54da67354ca45596f98a3cea115bf32a8d2c252a0473080f25fe1d7bd9bfa153

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 09:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
File Fahrenheit.Indigo.Prophecy.Remastered.zip...msi
Size 1.6MB
Sample240613-lvbjmatdkf
SHA256 54da67354ca45596f98a3cea115bf32a8d2c252a0473080f25fe1d7bd9bfa153
MD5 28d28b44624c4e00fb5d3e96c9637c3d
SHA1 806c432fc90b27fa99844747a8259e81fac68543
SHA512 08cbbcbb11dbf3aa663c1614f13ac2cfd846aaecd7a31c977a6f538efbaa4bec3e3d20383af68d723f81c892d6156ff91115d82b3e1d962af3767e6b9a0b9771
SSDEEP 49152:CfeRc/f9r84jEHYDgS5u7v+ycFTzn795k0zjjZ:7VHYDgrSycl
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	MSIC2AB.tmp

Drops file in Windows directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIC18D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC18E.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{8D051B69-E258-4E03-813B-5BB4627D724B}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC2AB.tmp	msiexec.exe
File created	C:\Windows\Installer\e57bf87.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC21D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e57bf87.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC071.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC11E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC1BE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC1ED.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e57bf8b.msi	msiexec.exe

Executes dropped EXE 1 IoCs

pid	Process
4264	MSIC2AB.tmp

Loads dropped DLL 6 IoCs

pid	Process
2520	MsiExec.exe
2520	MsiExec.exe
2520	MsiExec.exe
2520	MsiExec.exe
2520	MsiExec.exe
2520	MsiExec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A\52C64B7E	msiexec.exe

Modifies registry class 20 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96B150D8852E30E418B3B54B26D727B4\ProductName = "Guard"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96B150D8852E30E418B3B54B26D727B4\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96B150D8852E30E418B3B54B26D727B4\Version = "16777216"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96B150D8852E30E418B3B54B26D727B4\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\96B150D8852E30E418B3B54B26D727B4	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96B150D8852E30E418B3B54B26D727B4\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96B150D8852E30E418B3B54B26D727B4\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96B150D8852E30E418B3B54B26D727B4\SourceList\PackageName = "File Fahrenheit.Indigo.Prophecy.Remastered.zip...msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96B150D8852E30E418B3B54B26D727B4\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96B150D8852E30E418B3B54B26D727B4\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96B150D8852E30E418B3B54B26D727B4\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\CE315C105C859B54A8A9FB99D8F5C90C	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96B150D8852E30E418B3B54B26D727B4\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96B150D8852E30E418B3B54B26D727B4	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96B150D8852E30E418B3B54B26D727B4\PackageCode = "2088ACF133F0AF54BBD3C7A4AF2F2121"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96B150D8852E30E418B3B54B26D727B4\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\CE315C105C859B54A8A9FB99D8F5C90C\96B150D8852E30E418B3B54B26D727B4	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96B150D8852E30E418B3B54B26D727B4\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96B150D8852E30E418B3B54B26D727B4\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\96B150D8852E30E418B3B54B26D727B4\MainFeature	msiexec.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
860	msiexec.exe
860	msiexec.exe
4868	AcroRd32.exe
4868	AcroRd32.exe
4868	AcroRd32.exe
4868	AcroRd32.exe
4868	AcroRd32.exe
4868	AcroRd32.exe
4868	AcroRd32.exe
4868	AcroRd32.exe
4868	AcroRd32.exe
4868	AcroRd32.exe
4868	AcroRd32.exe
4868	AcroRd32.exe
4868	AcroRd32.exe
4868	AcroRd32.exe
4868	AcroRd32.exe
4868	AcroRd32.exe
4868	AcroRd32.exe
4868	AcroRd32.exe
4868	AcroRd32.exe
4868	AcroRd32.exe
5084	msedge.exe
5084	msedge.exe
1868	msedge.exe
1868	msedge.exe
1580	identity_helper.exe
1580	identity_helper.exe

