Analysis
-
max time kernel
1191s -
max time network
1195s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
submitted
27-06-2024 14:59
Static task
static1
Behavioral task
behavioral1
Sample
Form_Ver-16-46-33.js
Resource
win7-20231129-en
windows7-x64
13 signatures
1200 seconds
Behavioral task
behavioral2
Sample
Form_Ver-16-46-33.js
Resource
win10v2004-20240508-en
windows10-2004-x64
10 signatures
1200 seconds
Behavioral task
behavioral3
Sample
Form_Ver-16-46-33.js
Resource
win11-20240611-en
windows11-21h2-x64
10 signatures
1200 seconds
General
-
Target
Form_Ver-16-46-33.js
-
Size
572KB
-
MD5
b1da07a445bfdf809306f5fe74e54d67
-
SHA1
3cec038e474050c290bdf4e670a36f482032ed68
-
SHA256
9003415cc22d4e8b3c444ffcf84bb3f1c3a294d40d1f66329733edfc8472a7d2
-
SHA512
728b321b98f45fc6cd1395ee5a34c1ee06ca17800c35ec1ee7f19ac3219aa8fc805140e6d0ecc25a638f8c815db541380d0651df2ff448121477ed3445bd6637
-
SSDEEP
6144:kMuyrXL4P/YsoZR3U52fYiGnh2xFpMp4/KJHaWTyFIXgBoEKnDmmzPvKYUNul8D7:kM/74PPitCt4XGlgJ5+Dk
Score
10/10
Malware Config
Signatures
-
Brute Ratel C4
A customized command and control framework for red teaming and adversary simulation.
-
Bruteratel family
-
Detect BruteRatel badger 3 IoCs
resource yara_rule behavioral2/memory/2256-47-0x000000033A710000-0x000000033A75A000-memory.dmp family_bruteratel behavioral2/memory/2256-46-0x000000033A710000-0x000000033A75A000-memory.dmp family_bruteratel behavioral2/memory/2256-57-0x000000033A710000-0x000000033A75A000-memory.dmp family_bruteratel -
Blocklisted process makes network request 34 IoCs
flow pid Process 4 3772 wscript.exe 7 3772 wscript.exe 12 3772 wscript.exe 16 4468 msiexec.exe 21 2256 rundll32.exe 23 2256 rundll32.exe 26 2256 rundll32.exe 51 2256 rundll32.exe 60 2256 rundll32.exe 62 2256 rundll32.exe 64 2256 rundll32.exe 65 2256 rundll32.exe 66 2256 rundll32.exe 67 2256 rundll32.exe 72 2256 rundll32.exe 73 2256 rundll32.exe 74 2256 rundll32.exe 76 2256 rundll32.exe 77 2256 rundll32.exe 78 2256 rundll32.exe 79 2256 rundll32.exe 80 2256 rundll32.exe 81 2256 rundll32.exe 82 2256 rundll32.exe 83 2256 rundll32.exe 84 2256 rundll32.exe 85 2256 rundll32.exe 86 2256 rundll32.exe 87 2256 rundll32.exe 88 2256 rundll32.exe 89 2256 rundll32.exe 90 2256 rundll32.exe 91 2256 rundll32.exe 92 2256 rundll32.exe -
Executes dropped EXE 1 IoCs
pid Process 4616 MSI771A.tmp -
Loads dropped DLL 5 IoCs
pid Process 1948 MsiExec.exe 1948 MsiExec.exe 1948 MsiExec.exe 1948 MsiExec.exe 2256 rundll32.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe -
Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI7513.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI771A.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI7583.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5FC3.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7485.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7523.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7543.