Analysis
-
max time kernel
1191s -
max time network
1196s -
platform
windows11-21h2_x64 -
resource
win11-20240611-en -
submitted
27-06-2024 14:59
Static task
static1
Behavioral task
behavioral1
Sample
Form_Ver-16-46-33.js
Resource
win7-20231129-en
windows7-x64
13 signatures
1200 seconds
Behavioral task
behavioral2
Sample
Form_Ver-16-46-33.js
Resource
win10v2004-20240508-en
windows10-2004-x64
10 signatures
1200 seconds
Behavioral task
behavioral3
Sample
Form_Ver-16-46-33.js
Resource
win11-20240611-en
windows11-21h2-x64
10 signatures
1200 seconds
General
-
Target
Form_Ver-16-46-33.js
-
Size
572KB
-
MD5
b1da07a445bfdf809306f5fe74e54d67
-
SHA1
3cec038e474050c290bdf4e670a36f482032ed68
-
SHA256
9003415cc22d4e8b3c444ffcf84bb3f1c3a294d40d1f66329733edfc8472a7d2
-
SHA512
728b321b98f45fc6cd1395ee5a34c1ee06ca17800c35ec1ee7f19ac3219aa8fc805140e6d0ecc25a638f8c815db541380d0651df2ff448121477ed3445bd6637
-
SSDEEP
6144:kMuyrXL4P/YsoZR3U52fYiGnh2xFpMp4/KJHaWTyFIXgBoEKnDmmzPvKYUNul8D7:kM/74PPitCt4XGlgJ5+Dk
Score
10/10
Malware Config
Signatures
-
Brute Ratel C4
A customized command and control framework for red teaming and adversary simulation.
-
Bruteratel family
-
Detect BruteRatel badger 3 IoCs
resource yara_rule behavioral3/memory/2600-44-0x000000033A710000-0x000000033A75A000-memory.dmp family_bruteratel behavioral3/memory/2600-45-0x000000033A710000-0x000000033A75A000-memory.dmp family_bruteratel behavioral3/memory/2600-55-0x000000033A710000-0x000000033A75A000-memory.dmp family_bruteratel -
Blocklisted process makes network request 32 IoCs
flow pid Process 2 3624 wscript.exe 4 3624 wscript.exe 5 3624 wscript.exe 6 1036 msiexec.exe 7 2600 rundll32.exe 8 2600 rundll32.exe 9 2600 rundll32.exe 11 2600 rundll32.exe 14 2600 rundll32.exe 15 2600 rundll32.exe 16 2600 rundll32.exe 17 2600 rundll32.exe 18 2600 rundll32.exe 20 2600 rundll32.exe 21 2600 rundll32.exe 26 2600 rundll32.exe 27 2600 rundll32.exe 29 2600 rundll32.exe 30 2600 rundll32.exe 31 2600 rundll32.exe 32 2600 rundll32.exe 33 2600 rundll32.exe 34 2600 rundll32.exe 35 2600 rundll32.exe 36 2600 rundll32.exe 37 2600 rundll32.exe 38 2600 rundll32.exe 39 2600 rundll32.exe 40 2600 rundll32.exe 41 2600 rundll32.exe 42 2600 rundll32.exe 43 2600 rundll32.exe -
Executes dropped EXE 1 IoCs
pid Process 3328 MSI183C.tmp -
Loads dropped DLL 5 IoCs
pid Process 3820 MsiExec.exe 3820 MsiExec.exe 3820 MsiExec.exe 3820 MsiExec.exe 2600 rundll32.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\SystemTemp\~DFFCEB12AC09470D30.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI17CE.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI183C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI700.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI172F.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI16C0.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI175E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI177F.tmp msiexec.exe -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSI183C.tmp -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B16D8C92CD4A6ECE8D3627CD42FD0E4C1CAB2F5E wscript.