Analysis
-
max time kernel
94s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
24/08/2024, 10:38
Static task
static1
Behavioral task
behavioral1
Sample
383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe
Resource
win7-20240704-en
General
-
Target
383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe
-
Size
4.7MB
-
MD5
a0023254d52f0f0ae306eaa788f4d628
-
SHA1
43c3058f6c9f64bcc7da8f2d8e0a5da0076b4948
-
SHA256
383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c
-
SHA512
2781abb843a870c1cfa02fd0bbb8603b7885230656284afee8cd1f4ea411f438fbdb6b2e48737e368d6ba51e340af9c07ee66e6811f80b144b3053fd0d231154
-
SSDEEP
98304:kAs++BUHecpbpx+sborjZGS/mBRjUOarcqQPV76M:kAKBx4px+sNxnaAqQt76M
Malware Config
Signatures
-
Loads dropped DLL 10 IoCs
pid Process 1980 MsiExec.exe 1980 MsiExec.exe 1980 MsiExec.exe 3920 MsiExec.exe 3920 MsiExec.exe 3920 MsiExec.exe 3920 MsiExec.exe 3920 MsiExec.exe 3920 MsiExec.exe 4044 MsiExec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\J: 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\B: 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe File opened (read-only) \??\H: 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe File opened (read-only) \??\S: 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe File opened (read-only) \??\V: 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe File opened (read-only) \??\Y: 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe File opened (read-only) \??\U: 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe File opened (read-only) \??\Z: 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe File opened (read-only) \??\A: 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe File opened (read-only) \??\I: 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe File opened (read-only) \??\M: 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe File opened (read-only) \??\O: 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe File opened (read-only) \??\P: 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe File opened (read-only) \??\R: 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\T: 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe File opened (read-only) \??\W: 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\K: 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\G: 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe File opened (read-only) \??\L: 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe File opened (read-only) \??\N: 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe File opened (read-only) \??\X: 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe -
Drops file in Windows directory 19 IoCs
description ioc Process File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIBB39.tmp msiexec.exe File created C:\Windows\SystemTemp\scrBC2D.ps1 MsiExec.exe File created C:\Windows\SystemTemp\scrBC2E.txt MsiExec.exe File created C:\Windows\SystemTemp\msiBC2C.txt MsiExec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIB961.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{D968B8FB-4256-46EA-A393-D235EA9F990C} msiexec.exe File opened for modification C:\Windows\Installer\MSIBA0E.tmp msiexec.exe File opened for modification C:\Windows\SystemTemp\pssBC3E.ps1 MsiExec.exe File opened for modification C:\Windows\Installer\MSIB873.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB931.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIBA2E.tmp msiexec.exe File opened for modification C:\Windows\SystemTemp\ProBC3F.tmp MsiExec.exe File opened for modification C:\Windows\Installer\MSIB8C2.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIB901.tmp msiexec.exe File created C:\Windows\Installer\e57b7c7.msi msiexec.exe File opened for modification C:\Windows\Installer\e57b7c7.msi msiexec.exe -
pid Process 2364 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe -
Modifies data under HKEY_USERS 44 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2976 msiexec.exe 2976 msiexec.exe 2364 powershell.exe 2364 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSecurityPrivilege 2976 msiexec.exe Token: SeCreateTokenPrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeAssignPrimaryTokenPrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeLockMemoryPrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeIncreaseQuotaPrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeMachineAccountPrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeTcbPrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeSecurityPrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeTakeOwnershipPrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeLoadDriverPrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeSystemProfilePrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeSystemtimePrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeProfSingleProcessPrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeIncBasePriorityPrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeCreatePagefilePrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeCreatePermanentPrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeBackupPrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeRestorePrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeShutdownPrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeDebugPrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeAuditPrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeSystemEnvironmentPrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeChangeNotifyPrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeRemoteShutdownPrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeUndockPrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeSyncAgentPrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeEnableDelegationPrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeManageVolumePrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeImpersonatePrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeCreateGlobalPrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeCreateTokenPrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeAssignPrimaryTokenPrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeLockMemoryPrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeIncreaseQuotaPrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeMachineAccountPrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeTcbPrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeSecurityPrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeTakeOwnershipPrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeLoadDriverPrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeSystemProfilePrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeSystemtimePrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeProfSingleProcessPrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeIncBasePriorityPrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeCreatePagefilePrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeCreatePermanentPrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeBackupPrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeRestorePrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeShutdownPrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeDebugPrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeAuditPrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeSystemEnvironmentPrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeChangeNotifyPrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeRemoteShutdownPrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeUndockPrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeSyncAgentPrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeEnableDelegationPrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeManageVolumePrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeImpersonatePrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeCreateGlobalPrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeCreateTokenPrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeAssignPrimaryTokenPrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeLockMemoryPrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeIncreaseQuotaPrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe Token: SeMachineAccountPrivilege 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2976 wrote to memory of 1980 2976 msiexec.exe 89 PID 2976 wrote to memory of 1980 2976 msiexec.exe 89 PID 2976 wrote to memory of 1980 2976 msiexec.exe 89 PID 3716 wrote to memory of 3816 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe 90 PID 3716 wrote to memory of 3816 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe 90 PID 3716 wrote to memory of 3816 3716 383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe 90 PID 2976 wrote to memory of 3920 2976 msiexec.exe 91 PID 2976 wrote to memory of 3920 2976 msiexec.exe 91 PID 2976 wrote to memory of 3920 2976 msiexec.exe 91 PID 2976 wrote to memory of 4044 2976 msiexec.exe 92 PID 2976 wrote to memory of 4044 2976 msiexec.exe 92 PID 2976 wrote to memory of 4044 2976 msiexec.exe 92 PID 4044 wrote to memory of 2364 4044 MsiExec.exe 93 PID 4044 wrote to memory of 2364 4044 MsiExec.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe"C:\Users\Admin\AppData\Local\Temp\383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe"1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Getintopc.com\EXE - Step 3 - Setup_Install 1.0.0\install\A9F990C\GetintoPC-Top-EXE.msi" /quiet /qn AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1724255291 " AI_EUIMSI=""2⤵
- System Location Discovery: System Language Discovery
PID:3816
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 16263C50C90C885D1DA8E55F205889BC C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1980
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 368B7DEE0CB1A506C57642F8A7DC4E852⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3920
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C52B4FB77EF93E246D62735E32614843 E Global\MSI00002⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe-NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Windows\SystemTemp\pssBC3E.ps1" -propFile "C:\Windows\SystemTemp\msiBC2C.txt" -scriptFile "C:\Windows\SystemTemp\scrBC2D.ps1" -scriptArgsFile "C:\Windows\SystemTemp\scrBC2E.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."3⤵
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2364
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
721KB
MD55a1f2196056c0a06b79a77ae981c7761
SHA1a880ae54395658f129e24732800e207ecd0b5603
SHA25652f41817669af7ac55b1516894ee705245c3148f2997fa0e6617e9cc6353e41e
SHA5129afc180ebc10c0ee0d7306f4b7085608a4e69321044d474691587bf7e63f945888781a9fc5e69568d351ac690b0335214bd04bdf5c75fd8a3bd1ec4be5d3475a
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Roaming\Getintopc.com\EXE - Step 3 - Setup_Install 1.0.0\install\A9F990C\GetintoPC-Top-EXE.msi
Filesize3.0MB
MD5412ab643d36494c1bee50fa456bb7e72
SHA11544c26e54f82b20db4fa794a38d930f5c6c8916
SHA256bd0d85ee49dfe1715698bb723f8b451e8a3e95ce8b2191c9d56227f593665218
SHA5121287e3dae4f5740514590056b2d72a082fbc6caf2d25b58c1b6e7c8cead1f5e3a68c662aaaca198277e93e98c87ead1c2a4527f3049dcc1c735f89cd44ca2d9b
-
C:\Users\Admin\AppData\Roaming\Getintopc.com\EXE - Step 3 - Setup_Install 1.0.0\install\A9F990C\LocalAppDataFolder\Updates\WindowsService.exe
Filesize65KB
MD59ceadcfe7e7535b2088f1fcf3c4b30c7
SHA1b5077627fb7b66d6a96f5db213e80c937171d2f9
SHA2565af9e89a7bfcfcae1c75de6acb7194b667d13776b61e79ea8aeab95f0af76bc7
SHA5121e36b9c493ed164784df1cdb198bda6baf2b8e6a53346ae84938ded60e9e627bad1c99a43756a84056c6760178e27643a8437d30db9c5bdc61afffce492fafda
-
Filesize
838KB
MD54a3f6a4023abd6bba56534de47d20017
SHA102dd888e467143e2e35465d73f39cf3e66afad10
SHA256a8dfdc283ad8d4dc6f500ddfab564e79dadae075c0d54784b50e1ca548709b30
SHA512580c7918ef90eb0020901bab645b72bcaf945ceb5bd56c2e7847f229b31a961bc4cd4ca9cb2583db480947ca8a0880b5ae4bd26717217abcacc9754352aaba28
-
Filesize
206KB
MD58f2b86dbdb785bf7bccea3a2069a10f4
SHA120c1b9626bb505d62a00ebb61ece4735a68d915d
SHA256ef258d170f3e3605acb90ff7df07d2d39954de8c41305dba1a3d8a2d594e9e4e
SHA512446f840f58e9a3e967421ef791ee646bec027cd0d26dbb65874791080fcc2385dec5bcbb060946a35ba4eec833ee8789b32ea46bd57c996e429baca6352f77fd
-
Filesize
743KB
MD5e92be2ea6cbab4b209fdb91999efa600
SHA13a78425b5d9094945ab20257900da3f05f146465
SHA256d5249e4b26c8a396c8d3806e0fd8ba01806520fd546d815cc912e693463c699a
SHA512215f81ac83f64eb3706444d4e018a1f25c09f6bb93432097f5262ee32484cfa1362fb43c91ff12be9611342b6151c09a5381a1dca51ae85beb49e4a9d5edee2c
-
Filesize
6KB
MD530c30ef2cb47e35101d13402b5661179
SHA125696b2aab86a9233f19017539e2dd83b2f75d4e
SHA25653094df6fa4e57a3265ff04bc1e970c10bcdb3d4094ad6dd610c05b7a8b79e0f
SHA512882be2768138bb75ff7dde7d5ca4c2e024699398baacd0ce1d4619902402e054297e4f464d8cb3c22b2f35d3dabc408122c207facad64ec8014f2c54834cf458
-
Filesize
628B
MD540b55328de4484462f6c1154013489d8
SHA1dd31380ab0327bc6feb2bceb3e996750a52a9b1a
SHA2560980664d6e0eebdc85552ce9f1b951d8ef34225d91aae6dccb82563e74432140
SHA5127b0b38f42f07a755ba6f858f74f0259f92f80555106cbc4c99a11c4279406073296227e264df09e74ef253ec10d8286fd688abe36602ff881ee8ccb7c1058c27