d4971c9374e
SHA25643881a332cc9398941882c0f9ccd409c5f371eb796585cbc54243b3d2c3c1003
SHA5128e9fecfe44796220d0f2ea2736810ae8dc270bcfe738c0514f31187d254de1611c679641577f2be5447f5f7a92398eb6a79fc08f1a87ac628fa2873729bd46f9
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
211KB
MD5a3ae5d86ecf38db9427359ea37a5f646
SHA1eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
SHA256c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
SHA51296ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0
-
Filesize
4KB
MD520986fecad1c10339e192993e72bbc4e
SHA1ca627fc0a6e96c2021da63e71d5d05d45b9894b9
SHA2562fab77079c0e9e6bae57c3f783936243a6f43550d08cab690c09b4409d4ea669
SHA5124cbe6c6cfef20a770e6cb9303ceddf1f0b53a5c1a8a26a9c769fe72735a36a9646f6937c6f8af26d42b0bf9860638af80cb201e6551d41fd2c813bbda39d5990
-
Filesize
7.7MB
MD59c1ecf03c14af50b445f4a679d90bac4
SHA1bf43f0bf8ec52f7cfdfb441edf0f131862ce8b5d
SHA2560491c25bcbf0dd2a7bc590af925c152eb08a533c8005d5dde32faa3a1439253b
SHA512651ab6286004dd6c5c41cf0e9929779934f025da2f4170c1c5972af7416af1c3afe32114cd60b3bed852fc5bf8a415ae6851f6102bfb5c4720e1698ea0ae013a
-
Filesize
6.5MB
MD54584320c923505da902b8b4622d11c28
SHA176ece4a164eb375d8204eafe3110338143106ebe
SHA256ee1db564c4b429f35926c9e8f145a62ba4e4aba2dc45a610e93b344e1c30673a
SHA51265b89485aec34eaac89f99d5c4fcf3e8b37fcfa173e5d2c831b6ec3200c21efb03126472c8cc61b648daf2bbe85e2a0083876fdff4e3a133142582e1159e6574
-
Filesize
1.3MB
MD558a22c03b1fa2caecbeebe8851d5a641
SHA139af942dab52259de39aa4d119ca0936c2bf3f79
SHA25688486ce20f3ccdaeb9ef9ab4c7b3046de8fe0bc47cb61ab5f0cf92bf36231043
SHA512463e5c03fb8668285920ed44b1c61b03e603ea5efbad0d4692660ee4320d068f80a97f7e92209610971ceaff7a1853e7bea351b1850e6765083b902e9e9283de
-
Filesize
3.4MB
MD59fbd3a81a04c3f4f729ba98d978693e8
SHA14091d01dcc8b3056d79e8c797c6edb309d7c8073
SHA256a4ba9451ab04754b73ec77ad0f848373a834467094cb3990cddfa3cb8f8c1f55
SHA5122f9ff1397a5d04e6c5f0f772dbb6daf4bf76a64e26c0d1cb62fea261a0a2c6ef19b1acbdff4c57384a2c5dbf9b5756db2df1459bf95366c898a498c532fee71e
-
Filesize
4.0MB
MD53945d58a350d379b66f44d2ec25b3350
SHA149485f8cf4bb295b552f197313873a354617c6da
SHA256d0e8e0438158641bb86b37fa5e048c8f802698a872ffe78abd1af2ee27780481
SHA5129bfb42fb98627498ec9f16504d2f25086906c3b962d3d4aed970066745998e18a3694e12374e01edc8ff18379cab683ac517f1235d11715591cd37f8cf7a2853
-
Filesize
374KB
MD5e1e0d151fd2a4df962fddd896c04638b
SHA11741d9b6f50bb4f3afc77c54878f542c4e484764
SHA256845e3a40cb30271fcfdae9b75cb5fbfab1805717c26089a3276cd99ab0b55acd
SHA5128c41fa3afa97ef248fe4550762b68a0465bcce09625bd5bdba13b260a28c06cb283ec30e74b38e86e02ac33a3ce213ed4b788d97e59aa054fe3081568ba215e6
-
Filesize
5.3MB
MD54b936f00b0baaf5d28ac8628fab2eebc
SHA126e3e064ab94dbf74f9a4089cfe44fe512aaa77e
SHA25604e9ec1d91aac38895e21a5bee7460ab2042ce552b25fa7cbb58f25effdc4728
SHA51273b19d0219ccd72dac156c3ce9f0f593a6b20baeb9d13b2e2a035598d9171c055d9516c8f4355056af17a4d3120786cf7a9a05d0e1e36daa239e7f3a8980e1ac
-
Filesize
26.1MB
MD5fd477558197aae4b0b45f118fa2e8b10
SHA1d5992a61e6b751d085bbba068c1eb8de6a742aad
SHA2568a9e78c87a9ab87c754a5402449f5bba91153af8495f2e723eb27bab93b2b39d
SHA51251e991fd6b141047e90bd3d1f76d1973b1db5be04c99be0165e61b5372eb364bd1f88403a08b5e5ddc1447c71e67bf5263653b58fa9ada917854c6b44c9b1f2d
-
Filesize
2.2MB
MD5fbc57a71569296384d453a613bc0d268
