8cd497dc93e83d4640c2a152fd30bc528a3fdd892de886ac2bfa2750f4f911a8

Analysis

max time kernel
147s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/08/2024, 16:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1.msi
Size 9.1MB
Sample240803-tjwpessgmb
SHA256 8cd497dc93e83d4640c2a152fd30bc528a3fdd892de886ac2bfa2750f4f911a8
MD5 019034b28776bcec36d8b272c0355a24
SHA1 076b56e4f271ec2fcd26d037cc7d7d0ba953a955
SHA512 93fd5ac6db969c684a939a78657746f6a5333dec1dc9a8be3eef4c85f8a47774bdac8fc48c6e2f658de44f85d4cc8af6ac772542299d9da132a67847ecb2ad1e
SSDEEP 49152:g1oYOtB7WHgVI0g6Tbrz5io+HGGWxyzilrXVVdWyAf1V7RWypBqZdQwOh+yH/mUF:gqYe7W9GGWBl9ArydQwKHj
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

microsoft discovery execution persistence phishing privilege_escalation

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
2	3080	msiexec.exe
26	764	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\carpostome.exe = "C:\\anterevolutionary\\carpostome.exe"	carpostome.exe

Downloads MZ/PE file

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	MSIAFEA.tmp

Detected potential entity reuse from brand microsoft.
phishing microsoft

Drops file in Windows directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e57adc4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAF5B.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB1C3.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAFEA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAFFB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6DA.tmp	msiexec.exe
File created	C:\Windows\Installer\e57adc4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAFAB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB098.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB0E7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6AA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAE51.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A2ABBCAB-0F4F-4507-B988-05087A0B1226}	msiexec.exe

Executes dropped EXE 2 IoCs

pid	Process
1120	MSIAFEA.tmp
388	carpostome.exe

Loads dropped DLL 9 IoCs

pid	Process
1376	MsiExec.exe
1376	MsiExec.exe
1376	MsiExec.exe
1376	MsiExec.exe
1376	MsiExec.exe
1376	MsiExec.exe
388	carpostome.exe
1376	MsiExec.exe
1376	MsiExec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
764	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3080	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIAFEA.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	carpostome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 53 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "982644193"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.microsoft.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "982644193"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001bc9387f4f791b45af7c7e57591307f1000000000200000000001066000000010000200000004f18898a4a6c31f7625545dd37504c0f4c0bc35be939a077668ae189e90279e0000000000e8000000002000020000000bbe1b734937a333c23ab90ba5e20292183c990f7801764c571a72dd2f4ae2b78200000001c16e9247e4c7bb4da17c36804707608602b786cba18936086b4f11064eec31a4000000006f90d482dee7d6fe968000ceb9df750265c8aa61651a1d2c801c1cad4896f54fc2dc9f90a998027807e09ddd9f3b6e503bea87ebd4d1c0a79b8b91e0033145e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31122879"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "984832025"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\microsoft.com\Total = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Internet Explorer\DOMStorage\microsoft.com	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001bc9387f4f791b45af7c7e57591307f100000000020000000000106600000001000020000000690f2eabf3fc4f6f79df202d8aec378ae18dc4bf6fbcc8e391cedb913966028d000000000e80000000020000200000009eef8e9a754d4f51d0bd0a97cdc7198786a3c4d3e0d11f633a6de2c0332eeb2d20000000e25b2df532471738a3b5cc75187746fc86c42e77c6b6c5080be437fc652ba2fc40000000bb8def820029722d217b5235f04e20cfff842f330e19fed846dd86132ea84e6280561659ba53d4414eeb78b8ff988cecd5cbb60cfb63a5491b0821308b2967a7	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5070ef3cbfe5da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{66397C8A-51B2-11EF-BB4F-D2EB330F3545} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\microsoft.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429466187"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "124"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.microsoft.com\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.microsoft.com\ = "124"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\microsoft.com\Total = "124"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6044e83cbfe5da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31122879"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31122879"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c00000000000000010000000083ffff0083ffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\microsoft.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
4224	msiexec.exe
4224	msiexec.exe
3888	msedge.exe
3888	msedge.exe
2388	msedge.exe
2388	msedge.exe
764	powershell.exe
764	powershell.exe
764	powershell.exe
2352	identity_helper.exe
2352	identity_helper.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe

