Analysis Overview
SHA256
0f883120e7c89e23ab672fe5a819774ff9a1054563f83e5f8cc16bf9eacd082c
Threat Level: Known bad
The file 0f883120e7c89e23ab672fe5a819774ff9a1054563f83e5f8cc16bf9eacd082cN was found to be: Known bad.
Malicious Activity Summary
Floxif family
Floxif, Floodfix
Detects Floxif payload
ACProtect 1.3x - 1.4x DLL software
Loads dropped DLL
Executes dropped EXE
Enumerates connected drives
UPX packed file
Drops file in Windows directory
Drops file in Program Files directory
System Location Discovery: System Language Discovery
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Modifies data under HKEY_USERS
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-11-09 12:12
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-09 12:12
Reported
2024-11-09 12:12
Platform
win7-20240903-en
Max time kernel
17s
Max time network
16s
Command Line
Signatures
Floxif family
Floxif, Floodfix
Detects Floxif payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
ACProtect 1.3x - 1.4x DLL software
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | \??\c:\6124cf06e36fa5214311\install.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\0f883120e7c89e23ab672fe5a819774ff9a1054563f83e5f8cc16bf9eacd082cN.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\0f883120e7c89e23ab672fe5a819774ff9a1054563f83e5f8cc16bf9eacd082cN.exe | N/A |
| N/A | N/A | \??\c:\6124cf06e36fa5214311\install.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\0f883120e7c89e23ab672fe5a819774ff9a1054563f83e5f8cc16bf9eacd082cN.exe | N/A |
Enumerates connected drives
| Description | Indicator | Process | Target |
| File opened (read-only) | \??\e: | C:\Users\Admin\AppData\Local\Temp\0f883120e7c89e23ab672fe5a819774ff9a1054563f83e5f8cc16bf9eacd082cN.exe | N/A |
| File opened (read-only) | \??\M: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\P: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\Q: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\S: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\O: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\T: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\Y: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\G: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\I: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\J: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\K: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\N: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\Z: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\A: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\B: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\R: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\W: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\X: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\E: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\H: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\L: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\U: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\V: | C:\Windows\system32\msiexec.exe | N/A |
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File created | C:\Program Files\Common Files\System\symsrv.dll | C:\Users\Admin\AppData\Local\Temp\0f883120e7c89e23ab672fe5a819774ff9a1054563f83e5f8cc16bf9eacd082cN.exe | N/A |
| File created | \??\c:\program files\common files\system\symsrv.dll.000 | C:\Users\Admin\AppData\Local\Temp\0f883120e7c89e23ab672fe5a819774ff9a1054563f83e5f8cc16bf9eacd082cN.exe | N/A |
| File opened for modification | \??\c:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia90.dll | C:\Windows\system32\msiexec.exe | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File created | \??\c:\Windows\Installer\f76fdb2.ipi | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | \??\c:\Windows\Installer\ | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\Installer\MSICEC.tmp | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | \??\c:\Windows\Installer\f76fdb2.ipi | C:\Windows\system32\msiexec.exe | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\0f883120e7c89e23ab672fe5a819774ff9a1054563f83e5f8cc16bf9eacd082cN.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\6124cf06e36fa5214311\install.exe | N/A |
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Key deleted | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E | C:\Windows\system32\msiexec.exe | N/A |
| Key deleted | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D | C:\Windows\system32\msiexec.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E | C:\Windows\system32\msiexec.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\0f883120e7c89e23ab672fe5a819774ff9a1054563f83e5f8cc16bf9eacd082cN.exe | N/A |