SHA1600709fb253cc83c05f6d32275e48377bf5df0ca
SHA2568148e18579dfd21038aa341d54996f158f503612de2990a88e95b0f13dba2090
SHA5123af21831fb4194802c3adf60d0bcc54f8f6b496ae8d40077b3aa67b101f687e838c10771d00d5df44be61e25774ce8f93b4567fde49d5d62deacf30a2a64544c
-
Filesize
567KB
MD5a874eafa8258e7fe7e383542a7d2c556
SHA17d8eae9e672b370cb0d542903a21989c50a7e654
SHA256e8fc9d7c7738f0b46f6b27afe8ea52cb0abff9b436ff61179a592ec07a052644
SHA512502d76fe15375594ae0f17600cc2b7927e0336725e5dd214d11f5c11a08c735d99c95203df603a5a7220bf9833ccbb2fa736f5be80cdca27e4de14be023cfd71
-
Filesize
3.1MB
MD56aec069100841113fab40a7497d922c5
SHA1390dda02a663d4beaaea7de2b81076a57791aa2f
SHA2561a8fa8e92808071ad831066c8c889180e9c6933bb3c8bebfe5d4605cb0e6001e
SHA51242c3d19f030ab52b125842c873f2a54150385aa5cc10f4cb1e35039f051ba1a696b0b54448e719141ac5c4065bfb4af3ce2d238d61b096effb906a8077e8478b
-
Filesize
645KB
MD52989d89c2c7c8d9206d8279273702b6e
SHA15ce76e8a7bb5f27d158b7687dc7b260d44c2b01e
SHA256237f97444b8be89d1a21d456dfad3a2f31e0516fd7775a7d5b8b59811d11b5e7
SHA512de984ac5a03c7ca3acce438b2530f68f6a88aa9423d8509f992aa23f3d7e4048671fdc0978160526b5b1861b2f6fc03671211e13310d4c82eabae9061dcbf574
-
Filesize
568KB
MD59c5b73e8f95f39eabe363fb9f6c2f5c2
SHA135e22106f54c62e27554eb56f70ef127f53d91e6
SHA256b0a47d07a5c10babd9f34d3d3e894a43b166f0526cd15b30a26e5d80651d0146
SHA5122d7acd13f7681a88a392ded3b814da13311967737de8c00345fe0a73597c9b64224f78d9c6296244f78bd032989d05a421e16ab1ce474ba5c3cbfc23eea6a85f
-
Filesize
44KB
MD5f08be14d9db1c6fa4ea5b65039ad43bb
SHA10d19482c51705a6ae9b04ebdb7372d62ef2c981e
SHA256d905847bfcf9ca207dbe591db52c603e3b197b243d86ca4d2355fe10eedf4adc
SHA512a224d81c8a6d3b4e767241751caea2c8bd2a70c1fb45e8ac850dff2832f6f89b03420f6a2d4dc778229b3a5300d3774860b134722229d89d3f2874a1d1854f7e
-
Filesize
186KB
MD5dd33dec8e7548c6a30850ddc94354dc3
SHA133cde479e61a9c59f58de0edb444ba1221405ea8
SHA2566798dbc7a3031a2d2585020366a480ce7be56fc9e3f4c5d2d0571521f12548c0
SHA512ac11e0d7e58664625bc71f162ad3ddc867a3a2e28225d8019d569a676493d81ad69071f9dc84bc5a22c3eab962b66f423ac1559738f449dfa258f8b98f0615d0
-
Filesize
125KB
MD515fadc3d1124a8abd466292faac945ac
SHA1aea1703e1ff123394756fbf5bebc08b036593e7b
SHA2566bbf02b1a92a3f2c1a653d5cff0e9989a74ea18c41c7908d74112fbc49cd8de9
SHA512083de2a6f8fe6d1ffc6e1cdad863adabe33cd7c1a46d33a9b9b82d6e352e04e6be1c9d351b20a98cf2840c71600ca946aa767ecf32d76fe71e4d13a4e768dcd2
-
Filesize
57KB
MD5566caf0bbe0c561bd410aecb37ee1583
SHA18e22dd6a937b2f861250340112f9c2cc682cbfa8
SHA2562c32ef3d33b0c41c279cd2009c28a41b962acaf16be5abccaaa317d6b163f825
SHA512013e55538ce4ed86e0b9f3b5a5fb0a162e58764e851eec6b2fa933a91ddd17664bf5f44efe50f90ac7f03b08c88a7c70c454ed519b9e7b25ccbf5f2bd2d6ca70
-
Filesize
912KB
MD5e83689afc95273f9cf2928424da6820c
SHA1264659a713d78e2f068f7121668bba3479de68b7
SHA256073f475e4e198f72faa0656bd09f0a22b93d1a922232297d8f22989bfebc4e63
SHA512dda83a6ede0278fb15f3c82d59ba38749f2744f291ebe266a8248772642bcfe4e1ad1f242a1b8fbc281dda2bbe7d7e41619ba4c8d4156ab0574a29adb195abaa
-
Filesize
184KB
MD5fe7e0bd53f52e6630473c31299a49fdd
SHA1f706f45768bfb95f4c96dfa0be36df57aa863898
SHA2562bea14d70943a42d344e09b7c9de5562fa7e109946e1c615dd584da30d06cc80
SHA512feed48286b1e182996a3664f0facdf42aae3692d3d938ea004350c85764db7a0bea996dfddf7a77149c0d4b8b776fb544e8b1ce5e9944086a5b1ed6a8a239a3c