Suspicious behavior: LoadsDriver 10 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
660	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3848	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3848	msiexec.exe
Token: SeSecurityPrivilege	860	msiexec.exe
Token: SeCreateTokenPrivilege	3848	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3848	msiexec.exe
Token: SeLockMemoryPrivilege	3848	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3848	msiexec.exe
Token: SeMachineAccountPrivilege	3848	msiexec.exe
Token: SeTcbPrivilege	3848	msiexec.exe
Token: SeSecurityPrivilege	3848	msiexec.exe
Token: SeTakeOwnershipPrivilege	3848	msiexec.exe
Token: SeLoadDriverPrivilege	3848	msiexec.exe
Token: SeSystemProfilePrivilege	3848	msiexec.exe
Token: SeSystemtimePrivilege	3848	msiexec.exe
Token: SeProfSingleProcessPrivilege	3848	msiexec.exe
Token: SeIncBasePriorityPrivilege	3848	msiexec.exe
Token: SeCreatePagefilePrivilege	3848	msiexec.exe
Token: SeCreatePermanentPrivilege	3848	msiexec.exe
Token: SeBackupPrivilege	3848	msiexec.exe
Token: SeRestorePrivilege	3848	msiexec.exe
Token: SeShutdownPrivilege	3848	msiexec.exe
Token: SeDebugPrivilege	3848	msiexec.exe
Token: SeAuditPrivilege	3848	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3848	msiexec.exe
Token: SeChangeNotifyPrivilege	3848	msiexec.exe
Token: SeRemoteShutdownPrivilege	3848	msiexec.exe
Token: SeUndockPrivilege	3848	msiexec.exe
Token: SeSyncAgentPrivilege	3848	msiexec.exe
Token: SeEnableDelegationPrivilege	3848	msiexec.exe
Token: SeManageVolumePrivilege	3848	msiexec.exe
Token: SeImpersonatePrivilege	3848	msiexec.exe
Token: SeCreateGlobalPrivilege	3848	msiexec.exe
Token: SeRestorePrivilege	860	msiexec.exe
Token: SeTakeOwnershipPrivilege	860	msiexec.exe
Token: SeRestorePrivilege	860	msiexec.exe
Token: SeTakeOwnershipPrivilege	860	msiexec.exe
Token: SeRestorePrivilege	860	msiexec.exe
Token: SeTakeOwnershipPrivilege	860	msiexec.exe
Token: SeRestorePrivilege	860	msiexec.exe
Token: SeTakeOwnershipPrivilege	860	msiexec.exe
Token: SeRestorePrivilege	860	msiexec.exe
Token: SeTakeOwnershipPrivilege	860	msiexec.exe
Token: SeRestorePrivilege	860	msiexec.exe
Token: SeTakeOwnershipPrivilege	860	msiexec.exe
Token: SeRestorePrivilege	860	msiexec.exe
Token: SeTakeOwnershipPrivilege	860	msiexec.exe
Token: SeRestorePrivilege	860	msiexec.exe
Token: SeTakeOwnershipPrivilege	860	msiexec.exe
Token: SeRestorePrivilege	860	msiexec.exe
Token: SeTakeOwnershipPrivilege	860	msiexec.exe
Token: SeRestorePrivilege	860	msiexec.exe
Token: SeTakeOwnershipPrivilege	860	msiexec.exe
Token: SeRestorePrivilege	860	msiexec.exe
Token: SeTakeOwnershipPrivilege	860	msiexec.exe
Token: SeRestorePrivilege	860	msiexec.exe
Token: SeTakeOwnershipPrivilege	860	msiexec.exe
Token: SeRestorePrivilege	860	msiexec.exe
Token: SeTakeOwnershipPrivilege	860	msiexec.exe
Token: SeRestorePrivilege	860	msiexec.exe
Token: SeTakeOwnershipPrivilege	860	msiexec.exe
Token: SeRestorePrivilege	860	msiexec.exe
Token: SeTakeOwnershipPrivilege	860	msiexec.exe
Token: SeRestorePrivilege	860	msiexec.exe
Token: SeTakeOwnershipPrivilege	860	msiexec.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
3848	msiexec.exe
3848	msiexec.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4868	AcroRd32.exe
4868	AcroRd32.exe
4868	AcroRd32.exe