Suspicious use of AdjustPrivilegeToken 59 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3080	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3080	msiexec.exe
Token: SeSecurityPrivilege	4224	msiexec.exe
Token: SeCreateTokenPrivilege	3080	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3080	msiexec.exe
Token: SeLockMemoryPrivilege	3080	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3080	msiexec.exe
Token: SeMachineAccountPrivilege	3080	msiexec.exe
Token: SeTcbPrivilege	3080	msiexec.exe
Token: SeSecurityPrivilege	3080	msiexec.exe
Token: SeTakeOwnershipPrivilege	3080	msiexec.exe
Token: SeLoadDriverPrivilege	3080	msiexec.exe
Token: SeSystemProfilePrivilege	3080	msiexec.exe
Token: SeSystemtimePrivilege	3080	msiexec.exe
Token: SeProfSingleProcessPrivilege	3080	msiexec.exe
Token: SeIncBasePriorityPrivilege	3080	msiexec.exe
Token: SeCreatePagefilePrivilege	3080	msiexec.exe
Token: SeCreatePermanentPrivilege	3080	msiexec.exe
Token: SeBackupPrivilege	3080	msiexec.exe
Token: SeRestorePrivilege	3080	msiexec.exe
Token: SeShutdownPrivilege	3080	msiexec.exe
Token: SeDebugPrivilege	3080	msiexec.exe
Token: SeAuditPrivilege	3080	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3080	msiexec.exe
Token: SeChangeNotifyPrivilege	3080	msiexec.exe
Token: SeRemoteShutdownPrivilege	3080	msiexec.exe
Token: SeUndockPrivilege	3080	msiexec.exe
Token: SeSyncAgentPrivilege	3080	msiexec.exe
Token: SeEnableDelegationPrivilege	3080	msiexec.exe
Token: SeManageVolumePrivilege	3080	msiexec.exe
Token: SeImpersonatePrivilege	3080	msiexec.exe
Token: SeCreateGlobalPrivilege	3080	msiexec.exe
Token: SeRestorePrivilege	4224	msiexec.exe
Token: SeTakeOwnershipPrivilege	4224	msiexec.exe
Token: SeRestorePrivilege	4224	msiexec.exe
Token: SeTakeOwnershipPrivilege	4224	msiexec.exe
Token: SeRestorePrivilege	4224	msiexec.exe
Token: SeTakeOwnershipPrivilege	4224	msiexec.exe
Token: SeRestorePrivilege	4224	msiexec.exe
Token: SeTakeOwnershipPrivilege	4224	msiexec.exe
Token: SeRestorePrivilege	4224	msiexec.exe
Token: SeTakeOwnershipPrivilege	4224	msiexec.exe
Token: SeRestorePrivilege	4224	msiexec.exe
Token: SeTakeOwnershipPrivilege	4224	msiexec.exe
Token: SeRestorePrivilege	4224	msiexec.exe
Token: SeTakeOwnershipPrivilege	4224	msiexec.exe
Token: SeRestorePrivilege	4224	msiexec.exe
Token: SeTakeOwnershipPrivilege	4224	msiexec.exe
Token: SeRestorePrivilege	4224	msiexec.exe
Token: SeTakeOwnershipPrivilege	4224	msiexec.exe
Token: SeDebugPrivilege	764	powershell.exe
Token: SeRestorePrivilege	4224	msiexec.exe
Token: SeTakeOwnershipPrivilege	4224	msiexec.exe
Token: SeRestorePrivilege	4224	msiexec.exe
Token: SeTakeOwnershipPrivilege	4224	msiexec.exe
Token: SeRestorePrivilege	4224	msiexec.exe
Token: SeTakeOwnershipPrivilege	4224	msiexec.exe
Token: SeRestorePrivilege	4224	msiexec.exe
Token: SeTakeOwnershipPrivilege	4224	msiexec.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
3080	msiexec.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
3080	msiexec.exe
1012	iexplore.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1012	iexplore.exe
1012	iexplore.exe
2356	IEXPLORE.EXE
2356	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4224 wrote to memory of 1376	4224	msiexec.exe	88
PID 4224 wrote to memory of 1376	4224	msiexec.exe	88
