Analysis
-
max time kernel
1801s -
max time network
1802s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28-06-2024 11:10
Static task
static1
Behavioral task
behavioral1
Sample
Broadband4 Workstation Agent 3.23.13.13 - 850_3124.msi
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral2
Sample
Broadband4 Workstation Agent 3.23.13.13 - 850_3124.msi
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral3
Sample
Broadband4 Workstation Agent 3.23.13.13 - 850_3124.msi
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
Broadband4 Workstation Agent 3.23.13.13 - 850_3124.msi
Resource
win11-20240611-en
windows11-21h2-x64
General
-
Target
Broadband4 Workstation Agent 3.23.13.13 - 850_3124.msi
-
Size
3.0MB
-
MD5
a1795b41cf04bc3c549896a40cd116f9
-
SHA1
40268e1facb97e9ae542e9beae0db8b644a1d537
-
SHA256
c533e6eb9fef83338af394ef5043870ce8319b6eaa5e9799dcf62e2692354690
-
SHA512
ff1d62c1dd0bdc0cf18e0a3f03f12e6971c951e327be24bf81f0efc87c061c6b58958493584092456f52e80ad25e4caf7c5fbab7915116df95384edc305203fd
-
SSDEEP
98304:RK4U6cziwzeb4RrOQJj2OucY5rpm6JcIUH4FIu4FdE:RwdziwaburOQJj2OU7UYFI5LE
Malware Config
Signatures
-
Blocklisted process makes network request 4 IoCs
flow pid Process 2 4268 msiexec.exe 4 4268 msiexec.exe 8 4268 msiexec.exe 11 4268 msiexec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\H: msiexec.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\Netsweeper WorkStation Agent\WAgent.exe msiexec.exe -
Drops file in Windows directory 18 IoCs
description ioc Process File created C:\Windows\Installer\e596f98.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI9776.tmp msiexec.exe File created C:\Windows\Installer\e596f9a.msi msiexec.exe File created C:\Windows\Installer\{4D2CAC43-2B80-46E9-8DF4-CFBFBC90039D}\ProductIcon.ico msiexec.exe File opened for modification C:\Windows\Installer\MSIA5C3.tmp msiexec.exe File opened for modification C:\Windows\Installer\e596f98.msi msiexec.exe File created C:\Windows\Installer\SourceHash{4D2CAC43-2B80-46E9-8DF4-CFBFBC90039D} msiexec.exe File opened for modification C:\Windows\Installer\MSI8B6E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9871.tmp msiexec.exe File created C:\Windows\Installer\wix{4D2CAC43-2B80-46E9-8DF4-CFBFBC90039D}.SchedServiceConfig.rmi MsiExec.exe File opened for modification C:\Windows\Installer\MSI99F8.tmp msiexec.exe File opened for modification C:\Windows\Installer\{4D2CAC43-2B80-46E9-8DF4-CFBFBC90039D}\ProductIcon.ico msiexec.exe File opened for modification C:\Windows\Installer\MSI9BFE.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI8B3F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9AE4.tmp msiexec.exe -
Executes dropped EXE 2 IoCs
pid Process 1860 WAgent.exe 4696 WAgent.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4376 sc.exe 2164 sc.exe -
Loads dropped DLL 7 IoCs
pid Process 620 MsiExec.exe 620 MsiExec.exe 944 MsiExec.exe 944 MsiExec.exe 944 MsiExec.exe 944 MsiExec.exe 620 MsiExec.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000064efbbd21686319b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000064efbbd20000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090064efbbd2000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d64efbbd2000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000064efbbd200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\22\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23 msiexec.exe -
Modifies registry class 24 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34CAC2D408B29E64D84FFCFBCB0930D9\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34CAC2D408B29E64D84FFCFBCB0930D9\DeploymentFlags = "3" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34CAC2D408B29E64D84FFCFBCB0930D9\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34CAC2D408B29E64D84FFCFBCB0930D9\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\34CAC2D408B29E64D84FFCFBCB0930D9 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34CAC2D408B29E64D84FFCFBCB0930D9\ProductIcon = "C:\\Windows\\Installer\\{4D2CAC43-2B80-46E9-8DF4-CFBFBC90039D}\\ProductIcon.ico" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\CD82034C7BF8A014FAACB9E7D2223859\34CAC2D408B29E64D84FFCFBCB0930D9 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34CAC2D408B29E64D84FFCFBCB0930D9\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\34CAC2D408B29E64D84FFCFBCB0930D9\CM_C_WAgent = "ProductFeature" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34CAC2D408B29E64D84FFCFBCB0930D9\AuthorizedLUAApp = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34CAC2D408B29E64D84FFCFBCB0930D9\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34CAC2D408B29E64D84FFCFBCB0930D9\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34CAC2D408B29E64D84FFCFBCB0930D9\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34CAC2D408B29E64D84FFCFBCB0930D9\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34CAC2D408B29E64D84FFCFBCB0930D9\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34CAC2D408B29E64D84FFCFBCB0930D9 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34CAC2D408B29E64D84FFCFBCB0930D9\ProductName = "Netsweeper Workstation Agent" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34CAC2D408B29E64D84FFCFBCB0930D9\Version = "51838989" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\CD82034C7BF8A014FAACB9E7D2223859 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34CAC2D408B29E64D84FFCFBCB0930D9\SourceList\PackageName = "Broadband4 Workstation Agent 3.23.13.13 - 850_3124.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34CAC2D408B29E64D84FFCFBCB0930D9\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34CAC2D408B29E64D84FFCFBCB0930D9\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\34CAC2D408B29E64D84FFCFBCB0930D9\ProductFeature msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34CAC2D408B29E64D84FFCFBCB0930D9\PackageCode = "40C6AE0483584624EB88E5E90F57CB91" msiexec.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 620 MsiExec.exe 620 MsiExec.exe 944 MsiExec.exe 944 MsiExec.exe 1860 WAgent.exe 1860 WAgent.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4268 msiexec.exe Token: SeIncreaseQuotaPrivilege 4268 msiexec.exe Token: SeSecurityPrivilege 1988 msiexec.exe Token: SeCreateTokenPrivilege 4268 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4268 msiexec.exe Token: SeLockMemoryPrivilege 4268 msiexec.exe Token: SeIncreaseQuotaPrivilege 4268 msiexec.exe Token: SeMachineAccountPrivilege 4268 msiexec.exe Token: SeTcbPrivilege 4268 msiexec.exe Token: SeSecurityPrivilege 4268 msiexec.exe Token: SeTakeOwnershipPrivilege 4268 msiexec.exe Token: SeLoadDriverPrivilege 4268 msiexec.exe Token: SeSystemProfilePrivilege 4268 msiexec.exe Token: SeSystemtimePrivilege 4268 msiexec.exe Token: SeProfSingleProcessPrivilege 4268 msiexec.exe Token: SeIncBasePriorityPrivilege 4268 msiexec.exe Token: SeCreatePagefilePrivilege 4268 msiexec.exe Token: SeCreatePermanentPrivilege 4268 msiexec.exe Token: SeBackupPrivilege 4268 msiexec.exe Token: SeRestorePrivilege 4268 msiexec.exe Token: SeShutdownPrivilege 4268 msiexec.exe Token: SeDebugPrivilege 4268 msiexec.exe Token: SeAuditPrivilege 4268 msiexec.exe Token: SeSystemEnvironmentPrivilege 4268 msiexec.exe Token: SeChangeNotifyPrivilege 4268 msiexec.exe Token: SeRemoteShutdownPrivilege 4268 msiexec.exe Token: SeUndockPrivilege 4268 msiexec.exe Token: SeSyncAgentPrivilege 4268 msiexec.exe Token: SeEnableDelegationPrivilege 4268 msiexec.exe Token: SeManageVolumePrivilege 4268 msiexec.exe Token: SeImpersonatePrivilege 4268 msiexec.exe Token: SeCreateGlobalPrivilege 4268 msiexec.exe Token: SeBackupPrivilege 5000 vssvc.exe Token: SeRestorePrivilege 5000 vssvc.exe Token: SeAuditPrivilege 5000 vssvc.exe Token: SeBackupPrivilege 1988 msiexec.exe Token: SeRestorePrivilege 1988 msiexec.exe Token: SeRestorePrivilege 1988 msiexec.exe Token: SeTakeOwnershipPrivilege 1988 msiexec.exe Token: SeRestorePrivilege 1988 msiexec.exe Token: SeTakeOwnershipPrivilege 1988 msiexec.exe Token: SeRestorePrivilege 1988 msiexec.exe