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSI771A.tmp -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A70BAE154034F459E9D4E6FAAC7E5B19BFBF96A0\Blob = 1400000001000000140000001e925d0c4adebdb654d95e4e1673d078c49407ec030000000100000014000000a70bae154034f459e9d4e6faac7e5b19bfbf96a00f0000000100000020000000eefeca5d84d60b02ebf940ca7acb561552caac87331dac76c1945392bd17e13f2000000001000000f9020000308202f5308201dda0030201020210114165894067b571aedbcd1e6b5060dd300d06092a864886f70d01010b050030133111300f06035504031308436c6f75644e6574301e170d3234303632353134303030305a170d3239303632343134303030305a30133111300f06035504031308436c6f75644e657430820122300d06092a864886f70d01010105000382010f003082010a0282010100c70102afeaa9d44edb441eb1da422a09034efd255fc1ef5ccd027b68470af41b956035dea112698205267aab0b039fcc44eeb2b414eceac5492305642cfa4fa90046eaf6424fccad67d1f68e74500569fce1fd07f889a7c60e4972dffa39a2f75ec025342bf24a4c1dc8dbdb0fb3dbbdfaa08ac04b6ca23c61c711b15611b9b1eda56a010ec31db3202c2bc16fd52b21c6c5ef484caff4f80d1821a46a2651285f8dbec9dc2852bbf4cdfd0ad0707b117a68f0aacacccd082aa72e4cd3df9f108aa3a713d15ff3ccb02c0da37c6d855951e069736be2c9b1a569b3d4a7ed3a03248f22804b6d0463dd0e5f50e3fd47573818deb34db0831c54cb8e9932968b4b0203010001a3453043300e0603551d0f0101ff04040302010630120603551d130101ff040830060101ff020101301d0603551d0e041604141e925d0c4adebdb654d95e4e1673d078c49407ec300d06092a864886f70d01010b0500038201010030dd560df8304f11f10b1e0ecdbbcc5fa3acb349c6beed5d5f61ba4e1d41996d90315503d50bcd27bc3d1ed30b2b2fb7fa774565a77703d247de2c464b1db3b4c2498eb57d46418ea9fc2a3e41eb49d9ed929ff92fd3c53548441607fa86b675c82cc4ed308ac4aca78ab88bf60c510bbe8b8d4d6a84597e5072dc9df056a63354a13badf79d74fe2d4149bc117b9df7a4982759623dd1c2babab7f1bffed5b3cf5a8c67c7f5f295a17656f4e6dbb2e3a30a5e49640cde06eadebaf0d50a76e2f75fa50fb696b50af05a5dbfcde0da7af9e27e4950e4afff8d3255b5292fde65937a1990138410972ce6b2915bfa2187121d5da1d681eb3a5506580fc7db934b wscript.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A70BAE154034F459E9D4E6FAAC7E5B19BFBF96A0\Blob = 1900000001000000100000001c3ac272924aa87c215c199588be6ff00f0000000100000020000000eefeca5d84d60b02ebf940ca7acb561552caac87331dac76c1945392bd17e13f030000000100000014000000a70bae154034f459e9d4e6faac7e5b19bfbf96a01400000001000000140000001e925d0c4adebdb654d95e4e1673d078c49407ec2000000001000000f9020000308202f5308201dda0030201020210114165894067b571aedbcd1e6b5060dd300d06092a864886f70d01010b050030133111300f06035504031308436c6f75644e6574301e170d3234303632353134303030305a170d3239303632343134303030305a30133111300f06035504031308436c6f75644e657430820122300d06092a864886f70d01010105000382010f003082010a0282010100c70102afeaa9d44edb441eb1da422a09034efd255fc1ef5ccd027b68470af41b956035dea112698205267aab0b039fcc44eeb2b414eceac5492305642cfa4fa90046eaf6424fccad67d1f68e74500569fce1fd07f889a7c60e4972dffa39a2f75ec025342bf24a4c1dc8dbdb0fb3dbbdfaa08ac04b6ca23c61c711b15611b9b1eda56a010ec31db3202c2bc16fd52b21c6c5ef484caff4f80d1821a46a2651285f8dbec9dc2852bbf4cdfd0ad0707b117a68f0aacacccd082aa72e4cd3df9f108aa3a713d15ff3ccb02c0da37c6d855951e069736be2c9b1a569b3d4a7ed3a03248f22804b6d0463dd0e5f50e3fd47573818deb34db0831c54cb8e9932968b4b0203010001a3453043300e0603551d0f0101ff04040302010630120603551d130101ff040830060101ff020101301d0603551d0e041604141e925d0c4adebdb654d95e4e1673d078c49407ec300d06092a864886f70d01010b0500038201010030dd560df8304f11f10b1e0ecdbbcc5fa3acb349c6beed5d5f61ba4e1d41996d90315503d50bcd27bc3d1ed30b2b2fb7fa774565a77703d247de2c464b1db3b4c2498eb57d46418ea9fc2a3e41eb49d9ed929ff92fd3c53548441607fa86b675c82cc4ed308ac4aca78ab88bf60c510bbe8b8d4d6a84597e5072dc9df056a63354a13badf79d74fe2d4149bc117b9df7a4982759623dd1c2babab7f1bffed5b3cf5a8c67c7f5f295a17656f4e6dbb2e3a30a5e49640cde06eadebaf0d50a76e2f75fa50fb696b50af05a5dbfcde0da7af9e27e4950e4afff8d3255b5292fde65937a1990138410972ce6b2915bfa2187121d5da1d681eb3a5506580fc7db934b wscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8 wscript.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 0f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c0b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000006200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df8653000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c01400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b1d00000001000000100000005467b0adde8d858e30ee517b1a19ecd909000000010000000c000000300a06082b060105050703030300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b8200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82 wscript.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 1900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b40300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b809000000010000000c000000300a06082b060105050703031d00000001000000100000005467b0adde8d858e30ee517b1a19ecd91400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b53000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df860b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000000f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82 wscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A70BAE154034F459E9D4E6FAAC7E5B19BFBF96A0 wscript.exe -
Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 4468 msiexec.exe 4468 msiexec.exe 4616 MSI771A.tmp 4616 MSI771A.tmp 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe 2256 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeShutdownPrivilege 3772 wscript.exe Token: SeIncreaseQuotaPrivilege 3772 wscript.exe Token: SeSecurityPrivilege 4468 msiexec.exe Token: SeCreateTokenPrivilege 3772 wscript.exe Token: SeAssignPrimaryTokenPrivilege 3772 wscript.exe Token: SeLockMemoryPrivilege 3772 wscript.exe Token: SeIncreaseQuotaPrivilege 3772 wscript.exe Token: SeMachineAccountPrivilege 3772 wscript.exe Token: SeTcbPrivilege 3772 wscript.exe Token: SeSecurityPrivilege 3772 wscript.exe Token: SeTakeOwnershipPrivilege 3772 wscript.exe Token: SeLoadDriverPrivilege 3772 wscript.exe Token: SeSystemProfilePrivilege 3772 wscript.exe Token: SeSystemtimePrivilege 3772 wscript.exe Token: SeProfSingleProcessPrivilege 3772 wscript.exe Token: SeIncBasePriorityPrivilege 3772 wscript.exe Token: SeCreatePagefilePrivilege 3772 wscript.exe Token: SeCreatePermanentPrivilege 3772 wscript.exe Token: SeBackupPrivilege 3772 wscript.exe Token: SeRestorePrivilege 3772 wscript.exe Token: SeShutdownPrivilege 3772 wscript.exe Token: SeDebugPrivilege 3772 wscript.exe Token: SeAuditPrivilege 3772 wscript.exe Token: SeSystemEnvironmentPrivilege 3772 wscript.exe Token: SeChangeNotifyPrivilege 3772 wscript.exe Token: SeRemoteShutdownPrivilege 