Resubmissions
16/08/2024, 04:45
240816-fdextszepr 816/08/2024, 04:39
240816-e927kazdkl 816/08/2024, 04:32
240816-e6ft6azbpq 1016/08/2024, 04:30
240816-e4t9rsvgkh 816/08/2024, 04:27
240816-e2417azakl 5Analysis
-
max time kernel
65s -
max time network
66s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
16/08/2024, 04:45
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://google.com
Resource
win10v2004-20240802-en
General
-
Target
https://google.com
Malware Config
Signatures
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation BootstrapperV1.16.exe Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation BootstrapperV1.10.exe -
Executes dropped EXE 2 IoCs
pid Process 3456 BootstrapperV1.10.exe 5984 BootstrapperV1.16.exe -
Loads dropped DLL 11 IoCs
pid Process 864 MsiExec.exe 864 MsiExec.exe 5928 MsiExec.exe 5928 MsiExec.exe 5928 MsiExec.exe 5928 MsiExec.exe 5928 MsiExec.exe 5616 MsiExec.exe 5616 MsiExec.exe 5616 MsiExec.exe 864 MsiExec.exe -
Blocklisted process makes network request 2 IoCs
flow pid Process 117 1276 msiexec.exe 119 1276 msiexec.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 94 pastebin.com 95 pastebin.com 108 pastebin.com -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\nodejs\node_modules\npm\node_modules\tuf-js\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\chalk\source\templates.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\are-we-there-yet\LICENSE.md msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\abbrev\abbrev.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmexec\lib\is-windows.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\lib\rebuild.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\package-json\lib\update-workspaces.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\pacote\lib\util\is-package-bin.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\signal-exit\signals.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\make-fetch-happen\lib\cache\entry.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\validate-npm-package-license\LICENSE msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\tlog\verify\set.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-search.html msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\npm-registry-fetch\lib\errors.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\lib\get-node-modules.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\man\man1\npm-root.1 msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\tuf-js\dist\models\signature.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\jsonparse\samplejson\basic.json msiexec.exe File created C:\Program Files\nodejs\node_modules\corepack\shims\yarn.cmd msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\man\man7\registry.7 msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\which\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\pacote\README.md msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\tiny-relative-date\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\function-bind\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-explain.md msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\LICENSE.md msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\yallist\iterator.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\events\History.md msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@colors\colors\lib\custom\zalgo.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@isaacs\string-locale-compare\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\lib\find-node-directory.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\lib\commands\version.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\fs\lib\readdir-scoped.