| N/A | N/A | C:\Windows\system32\msiexec.exe | N/A |
| N/A | N/A | C:\Windows\system32\msiexec.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\0f883120e7c89e23ab672fe5a819774ff9a1054563f83e5f8cc16bf9eacd082cN.exe | N/A |
| Token: SeShutdownPrivilege | N/A | \??\c:\6124cf06e36fa5214311\install.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | \??\c:\6124cf06e36fa5214311\install.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeCreateTokenPrivilege | N/A | \??\c:\6124cf06e36fa5214311\install.exe | N/A |
| Token: SeAssignPrimaryTokenPrivilege | N/A | \??\c:\6124cf06e36fa5214311\install.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | \??\c:\6124cf06e36fa5214311\install.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | \??\c:\6124cf06e36fa5214311\install.exe | N/A |
| Token: SeMachineAccountPrivilege | N/A | \??\c:\6124cf06e36fa5214311\install.exe | N/A |
| Token: SeTcbPrivilege | N/A | \??\c:\6124cf06e36fa5214311\install.exe | N/A |
| Token: SeSecurityPrivilege | N/A | \??\c:\6124cf06e36fa5214311\install.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | \??\c:\6124cf06e36fa5214311\install.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | \??\c:\6124cf06e36fa5214311\install.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | \??\c:\6124cf06e36fa5214311\install.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | \??\c:\6124cf06e36fa5214311\install.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | \??\c:\6124cf06e36fa5214311\install.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | \??\c:\6124cf06e36fa5214311\install.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | \??\c:\6124cf06e36fa5214311\install.exe | N/A |
| Token: SeCreatePermanentPrivilege | N/A | \??\c:\6124cf06e36fa5214311\install.exe | N/A |
| Token: SeBackupPrivilege | N/A | \??\c:\6124cf06e36fa5214311\install.exe | N/A |
| Token: SeRestorePrivilege | N/A | \??\c:\6124cf06e36fa5214311\install.exe | N/A |
| Token: SeShutdownPrivilege | N/A | \??\c:\6124cf06e36fa5214311\install.exe | N/A |
| Token: SeDebugPrivilege | N/A | \??\c:\6124cf06e36fa5214311\install.exe | N/A |
| Token: SeAuditPrivilege | N/A | \??\c:\6124cf06e36fa5214311\install.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | \??\c:\6124cf06e36fa5214311\install.exe | N/A |
| Token: SeChangeNotifyPrivilege | N/A | \??\c:\6124cf06e36fa5214311\install.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | \??\c:\6124cf06e36fa5214311\install.exe | N/A |
| Token: SeUndockPrivilege | N/A | \??\c:\6124cf06e36fa5214311\install.exe | N/A |
| Token: SeSyncAgentPrivilege | N/A | \??\c:\6124cf06e36fa5214311\install.exe | N/A |
| Token: SeEnableDelegationPrivilege | N/A | \??\c:\6124cf06e36fa5214311\install.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | \??\c:\6124cf06e36fa5214311\install.exe | N/A |
| Token: SeImpersonatePrivilege | N/A | \??\c:\6124cf06e36fa5214311\install.exe | N/A |
| Token: SeCreateGlobalPrivilege | N/A | \??\c:\6124cf06e36fa5214311\install.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeShutdownPrivilege | N/A | \??\c:\6124cf06e36fa5214311\install.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\0f883120e7c89e23ab672fe5a819774ff9a1054563f83e5f8cc16bf9eacd082cN.exe
"C:\Users\Admin\AppData\Local\Temp\0f883120e7c89e23ab672fe5a819774ff9a1054563f83e5f8cc16bf9eacd082cN.exe"
\??\c:\6124cf06e36fa5214311\install.exe
c:\6124cf06e36fa5214311\.\install.exe
C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 5isohu.com | udp |
| US | 8.8.8.8:53 | www.aieov.com | udp |
| US | 45.33.20.235:80 | www.aieov.com | tcp |
Files
memory/2464-0-0x0000000001005000-0x0000000001006000-memory.dmp
\Program Files\Common Files\System\symsrv.dll
| MD5 | 7574cf2c64f35161ab1292e2f532aabf |
| SHA1 | 14ba3fa927a06224dfe587014299e834def4644f |
| SHA256 | de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085 |
| SHA512 | 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab |
memory/2464-4-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2464-6-0x0000000001000000-0x000000000101E000-memory.dmp
\6124cf06e36fa5214311\install.exe
| MD5 | 4138c31964fbcb3b7418e086933324c3 |
| SHA1 | 97cc6f58fb064ab6c4a2f02fb665fef77d30532f |
| SHA256 | b72056fc3df6f46069294c243fe5006879bf4a9d8eef388369a590ca41745f29 |
| SHA512 | 40cf2f35c3a944fca93d58d66465f0308197f5485381ff07d3065e0f59e94fc3834313068e4e5e5da395413ff2d3d1c3ff6fa050f2256e118972bf21a5643557 |
\??\c:\6124cf06e36fa5214311\install.ini
| MD5 | f8f6c0e030cb622f065fe47d61da91d7 |
| SHA1 | cf6fa99747de8f35c6aea52df234c9c57583baa3 |
| SHA256 | c16727881c47a40077dc5a1f1ea71cbb28e3f4e156c0ae7074c6d7f5ecece21d |