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B16D8C92CD4A6ECE8D3627CD42FD0E4C1CAB2F5E\Blob = 140000000100000014000000d516193485875a78a233fc8081127d44f24ef7b5030000000100000014000000b16d8c92cd4a6ece8d3627cd42fd0e4c1cab2f5e0f0000000100000020000000245458b06ed0c56821bc7e0bf76ebf0676f5549d18bc18e4d92b1fda416d61522000000001000000f9020000308202f5308201dda003020102021001153c8aeef7f494753933c74789f84b300d06092a864886f70d01010b050030133111300f06035504031308436c6f75644e6574301e170d3234303631373039303030305a170d3239303631363039303030305a30133111300f06035504031308436c6f75644e657430820122300d06092a864886f70d01010105000382010f003082010a02820101009cbad201bd7e4a3b4aed4c40f048190745ccc631fc21be787140a7de9bd934609484997e6da13dafb880a6519bdc1dffe5722dadfb9f71ebf579833f5af2a8d2f038723cace416b6f3ce9609c87f428a7c08a3d970cbe641eb0690c494382b3f3e203b2eb695f1ab535d3fcf71d0899d0a70a554d5f2d547a5f01248e0d1bd4676de179b66cee2e0d9c5d3bf059b3c7d9261ccda2f74adae375f1007632662dca4180a2a13964ee91e12b51d58a1817d15b844a778bc26b2e2999add02484abb0c6513bf1d039d3cc4b7032c7bc08f830ddaf9c524ad8e4a48380ab90a1edaaffc44d53c6fe0ca565c0724772db58af7cb02e213239f74667678d1cb38dc610d0203010001a3453043300e0603551d0f0101ff04040302010630120603551d130101ff040830060101ff020101301d0603551d0e04160414d516193485875a78a233fc8081127d44f24ef7b5300d06092a864886f70d01010b050003820101008f2dcfd8b5ca8acef43df1f8b50fae37ba57867b0c4aa253bf09bfcf5b189208afb3b1ec81bc834b213b9a210576d10f00558355c2a7c0a180692992be29fe06c3a654075fef18beecb4026caa80846e4e2ee9452b100efbd9323b66c23eb3a3e89029ffa10d5605c42052f16cdda7e7a17207fd8654cd3afe9076fec6874b4374b531cac1d6e08c6709538b214ed4660387009d538b2b82f60e735045e4bcbf22e66e81a8cedb4d8697c9293fb11d323e4df61ce85501b6374d1f4e02f1b9388a2981feb77aa1ed58bdf62e0123d0c9d2831958fa6b9100a67d8375268a1466183465368ac8f5420bba387e934ede89e92b4bcb8ea4ac3673c5f64437f0c48d wscript.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B16D8C92CD4A6ECE8D3627CD42FD0E4C1CAB2F5E\Blob = 1900000001000000100000002b4f27d337fbbb2a4b54c84f758d0ec50f0000000100000020000000245458b06ed0c56821bc7e0bf76ebf0676f5549d18bc18e4d92b1fda416d6152030000000100000014000000b16d8c92cd4a6ece8d3627cd42fd0e4c1cab2f5e140000000100000014000000d516193485875a78a233fc8081127d44f24ef7b52000000001000000f9020000308202f5308201dda003020102021001153c8aeef7f494753933c74789f84b300d06092a864886f70d01010b050030133111300f06035504031308436c6f75644e6574301e170d3234303631373039303030305a170d3239303631363039303030305a30133111300f06035504031308436c6f75644e657430820122300d06092a864886f70d01010105000382010f003082010a02820101009cbad201bd7e4a3b4aed4c40f048190745ccc631fc21be787140a7de9bd934609484997e6da13dafb880a6519bdc1dffe5722dadfb9f71ebf579833f5af2a8d2f038723cace416b6f3ce9609c87f428a7c08a3d970cbe641eb0690c494382b3f3e203b2eb695f1ab535d3fcf71d0899d0a70a554d5f2d547a5f01248e0d1bd4676de179b66cee2e0d9c5d3bf059b3c7d9261ccda2f74adae375f1007632662dca4180a2a13964ee91e12b51d58a1817d15b844a778bc26b2e2999add02484abb0c6513bf1d039d3cc4b7032c7bc08f830ddaf9c524ad8e4a48380ab90a1edaaffc44d53c6fe0ca565c0724772db58af7cb02e213239f74667678d1cb38dc610d0203010001a3453043300e0603551d0f0101ff04040302010630120603551d130101ff040830060101ff020101301d0603551d0e04160414d516193485875a78a233fc8081127d44f