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\agent-base\src\promisify.ts msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmexec\LICENSE msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmfund\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\ip-regex\license msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\gauge\lib\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\pacote\lib\util\trailing-slashes.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\ini\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\tuf-js\dist\models\key.d.ts msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\negotiator\lib\language.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\nopt\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-pipeline\node_modules\minipass\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\fs-minipass\lib\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\glob\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\events\tests\subclass.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\agent-base\dist\src\promisify.d.ts msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\tuf-js\dist\models\role.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\make-fetch-happen\lib\cache\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\socks\build\index.js.map msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\readable-stream\lib\_stream_writable.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\mkdirp\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\lib\check-bin.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\ci-info\LICENSE msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\run-script\LICENSE msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-pipeline\LICENSE msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\ansi-regex\index.d.ts msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-completion.html msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\validate-npm-package-name\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\readable-stream\lib\_stream_readable.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-doctor.md msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\lib\shim-bin.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\gauge\package.json msiexec.exe -
Drops file in Windows directory 21 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI8F16.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI6DBD.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8C84.tmp msiexec.exe File created C:\Windows\Installer\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\NodeIcon msiexec.exe File opened for modification C:\Windows\Installer\MSI6C54.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6DDD.tmp msiexec.exe File opened for modification C:\Windows\Installer\e586433.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI68A8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6926.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC} msiexec.exe File opened for modification C:\Windows\Installer\MSI6956.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\e586437.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI930F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8DAE.tmp msiexec.exe File opened for modification C:\Windows\Installer\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\NodeIcon msiexec.exe File created C:\Windows\Installer\e586433.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI72EF.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI730F.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BootstrapperV1.10.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wevtutil.exe -
Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133682571600726099" chrome.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe -
Modifies registry class 30 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\EnvironmentPathNode = "EnvironmentPath" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\npm msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\PackageCode = "347C7A52EDBDC9A498427C0BC7ABB536" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\PackageName = "node-v18.16.0-x64.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\NodeEtwSupport = "NodeRuntime" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\DocumentationShortcuts msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\corepack msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\NodeRuntime msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782\5B532AFE1A6C6E24B99C208A5DF6C1CD msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\EnvironmentPathNpmModules = "EnvironmentPath" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\Version = "303038464" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\EnvironmentPath msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\ProductName = "Node.js" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\ProductIcon = "C:\\Windows\\Installer\\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\\NodeIcon" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\Media msiexec.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 2504 msedge.exe 2504 msedge.exe 2536 msedge.exe 2536 msedge.exe 5060 chrome.exe 5060 chrome.exe 5984 BootstrapperV1.16.exe 5984 BootstrapperV1.16.exe 5984 BootstrapperV1.16.exe 1276 msiexec.exe 1276 msiexec.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 2536 msedge.exe 2536 msedge.exe 2536 msedge.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeDebugPrivilege 3456 BootstrapperV1.10.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeDebugPrivilege 5984 BootstrapperV1.16.exe -
Suspicious use of FindShellTrayWindow 59 IoCs
pid Process 2536 msedge.exe 2536 msedge.exe 2536 msedge.exe 2536 msedge.exe 2536 msedge.exe 2536 msedge.exe 2536 msedge.exe 2536 msedge.exe 2536 msedge.exe 2536 msedge.exe 2536 msedge.exe 2536 msedge.exe 2536 msedge.exe 2536 msedge.exe 2536 msedge.exe 2536 msedge.exe 2536 msedge.exe 2536 msedge.exe 2536 msedge.exe 2536 msedge.exe 2536 msedge.exe 2536 msedge.exe 2536 msedge.exe 2536 msedge.exe 2536 msedge.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe -
Suspicious use of SendNotifyMessage 48 IoCs
pid Process 2536 msedge.exe 2536 msedge.exe 2536 msedge.exe 2536 msedge.exe 2536 msedge.exe 2536 msedge.exe 2536 msedge.exe 2536 msedge.exe 2536 msedge.exe 2536 msedge.exe 2536 msedge.exe 2536 msedge.exe 2536 msedge.exe 2536 msedge.exe 2536 msedge.exe 2536 msedge.exe 2536 msedge.exe 2536 msedge.exe 2536 msedge.exe 2536 msedge.exe 2536 msedge.exe 2536 msedge.exe 2536 msedge.exe 2536 msedge.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2536 wrote to memory of 636 2536 msedge.exe 86 PID 2536 wrote to memory of 636 2536 msedge.exe 86 PID 2536 wrote to memory of 2776 2536 msedge.exe 87 PID 2536 wrote to memory of 2776 2536 msedge.exe 87 PID 2536 wrote to memory of 2776 2536 msedge.exe 87 PID 2536 wrote to memory of 2776 2536 msedge.exe 87 PID 2536 wrote to memory of 2776 2536 msedge.exe 87 PID 2536 wrote to memory of 2776 2536 msedge.exe 87 PID 2536 wrote to memory of 2776 2536 msedge.exe 87 PID 2536 wrote to memory of 2776 2536 msedge.exe 87 PID 2536 wrote to memory of 2776 2536 msedge.exe 87 PID 2536 wrote to memory of 2776 2536 msedge.exe 87 PID 2536 wrote to memory of 2776 2536 msedge.exe 87 PID 2536 wrote to memory of 2776 2536 msedge.exe 87 PID 2536 wrote to memory of 2776 2536 msedge.exe 87 PID 2536 wrote to memory of 2776 2536 msedge.exe 87 PID 2536 wrote to memory of 2776 2536 msedge.exe 87 PID 2536 wrote to memory of 2776 2536 msedge.exe 87 PID 2536 wrote to memory of 2776 2536 msedge.exe 87 PID 2536 wrote to memory of 2776 2536 msedge.exe 87 PID 2536 wrote to memory of 2776 2536 msedge.exe 87 PID 2536 wrote to memory of 2776 