| SHA512 | b70c6d67dac5e6a0dbd17e3bcf570a95914482abad20d0304c02da22231070b4bc887720dbae972bc5066457e1273b68fde0805f1c1791e9466a5ca343485cde |
\??\c:\6124cf06e36fa5214311\install.res.1033.dll
| MD5 | ff6003014eefc9c30abe20e3e1f5fbe8 |
| SHA1 | 4a5bd05f94545f01efc10232385b8fecad300678 |
| SHA256 | a522c5ea3250cdd538a9ce7b4a06dfd5123e7eb05eef67509f2b975a8e1d3067 |
| SHA512 | 3adc5c705bab7fa7b50517a5eb3301491f5150b56e1088ed436590458e963da204cd1875af75db89742403476a56a94c3f425c05327767bdb4bbee4859667ac2 |
\??\c:\6124cf06e36fa5214311\globdata.ini
| MD5 | 0a6b586fabd072bd7382b5e24194eac7 |
| SHA1 | 60e3c7215c1a40fbfb3016d52c2de44592f8ca95 |
| SHA256 | 7912e3fcf2698cf4f8625e563cd8215c6668739cae18bd6f27af2d25bec5c951 |
| SHA512 | b96b0448e9f0e94a7867b6bb103979e9ef2c0e074bcb85988d450d63de6edcf21dc83bb154aafb7de524af3c3734f0bb1ba649db0408612479322e1aa85be9f4 |
memory/2692-45-0x0000000000130000-0x0000000000131000-memory.dmp
\??\c:\6124cf06e36fa5214311\vc_red.msi
| MD5 | 7e641e6a0b456271745c20c3bb8a18f9 |
| SHA1 | ae6cedcb81dc443611a310140ae4671789dbbf3a |
| SHA256 | 34c5e7d7ea270ee67f92d34843d89603d6d3b6d9ef5247b43ae3c59c909d380d |
| SHA512 | f67d6bf69d094edcc93541332f31b326131ff89672edb30fd349def6952ad8bfd07dc2f0ca5967b48a7589eee5b7a14b9a2c1ebe0cba4ae2324f7957090ea903 |
\??\c:\6124cf06e36fa5214311\vcredist.bmp
| MD5 | 06fba95313f26e300917c6cea4480890 |
| SHA1 | 31beee44776f114078fc403e405eaa5936c4bc3b |
| SHA256 | 594884a8006e24ad5b1578cd7c75aca21171bb079ebdc4f6518905bcf2237ba1 |
| SHA512 | 7dca0f1ab5d3fd1ac8755142a7ca4d085bb0c2f12a7272e56159dadfa22da79ec8261815be71b9f5e7c32f6e8121ecb2443060f7db76feaf01eb193200e67dfd |
\6124cf06e36fa5214311\install.res.1033.dll.tmp
| MD5 | 0117b86ae22a53cd03596b4e591d3e90 |
| SHA1 | aca287513c9c8a0f535e1201a19123e78f98a307 |
| SHA256 | 07fc0ea97cd48c03ce2c8429a43e3a8592d847fe093d58087120667984a01348 |
| SHA512 | 78c3aa0e035308ca7de94749f878b4d6dc39a63d23397a1886d6dca4883fbb52e0693abebff986da0fe6705a4381486da4fa873f6bcf7239e8d917ae56bf8f15 |
C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI5158.txt
| MD5 | ae2951df6a86081f951bb60e4a1d2712 |
| SHA1 | 628c5bb4ae58d225ed4df6b51e60d06234aca7c1 |
| SHA256 | 52939b0d4b6821762a20be831f98e21c6019080f15c26f44a62df9d8880ae701 |
| SHA512 | 293c8f73f9e5a69f50da3108ff10de1385269e4cf6be0883069f62283c2a458b94dbbb9569a174c2b4b40da95f4cb3570cc0e4c550a99f5f606cb1cfe75e091a |
memory/2464-57-0x0000000001005000-0x0000000001006000-memory.dmp
memory/2464-58-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2464-59-0x0000000001000000-0x000000000101E000-memory.dmp
memory/2464-60-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2692-61-0x0000000075220000-0x0000000075237000-memory.dmp
memory/2692-62-0x0000000000130000-0x0000000000131000-memory.dmp
memory/2464-88-0x0000000001000000-0x000000000101E000-memory.dmp
memory/2464-87-0x0000000010000000-0x0000000010030000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-11-09 12:12
Reported
2024-11-09 12:13
Platform
win10v2004-20241007-en
Max time kernel
16s
Max time network
17s
Command Line
Signatures
Floxif family
Floxif, Floodfix
Detects Floxif payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
ACProtect 1.3x - 1.4x DLL software
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | \??\c:\6ab220b62523e330606df8\install.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\0f883120e7c89e23ab672fe5a819774ff9a1054563f83e5f8cc16bf9eacd082cN.exe | N/A |
| N/A | N/A | \??\c:\6ab220b62523e330606df8\install.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\0f883120e7c89e23ab672fe5a819774ff9a1054563f83e5f8cc16bf9eacd082cN.exe | N/A |
Enumerates connected drives
| Description | Indicator | Process | Target |
| File opened (read-only) | \??\G: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\I: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\O: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\Q: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\W: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\e: | C:\Users\Admin\AppData\Local\Temp\0f883120e7c89e23ab672fe5a819774ff9a1054563f83e5f8cc16bf9eacd082cN.exe | N/A |
