Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09-10-2024 17:45
Static task
static1
Behavioral task
behavioral1
Sample
EZFN Launcher_1.2.5_x64_en-US.msi
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
EZFN Launcher_1.2.5_x64_en-US.msi
Resource
win10v2004-20241007-en
windows10-2004-x64
28 signatures
150 seconds
General
-
Target
EZFN Launcher_1.2.5_x64_en-US.msi
-
Size
7.1MB
-
MD5
e418e4a9cb75024e14e1ec3e6e91e0a0
-
SHA1
6d82c663a6dcbe522c2cec7152be8acf53832196
-
SHA256
641082b5805ad60fe6493dd36bae8dfc390940bd1d15add162bef02345ff3f0e
-
SHA512
b921d77f1dafe44a6018c9552c3e216fd86cbd6e3e0c758dee0db3e7cb142c0178b8aad11dd2432696a121cb6d496b49431e79d8fe024afe58e987890a855c7d
-
SSDEEP
196608:FrBn5fZ9AA/AwF532R11xsNqe7I85IYYF1V:FLrdFgzsNB7I2IYY
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
pid Process 1424 powershell.exe 1424 powershell.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe -
Drops file in Program Files directory 16 IoCs
description ioc Process File created C:\Program Files\EZFN Launcher\_up_\public\season_images\Season1.webp msiexec.exe File created C:\Program Files\EZFN Launcher\EZFN Launcher.exe msiexec.exe File created C:\Program Files\EZFN Launcher\_up_\public\season_images\Season11.webp msiexec.exe File created C:\Program Files\EZFN Launcher\_up_\public\season_images\Season8.webp msiexec.exe File created C:\Program Files\EZFN Launcher\_up_\public\default_skin.png msiexec.exe File created C:\Program Files\EZFN Launcher\_up_\public\season_images\Season6.webp msiexec.exe File created C:\Program Files\EZFN Launcher\_up_\public\season_images\Season9.webp msiexec.exe File created C:\Program Files\EZFN Launcher\_up_\public\season_images\Season7.webp msiexec.exe File opened for modification C:\Program Files\EZFN Launcher\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File created C:\Program Files\EZFN Launcher\Uninstall EZFN Launcher.lnk msiexec.exe File created C:\Program Files\EZFN Launcher\_up_\public\season_images\Season10.webp msiexec.exe File created C:\Program Files\EZFN Launcher\_up_\public\season_images\Season3.webp msiexec.exe File created C:\Program Files\EZFN Launcher\_up_\public\season_images\Season15.webp msiexec.exe File created C:\Program Files\EZFN Launcher\_up_\public\season_images\Season4.webp msiexec.exe File created C:\Program Files\EZFN Launcher\_up_\public\season_images\Season2.webp msiexec.exe File created C:\Program Files\EZFN Launcher\_up_\public\season_images\Season5.webp msiexec.exe -
Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\Installer\f76e9f3.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIEAEB.tmp msiexec.exe File created C:\Windows\Installer\{4BB735E8-3588-4002-AEE1-43D83DEE70B5}\ProductIcon msiexec.exe File created C:\Windows\Installer\f76e9f5.msi msiexec.exe File opened for modification C:\Windows\Installer\f76e9f3.ipi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\f76e9f2.msi msiexec.exe File opened for modification C:\Windows\Installer\f76e9f2.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\{4BB735E8-3588-4002-AEE1-43D83DEE70B5}\ProductIcon msiexec.exe -
Loads dropped DLL 7 IoCs
pid Process 988 MsiExec.exe 616 msiexec.exe 616 msiexec.exe 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe -
Modifies data under HKEY_USERS 46 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D msiexec.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe -
Modifies registry class 35 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E537BB488532004EA1E348DD3EE075B\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E537BB488532004EA1E348DD3EE075B\SourceList\Media msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E537BB488532004EA1E348DD3EE075B\SourceList\Net msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\148EDAE345EAC3E54B1170CBD502D298 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Features\8E537BB488532004EA1E348DD3EE075B msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8E537BB488532004EA1E348DD3EE075B\External msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E537BB488532004EA1E348DD3EE075B\ProductName = "EZFN Launcher" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E537BB488532004EA1E348DD3EE075B\Language = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E537BB488532004EA1E348DD3EE075B\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E537BB488532004EA1E348DD3EE075B\SourceList\PackageName = "EZFN Launcher_1.2.5_x64_en-US.