3772 wscript.exe Token: SeUndockPrivilege 3772 wscript.exe Token: SeSyncAgentPrivilege 3772 wscript.exe Token: SeEnableDelegationPrivilege 3772 wscript.exe Token: SeManageVolumePrivilege 3772 wscript.exe Token: SeImpersonatePrivilege 3772 wscript.exe Token: SeCreateGlobalPrivilege 3772 wscript.exe Token: SeRestorePrivilege 4468 msiexec.exe Token: SeTakeOwnershipPrivilege 4468 msiexec.exe Token: SeRestorePrivilege 4468 msiexec.exe Token: SeTakeOwnershipPrivilege 4468 msiexec.exe Token: SeRestorePrivilege 4468 msiexec.exe Token: SeTakeOwnershipPrivilege 4468 msiexec.exe Token: SeRestorePrivilege 4468 msiexec.exe Token: SeTakeOwnershipPrivilege 4468 msiexec.exe Token: SeRestorePrivilege 4468 msiexec.exe Token: SeTakeOwnershipPrivilege 4468 msiexec.exe Token: SeRestorePrivilege 4468 msiexec.exe Token: SeTakeOwnershipPrivilege 4468 msiexec.exe Token: SeRestorePrivilege 4468 msiexec.exe Token: SeTakeOwnershipPrivilege 4468 msiexec.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4468 wrote to memory of 1948 4468 msiexec.exe 82 PID 4468 wrote to memory of 1948 4468 msiexec.exe 82 PID 4468 wrote to memory of 1948 4468 msiexec.exe 82 PID 4468 wrote to memory of 4616 4468 msiexec.exe 85 PID 4468 wrote to memory of 4616 4468 msiexec.exe 85 PID 4468 wrote to memory of 4616 4468 msiexec.exe 85
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\Form_Ver-16-46-33.js1⤵
- Blocklisted process makes network request
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:3772
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding FE00A794DF7D7220E55D9DF92803B4D42⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1948
-
-
C:\Windows\Installer\MSI771A.tmp"C:\Windows\Installer\MSI771A.tmp" C:/Windows/System32/rundll32.exe C:\Users\Admin\AppData\Roaming\capisp.dll, remi2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4616
-
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\capisp.dll, remi1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2256
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD570b599f67e97cb878ca7be88e069a82d
SHA1768f8a179fee1f13505c7b772e543b19b29b14c8
SHA2569b7bdb4cb71e84c5cff0923928bf7777a41cb5e0691810ae948304c151c0c1c5
SHA512163c8e0b2676a27f1781e9fdec3c9994ba828c0085b9fdff9df4dd0112da122a5d7f6ca597af396f99c2afadbe438e1ab967dfba34451ee4ba3c59cd244b4985
-
Filesize
1.8MB
MD53645512add0c8cb24a88d2ffe3fe7620
SHA166dbfe6ffc1918f51b28af1abf55df0d1beaefe6
SHA256d71bfab9cca5df6a28e12ba51fe5eaf0f9151514b3fd363264513347a8c5cf3a
SHA51285151258ccb3b590716aed87c4a6a24ba74931aab0b378e279d9ab510fce94dfd26632d8ba44975e8136b1a9cc6c190e64c8b223f5f5e4f5b9cb3c6fb4a9429c
-
Filesize
436KB
MD5475d20c0ea477a35660e3f67ecf0a1df
SHA167340739f51e1134ae8f0ffc5ae9dd710e8e3a08
SHA256426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
SHA51299525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
-
Filesize
389KB
MD5b9545ed17695a32face8c3408a6a3553
SHA1f6c31c9cd832ae2aebcd88e7b2fa6803ae93fc83
SHA2561e0e63b446eecf6c9781c7d1cae1f46a3bb31654a70612f71f31538fb4f4729a
SHA512f6d6dc40dcba5ff091452d7cc257427dcb7ce2a21816b4fec2ee249e63246b64667f5c4095220623533243103876433ef8c12c9b612c0e95fdfffe41d1504e04