2536 msedge.exe 87 PID 2536 wrote to memory of 2776 2536 msedge.exe 87 PID 2536 wrote to memory of 2776 2536 msedge.exe 87 PID 2536 wrote to memory of 2776 2536 msedge.exe 87 PID 2536 wrote to memory of 2776 2536 msedge.exe 87 PID 2536 wrote to memory of 2776 2536 msedge.exe 87 PID 2536 wrote to memory of 2776 2536 msedge.exe 87 PID 2536 wrote to memory of 2776 2536 msedge.exe 87 PID 2536 wrote to memory of 2776 2536 msedge.exe 87 PID 2536 wrote to memory of 2776 2536 msedge.exe 87 PID 2536 wrote to memory of 2776 2536 msedge.exe 87 PID 2536 wrote to memory of 2776 2536 msedge.exe 87 PID 2536 wrote to memory of 2776 2536 msedge.exe 87 PID 2536 wrote to memory of 2776 2536 msedge.exe 87 PID 2536 wrote to memory of 2776 2536 msedge.exe 87 PID 2536 wrote to memory of 2776 2536 msedge.exe 87 PID 2536 wrote to memory of 2776 2536 msedge.exe 87 PID 2536 wrote to memory of 2776 2536 msedge.exe 87 PID 2536 wrote to memory of 2776 2536 msedge.exe 87 PID 2536 wrote to memory of 2776 2536 msedge.exe 87 PID 2536 wrote to memory of 2776 2536 msedge.exe 87 PID 2536 wrote to memory of 2504 2536 msedge.exe 88 PID 2536 wrote to memory of 2504 2536 msedge.exe 88 PID 2536 wrote to memory of 3016 2536 msedge.exe 89 PID 2536 wrote to memory of 3016 2536 msedge.exe 89 PID 2536 wrote to memory of 3016 2536 msedge.exe 89 PID 2536 wrote to memory of 3016 2536 msedge.exe 89 PID 2536 wrote to memory of 3016 2536 msedge.exe 89 PID 2536 wrote to memory of 3016 2536 msedge.exe 89 PID 2536 wrote to memory of 3016 2536 msedge.exe 89 PID 2536 wrote to memory of 3016 2536 msedge.exe 89 PID 2536 wrote to memory of 3016 2536 msedge.exe 89 PID 2536 wrote to memory of 3016 2536 msedge.exe 89 PID 2536 wrote to memory of 3016 2536 msedge.exe 89 PID 2536 wrote to memory of 3016 2536 msedge.exe 89 PID 2536 wrote to memory of 3016 2536 msedge.exe 89 PID 2536 wrote to memory of 3016 2536 msedge.exe 89 PID 2536 wrote to memory of 3016 2536 msedge.exe 89 PID 2536 wrote to memory of 3016 2536 msedge.exe 89 PID 2536 wrote to memory of 3016 2536 msedge.exe 89 PID 2536 wrote to memory of 3016 2536 msedge.exe 89 PID 2536 wrote to memory of 3016 2536 msedge.exe 89 PID 2536 wrote to memory of 3016 2536 msedge.exe 89
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.com1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8841246f8,0x7ff884124708,0x7ff8841247182⤵PID:636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,11842163736125321085,15028098522032231425,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2024 /prefetch:22⤵PID:2776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2012,11842163736125321085,15028098522032231425,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2012,11842163736125321085,15028098522032231425,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:82⤵PID:3016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,11842163736125321085,15028098522032231425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:12⤵PID:1144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,11842163736125321085,15028098522032231425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:12⤵PID:3456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,11842163736125321085,15028098522032231425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:12⤵PID:532
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1600
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5068
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5060 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff87228cc40,0x7ff87228cc4c,0x7ff87228cc582⤵PID:3468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1944,i,5823068070766639180,6796243000061149951,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1940 /prefetch:22⤵PID:2860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2100,i,5823068070766639180,6796243000061149951,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2084 /prefetch:32⤵PID:4328