PID 4224 wrote to memory of 1376	4224	msiexec.exe	88
PID 4224 wrote to memory of 1120	4224	msiexec.exe	89
PID 4224 wrote to memory of 1120	4224	msiexec.exe	89
PID 4224 wrote to memory of 1120	4224	msiexec.exe	89
PID 1120 wrote to memory of 2388	1120	MSIAFEA.tmp	90
PID 1120 wrote to memory of 2388	1120	MSIAFEA.tmp	90
PID 2388 wrote to memory of 2944	2388	msedge.exe	91
PID 2388 wrote to memory of 2944	2388	msedge.exe	91
PID 1376 wrote to memory of 764	1376	MsiExec.exe	92
PID 1376 wrote to memory of 764	1376	MsiExec.exe	92
PID 1376 wrote to memory of 764	1376	MsiExec.exe	92
PID 2388 wrote to memory of 3964	2388	msedge.exe	94
PID 2388 wrote to memory of 3964	2388	msedge.exe	94
PID 2388 wrote to memory of 3964	2388	msedge.exe	94
PID 2388 wrote to memory of 3964	2388	msedge.exe	94
PID 2388 wrote to memory of 3964	2388	msedge.exe	94
PID 2388 wrote to memory of 3964	2388	msedge.exe	94
PID 2388 wrote to memory of 3964	2388	msedge.exe	94
PID 2388 wrote to memory of 3964	2388	msedge.exe	94
PID 2388 wrote to memory of 3964	2388	msedge.exe	94
PID 2388 wrote to memory of 3964	2388	msedge.exe	94
PID 2388 wrote to memory of 3964	2388	msedge.exe	94
PID 2388 wrote to memory of 3964	2388	msedge.exe	94
PID 2388 wrote to memory of 3964	2388	msedge.exe	94
PID 2388 wrote to memory of 3964	2388	msedge.exe	94
PID 2388 wrote to memory of 3964	2388	msedge.exe	94
PID 2388 wrote to memory of 3964	2388	msedge.exe	94
PID 2388 wrote to memory of 3964	2388	msedge.exe	94
PID 2388 wrote to memory of 3964	2388	msedge.exe	94
PID 2388 wrote to memory of 3964	2388	msedge.exe	94
PID 2388 wrote to memory of 3964	2388	msedge.exe	94
PID 2388 wrote to memory of 3964	2388	msedge.exe	94
PID 2388 wrote to memory of 3964	2388	msedge.exe	94
PID 2388 wrote to memory of 3964	2388	msedge.exe	94
PID 2388 wrote to memory of 3964	2388	msedge.exe	94
PID 2388 wrote to memory of 3964	2388	msedge.exe	94
PID 2388 wrote to memory of 3964	2388	msedge.exe	94
PID 2388 wrote to memory of 3964	2388	msedge.exe	94
PID 2388 wrote to memory of 3964	2388	msedge.exe	94
PID 2388 wrote to memory of 3964	2388	msedge.exe	94
PID 2388 wrote to memory of 3964	2388	msedge.exe	94
PID 2388 wrote to memory of 3964	2388	msedge.exe	94
PID 2388 wrote to memory of 3964	2388	msedge.exe	94
PID 2388 wrote to memory of 3964	2388	msedge.exe	94
PID 2388 wrote to memory of 3964	2388	msedge.exe	94
PID 2388 wrote to memory of 3964	2388	msedge.exe	94
PID 2388 wrote to memory of 3964	2388	msedge.exe	94
PID 2388 wrote to memory of 3964	2388	msedge.exe	94
PID 2388 wrote to memory of 3964	2388	msedge.exe	94
PID 2388 wrote to memory of 3964	2388	msedge.exe	94
PID 2388 wrote to memory of 3964	2388	msedge.exe	94
PID 2388 wrote to memory of 3888	2388	msedge.exe	95
PID 2388 wrote to memory of 3888	2388	msedge.exe	95
PID 2388 wrote to memory of 2500	2388	msedge.exe	96
PID 2388 wrote to memory of 2500	2388	msedge.exe	96
PID 2388 wrote to memory of 2500	2388	msedge.exe	96
PID 2388 wrote to memory of 2500	2388	msedge.exe	96
PID 2388 wrote to memory of 2500	2388	msedge.exe	96
PID 2388 wrote to memory of 2500	2388	msedge.exe	96
PID 2388 wrote to memory of 2500	2388	msedge.exe	96
PID 2388 wrote to memory of 2500	2388	msedge.exe	96
PID 2388 wrote to memory of 2500	2388	msedge.exe	96