Token: SeTakeOwnershipPrivilege 1988 msiexec.exe Token: SeRestorePrivilege 1988 msiexec.exe Token: SeTakeOwnershipPrivilege 1988 msiexec.exe Token: SeRestorePrivilege 1988 msiexec.exe Token: SeTakeOwnershipPrivilege 1988 msiexec.exe Token: SeRestorePrivilege 1988 msiexec.exe Token: SeTakeOwnershipPrivilege 1988 msiexec.exe Token: SeShutdownPrivilege 944 MsiExec.exe Token: SeRestorePrivilege 1988 msiexec.exe Token: SeTakeOwnershipPrivilege 1988 msiexec.exe Token: SeRestorePrivilege 1988 msiexec.exe Token: SeTakeOwnershipPrivilege 1988 msiexec.exe Token: SeRestorePrivilege 1988 msiexec.exe Token: SeTakeOwnershipPrivilege 1988 msiexec.exe Token: SeRestorePrivilege 1988 msiexec.exe Token: SeTakeOwnershipPrivilege 1988 msiexec.exe Token: SeRestorePrivilege 1988 msiexec.exe Token: SeTakeOwnershipPrivilege 1988 msiexec.exe Token: SeRestorePrivilege 1988 msiexec.exe Token: SeTakeOwnershipPrivilege 1988 msiexec.exe Token: SeRestorePrivilege 1988 msiexec.exe Token: SeTakeOwnershipPrivilege 1988 msiexec.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4268 msiexec.exe 4268 msiexec.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe 4696 WAgent.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4696 WAgent.exe 4696 WAgent.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1988 wrote to memory of 5076 1988 msiexec.exe 105 PID 1988 wrote to memory of 5076 1988 msiexec.exe 105 PID 1988 wrote to memory of 620 1988 msiexec.exe 107 PID 1988 wrote to memory of 620 1988 msiexec.exe 107 PID 1988 wrote to memory of 620 1988 msiexec.exe 107 PID 1988 wrote to memory of 944 1988 msiexec.exe 108 PID 1988 wrote to memory of 944 1988 msiexec.exe 108 PID 1988 wrote to memory of 944 1988 msiexec.exe 108 PID 944 wrote to memory of 4376 944 MsiExec.exe 109 PID 944 wrote to memory of 4376 944 MsiExec.exe 109 PID 944 wrote to memory of 4376 944 MsiExec.exe 109 PID 944 wrote to memory of 2164 944 MsiExec.exe 111 PID 944 wrote to memory of 2164 944 MsiExec.exe 111 PID 944 wrote to memory of 2164 944 MsiExec.exe 111 PID 1860 wrote to memory of 4696 1860 WAgent.exe 115 PID 1860 wrote to memory of 4696 1860 WAgent.exe 115 PID 1860 wrote to memory of 4696 1860 WAgent.exe 115 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\Broadband4 Workstation Agent 3.23.13.13 - 850_3124.msi"1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4268
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:5076
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 7579AAF8C21794B530BF16C80AF3193F2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:620
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C7541F91F234EDA50336ED6A5E7C0660 E Global\MSI00002⤵
- Drops file in Windows directory
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Windows\SysWOW64\sc.exe"sc.exe" config wagent start= auto3⤵
- Launches sc.exe
PID:4376
-
-
C:\Windows\SysWOW64\sc.exe"sc.exe" start wagent3⤵
- Launches sc.exe
PID:2164
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5000
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1420 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:81⤵PID:4472
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman1⤵PID:4352
-
C:\Program Files (x86)\Netsweeper WorkStation Agent\WAgent.exe"C:\Program Files (x86)\Netsweeper WorkStation Agent\WAgent.exe" -S -w nsw-user-auth-win-3-23-13.broadband4.co.uk -g f3f1247d3986ab1c0db2e04ed8dcd85c -L 0861e0489a298d8c3b60a115376439dc -t 1800 -i -l -v -F -a -A -s BB4_ -D 850_31241⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Program Files (x86)\Netsweeper WorkStation Agent\WAgent.exe"C:\Program Files (x86)\Netsweeper WorkStation Agent\WAgent.exe" -w nsw-user-auth-win-3-23-13.broadband4.co.uk -g f3f1247d3986ab1c0db2e04ed8dcd85c -L 0861e0489a298d8c3b60a115376439dc -t 1800 -i -l -v -F -a -A -s BB4_ -D 850_31242⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5012 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:81⤵PID:4904
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
189KB