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1368,i,5823068070766639180,6796243000061149951,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2344 /prefetch:82⤵PID:5108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3168,i,5823068070766639180,6796243000061149951,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3180 /prefetch:12⤵PID:5036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3328,i,5823068070766639180,6796243000061149951,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:1744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4572,i,5823068070766639180,6796243000061149951,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4524 /prefetch:12⤵PID:2196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4708,i,5823068070766639180,6796243000061149951,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4552 /prefetch:82⤵PID:4308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4772,i,5823068070766639180,6796243000061149951,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4724 /prefetch:82⤵PID:5376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5124,i,5823068070766639180,6796243000061149951,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4936 /prefetch:12⤵PID:5828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5184,i,5823068070766639180,6796243000061149951,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5244 /prefetch:12⤵PID:6128
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4928,i,5823068070766639180,6796243000061149951,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3192 /prefetch:12⤵PID:2180
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=3460,i,5823068070766639180,6796243000061149951,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5216 /prefetch:12⤵PID:2692
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3432,i,5823068070766639180,6796243000061149951,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5116 /prefetch:82⤵PID:5520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=3192,i,5823068070766639180,6796243000061149951,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5532 /prefetch:82⤵PID:5588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5488,i,5823068070766639180,6796243000061149951,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5672 /prefetch:82⤵PID:5620
-
-
C:\Users\Admin\Downloads\BootstrapperV1.10.exe"C:\Users\Admin\Downloads\BootstrapperV1.10.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3456 -
C:\Users\Admin\Downloads\BootstrapperV1.16.exe"C:\Users\Admin\Downloads\BootstrapperV1.16.exe" --oldBootstrapper "C:\Users\Admin\Downloads\BootstrapperV1.10.exe" --isUpdate true3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5984 -
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi" /qn4⤵PID:5776
-
-
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:1648
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:5436
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1276 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding D123173B11F808C32157D99D8AC2B4652⤵
- Loads dropped DLL
PID:864
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 7199BCC10E1A6712555E402B9EA64D992⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5928
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding BE6992DEE4169B45E2B56C078282BA10 E Global\MSI00002⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5616 -
C:\Windows\SysWOW64\wevtutil.exe"wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man"3⤵
- System Location Discovery: System Language Discovery
PID:5744 -
C:\Windows\System32\wevtutil.exe"wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man" /fromwow644⤵PID:4212
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD55c9c1a4765e606ba29b8539446b78135
SHA102afa93524695029f584c279a0237548de7161bb