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\1.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3080

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4224
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 11845323E475F1BC8BA09DEF2EE5EE34
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1376
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssB3E1.ps1"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:764
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c C:\anterevolutionary\carpostome.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1048
    - - C:\anterevolutionary\carpostome.exe
        
        C:\anterevolutionary\carpostome.exe
        5⤵
        Adds Run key to start application
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:388
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" %1 "https://rebrand.ly/5sayib0"
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:1012
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1012 CREDAT:17410 /prefetch:2
        7⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2356
- C:\Windows\Installer\MSIAFEA.tmp
  "C:\Windows\Installer\MSIAFEA.tmp" https://freitaslogistica.com/sucedido/
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://freitaslogistica.com/sucedido/
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd8b2946f8,0x7ffd8b294708,0x7ffd8b294718
      4⤵
      PID:2944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,9032884163577786500,7584507854773073266,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
      4⤵
      PID:3964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,9032884163577786500,7584507854773073266,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,9032884163577786500,7584507854773073266,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
      4⤵
      PID:2500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9032884163577786500,7584507854773073266,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
      4⤵
      PID:4016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9032884163577786500,7584507854773073266,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
      4⤵
      PID:1084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9032884163577786500,7584507854773073266,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4000 /prefetch:1
      4⤵
      PID:4208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9032884163577786500,7584507854773073266,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3536 /prefetch:1
      4⤵
      PID:1608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,9032884163577786500,7584507854773073266,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 /prefetch:8
      4⤵
      PID:5004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,9032884163577786500,7584507854773073266,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9032884163577786500,7584507854773073266,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
      4⤵
      PID:840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9032884163577786500,7584507854773073266,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
      4⤵
      PID:808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9032884163577786500,7584507854773073266,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3536 /prefetch:1
      4⤵
      PID:4960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9032884163577786500,7584507854773073266,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:1
      4⤵
      PID:1704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9032884163577786500,7584507854773073266,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1380 /prefetch:1
      4⤵
      PID:4112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9032884163577786500,7584507854773073266,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1048 /prefetch:1
      4⤵
      PID:3780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,9032884163577786500,7584507854773073266,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5708 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3360