4868	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 860 wrote to memory of 2520	860	msiexec.exe	88
PID 860 wrote to memory of 2520	860	msiexec.exe	88
PID 860 wrote to memory of 2520	860	msiexec.exe	88
PID 860 wrote to memory of 4264	860	msiexec.exe	89
PID 860 wrote to memory of 4264	860	msiexec.exe	89
PID 860 wrote to memory of 4264	860	msiexec.exe	89
PID 4264 wrote to memory of 1868	4264	MSIC2AB.tmp	90
PID 4264 wrote to memory of 1868	4264	MSIC2AB.tmp	90
PID 1868 wrote to memory of 1040	1868	msedge.exe	91
PID 1868 wrote to memory of 1040	1868	msedge.exe	91
PID 1868 wrote to memory of 3732	1868	msedge.exe	92
PID 1868 wrote to memory of 3732	1868	msedge.exe	92
PID 1868 wrote to memory of 3732	1868	msedge.exe	92
PID 1868 wrote to memory of 3732	1868	msedge.exe	92
PID 1868 wrote to memory of 3732	1868	msedge.exe	92
PID 1868 wrote to memory of 3732	1868	msedge.exe	92
PID 1868 wrote to memory of 3732	1868	msedge.exe	92
PID 1868 wrote to memory of 3732	1868	msedge.exe	92
PID 1868 wrote to memory of 3732	1868	msedge.exe	92
PID 1868 wrote to memory of 3732	1868	msedge.exe	92
PID 1868 wrote to memory of 3732	1868	msedge.exe	92
PID 1868 wrote to memory of 3732	1868	msedge.exe	92
PID 1868 wrote to memory of 3732	1868	msedge.exe	92
PID 1868 wrote to memory of 3732	1868	msedge.exe	92
PID 1868 wrote to memory of 3732	1868	msedge.exe	92
PID 1868 wrote to memory of 3732	1868	msedge.exe	92
PID 1868 wrote to memory of 3732	1868	msedge.exe	92
PID 1868 wrote to memory of 3732	1868	msedge.exe	92
PID 1868 wrote to memory of 3732	1868	msedge.exe	92
PID 1868 wrote to memory of 3732	1868	msedge.exe	92
PID 1868 wrote to memory of 3732	1868	msedge.exe	92
PID 1868 wrote to memory of 3732	1868	msedge.exe	92
PID 1868 wrote to memory of 3732	1868	msedge.exe	92
PID 1868 wrote to memory of 3732	1868	msedge.exe	92
PID 1868 wrote to memory of 3732	1868	msedge.exe	92
PID 1868 wrote to memory of 3732	1868	msedge.exe	92
PID 1868 wrote to memory of 3732	1868	msedge.exe	92
PID 1868 wrote to memory of 3732	1868	msedge.exe	92
PID 1868 wrote to memory of 3732	1868	msedge.exe	92
PID 1868 wrote to memory of 3732	1868	msedge.exe	92
PID 1868 wrote to memory of 3732	1868	msedge.exe	92
PID 1868 wrote to memory of 3732	1868	msedge.exe	92
PID 1868 wrote to memory of 3732	1868	msedge.exe	92
PID 1868 wrote to memory of 3732	1868	msedge.exe	92
PID 1868 wrote to memory of 3732	1868	msedge.exe	92
PID 1868 wrote to memory of 3732	1868	msedge.exe	92
PID 1868 wrote to memory of 3732	1868	msedge.exe	92
PID 1868 wrote to memory of 3732	1868	msedge.exe	92
PID 1868 wrote to memory of 3732	1868	msedge.exe	92
PID 1868 wrote to memory of 3732	1868	msedge.exe	92
PID 1868 wrote to memory of 5084	1868	msedge.exe	93
PID 1868 wrote to memory of 5084	1868	msedge.exe	93
PID 1868 wrote to memory of 2532	1868	msedge.exe	94
PID 1868 wrote to memory of 2532	1868	msedge.exe	94
PID 1868 wrote to memory of 2532	1868	msedge.exe	94
PID 1868 wrote to memory of 2532	1868	msedge.exe	94
PID 1868 wrote to memory of 2532	1868	msedge.exe	94
PID 1868 wrote to memory of 2532	1868	msedge.exe	94
PID 1868 wrote to memory of 2532	1868	msedge.exe	94
PID 1868 wrote to memory of 2532	1868	msedge.exe	94
PID 1868 wrote to memory of 2532	1868	msedge.exe	94
PID 1868 wrote to memory of 2532	1868	msedge.exe	94
PID 1868 wrote to memory of 2532	1868	msedge.exe	94
PID 1868 wrote to memory of 2532	1868	msedge.exe	94