SHA256c04f02fbdcc0d5cd6c619b08c8b1e688dca0f4e4e6a67d11003d63709e71a3d6
SHA5129e918a5dafd177efad7b4e61970e49d964c0ab6acc8279953bc2701af6b380b0dbf897a92cd555cb1e63e9b0ae18a7df2da1b73471b7666c25eb67565ac1b7f0
-
Filesize
10KB
MD51d51e18a7247f47245b0751f16119498
SHA178f5d95dd07c0fcee43c6d4feab12d802d194d95
SHA2561975aa34c1050b8364491394cebf6e668e2337c3107712e3eeca311262c7c46f
SHA5121eccbe4ddae3d941b36616a202e5bd1b21d8e181810430a1c390513060ae9e3f12cd23f5b66ae0630fd6496b3139e2cc313381b5506465040e5a7a3543444e76
-
Filesize
8KB
MD5d3bc164e23e694c644e0b1ce3e3f9910
SHA11849f8b1326111b5d4d93febc2bafb3856e601bb
SHA2561185aaa5af804c6bc6925f5202e68bb2254016509847cd382a015907440d86b4
SHA51291ebff613f4c35c625bb9b450726167fb77b035666ed635acf75ca992c4846d952655a2513b4ecb8ca6f19640d57555f2a4af3538b676c3bd2ea1094c4992854
-
Filesize
818B
MD52916d8b51a5cc0a350d64389bc07aef6
SHA1c9d5ac416c1dd7945651bee712dbed4d158d09e1
SHA256733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04
SHA512508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74
-
Filesize
1KB
MD55ad87d95c13094fa67f25442ff521efd
SHA101f1438a98e1b796e05a74131e6bb9d66c9e8542
SHA25667292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec
SHA5127187720ccd335a10c9698f8493d6caa2d404e7b21731009de5f0da51ad5b9604645fbf4bc640aa94513b9eb372aa6a31df2467198989234bc2afbce87f76fbc3
-
Filesize
754B
MD5d2cf52aa43e18fdc87562d4c1303f46a
SHA158fb4a65fffb438630351e7cafd322579817e5e1
SHA25645e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0
SHA51254e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16
-
Filesize
771B
MD5e9dc66f98e5f7ff720bf603fff36ebc5
SHA1f2b428eead844c4bf39ca0d0cf61f6b10aeeb93b
SHA256b49c8d25a8b57fa92b2902d09c4b8a809157ee32fc10d17b7dbb43c4a8038f79
SHA5128027d65e1556511c884cb80d3c1b846fc9d321f3f83002664ad3805c4dee8e6b0eaf1db81c459153977bdbde9e760b0184ba6572f68d78c37bff617646bcfc3b
-
Filesize
730B
MD5072ac9ab0c4667f8f876becedfe10ee0
SHA10227492dcdc7fb8de1d14f9d3421c333230cf8fe
SHA2562ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013
SHA512f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013
-
C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-pipeline\node_modules\minipass\package.json
Filesize1KB
MD5d116a360376e31950428ed26eae9ffd4
SHA1192b8e06fb4e1f97e5c5c7bf62a9bff7704c198b
SHA256c3052bd85910be313e38ad355528d527b565e70ef15a784db3279649eee2ded5
SHA5125221c7648f4299234a4637c47d3f1eb5e147014704913bc6fdad91b9b6a6ccc109bced63376b82b046bb5cad708464c76fb452365b76dbf53161914acf8fb11a
-
Filesize
802B
MD5d7c8fab641cd22d2cd30d2999cc77040
SHA1d293601583b1454ad5415260e4378217d569538e
SHA25604400db77d925de5b0264f6db5b44fe6f8b94f9419ad3473caaa8065c525c0be
SHA512278ff929904be0c19ee5fb836f205e3e5b3e7cec3d26dd42bbf1e7e0ca891bf9c42d2b28fce3741ae92e4a924baf7490c7c6c59284127081015a82e2653e0764
-
Filesize
16KB
MD5bc0c0eeede037aa152345ab1f9774e92
SHA156e0f71900f0ef8294e46757ec14c0c11ed31d4e
SHA2567a395802fbe01bb3dc8d09586e0864f255874bf897378e546444fbaec29f54c5
SHA5125f31251825554bf9ed99eda282fa1973fcec4a078796a10757f4fb5592f2783c4ebdd00bdf0d7ed30f82f54a7668446a372039e9d4589db52a75060ca82186b3
-
Filesize
780B
MD5b020de8f88eacc104c21d6e6cacc636d
SHA120b35e641e3a5ea25f012e13d69fab37e3d68d6b
SHA2563f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706
SHA5124220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38
-
Filesize
763B
MD57428aa9f83c500c4a434f8848ee23851
SHA1166b3e1c1b7d7cb7b070108876492529f546219f
SHA2561fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7
SHA512c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce
-
C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\index.d.ts
Filesize4KB
MD5f0bd53316e08991d94586331f9c11d97
SHA1f5a7a6dc0da46c3e077764cfb3e928c4a75d383e
SHA256dd3eda3596af30eda88b4c6c2156d3af6e7fa221f39c46e492c5e9fb697e2fef