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e57adc7.rbs

Path C:\Config.Msi\e57adc7.rbs
Size 1.2MB
SHA256 d807f8ee8d7e984b8e46e64ff2390b5d411c48c741d4a20cecf55c446f60c7f7
MD5 cc0072bedaf8bcce79db14d8d83e1680
SHA1 df95f077cb2f5ce9829359d5896d8fd46996e043
SHA512 812690de511ca3916f256d980659df698dd786fd35dd5754f6b239fa4777725acbba2f34c29152397112b632df6a3923590189985dbe779586f42a21de2d22db
SSDEEP 24576:UKd6BSOx4NHcDfVI0g6TjKd6BSOx4NHcDfVI0g6TA:UtB7WHgVI0g6TjtB7WHgVI0g6TA
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1
MD5 847d47008dbea51cb1732d54861ba9c9
SHA1 f2099242027dccb88d6f05760b57f7c89d926c0d
SHA512 bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e
MD5 f9664c896e19205022c094d725f820b6
SHA1 f8f1baf648df755ba64b412d512446baf88c0184
SHA512 3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 84d65b945525674f58e6aaa2117a17c00d40569a47b53c596b9b78876ace469e
MD5 79137171788c0931d616f3dca34d5604
SHA1 9bce2e08479ca0fc3cd606e0f02faa914947a411
SHA512 8af261cf836d935a8dc9bb0a3e2323155cca0aca91b96e8f6e7e555a36d24de4bac6dcee5121e556b0fa99b3bcd58a489b051c4d0d75e69603f41ce44e66ab4d
SSDEEP 96:nlk/Ui1/XOrwpvWMoiVmdeH4s5oUWQyV+VDCziEwb:nlk/PxCGWMXoro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 798d45671f03c89211ac42228d3b32b63681c8cc25047376c651049beb17605b
MD5 42f8f4266d51340e24fb35a6779faad6
SHA1 7f957a88064a3e496b6f881b0df2ef7386251431
SHA512 26f3ca873f76f15480bb7cde5c6a2bc69ffdc6457649fc4ca5f8a2787664ac0f39688d42739e836c921d14ce9c87d82e0a4dca24b8f0f79dae17f7cb33734342
SSDEEP 96:nlk/hi1zXOrwpvWMoiVmdeH4s5oUWQyV+VD7AiEwb:nlk/ExCGWMXorg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 0e093222735c46995973c9f574fbbaccf170aed0356334a147b64d5fe871d091
MD5 62babd4b1b9a8f73d4b0f70e357a377b
SHA1 019259af836c300fe3bba152313d4cf3319cf5f6
SHA512 b54cb1dd9818a62cb01f0f405b4e14582b227742a902defc3c82dbdbff9ac608109aff59b9866661603d73bfbb51a1e962d11663e4752dbcda94621ee951e266
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupgqe2RU+hi6+s0KVhY3NIn:A9iIxuERzA83h09RZxYDxTcKo3NIn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 05d4921f16683aa2cb370ffb6923991eacd5483076bf1385aa54d2838de62847
MD5 1455e7a9bda87ea801ae0aef4c48f417
SHA1 016635c119381e3679cb239c2ba59b758a9d7ad2
SHA512 dffc85da62e7c9a008ae9e2d551e956e3892dc05e40e8f0cbbe473e789225b558ae6a80c7f9d3f2f713aaec25424399d00e25e72f11b8878003baebca48d5665
SSDEEP 192:AoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupgqe2RU+hi6Ts0KVhY3NIn:49iIxuERzA83h09RZxYDxT7Ko3NIn
MD5 SHA1 SHA512 SSDEEP

Submit Download

www.microsoft[1].xml

Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\2PF5C7U3\www.microsoft[1].xml
Size 13B
SHA256 b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db
MD5 c1ddea3ef6bbef3e7060a1a9ad89e4c5
SHA1 35e3224fcbd3e1af306f2b6a2c6bbea9b0867966
SHA512 6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed
MD5 SHA1 SHA512

Submit Download

imagestore.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\374sd3b\imagestore.dat
Size 17KB
SHA256 d5ba3b169456c92bd599751d28d381bb207c255f2e68a9519efd23c81e8ff991
MD5 3e510abcedc7a0f0f23ee5856453160c
SHA1 a2a368a888b682fed6f1663b9b36f7d08c8362a4
SHA512 e772834c99732eeb1e1c946576e40edf3efe072834003a1121868a3b1a7e0b6f3f48436c9f636cb49500c4773042a311b0337f19598cfbe62dd1b565e2befb56
SSDEEP 48:O+HL+oL+QL+tgyyyyyyyyyyyyy7L+D8L+GQQQQQx:+QQQQQx
MD5 SHA1 SHA512 SSDEEP

Submit Download

favicon[1].ico

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G40JFEW9\favicon[1].ico
Size 16KB
SHA256 90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21
MD5 12e3dac858061d088023b2bd48e2fa96
SHA1 e08ce1a144eceae0c3c2ea7a9d6fbc5658f24ce5
SHA512 c5030c55a855e7a9e20e22f4c70bf1e0f3c558a9b7d501cfab6992ac2656ae5e41b050ccac541efa55f9603e0d349b247eb4912ee169d44044271789c719cd01
SSDEEP 24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5 SHA1 SHA512 SSDEEP

