Analysis
-
max time kernel
1799s -
max time network
1749s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
28/06/2024, 11:10
Static task
static1
Behavioral task
behavioral1
Sample
Broadband4 Workstation Agent 3.23.13.13 - 850_3124.msi
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral2
Sample
Broadband4 Workstation Agent 3.23.13.13 - 850_3124.msi
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral3
Sample
Broadband4 Workstation Agent 3.23.13.13 - 850_3124.msi
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
Broadband4 Workstation Agent 3.23.13.13 - 850_3124.msi
Resource
win11-20240611-en
windows11-21h2-x64
General
-
Target
Broadband4 Workstation Agent 3.23.13.13 - 850_3124.msi
-
Size
3.0MB
-
MD5
a1795b41cf04bc3c549896a40cd116f9
-
SHA1
40268e1facb97e9ae542e9beae0db8b644a1d537
-
SHA256
c533e6eb9fef83338af394ef5043870ce8319b6eaa5e9799dcf62e2692354690
-
SHA512
ff1d62c1dd0bdc0cf18e0a3f03f12e6971c951e327be24bf81f0efc87c061c6b58958493584092456f52e80ad25e4caf7c5fbab7915116df95384edc305203fd
-
SSDEEP
98304:RK4U6cziwzeb4RrOQJj2OucY5rpm6JcIUH4FIu4FdE:RwdziwaburOQJj2OU7UYFI5LE
Malware Config
Signatures
-
Blocklisted process makes network request 4 IoCs
flow pid Process 1 5044 msiexec.exe 3 5044 msiexec.exe 5 5044 msiexec.exe 7 5044 msiexec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\Netsweeper WorkStation Agent\WAgent.exe msiexec.exe -
Drops file in Windows directory 18 IoCs
description ioc Process File created C:\Windows\Installer\{4D2CAC43-2B80-46E9-8DF4-CFBFBC90039D}\ProductIcon.ico msiexec.exe File opened for modification C:\Windows\Installer\MSIC608.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIBFE7.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC047.tmp msiexec.exe File created C:\Windows\Installer\wix{4D2CAC43-2B80-46E9-8DF4-CFBFBC90039D}.SchedServiceConfig.rmi MsiExec.exe File created C:\Windows\Installer\e57be00.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIC190.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC1DF.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\{4D2CAC43-2B80-46E9-8DF4-CFBFBC90039D}\ProductIcon.ico msiexec.exe File opened for modification C:\Windows\Installer\MSIC24D.tmp msiexec.exe File created C:\Windows\Installer\e57be02.msi msiexec.exe File opened for modification C:\Windows\Installer\e57be00.msi msiexec.exe File created C:\Windows\Installer\SourceHash{4D2CAC43-2B80-46E9-8DF4-CFBFBC90039D} msiexec.exe File opened for modification C:\Windows\Installer\MSIBEFA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIBF0B.tmp msiexec.exe -
Executes dropped EXE 2 IoCs
pid Process 4860 WAgent.exe 1012 WAgent.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4140 sc.exe 528 sc.exe -
Loads dropped DLL 7 IoCs
pid Process 1888 MsiExec.exe 1888 MsiExec.exe 3752 MsiExec.exe 3752 MsiExec.exe 3752 MsiExec.exe 3752 MsiExec.exe 1888 MsiExec.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1A\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b msiexec.exe -
Modifies registry class 24 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34CAC2D408B29E64D84FFCFBCB0930D9\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34CAC2D408B29E64D84FFCFBCB0930D9\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34CAC2D408B29E64D84FFCFBCB0930D9\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34CAC2D408B29E64D84FFCFBCB0930D9\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\34CAC2D408B29E64D84FFCFBCB0930D9\CM_C_WAgent = "ProductFeature" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\34CAC2D408B29E64D84FFCFBCB0930D9\ProductFeature msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34CAC2D408B29E64D84FFCFBCB0930D9\Version = "51838989" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34CAC2D408B29E64D84FFCFBCB0930D9\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34CAC2D408B29E64D84FFCFBCB0930D9\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34CAC2D408B29E64D84FFCFBCB0930D9\ProductIcon = "C:\\Windows\\Installer\\{4D2CAC43-2B80-46E9-8DF4-CFBFBC90039D}\\ProductIcon.ico" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34CAC2D408B29E64D84FFCFBCB0930D9\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\CD82034C7BF8A014FAACB9E7D2223859 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\34CAC2D408B29E64D84FFCFBCB0930D9 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34CAC2D408B29E64D84FFCFBCB0930D9 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34CAC2D408B29E64D84FFCFBCB0930D9\ProductName = "Netsweeper Workstation Agent" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\CD82034C7BF8A014FAACB9E7D2223859\34CAC2D408B29E64D84FFCFBCB0930D9 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34CAC2D408B29E64D84FFCFBCB0930D9\SourceList\PackageName = "Broadband4 Workstation Agent 3.23.13.13 - 850_3124.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34CAC2D408B29E64D84FFCFBCB0930D9\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34CAC2D408B29E64D84FFCFBCB0930D9\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34CAC2D408B29E64D84FFCFBCB0930D9\PackageCode = "40C6AE0483584624EB88E5E90F57CB91" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34CAC2D408B29E64D84FFCFBCB0930D9\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34CAC2D408B29E64D84FFCFBCB0930D9\SourceList\Media\1 = ";" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34CAC2D408B29E64D84FFCFBCB0930D9\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34CAC2D408B29E64D84FFCFBCB0930D9\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1888 MsiExec.exe 1888 MsiExec.exe 3752 MsiExec.exe 3752 MsiExec.exe 4860 WAgent.exe 4860 WAgent.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5044 msiexec.exe Token: SeIncreaseQuotaPrivilege 5044 msiexec.exe Token: SeSecurityPrivilege 4520 msiexec.exe Token: SeCreateTokenPrivilege 5044 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5044 msiexec.exe Token: SeLockMemoryPrivilege 5044 msiexec.exe Token: SeIncreaseQuotaPrivilege 5044 msiexec.exe Token: SeMachineAccountPrivilege 5044 msiexec.exe Token: SeTcbPrivilege 5044 msiexec.exe Token: SeSecurityPrivilege 5044 msiexec.exe Token: SeTakeOwnershipPrivilege 5044 msiexec.exe Token: SeLoadDriverPrivilege 5044 msiexec.exe Token: SeSystemProfilePrivilege 5044 msiexec.exe Token: SeSystemtimePrivilege 5044 msiexec.exe Token: SeProfSingleProcessPrivilege 5044 msiexec.exe Token: SeIncBasePriorityPrivilege 5044 msiexec.exe Token: SeCreatePagefilePrivilege 5044 msiexec.exe Token: SeCreatePermanentPrivilege 5044 msiexec.exe Token: SeBackupPrivilege 5044 msiexec.exe Token: SeRestorePrivilege 5044 msiexec.exe Token: SeShutdownPrivilege 5044 msiexec.exe Token: SeDebugPrivilege 5044 msiexec.exe Token: SeAuditPrivilege 5044 msiexec.exe Token: SeSystemEnvironmentPrivilege 5044 msiexec.exe Token: SeChangeNotifyPrivilege 5044 msiexec.exe Token: SeRemoteShutdownPrivilege 5044 msiexec.exe Token: SeUndockPrivilege 5044 msiexec.exe Token: SeSyncAgentPrivilege 5044 msiexec.exe Token: SeEnableDelegationPrivilege 5044 msiexec.exe Token: SeManageVolumePrivilege 5044 msiexec.exe Token: SeImpersonatePrivilege 5044 msiexec.exe Token: SeCreateGlobalPrivilege 5044 msiexec.exe Token: SeBackupPrivilege 516 vssvc.exe Token: SeRestorePrivilege 516 vssvc.exe Token: SeAuditPrivilege 516 vssvc.exe Token: SeBackupPrivilege 4520 msiexec.exe Token: SeRestorePrivilege 4520 msiexec.exe Token: SeRestorePrivilege 4520 msiexec.exe Token: SeTakeOwnershipPrivilege 4520 msiexec.exe Token: SeRestorePrivilege 4520 msiexec.exe Token: SeTakeOwnershipPrivilege 4520 msiexec.exe Token: SeRestorePrivilege 4520 msiexec.exe Token: SeTakeOwnershipPrivilege 4520 msiexec.exe Token: SeRestorePrivilege 4520 msiexec.exe Token: SeTakeOwnershipPrivilege 4520 msiexec.exe