SHA512fd6affbaed67d09cf45478f38e92b8ca6c27650a232cbbeaff36e4f7554fb731ae44cf732378641312e98221539e3d8fabe80a7814e4f425026202de44eb5839
-
Filesize
771B
MD51d7c74bcd1904d125f6aff37749dc069
SHA121e6dfe0fffc2f3ec97594aa261929a3ea9cf2ab
SHA25624b8d53712087b867030d18f2bd6d1a72c78f9fb4dee0ce025374da25e4443b9
SHA512b5ac03addd29ba82fc05eea8d8d09e0f2fa9814d0dd619c2f7b209a67d95b538c3c2ff70408641ef3704f6a14e710e56f4bf57c2bb3f8957ba164f28ee591778
-
Filesize
84B
MD50c3d77c634f46e5a1d3398b486342e3a
SHA11febe77346a037027ba1fc2fe073c7c93418f0be
SHA256b4b0b4057df774b1a33706cc4c57884681197e3edeffd4afdbf37be974f8f828
SHA51215613e036214ce79048916b2bba4e9db76c1250d55f6c5a43ca54878aaade6313c5b3a90a37f9a2c7870c25481d512d4de2b6c14906823ec7926274c0e0ff260
-
Filesize
649B
MD567771158cbcebaa1d1c161f909200c8b
SHA11118fe284bc10f82e3da53cecf253d1f2a03b945
SHA256f4ff310cb73eb28d3f834c738ed70a032df6d31cefc5e37adc0897a7f7d923fb
SHA5120df21e30248877d863e9ff5525161055e131d5483aa334d2180840de6685faa16dcf90e3f65e3e5d2cabb562b4a5331b200e093dfed8cf91315eb72c5ead4adb
-
Filesize
144B
MD5ab1406876021aeb9522d047de9f7561d
SHA16ed7c3ca35f5c44452309cf8f875ac31c354f225
SHA256b66282c018f32b604080dc67fb464d0e75ca4e2060c8dc3e13c4eb14baf8b42f
SHA5123239033d36f66c653f4a9d5d84861e804de4f665472954539410f16b25c3dc5fda0b69aef47032090236d4f3e559ad56f6fdc713e5f128b65975e83682efca57
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
356B
MD5e7fa533c19120ed6fcff379e4da68b82
SHA13fb16f7cc0254a772f835f86b3bf92339c012b9f
SHA256a83f8edb1fa8185708ad148e42e7c8a401dd3fdac8b0d6c97a8dda7e50477ffe
SHA512bfcf9f768fb4777687fd5726626bee3fcf7808830f3985d39608b840bb727e98b1c4e899807c3f9d49fa49425db7043e34426d68a75c473484936a14059146ce
-
Filesize
692B
MD5eb1ccb414362c7d805c51f6658ee607f
SHA11333d62716d1aac6e0b423f07ec78c33380bff09
SHA2562425eafae06f853178c3bd8a00c3c61103d9dcff8531b66f94808186263fac70
SHA5125873ac11214a6bd2b2f8e792f3dc333552dda7c015d55f7982c847007467f5e0a4a197301a56f4e7ff102046a3a0c0dc798f6b71b1951e049099be1b38307145
-
Filesize
9KB
MD5fcb7da84917a7a78671aa57a94b4ff47
SHA13b69de2ef48ff3ef284a293fd1a2c765f9756a5b
SHA25661bde616758cf4e2a22c8844436e69a5fcfa88e054c14d78f8cd29f93e8e08c3
SHA512efced08030feab26dee46412963ec463c0ffa50abc6fb9bb70b4e5f7da81146caeaea3fce6c351893c5376c26ce361a08feb87d4e795da28708160e2136aeeb3
-
Filesize
9KB
MD5cfe58260ffb66ff74065e30935a5a8ee
SHA12f7098cdf6d718df87d4c946c982da03901a85b9
SHA256e15fdb4183cde6f66f8d451ccd692752860936f7c0322244bd6142d01bc3e13f
SHA512e1f44c04b9e3944514bf835f2dedc11d9e21022d3896b11971e5b5b32b66493456443a1b18ff71102af267c00649b8ee7fe24d0a3f3724f4d88bed69e621ffa8
-
Filesize
9KB
MD5e4d1151380199ca5e99e24ba043907fd
SHA1d3de558ad5aeec702e487e848a2b07e07a560dac
SHA256480db5d43e314a340961809d7cb39e3585d11519039405f35e67ac4f4e4439c6
SHA512e85d8be3e01d748097c74f3cf6cffc095ccc5b9afae0eeb6b5b662f5e831d8bb81732c8065435c71fcbcb72fefd82eaea04af137ae630f5834116a1a1e234589
-
Filesize
9KB
MD5c14ffd2a95a979fb88b4389a065bee0e
SHA17c338e85215339c125cf999da41beb35f15c98d4
SHA25642ebab6e1429e7f4a8f7870502b5dd2b54f0d775a339160d166631dced0e3096
SHA5127c26e4c232f3f950bf20387ff6fd7e320a909ce81a103057697507cf08dc4007fedb287de0235b6350360bb21167e52276d6e465fc1dbb3c6dcdeded71921be1
-
Filesize
13KB
MD57d5713f940977101328e301fb76f8ae1
SHA19621858fafedd1731905b52e37d20955f9af031e
SHA256f1d0e2ba95f14d6abef2ff9114e2fdeb5980747b7f3ea2d009c9d12af651d711
SHA512c1e528013d9ccdf9a6455c4d83ce68fa42bc1c1600dc88abad6471150e9c23e4defc0aa927e47cfe332a7cd32a6661b15c0720ddf4f8a663902ccf9882971eda
-
Filesize
195KB
MD5e1d278adc63b0974970c6c79496df6c9
SHA1f77b2a5afdb3244ab6d157b21ae72a69348be6fd
SHA256578a6a405bc22f0e21f121d7cdf27a451c7c2f677b8ac4f7729a844bc2555733
SHA5124b87fec3709d4566a812d5fce9beb5ab7a7c5e594c902b227d7eeb8daffdd293a4c7340f8f940804a5631856f0a28b8662aeeb65329ec7be4a83a09f9678c054
-
Filesize
196KB
MD5f71580e872a5b7201d9ccb4239ce1971
SHA19c18633b635ea1ba03c8b6c637ef893ed6620bf6