C:\Windows\system32\msiexec.exe
msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\File Fahrenheit.Indigo.Prophecy.Remastered.zip...msi"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3848

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4868

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:860
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A9410D9D35494399C2D50C3FA521390D
  2⤵
  - Loads dropped DLL
  PID:2520
- C:\Windows\Installer\MSIC2AB.tmp
  "C:\Windows\Installer\MSIC2AB.tmp" https://telixsearch.com/tyy
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://telixsearch.com/tyy
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff932c046f8,0x7ff932c04708,0x7ff932c04718
      4⤵
      PID:1040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,17061686718183223854,6851425824490560009,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
      4⤵
      PID:3732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,17061686718183223854,6851425824490560009,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2476 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,17061686718183223854,6851425824490560009,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
      4⤵
      PID:2532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17061686718183223854,6851425824490560009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
      4⤵
      PID:756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17061686718183223854,6851425824490560009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
      4⤵
      PID:684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17061686718183223854,6851425824490560009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4000 /prefetch:1
      4⤵
      PID:2148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17061686718183223854,6851425824490560009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3596 /prefetch:1
      4⤵
      PID:4232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,17061686718183223854,6851425824490560009,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5016 /prefetch:8
      4⤵
      PID:2472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,17061686718183223854,6851425824490560009,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5016 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17061686718183223854,6851425824490560009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4464 /prefetch:1
      4⤵
      PID:4520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17061686718183223854,6851425824490560009,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4448 /prefetch:1
      4⤵
      PID:1448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17061686718183223854,6851425824490560009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
      4⤵
      PID:4300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17061686718183223854,6851425824490560009,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4336 /prefetch:1
      4⤵
      PID:5156