24ef7b5300d06092a864886f70d01010b050003820101008f2dcfd8b5ca8acef43df1f8b50fae37ba57867b0c4aa253bf09bfcf5b189208afb3b1ec81bc834b213b9a210576d10f00558355c2a7c0a180692992be29fe06c3a654075fef18beecb4026caa80846e4e2ee9452b100efbd9323b66c23eb3a3e89029ffa10d5605c42052f16cdda7e7a17207fd8654cd3afe9076fec6874b4374b531cac1d6e08c6709538b214ed4660387009d538b2b82f60e735045e4bcbf22e66e81a8cedb4d8697c9293fb11d323e4df61ce85501b6374d1f4e02f1b9388a2981feb77aa1ed58bdf62e0123d0c9d2831958fa6b9100a67d8375268a1466183465368ac8f5420bba387e934ede89e92b4bcb8ea4ac3673c5f64437f0c48d wscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8 wscript.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 0f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c0b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000006200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df8653000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c01400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b1d00000001000000100000005467b0adde8d858e30ee517b1a19ecd909000000010000000c000000300a06082b060105050703030300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b8200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82 wscript.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 1900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b40300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b809000000010000000c000000300a06082b060105050703031d00000001000000100000005467b0adde8d858e30ee517b1a19ecd91400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b53000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df860b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000000f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82 wscript.exe -
Suspicious behavior: EnumeratesProcesses 54 IoCs
pid Process 1036 msiexec.exe 1036 msiexec.exe 3328 MSI183C.tmp 3328 MSI183C.tmp 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe 2600 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeShutdownPrivilege 3624 wscript.exe Token: SeIncreaseQuotaPrivilege 3624 wscript.exe Token: SeSecurityPrivilege 1036 msiexec.exe Token: SeCreateTokenPrivilege 3624 wscript.exe Token: SeAssignPrimaryTokenPrivilege 3624 wscript.exe Token: SeLockMemoryPrivilege 3624 wscript.exe Token: SeIncreaseQuotaPrivilege 3624 wscript.exe Token: SeMachineAccountPrivilege 3624 wscript.exe Token: SeTcbPrivilege 3624 wscript.exe Token: SeSecurityPrivilege 3624 wscript.exe Token: SeTakeOwnershipPrivilege 3624 wscript.exe Token: SeLoadDriverPrivilege 3624 wscript.exe Token: SeSystemProfilePrivilege 3624 wscript.exe Token: SeSystemtimePrivilege 3624 wscript.exe Token: SeProfSingleProcessPrivilege 3624 wscript.exe Token: SeIncBasePriorityPrivilege 3624 wscript.exe Token: SeCreatePagefilePrivilege 3624 wscript.exe Token: SeCreatePermanentPrivilege 3624 wscript.exe Token: SeBackupPrivilege 3624 wscript.exe Token: SeRestorePrivilege 3624 wscript.exe Token: SeShutdownPrivilege 3624 wscript.exe Token: SeDebugPrivilege 3624 wscript.exe Token: SeAuditPrivilege 3624 wscript.exe Token: SeSystemEnvironmentPrivilege 3624 wscript.exe Token: SeChangeNotifyPrivilege 3624 wscript.exe Token: SeRemoteShutdownPrivilege 3624 wscript.exe Token: SeUndockPrivilege 3624 wscript.exe Token: SeSyncAgentPrivilege 3624 wscript.exe Token: SeEnableDelegationPrivilege 3624 wscript.exe Token: SeManageVolumePrivilege 3624 wscript.exe Token: SeImpersonatePrivilege 3624 wscript.exe Token: SeCreateGlobalPrivilege 3624 wscript.exe Token: SeRestorePrivilege 1036 msiexec.exe Token: SeTakeOwnershipPrivilege 1036 msiexec.exe Token: SeRestorePrivilege 1036 msiexec.exe Token: SeTakeOwnershipPrivilege 1036 msiexec.exe Token: SeRestorePrivilege 1036 msiexec.exe Token: SeTakeOwnershipPrivilege 1036 msiexec.exe Token: SeRestorePrivilege 1036 msiexec.exe Token: SeTakeOwnershipPrivilege 1036 msiexec.exe Token: SeRestorePrivilege 1036 msiexec.exe Token: SeTakeOwnershipPrivilege 1036 msiexec.exe Token: SeRestorePrivilege 1036 msiexec.exe Token: SeTakeOwnershipPrivilege 1036 msiexec.exe Token: SeRestorePrivilege 1036 msiexec.exe Token: SeTakeOwnershipPrivilege 1036 msiexec.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1036 wrote to memory of 3820 1036 msiexec.exe 80 PID 1036 wrote to memory of 3820 1036 msiexec.exe 80 PID 1036 wrote to memory of 3820 1036 msiexec.exe 80 PID 1036 wrote to memory of 3328 1036 msiexec.exe 81 PID 1036 wrote to memory of 3328 1036 msiexec.exe 81 PID 1036 wrote to memory of 3328 1036 msiexec.exe 81
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\Form_Ver-16-46-33.js1⤵
- Blocklisted process makes network request
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:3624
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D3EB9397523806C47AEEDB7A86A406852⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3820
-
-
C:\Windows\Installer\MSI183C.tmp"C:\Windows\Installer\MSI183C.tmp" C:/Windows/System32/rundll32.exe C:\Users\Admin\AppData\Roaming\capisp.dll, remi2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3328
-
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\capisp.dll, remi1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2600
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD570b599f67e97cb878ca7be88e069a82d
SHA1768f8a179fee1f13505c7b772e543b19b29b14c8
SHA2569b7bdb4cb71e84c5cff0923928bf7777a41cb5e0691810ae948304c151c0c1c5
SHA512163c8e0b2676a27f1781e9fdec3c9994ba828c0085b9fdff9df4dd0112da122a5d7f6ca597af396f99c2afadbe438e1ab967dfba34451ee4ba3c59cd244b4985
-
Filesize
436KB
MD5475d20c0ea477a35660e3f67ecf0a1df
SHA167340739f51e1134ae8f0ffc5ae9dd710e8e3a08
SHA256426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
SHA51299525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
-
Filesize
389KB
MD5b9545ed17695a32face8c3408a6a3553
SHA1f6c31c9cd832ae2aebcd88e7b2fa6803ae93fc83
SHA2561e0e63b446eecf6c9781c7d1cae1f46a3bb31654a70612f71f31538fb4f4729a
SHA512f6d6dc40dcba5ff091452d7cc257427dcb7ce2a21816b4fec2ee249e63246b64667f5c4095220623533243103876433ef8c12c9b612c0e95fdfffe41d1504e04
-
Filesize
1.8MB
MD53645512add0c8cb24a88d2ffe3fe7620
SHA166dbfe6ffc1918f51b28af1abf55df0d1beaefe6
SHA256d71bfab9cca5df6a28e12ba51fe5eaf0f9151514b3fd363264513347a8c5cf3a
SHA51285151258ccb3b590716aed87c4a6a24ba74931aab0b378e279d9ab510fce94dfd26632d8ba44975e8136b1a9cc6c190e64c8b223f5f5e4f5b9cb3c6fb4a9429c