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E537BB488532004EA1E348DD3EE075B\SourceList\Media\1 = ";" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E537BB488532004EA1E348DD3EE075B\Clients = 3a0000000000 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E537BB488532004EA1E348DD3EE075B\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8E537BB488532004EA1E348DD3EE075B\MainProgram msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E537BB488532004EA1E348DD3EE075B msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E537BB488532004EA1E348DD3EE075B\PackageCode = "D03B14B87900F2546A11B9257902A0CA" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\148EDAE345EAC3E54B1170CBD502D298\8E537BB488532004EA1E348DD3EE075B msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8E537BB488532004EA1E348DD3EE075B msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8E537BB488532004EA1E348DD3EE075B\ShortcutsFeature = "MainProgram" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E537BB488532004EA1E348DD3EE075B\ProductIcon = "C:\\Windows\\Installer\\{4BB735E8-3588-4002-AEE1-43D83DEE70B5}\\ProductIcon" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E537BB488532004EA1E348DD3EE075B\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Products\8E537BB488532004EA1E348DD3EE075B msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E537BB488532004EA1E348DD3EE075B\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8E537BB488532004EA1E348DD3EE075B msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E537BB488532004EA1E348DD3EE075B\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E537BB488532004EA1E348DD3EE075B\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Products\8E537BB488532004EA1E348DD3EE075B\SourceList msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E537BB488532004EA1E348DD3EE075B msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E537BB488532004EA1E348DD3EE075B\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\148EDAE345EAC3E54B1170CBD502D298 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E537BB488532004EA1E348DD3EE075B\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8E537BB488532004EA1E348DD3EE075B\Environment = "MainProgram" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E537BB488532004EA1E348DD3EE075B\Version = "16908293" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E537BB488532004EA1E348DD3EE075B\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E537BB488532004EA1E348DD3EE075B\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 616 msiexec.exe 616 msiexec.exe 1424 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2224 msiexec.exe Token: SeIncreaseQuotaPrivilege 2224 msiexec.exe Token: SeRestorePrivilege 616 msiexec.exe Token: SeTakeOwnershipPrivilege 616 msiexec.exe Token: SeSecurityPrivilege 616 msiexec.exe Token: SeCreateTokenPrivilege 2224 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2224 msiexec.exe Token: SeLockMemoryPrivilege 2224 msiexec.exe Token: SeIncreaseQuotaPrivilege 2224 msiexec.exe Token: SeMachineAccountPrivilege 2224 msiexec.exe Token: SeTcbPrivilege 2224 msiexec.exe Token: SeSecurityPrivilege 2224 msiexec.exe Token: SeTakeOwnershipPrivilege 2224 msiexec.exe Token: SeLoadDriverPrivilege 2224 msiexec.exe Token: SeSystemProfilePrivilege 2224 msiexec.exe Token: SeSystemtimePrivilege 2224 msiexec.exe Token: SeProfSingleProcessPrivilege 2224 msiexec.exe Token: SeIncBasePriorityPrivilege 2224 msiexec.exe Token: SeCreatePagefilePrivilege 2224 msiexec.exe Token: SeCreatePermanentPrivilege 2224 msiexec.exe Token: SeBackupPrivilege 2224 msiexec.exe Token: SeRestorePrivilege 2224 msiexec.exe Token: SeShutdownPrivilege 2224 msiexec.exe Token: SeDebugPrivilege 2224 msiexec.exe Token: SeAuditPrivilege 2224 msiexec.exe Token: SeSystemEnvironmentPrivilege 2224 msiexec.exe Token: SeChangeNotifyPrivilege 2224 msiexec.exe Token: SeRemoteShutdownPrivilege 2224 msiexec.exe Token: SeUndockPrivilege 2224 msiexec.exe Token: SeSyncAgentPrivilege 2224 msiexec.exe Token: SeEnableDelegationPrivilege 2224 msiexec.exe Token: SeManageVolumePrivilege 2224 msiexec.exe Token: SeImpersonatePrivilege 2224 