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1052

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e57bf8a.rbs

Path C:\Config.Msi\e57bf8a.rbs
Size 11KB
SHA256 87522cc8d0658264e238894e1f9908bee117f7ced829aaedf504fda7e7d1cc12
MD5 1f3b6a53b77c79787dd8e59ffdcd0131
SHA1 5cff038b4df4d56ad62773c522a2f502646dfae6
SHA512 e9e833da688fd002580c0f6665a6f4f8c2ce096b09406165ebd258d9b30793ad6b18483185a49591d0bb97fa080b83829945e71835e449174b4ed4f2402c88fd
SSDEEP 192:nrPT7JBNWKKW7snw5c2H7CEXlm+UeBB5MRJMXOI/aRJMXOJbl5/kCO6keYXXA0nK:nrNXlm6BaWcWGbliV6keYXXA0ngVhTrD
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b
MD5 eaa3db555ab5bc0cb364826204aad3f0
SHA1 a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca
SHA512 e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c
MD5 4b4f91fa1b362ba5341ecb2836438dea
SHA1 9561f5aabed742404d455da735259a2c6781fa07
SHA512 fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 51bd4b0c23522868497f687a5a1db860b0fd4a78ac0e4d435ab23b31d03588c4
MD5 1adad105e22a47a180e9d5f994ebfc06
SHA1 1d332f0d09cecc8873d65e50e52804296464b75e
SHA512 dd34478de21f684029cb568c9a4af218c17d61986148577175483b9b8d7beb3d52f63ecaf7349ff3ee867a57d2032f32f308febad8f0faddeae905058c844149
SSDEEP 96:n9AkGgY1Xoj0wpvWMoiVmdeHmQICUWQyV+VDCziEwb:n9AkkVoj0GWMXdro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 1585a5ac4126f3becb8e0e86a330db36b417500391bd05e953b223270472dc75
MD5 3477b98ebc8b17214221175e2331928b
SHA1 59671e7b718a264ca422bd639c94c28ba17bad44
SHA512 fb5aae50af01e7127d589b2edea9b4f8b02322d5ec5ec404a5cee5e211ccba5d7b5ac67cac4195b5c2070a4800bae3ffa5b98335972caa2e5159f21de90585e3
SSDEEP 96:n9AkGgY17oj0wpvWMoiVmdeHmQI7dUWQyV+VD7AiEwb:n9Akk9oj0GWMXWrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 153e49074108d94deebc66fd4ceafde66b5d874d77d1b4eaa4ec4fe27b11a046
MD5 d6a9be6053a0788fe30fb5e03f55998a
SHA1 1d34205f9e8c10f63475f59b9f8ee09c790be4be
SHA512 445d44f3ad14a74969dac62091a79450f1aaf05ef56575065cd5f5d1e882c2cccbd1ff2d29cbea592e39ce592042ab55664488064f265739d8cf0ce4301665a0
SSDEEP 192:+oCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupDYe2RUSIKbt:K9iIxuERzA83h09RZxYDWft
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a2de76e28954bc7862aa2895f242f03ac8513de9d3a7c916c57fa4c41dd4c7e3
MD5 9fa0c859409a989e50b08bacf7dea3f6
SHA1 2dcce0513423cb58f68396b9c3b46f56489d6e8a
SHA512 0716287c449b871d0dc6626eda26f285a6a80e88d5947aa8d75b9397e69734cd0153f71f8fa3bb663a7bfc46be78d4975eae4ee41af3b57fde5a778dc2da1f1d
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupDYe2RUWIKbt:A9iIxuERzA83h09RZxYDWRt
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSIC071.tmp

Path C:\Windows\Installer\MSIC071.tmp
Size 738KB
SHA256 32b60176177d943df28f931828717f4b52b1434b8c0cd3ca8cc8a424b016b092
MD5 8d84543f774c6b280b32b24265e272e8
SHA1 cd3a0dbc06b9b4945f3a5d3b40972a0b5f66044b
SHA512 247c5c3c4765e61b4d4b7514886e9eccb45746593b21a8dc8f718a224a1a0bc813fe227030738c3035cb9a9017ba53d7feff07cccb11407e9b22678af0c42056
SSDEEP 12288:1CIETjR8kJ/FQhGd6rZj5Tzlqph0lhSMXleUnD55vscNzjjZqK:1jEhnJ/mhGd6NFTzqh0lhSMXlLnD55km
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSIC2AB.tmp

Path C:\Windows\Installer\MSIC2AB.tmp
Size 416KB
SHA256 0272659c6402b95da6c59cbfe4e3e60a361c50bebf536dd0b4c7b914e05cf175
MD5 4f5c40ec5d343ed9f185fbd1d6123d0b
SHA1 3b7569cbe35834c21493385329e43a73ef66413f
SHA512 64d5476938997a4478744c1185e73391047a1f198d57dc91cc49b9229f144086cae831af828600d979f02c1739065e252fc54e1491354438d875785ba9d8efac
SSDEEP 12288:06FaqMeU/Hzb9r84jEIWOlDgSNj43HkBX53k17vij:0CaqMr/f9r84jEHYDgOX5017vE
MD5 SHA1 SHA512 SSDEEP

Submit Download