SHA25697a2f0543f76232c0fbc0e75ed508b39938bd37428a8ce8b83c0b310263f41a2
SHA512e17943c83e3b9e96d31a748a2881af33004e9a7cb5da178d6119b91680cca6aee383a6fc44a725bcc0820d9e3ba9f15a30e379bacbf129366715c940efc682a2
-
Filesize
152B
MD5ff63763eedb406987ced076e36ec9acf
SHA116365aa97cd1a115412f8ae436d5d4e9be5f7b5d
SHA2568f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c
SHA512ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f
-
Filesize
152B
MD52783c40400a8912a79cfd383da731086
SHA1001a131fe399c30973089e18358818090ca81789
SHA256331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5
SHA512b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685
-
Filesize
209KB
MD53e552d017d45f8fd93b94cfc86f842f2
SHA1dbeebe83854328e2575ff67259e3fb6704b17a47
SHA25627d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6
SHA512e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize120B
MD55233269eb4f579821e8c0257cfbbf15b
SHA1bf0924fa18a34e50c47bd22b8ae504ede912ac25
SHA25614a6c09ae58be988e0d9af101157c93ad947627bcb21fc17ec13a350ef903d17
SHA512969ceaa8c40e42970ab8591164adf9f657b3f83f2de876e8aaad50b6c2788cb8a6547b854bde6d4f78657a0924e681482a7690c528329a413bec7f099d853598
-
Filesize
6KB
MD5a083e698cecf5fbd4b1e9931fd89493f
SHA19626f00c5b3154face0ff87416eaaa21f13d2e79
SHA2565200c828bcd9d963f8bd3dbfc36bc34b2e277de8df1d52a9489ccb0ae4536cb6
SHA512e0435bcab3f65863fd17978b0c03e962a7750f41ef93cb6797654d56fbc8724cf1473c4c363b3df4b8184f8921fcd782fdc3d00d5427f1bd41c05d96ed60668d
-
Filesize
6KB
MD5da5e197e52c204de2fb40ff656a941cb
SHA1b9d9eeae569fa79de667812a6c424bf7e49153b9
SHA25651abecdca78cb4d88733f1812044016dccef9207f6ddb3d62a39784358ec0d03
SHA51203d52504cf8e5cf1f28921d8f46643e08463443f7f4a3d4252eb00f429422da83160aa58ef53d85c06d7f46bfa1465ca49edb72f02e2dd69eb991ae3c37f32b4
-
Filesize
10KB
MD566b36067c226fc2b4088f863237bcba1
SHA1ff8bf700f558153f023efc2f557d0213038f7f3c
SHA2560ad4bd5a0ac98ec3deb3c4de2b92980aa05d1a67353545df82bc4ae234160c85
SHA51237f621d50d3950cbf7ba8d0dad96aabd2a2640f20be434e3825fe04c89573b3a5d383126def1588da07a07b2e244f70253d6c5e1c116b5096a577975f58077d5
-
Filesize
30.1MB
MD50e4e9aa41d24221b29b19ba96c1a64d0
SHA1231ade3d5a586c0eb4441c8dbfe9007dc26b2872
SHA2565bfb6f3ab89e198539408f7e0e8ec0b0bd5efe8898573ec05b381228efb45a5d
SHA512e6f27aecead72dffecbeaad46ebdf4b1fd3dbcddd1f6076ba183b654e4e32d30f7af1236bf2e04459186e993356fe2041840671be73612c8afed985c2c608913
-
Filesize
795KB
MD5a7f3293b177a63f6c50b5560e729cbff
SHA14885073e4881cffc5c5155de720aa65755418fe8
SHA256da17868f107954124c0953fd1cb37ac8ed4e78460905e83d6402b966a77ee7dc
SHA51270b3431b238457a24e66914d0059e7e8e2dc4f79ac49c9a9c510214b8bc1279af6947288442060ac02c3cf3c863c144ef95219006097d2e59183586f7f701438
-
Filesize
796KB
MD576639ab92661f5c384302899934051ab
SHA19b33828f8ad3a686ff02b1a4569b8ae38128caed
SHA2566bb9ad960bcc9010db1b9918369bdfc4558f19287b5b6562079c610a28320178
SHA512928e4374c087070f8a6786f9082f05a866751ea877edf9afa23f6941dfc4d6762e1688bbb135788d6286ec324fa117fc60b46fed2f6e3a4ab059465a00f2ebee
-
Filesize
122KB
MD59fe9b0ecaea0324ad99036a91db03ebb
SHA1144068c64ec06fc08eadfcca0a014a44b95bb908
SHA256e2cce64916e405976a1d0c522b44527d12b1cba19de25da62121cf5f41d184c9
SHA512906641a73d69a841218ae90b83714a05af3537eec8ad1d761f58ac365cf005bdd74ad88f71c4437aaa126ac74fa46bcad424d17c746ab197eec2caa1bd838176
-
Filesize
211KB
MD5a3ae5d86ecf38db9427359ea37a5f646
SHA1eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
SHA256c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
SHA51296ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0
-
Filesize
297KB
MD57a86ce1a899262dd3c1df656bff3fb2c
SHA133dcbe66c0dc0a16bab852ed0a6ef71c2d9e0541
SHA256b8f2d0909d7c2934285a8be010d37c0609c7854a36562cbfcbce547f4f4c7b0c
SHA512421e8195c47381de4b3125ab6719eec9be7acd2c97ce9247f4b70a309d32377917c9686b245864e914448fe53df2694d5ee5f327838d029989ba7acafda302ec