msiexec.exe Token: SeCreateGlobalPrivilege 2224 msiexec.exe Token: SeCreateTokenPrivilege 2224 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2224 msiexec.exe Token: SeLockMemoryPrivilege 2224 msiexec.exe Token: SeIncreaseQuotaPrivilege 2224 msiexec.exe Token: SeMachineAccountPrivilege 2224 msiexec.exe Token: SeTcbPrivilege 2224 msiexec.exe Token: SeSecurityPrivilege 2224 msiexec.exe Token: SeTakeOwnershipPrivilege 2224 msiexec.exe Token: SeLoadDriverPrivilege 2224 msiexec.exe Token: SeSystemProfilePrivilege 2224 msiexec.exe Token: SeSystemtimePrivilege 2224 msiexec.exe Token: SeProfSingleProcessPrivilege 2224 msiexec.exe Token: SeIncBasePriorityPrivilege 2224 msiexec.exe Token: SeCreatePagefilePrivilege 2224 msiexec.exe Token: SeCreatePermanentPrivilege 2224 msiexec.exe Token: SeBackupPrivilege 2224 msiexec.exe Token: SeRestorePrivilege 2224 msiexec.exe Token: SeShutdownPrivilege 2224 msiexec.exe Token: SeDebugPrivilege 2224 msiexec.exe Token: SeAuditPrivilege 2224 msiexec.exe Token: SeSystemEnvironmentPrivilege 2224 msiexec.exe Token: SeChangeNotifyPrivilege 2224 msiexec.exe Token: SeRemoteShutdownPrivilege 2224 msiexec.exe Token: SeUndockPrivilege 2224 msiexec.exe Token: SeSyncAgentPrivilege 2224 msiexec.exe Token: SeEnableDelegationPrivilege 2224 msiexec.exe Token: SeManageVolumePrivilege 2224 msiexec.exe Token: SeImpersonatePrivilege 2224 msiexec.exe Token: SeCreateGlobalPrivilege 2224 msiexec.exe Token: SeCreateTokenPrivilege 2224 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2224 msiexec.exe 2224 msiexec.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 616 wrote to memory of 988 616 msiexec.exe 31 PID 616 wrote to memory of 988 616 msiexec.exe 31 PID 616 wrote to memory of 988 616 msiexec.exe 31 PID 616 wrote to memory of 988 616 msiexec.exe 31 PID 616 wrote to memory of 988 616 msiexec.exe 31 PID 616 wrote to memory of 988 616 msiexec.exe 31 PID 616 wrote to memory of 988 616 msiexec.exe 31 PID 616 wrote to memory of 1424 616 msiexec.exe 36 PID 616 wrote to memory of 1424 616 msiexec.exe 36 PID 616 wrote to memory of 1424 616 msiexec.exe 36 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\EZFN Launcher_1.2.5_x64_en-US.msi"1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2224
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5CD74E86A02789FC1C03817D86719917 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:988
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -windowstyle hidden try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 } catch {}; Invoke-WebRequest -Uri "https://go.microsoft.com/fwlink/p/?LinkId=2124703" -OutFile "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" ; Start-Process -FilePath "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" -ArgumentList ( '/install') -Wait2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:1424
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:2448
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000598" "00000000000005E0"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2772
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD583a8d1b9f0373d535000ec0cbcaf2447
SHA12dbc25a817ad607e5fc0eae85bd52544e796ef23
SHA256e356df142548d343d92860729a896916f07ea3fe04a5ca6d76a1d594c378b022
SHA5120e30b51012482d7151d7246d5b0febc9ee930327f8ff61c59473be70f82981a7d74fa503b30238dca62de57d9778404a4229ebd5c04bdd743ee0127b1bdcfafc
-
Filesize
113KB
MD54fdd16752561cf585fed1506914d73e0
SHA1f00023b9ae3c8ce5b7bb92f25011eaebe6f9d424
SHA256aecd2d2fe766f6d439acc2bbf1346930ecc535012cf5ad7b3273d2875237b7e7
SHA5123695e7eb1e35ec959243a91ab5b4454eb59aeef0f2699aa5de8e03de8fbb89f756a89130526da5c08815408cb700284a17936522ad2cad594c3e6e9d18a3f600
-
Filesize
7.1MB
MD5e418e4a9cb75024e14e1ec3e6e91e0a0
SHA16d82c663a6dcbe522c2cec7152be8acf53832196
SHA256641082b5805ad60fe6493dd36bae8dfc390940bd1d15add162bef02345ff3f0e
SHA512b921d77f1dafe44a6018c9552c3e216fd86cbd6e3e0c758dee0db3e7cb142c0178b8aad11dd2432696a121cb6d496b49431e79d8fe024afe58e987890a855c7d
-
Filesize
8.3MB
MD595cf8c442bc70aca96b084d92e9b7ea7
SHA19b1892061796eb3cd0659e79d5d0012015a04513
SHA256a733c515622fe402415ad61df3abc80768fe3e1fb87739bffd07c08d439fd9ee
SHA512dc62282ab762a75e829056c024a14377c73beed7b92df22927bf18d1888c2020a919f5043572261fada2d1e4e823cd41ef1a01a5dc9f3e50fb16d26a66a35195