Analysis
- max time kernel
126s - max time network
85s - platform
windows7_x64 - resource
win7-20240729-en - resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system - submitted
10/09/2024, 02:09
Static task
static1
Behavioral task
behavioral1
Sample
b4346702b4b5029cbd627b5df724550f8b783ba22876e5070dadc0ed5c214df2.msi
Resource
win7-20240729-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
b4346702b4b5029cbd627b5df724550f8b783ba22876e5070dadc0ed5c214df2.msi
Resource
win10v2004-20240802-en
windows10-2004-x64
17 signatures
150 seconds
General
- Target b4346702b4b5029cbd627b5df724550f8b783ba22876e5070dadc0ed5c214df2.msi
- Size 23.0MB
- Sample240910-clb95atcra
- SHA256 b4346702b4b5029cbd627b5df724550f8b783ba22876e5070dadc0ed5c214df2
- MD5 4295dda40427af8df6738b3531d63389
- SHA1 cb5a45de787c34eda399a3cad64abd3b6133f514
- SHA512 31ae6245cc6188e9d8b471c9cb169263fb7189e3d7653266857db01e3b92b1773ddc1971e3468734f48294f48aaf1a1e93b21d3ffc89dc30f6fcf8549c6a24e2
- SSDEEP 393216:u66L7jpW/sxwA0Ip5AGgrJmD1Y5D9xAgAmBOn4AZENqMJiaErOQtt4KgTD5v2X:uHWUxOQxZDKNfAuOri9rQtlKy
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 2128 created 1244 2128 MsiExec.exe 21 - Blocklisted process makes network request 4 IoCs
flow pid Process 3 2636 msiexec.exe 6 2636 msiexec.exe 7 2636 msiexec.exe 8 1496 msiexec.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe - Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\Installer\f77b55b.msi msiexec.exe File created C:\Windows\Installer\f77b55c.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIC234.tmp msiexec.exe File opened for modification C:\Windows\Installer\f77b55c.ipi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\f77b55b.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIB72B.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\f77b55e.msi msiexec.exe - Loads dropped DLL 1 IoCs
pid Process 2128 MsiExec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2636 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dialer.exe - Modifies data under HKEY_USERS 46 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D msiexec.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe - Modifies registry class 22 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\Version = "16777216" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A425586BD2489EF4F8012A4FFEF4857B msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\SourceList\Media\1 = ";" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F44E241F0BCCADE479DE975C6A0CB160 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\ProductName = "Installer" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\PackageCode = "7A74966847EC2A34B99EB7B98AF9DD09" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\DeploymentFlags = "2" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F44E241F0BCCADE479DE975C6A0CB160\DefaultFeature msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A425586BD2489EF4F8012A4FFEF4857B\F44E241F0BCCADE479DE975C6A0CB160 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\SourceList\PackageName = "b4346702b4b5029cbd627b5df724550f8b783ba22876e5070dadc0ed5c214df2.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2128 MsiExec.exe 2128 MsiExec.exe 1536 dialer.exe 1536 dialer.exe 1496 msiexec.exe 1496 msiexec.exe 1536 dialer.exe 1536 dialer.