Token: SeRestorePrivilege 4520 msiexec.exe Token: SeTakeOwnershipPrivilege 4520 msiexec.exe Token: SeRestorePrivilege 4520 msiexec.exe Token: SeTakeOwnershipPrivilege 4520 msiexec.exe Token: SeRestorePrivilege 4520 msiexec.exe Token: SeTakeOwnershipPrivilege 4520 msiexec.exe Token: SeShutdownPrivilege 3752 MsiExec.exe Token: SeRestorePrivilege 4520 msiexec.exe Token: SeTakeOwnershipPrivilege 4520 msiexec.exe Token: SeRestorePrivilege 4520 msiexec.exe Token: SeTakeOwnershipPrivilege 4520 msiexec.exe Token: SeRestorePrivilege 4520 msiexec.exe Token: SeTakeOwnershipPrivilege 4520 msiexec.exe Token: SeRestorePrivilege 4520 msiexec.exe Token: SeTakeOwnershipPrivilege 4520 msiexec.exe Token: SeRestorePrivilege 4520 msiexec.exe Token: SeTakeOwnershipPrivilege 4520 msiexec.exe Token: SeRestorePrivilege 4520 msiexec.exe Token: SeTakeOwnershipPrivilege 4520 msiexec.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 5044 msiexec.exe 1012 WAgent.exe 5044 msiexec.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe 1012 WAgent.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1012 WAgent.exe 1012 WAgent.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 4520 wrote to memory of 3044 4520 msiexec.exe 79 PID 4520 wrote to memory of 3044 4520 msiexec.exe 79 PID 4520 wrote to memory of 1888 4520 msiexec.exe 81 PID 4520 wrote to memory of 1888 4520 msiexec.exe 81 PID 4520 wrote to memory of 1888 4520 msiexec.exe 81 PID 4520 wrote to memory of 3752 4520 msiexec.exe 82 PID 4520 wrote to memory of 3752 4520 msiexec.exe 82 PID 4520 wrote to memory of 3752 4520 msiexec.exe 82 PID 3752 wrote to memory of 4140 3752 MsiExec.exe 83 PID 3752 wrote to memory of 4140 3752 MsiExec.exe 83 PID 3752 wrote to memory of 4140 3752 MsiExec.exe 83 PID 3752 wrote to memory of 528 3752 MsiExec.exe 85 PID 3752 wrote to memory of 528 3752 MsiExec.exe 85 PID 3752 wrote to memory of 528 3752 MsiExec.exe 85 PID 4860 wrote to memory of 1012 4860 WAgent.exe 89 PID 4860 wrote to memory of 1012 4860 WAgent.exe 89 PID 4860 wrote to memory of 1012 4860 WAgent.exe 89 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\Broadband4 Workstation Agent 3.23.13.13 - 850_3124.msi"1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5044
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:3044
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F8807C7460B15C5EB6B77B43F381C0092⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1888
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 22C4A00E450985066105E02B86BCB2B9 E Global\MSI00002⤵
- Drops file in Windows directory
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Windows\syswow64\sc.exe"sc.exe" config wagent start= auto3⤵
- Launches sc.exe
PID:4140
-
-
C:\Windows\syswow64\sc.exe"sc.exe" start wagent3⤵
- Launches sc.exe
PID:528
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:516
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s Netman1⤵PID:1540
-
C:\Program Files (x86)\Netsweeper WorkStation Agent\WAgent.exe"C:\Program Files (x86)\Netsweeper WorkStation Agent\WAgent.exe" -S -w nsw-user-auth-win-3-23-13.broadband4.co.uk -g f3f1247d3986ab1c0db2e04ed8dcd85c -L 0861e0489a298d8c3b60a115376439dc -t 1800 -i -l -v -F -a -A -s BB4_ -D 850_31241⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Program Files (x86)\Netsweeper WorkStation Agent\WAgent.exe"C:\Program Files (x86)\Netsweeper WorkStation Agent\WAgent.exe" -w nsw-user-auth-win-3-23-13.broadband4.co.uk -g f3f1247d3986ab1c0db2e04ed8dcd85c -L 0861e0489a298d8c3b60a115376439dc -t 1800 -i -l -v -F -a -A -s BB4_ -D 850_31242⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1012
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
189KB
MD5456e6de450dda91e6689811ee76b6463
SHA152e86248c6d17ba7b277a259e7a667fa0ed73552
SHA256eb400e5f0be4ebebde0a4f9bb5bb7a81ba715415b09131796861d31668181f49