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NMN7D09E\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_0oakkppq.na2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0oakkppq.na2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

pssB3D0.ps1

Path C:\Users\Admin\AppData\Local\Temp\pssB3D0.ps1
Size 3.8MB
SHA256 7f3a6b78d1419e214c471c217cfae2ac4c3815cd24790d63efce70b186fe0361
MD5 1cfef760653c2d7add6bba65d0cb11de
SHA1 a01775cae46aaf1692f20d668d79cab035eb1797
SHA512 14c0d4d4976ed64cceb5c68d73b764c781338c52676d9d80b270053daeb1cf53ab6946c60a153d1f648852e5f0a4c0eb20cb5b774b6b40aa338bcd82ad3e9c9f
SSDEEP 24576:wBNN2PbEeuYwE6M6fMk4OVNvlCl1iHjYEf2Psq3hH89/qoOSGkMHIhHUhPx4sT+C:wBN8QJh4EiJDeGfoS7TPU2H
MD5 SHA1 SHA512 SSDEEP

Submit Download

pssB3E1.ps1

Path C:\Users\Admin\AppData\Local\Temp\pssB3E1.ps1
Size 5KB
SHA256 8113f58f257e930f5f3f34e1b0e6c4b80c892ac77e1f4fd7548e34dcd99356c1
MD5 5d57b9cd20aab08b307b9be8a7ab6a11
SHA1 50fc03826d8147db113b446b5ceb083dcb0d102f
SHA512 4db82f171d8926d841723160ca24aeb2b9f79c7b06e31970f4938b6adc862260f4140271bae099058b6c79eeeada09dbd3d4258900eaeb8c943646b36d79a76e
SSDEEP 24:QCGTXuARQvAD5V4zzLFAmhm/YMMtEzfug/Au6+w7uVIj9u92VFo1OWGvFnpVAATW:QTecPVRm7tGDck6Rgc/jy
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSIAE51.tmp

Path C:\Windows\Installer\MSIAE51.tmp
Size 379KB
SHA256 f89c4313f2f4bc8654a7fa3697702e36688e8c2756df5ada209a7f3e3f1d906f
MD5 305a50c391a94b42a68958f3f89906fb
SHA1 4110d68d71f3594f5d3bdfca91a1c759ab0105d4
SHA512 fcad17ce34e35de6f0c7259e92acc842db2e68008cf45e628b18d71cb3bffcfca35e233cd8ae5eb2ae758b8a6503dbe832dd70038432ccbd56c99cd45da535f7
SSDEEP 6144:AtBnIPLnkhsByA5mx1d6N/mFoO86j6HHIBVjdpU2bupEP4xzGi6Sc9AOZ0MrVK2Z:AtBqnkbIQ6HHI/RpXupEP49v63zLrVVb
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSIAFEA.tmp

Path C:\Windows\Installer\MSIAFEA.tmp
Size 404KB
SHA256 55ad26c17f4aac71e6db6a6edee6ebf695510dc7e533e3fee64afc3eb06291e5
MD5 a34d4f165087b11d9e06781d52262868
SHA1 1b7b6a5bb53b7c12fb45325f261ad7a61b485ce1
SHA512 aa62ff3b601ddb83133dd3659b0881f523454dc7eea921da7cfefc50426e70bb36b4ebc337a8f16620da610784a81a8e4aa1cf5e0959d28aa155d1f026a81aaf
SSDEEP 12288:i4HyzQyz5io+HEbdG7U674UdfE+jwbuTphIvQZy9q8oi9:iyyzQyz5io+HExGWUAyiqZI
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSIB0E7.tmp

Path C:\Windows\Installer\MSIB0E7.tmp
Size 602KB
SHA256 9f903a637445d2df9923044939130135073112ec2e35a2c3e7a04da67d84c39a
MD5 7a65c26658055067c9bdf80f1ec7e3da
SHA1 58182a420b1c2b89600d8bd3dc62be20a48af3a8
SHA512 852f75b1cb59b420324e2b9183cc506a6697d984ad867546e147b8abb2efe110fbceea6094036e987ad5783268f63bf6d4a50e12446e6fcd1fc65503c6f20d65
SSDEEP 12288:9iVKdSVP8g9Ug3dqBqaOG0UWGZWo/yuIW+z+PE+bSnjffVfAGPdG6Tt:iKd6BSOx4NHcDfVI0g6Tt
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSIB1C3.tmp