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 916 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2636 msiexec.exe Token: SeIncreaseQuotaPrivilege 2636 msiexec.exe Token: SeRestorePrivilege 1496 msiexec.exe Token: SeTakeOwnershipPrivilege 1496 msiexec.exe Token: SeSecurityPrivilege 1496 msiexec.exe Token: SeCreateTokenPrivilege 2636 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2636 msiexec.exe Token: SeLockMemoryPrivilege 2636 msiexec.exe Token: SeIncreaseQuotaPrivilege 2636 msiexec.exe Token: SeMachineAccountPrivilege 2636 msiexec.exe Token: SeTcbPrivilege 2636 msiexec.exe Token: SeSecurityPrivilege 2636 msiexec.exe Token: SeTakeOwnershipPrivilege 2636 msiexec.exe Token: SeLoadDriverPrivilege 2636 msiexec.exe Token: SeSystemProfilePrivilege 2636 msiexec.exe Token: SeSystemtimePrivilege 2636 msiexec.exe Token: SeProfSingleProcessPrivilege 2636 msiexec.exe Token: SeIncBasePriorityPrivilege 2636 msiexec.exe Token: SeCreatePagefilePrivilege 2636 msiexec.exe Token: SeCreatePermanentPrivilege 2636 msiexec.exe Token: SeBackupPrivilege 2636 msiexec.exe Token: SeRestorePrivilege 2636 msiexec.exe Token: SeShutdownPrivilege 2636 msiexec.exe Token: SeDebugPrivilege 2636 msiexec.exe Token: SeAuditPrivilege 2636 msiexec.exe Token: SeSystemEnvironmentPrivilege 2636 msiexec.exe Token: SeChangeNotifyPrivilege 2636 msiexec.exe Token: SeRemoteShutdownPrivilege 2636 msiexec.exe Token: SeUndockPrivilege 2636 msiexec.exe Token: SeSyncAgentPrivilege 2636 msiexec.exe Token: SeEnableDelegationPrivilege 2636 msiexec.exe Token: SeManageVolumePrivilege 2636 msiexec.exe Token: SeImpersonatePrivilege 2636 msiexec.exe Token: SeCreateGlobalPrivilege 2636 msiexec.exe Token: SeBackupPrivilege 1948 vssvc.exe Token: SeRestorePrivilege 1948 vssvc.exe Token: SeAuditPrivilege 1948 vssvc.exe Token: SeBackupPrivilege 1496 msiexec.exe Token: SeRestorePrivilege 1496 msiexec.exe Token: SeRestorePrivilege 2736 DrvInst.exe Token: SeRestorePrivilege 2736 DrvInst.exe Token: SeRestorePrivilege 2736 DrvInst.exe Token: SeRestorePrivilege 2736 DrvInst.exe Token: SeRestorePrivilege 2736 DrvInst.exe Token: SeRestorePrivilege 2736 DrvInst.exe Token: SeRestorePrivilege 2736 DrvInst.exe Token: SeLoadDriverPrivilege 2736 DrvInst.exe Token: SeLoadDriverPrivilege 2736 DrvInst.exe Token: SeLoadDriverPrivilege 2736 DrvInst.exe Token: SeRestorePrivilege 1496 msiexec.exe Token: SeTakeOwnershipPrivilege 1496 msiexec.exe Token: SeRestorePrivilege 1496 msiexec.exe Token: SeTakeOwnershipPrivilege 1496 msiexec.exe Token: SeShutdownPrivilege 916 msiexec.exe Token: SeIncreaseQuotaPrivilege 916 msiexec.exe Token: SeCreateTokenPrivilege 916 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 916 msiexec.exe Token: SeLockMemoryPrivilege 916 msiexec.exe Token: SeIncreaseQuotaPrivilege 916 msiexec.exe Token: SeMachineAccountPrivilege 916 msiexec.exe Token: SeTcbPrivilege 916 msiexec.exe Token: SeSecurityPrivilege 916 msiexec.exe Token: SeTakeOwnershipPrivilege 916 msiexec.exe Token: SeLoadDriverPrivilege 916 msiexec.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2636 msiexec.exe 916 msiexec.exe 2636 msiexec.exe - Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1496 wrote to memory of 2128 1496 msiexec.exe 34 PID 1496 wrote to memory of 2128 1496 msiexec.exe 34 PID 1496 wrote to memory of 2128 1496 msiexec.exe 34 PID 1496 wrote to memory of 2128 1496 msiexec.exe 34 PID 1496 wrote to memory of 2128 1496 msiexec.exe 34 PID 1496 wrote to memory of 2128 1496 msiexec.exe 34 PID 1496 wrote to memory of 2128 1496 msiexec.exe 34 PID 2128 wrote to memory of 916 2128 MsiExec.exe 35 PID 2128 wrote to memory of 916 2128 MsiExec.exe 35 PID 2128 wrote to memory of 916 2128 MsiExec.exe 35 PID 2128 wrote to memory of 916 2128 MsiExec.exe 35 PID 2128 wrote to memory of 916 2128 MsiExec.exe 35 PID 2128 wrote to memory of 916 2128 MsiExec.exe 35 PID 2128 wrote to memory of 916 2128 MsiExec.exe 35 PID 2128 wrote to memory of 1536 2128 MsiExec.exe 36 PID 2128 wrote to memory of 1536 2128 MsiExec.exe 36 PID 2128 wrote to memory of 1536 2128 MsiExec.exe 36 PID 2128 wrote to memory of 1536 2128 MsiExec.exe 36 PID 2128 wrote to memory of 1536 2128 MsiExec.exe 36 PID 2128 wrote to memory of 1536 2128 MsiExec.exe 36 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1244