SHA5121e838355f60056e858df95943c6cc251c0fd2a92e22daa647f62aca38530e0015599db87c90f7b035d2037adeb59beff2619379b96f7d8bd26ad13a5542dac4c
-
Filesize
6.6MB
MD58c6a80e02dd88f70e58d89a4891782a5
SHA1a51f91764883d9db6c66021e766476e24fa93d36
SHA2563275792298097a5332447e9f342637de7d856bee34926b1182aa26307bc1bea8
SHA51250f879d480c64db5da402940e93eb69a4bcbd9b568067c7e68c409fab396e648a01562dc5288a5879b5dc961c67014eefa3b7f2bcf5fae50fcc1dcbf81d72b53
-
Filesize
834B
MD5a0af4d81b2b19a99a3d01be89d5f99d9
SHA14725c1a810005f860ede9dace7f1e5a20e5230d6
SHA256de9f05ceb1610cf9964f0def09d525005569602993c82a647743f192e9414d4a
SHA512eb98d475d51d07b929d92fe5aa00bfa21078f567906f3650eb3bebfff39c616a21918da8f0687853310acebdb160d4f65451204619a7b8085fbbc25491bb0554
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE
Filesize5B
MD55bfa51f3a417b98e7443eca90fc94703
SHA18c015d80b8a23f780bdd215dc842b0f5551f63bd
SHA256bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
SHA5124cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EA618097E393409AFA316F0F87E2C202_BF30C13052A27490F85D7F6C00189188
Filesize1KB
MD54c57191c9667009598b4fb8bc4ce1bfb
SHA10c348755947ae8ef07e9db6c186fdbe40e813d24
SHA256007d8ccb5ee3001832e284c963403e0123c8f7e73a809bef8cc521d0b9bc7d63
SHA512fc744c437e185ded7218d8f8c9fefdf5f821d7d5fc6f007397f12f0475acca2ab853239477b3e994a50e97322ec12a7cf4da092fdedee34557282080458cb80e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\40C68D5626484A90937F0752C8B950AB
Filesize180B
MD53fcb0f68b73c86c69d3f28c7f6170d0f
SHA1d6dc22b20044323784e3b6acd0c10c10d8c47ec8
SHA256542556b662e8de3ad75855cd1d615d5051397125e19cb6fe3b5b18424414da20
SHA512dc35cbfc48ebb7954db0d8f81c41026fddf5b7b62a352c90ae70bfea1600efd3873c409e34215805315b26aba08fb01cf3a88039dbcbe6dd12d605b03e4ff846
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE
Filesize398B
MD58aa4fa37875fd347a62f35b11c3a35ca
SHA15b24788a0d7ad17870a2539eb48d11c18501756e
SHA256a4002295ce33382bdcfe1d87b11b356953097be4a13d589f98b9fe9f8caf00b6
SHA51266f5fc015eea5e14312ee6f9cc7458279060fbf4586bd89d6344e0230e94680d6b3525e243d014be26ef7d3e41258a3b6353f4324fbe04621d21cf84c2fe72be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EA618097E393409AFA316F0F87E2C202_BF30C13052A27490F85D7F6C00189188
Filesize406B
MD5ef90f3c6bcbe61ee6c3a31d40bdffd30
SHA1dd9a1e752570e2b2deead346b58ea50c748fde7b
SHA2560cf737613fb6d21eabe909ea7b48a4a5c37d94dc06e0c52053e6dea8121fe52b
SHA512f190979dd1833ea7c2aa0c2aada1b5e00f9860e2c5323c879333bda1c33bdccb1e44f48db96581946d11eb5a00ac8943e79ab6caf039fcd6cf850f98a1cb95ac
-
Filesize
181KB
MD5b1298b75b1c09fdbb3906aeec500f066
SHA1d84b4fe247a47ea7649f75e88791d34a60454f2e
SHA256826289b33e9046fd86c559ac3c888129451534bfb2f31fa264d0c62760e0e35e
SHA5122359518d0c5a19123b3491143d20f453e09d973323863b51b917434a5989790f0aad47ac41fb142ab5aceed973ad924392f7efa7244a17d2374d262cc2b8fac5
-
Filesize
3.0MB
MD5a1795b41cf04bc3c549896a40cd116f9
SHA140268e1facb97e9ae542e9beae0db8b644a1d537
SHA256c533e6eb9fef83338af394ef5043870ce8319b6eaa5e9799dcf62e2692354690
SHA512ff1d62c1dd0bdc0cf18e0a3f03f12e6971c951e327be24bf81f0efc87c061c6b58958493584092456f52e80ad25e4caf7c5fbab7915116df95384edc305203fd
-
Filesize
26.0MB
MD545399ed46670673c596905e1fc89cd71
SHA1a414cc0d8d5195feb2efbc4f294f9afabae1a6f9
SHA2569d8f5a19c873913a90f4097d76a2b4fc28038ac037c4659b63c360d2db5c5af4
SHA512eb529c4e54c058c8a0cd7c8d2ce2ac3fce1d674103d8563f9a7c75e3c210ebe5e621ed746956c7d4e387d176906eca6651cfdffcac9a63a5cf764d5baf3df4f3
-
\??\Volume{38fc2686-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{5fff566c-b639-4fc7-81a7-90f9934de789}_OnDiskSnapshotProp
Filesize5KB
MD5d7185262c9bf923cc040af5561634c32
SHA15ac9847166fac371a2bca76aafb4dae1e188236b
SHA2569d0281c0422e0326394eebb0ed79149ac98197c76028ccf188d651c622a8fda6
SHA5126675658554dea3e393791f401700ca661942b8a27aa1253e8bc94716ed4af025c5339d112ed841a8ee6e42b0c4f3f311d5895ffae249e320b02a8edf997af7cf