Path C:\Windows\Installer\MSIB1C3.tmp
Size 620KB
SHA256 b3eb3c8ce966d12566acde81fdcff35ff2099f8620846e00a5a4b84e93aa57e5
MD5 f3f72d9186aa2805d8bb2b770b488ed2
SHA1 b26248f1b9aaaba4b6bda2e193a6ecbf669e12d4
SHA512 8e44b27d75480040e0810ce5620433950e5d3bc3374d508f045cdbe87cc659d522d160bb05a8e3ead77061bfde43a23f788f75903fc7551dab252df48ab48050
SSDEEP 12288:bKG7e/E22j/f/fZwqVYXV8V7RWypBqZVjrbYzb4E1w+s5elOZI+PIurI1C/sh/Qq:bf7MV8V7RWypBqZVj3Y/4YwOYmhYDyYk
MD5 SHA1 SHA512 SSDEEP

Submit Download

carpostome.exe

Path C:\anterevolutionary\carpostome.exe
Size 446KB
SHA256 054b01984bdebaf673506849cccae7c329209245f3cbc0f6d366bba1294658df
MD5 b3b871e6016b1d02f7fa35cb885e7d8f
SHA1 78b97c60a8e4caa1058e35c5a3c58375fc126e95
SHA512 36e4eb7c066368bdf668a4356ebb3f00a8aad48770808241fc4686711c78a9c695837a73400de83286383d6cc189e17c4d094f2c68b62e2a18c7be6e7ceaf5b3
SSDEEP 12288:aKmRE3LJjlPbct7duQb4Od01AJGS3mrxWI7n3OqiHThrmotbY7rSrZWZlJmwJI+h:Ce33U01AJGS3mrxWI7n3OqiHThrmotbS
MD5 SHA1 SHA512 SSDEEP

Submit Download

dbghelp.dll

Path C:\anterevolutionary\dbghelp.dll
Size 8.6MB
SHA256 4b1c85f3992ab298efe8a772c4735d1f76750ef43cc2cf2125afd15f59116c10
MD5 44be3178fad93c5ac1ea94561023473d
SHA1 039e7d56dd1d2619ae91d4975e5044a51c06ed93
SHA512 c6b19719c060035e1d0c17b2aa12b61b4f54735433af632f7fc8723d774ef12f2c34db9aafafcfcb8c5ff53d9eaa73e331f7582068628abd48e3f5c255e4c0c4
SSDEEP 196608:cHLIP8XxM6ulOkKGSRYDHFd6sgusV7wrbUMLQ+9+2gXxfRffRpJISeg80IK1Rp:ci8Xi6ulOkK7R036xCYML9MlBpiap
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/388-170-0x000000006EC40000-0x000000006F4DA000-memory.dmp

Download

memory/764-99-0x000000000B160000-0x000000000B7DA000-memory.dmp

Download

memory/764-95-0x0000000009E20000-0x0000000009EB6000-memory.dmp

Download

memory/764-80-0x0000000005E00000-0x0000000005E4C000-memory.dmp

Download

memory/764-79-0x0000000005DE0000-0x0000000005DFE000-memory.dmp

Download

memory/764-73-0x0000000005930000-0x0000000005C84000-memory.dmp

Download

memory/764-98-0x000000000A530000-0x000000000AAD4000-memory.dmp

Download

memory/764-63-0x0000000005620000-0x0000000005686000-memory.dmp

Download

memory/764-64-0x00000000057C0000-0x0000000005826000-memory.dmp

Download

memory/764-97-0x0000000009DD0000-0x0000000009DF2000-memory.dmp

Download

memory/764-62-0x0000000004E40000-0x0000000004E62000-memory.dmp

Download

memory/764-61-0x0000000004F80000-0x00000000055A8000-memory.dmp

Download

memory/764-60-0x0000000002830000-0x0000000002866000-memory.dmp

Download

memory/764-96-0x0000000009D80000-0x0000000009D9A000-memory.dmp

Download