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\b4346702b4b5029cbd627b5df724550f8b783ba22876e5070dadc0ed5c214df2.msi2⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2636
-
-
C:\Windows\SysWOW64\dialer.exe"C:\Windows\system32\dialer.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1536
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding AD2774D903FC71D44327A4B1F5E13CA42⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\dXNlcg==.msi"3⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:916
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1948
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003E0" "00000000000003D4"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2736
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\f77b55d.rbs
- Size 6KB
- SHA256 b15de284b5e2a7aca2034f0ef6ebce413c6c4a8664044ca24d613f3df47728ff
- MD5 5d2b3677b2e3b97f40b13b2ca36d925f
- SHA1 455c978e9a49be17c4c91c1737d0f1b42618ee06
- SHA512 c4f39c161bacf7895270798e9c7ccff00f0911a1371ae555783cb75e71dc0d737454312f8acbcc2eb3b844ff1ff47cefdcf2ba9c1b2056f9eaf2cfce018c549c
- SSDEEP 96:HtTeP7eCfurUXrFQxlTCsAqSdUXrFQxlTC6jY1nlAqSIHS35cmWf2jjCMpujidN4:HJUe4X+TOYX+TOSZyMp9s
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07298EE8EBA9732300AE62BDCA6B6898
- Size 1KB
- SHA256 2e7bf16cc22485a7bbe2aa8696750761b0ae39be3b2fe9d0cc6d4ef73491425c
- MD5 e11e31581aae545302f6176a117b4d95
- SHA1 743af0529bd032a0f44a83cdd4baa97b7c2ec49a
- SHA512 c63aba6ca79c60a92b3bd26d784a5436e45a626022958bf6c194afc380c7bfb01fadf0b772513bbdbd7f1bb73691b0edb2f60b2f235ec9e0b81c427e04fbe451
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07298EE8EBA9732300AE62BDCA6B6898
- Size 312B
- SHA256 7853aff454af2d1e7094b4b2010f315d28de38c2c72431e7bf99c95e19269b92
- MD5 54c3c7bbc4abf692986fa54303d589be
- SHA1 d5481a3fdc0066a6afdf6a1631ff5497fd108494
- SHA512 ef821bc51c780decdaffa92289fb3aca51a88fcf461483496e7cbc4fc83755dc5c94d8f24d71610a5e31d6d523b2814761ff675600b952ecd0045fed07a93878
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 96fc478a58e09e9a9534667735fc3786866262754b9e64a512fef01502db0b69
- MD5 19ed51470a28e0ce12424b587157da3f
- SHA1 eaa29672f59f59e353d5371a188ea0890a2edcd7
- SHA512 1e214b5c96b054a932ebff375bc5cadac3f7f6767aa628649c896c908d1bfe76372b25844a173c3c0f9c78a66442cc9bb439c9ecbdc744910844c133f2a6246a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Cab5959.tmp
- Size 70KB
- SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
- MD5 49aebf8cbd62d92ac215b2923fb1b9f5
- SHA1 1723be06719828dda65ad804298d0431f6aff976
- SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
- SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar941A.tmp
- Size 181KB
- SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
- MD5 4ea6026cf93ec6338144661bf1202cd1
- SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
- SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
- SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\dXNlcg==.msi
- Size 22.3MB
- SHA256 96811ea4f9266ba8ee5c758c146fbc84f3cfe5ec4c5c966b5885e11b5f696f74
- MD5 e969fa4b30951a66e9bf28b21fd75174
- SHA1 dc818acf470ad20f56f464e4839650564f023a7f
- SHA512 6da2ec033f58843a06270ef04c55ba0ee8449df685f1902ab953bf511acd0a4735532db3bff73858c082005b4df27d5c376a4fb324f9506b85564356286b0f68
- SSDEEP 393216:mVRJXHgNhsJrafxTcoJdmNcYaXt4l5hAYLBC96O6GrpBJ8HjQPiRbnVY//:GbWGrNoJ425t4l5hPMtBJejQoVY//
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSIB72B.tmp
- Size 193KB
- SHA256 dbe502732e67c80c03fba12a885f3c68023eeff31fcde8170f4733d8261b540e
- MD5 7e274959f4347527c246a2c6343105e7
- SHA1 8885c1a2624ccd01102d9eabfa9050fd19093f16
- SHA512 bf4666efec860030f2795ebdb5ed34a11f2611a342ea1b752dd232072425420b9155804fc43ed7546c4fd3973bc68cdfc9c5cd9765d3c529891a0862173df4b9
- SSDEEP 3072:jPdNGLLCYm8dRtNxJApFR4KYGIh1InvVeLpF9ZWGyRkVY0fhucg0rE13w0g:DdNGL9BUR4KY16vVgRJrE9w0
- MD5 SHA1 SHA512 SSDEEP