MD53bbcb4cde86fd0710d40310bbde2ca94
SHA1d49eec0fe4434f29bc12e28093c531fdba9b9824
SHA256edff485bae3405f8bd94cfc0b666a1ef1b1eeb05d0dc4841eba9ae76c76c1059
SHA5121cd7648168be652dd01c08d9b63ce07e9a78d4ea66335e67e5f324d6dde11576b73e2a1bb62678600d08c046de276fde78ccb5c3f620a80953941e6765d2c186
-
Filesize
6.6MB
MD58c6a80e02dd88f70e58d89a4891782a5
SHA1a51f91764883d9db6c66021e766476e24fa93d36
SHA2563275792298097a5332447e9f342637de7d856bee34926b1182aa26307bc1bea8
SHA51250f879d480c64db5da402940e93eb69a4bcbd9b568067c7e68c409fab396e648a01562dc5288a5879b5dc961c67014eefa3b7f2bcf5fae50fcc1dcbf81d72b53
-
Filesize
834B
MD5a0af4d81b2b19a99a3d01be89d5f99d9
SHA14725c1a810005f860ede9dace7f1e5a20e5230d6
SHA256de9f05ceb1610cf9964f0def09d525005569602993c82a647743f192e9414d4a
SHA512eb98d475d51d07b929d92fe5aa00bfa21078f567906f3650eb3bebfff39c616a21918da8f0687853310acebdb160d4f65451204619a7b8085fbbc25491bb0554
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE
Filesize5B
MD55bfa51f3a417b98e7443eca90fc94703
SHA18c015d80b8a23f780bdd215dc842b0f5551f63bd
SHA256bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
SHA5124cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EA618097E393409AFA316F0F87E2C202_BF30C13052A27490F85D7F6C00189188
Filesize1KB
MD54c57191c9667009598b4fb8bc4ce1bfb
SHA10c348755947ae8ef07e9db6c186fdbe40e813d24
SHA256007d8ccb5ee3001832e284c963403e0123c8f7e73a809bef8cc521d0b9bc7d63
SHA512fc744c437e185ded7218d8f8c9fefdf5f821d7d5fc6f007397f12f0475acca2ab853239477b3e994a50e97322ec12a7cf4da092fdedee34557282080458cb80e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\40C68D5626484A90937F0752C8B950AB
Filesize180B
MD5beeb91338a992799ce43ec91a1c01321
SHA149aa44d47060443119655e0509146f38fe2aa29e
SHA25683966089fc9c178c889f13bb701a6972576bf5ac06271b23bf038b82eaf39676
SHA5127071c7dab5f2527d8654e06f47c8aec94f205971319c4ef38e872f24fef33309f1794d25909fed693c4e64e54246700d52141d8812c3558be3a98e23a788d2c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE
Filesize398B
MD5de92949c32cbc85d8b320f5a20432cf8
SHA165c6bd4d49b9705142052df354ea5061624a7ff4
SHA256dce9e07265055301c11c913252b9177047bce2b3a3f1a2a14756e242b042dca5
SHA5125a07ddcf2fe7508788461cf9e8e776c923966369ce268f82160a3f490555ab6a7181215134cc838cf4dfadb5bae5cb22e4655f88253024366a0fb4fb25376b93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EA618097E393409AFA316F0F87E2C202_BF30C13052A27490F85D7F6C00189188
Filesize406B
MD501bd0524c0ed8997028c7cda7be7ffe9
SHA1dd6bc55d7145407f9401fabe3de94d5c2c81a896
SHA256779dee3bddf5825dfdea996c0e9748c4aea0cd69e1b9e2ec0c5f3aa7aa023f44
SHA5127bd20f4fb7f68fbd89c97d369de51fdaa3dc91ca436b137c9d71ea3b910d07baefd95f27b1cfc44c08ea50278541a811217db28cd549b461f240dec29028f557
-
Filesize
181KB
MD5b1298b75b1c09fdbb3906aeec500f066
SHA1d84b4fe247a47ea7649f75e88791d34a60454f2e
SHA256826289b33e9046fd86c559ac3c888129451534bfb2f31fa264d0c62760e0e35e
SHA5122359518d0c5a19123b3491143d20f453e09d973323863b51b917434a5989790f0aad47ac41fb142ab5aceed973ad924392f7efa7244a17d2374d262cc2b8fac5
-
Filesize
3.0MB
MD5a1795b41cf04bc3c549896a40cd116f9
SHA140268e1facb97e9ae542e9beae0db8b644a1d537
SHA256c533e6eb9fef83338af394ef5043870ce8319b6eaa5e9799dcf62e2692354690
SHA512ff1d62c1dd0bdc0cf18e0a3f03f12e6971c951e327be24bf81f0efc87c061c6b58958493584092456f52e80ad25e4caf7c5fbab7915116df95384edc305203fd
-
Filesize
23.7MB
MD5170b2ccdd74a3b46729ee416fb9bb658
SHA114deaa3e8e1280bb8242b7fc1fd0c23904638527
SHA256861d678db884c91d64f07524f726eb28a2acc2701d748fa5c8013c9afe3ae5fb
SHA512032a5b4f8d762c2a1556353553ad874ee881b802274d7139a1ae3532046daeb68233e5bc1ab9d97245c45014946b0a3a3e32b58b5aaa9a63857ba5e18ce2b0fd
-
\??\Volume{d2bbef64-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{1d8b3476-df7b-4e6e-ac11-9380e921631a}_OnDiskSnapshotProp
Filesize6KB
MD5b87d81b57a30a1e2472c637a15e28e1d
SHA1e0e7192898901d14c6c7951c6307ba4c932404a3
SHA256c752516c94af3f31ce3e9967ad47c8862ec915c983615243ed6539e80e19f795
SHA512974250e92c3780367cf53e49da7f34ebd53af75f5a999b028321a372ab15fce7806654c57bf98a0cea420e811de62d6453463c1e8964d63bce5217a717cec4bd