| File opened (read-only) | \??\J: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\K: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\M: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\T: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\U: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\X: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\A: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\R: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\S: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\Y: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\Z: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\N: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\E: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\H: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\L: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\P: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\V: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\B: | C:\Windows\system32\msiexec.exe | N/A |
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File created | C:\Program Files\Common Files\System\symsrv.dll | C:\Users\Admin\AppData\Local\Temp\0f883120e7c89e23ab672fe5a819774ff9a1054563f83e5f8cc16bf9eacd082cN.exe | N/A |
| File created | \??\c:\program files\common files\system\symsrv.dll.000 | C:\Users\Admin\AppData\Local\Temp\0f883120e7c89e23ab672fe5a819774ff9a1054563f83e5f8cc16bf9eacd082cN.exe | N/A |
| File opened for modification | \??\c:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia90.dll | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | \??\c:\Program Files (x86)\Common Files\Microsoft Shared\VC\ | C:\Windows\system32\msiexec.exe | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\Installer\inprogressinstallinfo.ipi | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\Installer\MSI9EFF.tmp | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | \??\c:\Windows\Installer\ | C:\Windows\system32\msiexec.exe | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\0f883120e7c89e23ab672fe5a819774ff9a1054563f83e5f8cc16bf9eacd082cN.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | \??\c:\6ab220b62523e330606df8\install.exe | N/A |
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" | C:\Windows\system32\LogonUI.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 | C:\Windows\system32\msiexec.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" | C:\Windows\system32\LogonUI.exe | N/A |
| Key deleted | \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E | C:\Windows\system32\msiexec.exe | N/A |
| Key deleted | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 | C:\Windows\system32\msiexec.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "46" | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 | C:\Windows\system32\LogonUI.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" | C:\Windows\system32\LogonUI.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" | C:\Windows\system32\LogonUI.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\0f883120e7c89e23ab672fe5a819774ff9a1054563f83e5f8cc16bf9eacd082cN.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\0f883120e7c89e23ab672fe5a819774ff9a1054563f83e5f8cc16bf9eacd082cN.exe | N/A |
| N/A | N/A | C:\Windows\system32\msiexec.exe | N/A |
| N/A | N/A | C:\Windows\system32\msiexec.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\LogonUI.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 208 wrote to memory of 4452 | N/A | C:\Users\Admin\AppData\Local\Temp\0f883120e7c89e23ab672fe5a819774ff9a1054563f83e5f8cc16bf9eacd082cN.exe | \??\c:\6ab220b62523e330606df8\install.exe |
| PID 208 wrote to memory of 4452 | N/A | C:\Users\Admin\AppData\Local\Temp\0f883120e7c89e23ab672fe5a819774ff9a1054563f83e5f8cc16bf9eacd082cN.exe | \??\c:\6ab220b62523e330606df8\install.exe |
| PID 208 wrote to memory of 4452 | N/A | C:\Users\Admin\AppData\Local\Temp\0f883120e7c89e23ab672fe5a819774ff9a1054563f83e5f8cc16bf9eacd082cN.exe | \??\c:\6ab220b62523e330606df8\install.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\0f883120e7c89e23ab672fe5a819774ff9a1054563f83e5f8cc16bf9eacd082cN.exe
"C:\Users\Admin\AppData\Local\Temp\0f883120e7c89e23ab672fe5a819774ff9a1054563f83e5f8cc16bf9eacd082cN.exe"
\??\c:\6ab220b62523e330606df8\install.exe
c:\6ab220b62523e330606df8\.\install.exe
C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39bb855 /state1:0x41c64e6d
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 58.55.71.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 106.209.201.84.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 5isohu.com | udp |
| US | 8.8.8.8:53 | www.aieov.com | udp |
| US | 45.79.19.196:80 | www.aieov.com | tcp |
| US | 8.8.8.8:53 | 69.31.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 196.19.79.45.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 5isohu.com | udp |
| US | 45.79.19.196:80 | www.aieov.com | tcp |
| US | 8.8.8.8:53 | 5isohu.com | udp |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| US | 45.79.19.196:80 | www.aieov.com | tcp |
| US | 8.8.8.8:53 | 133.211.185.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 23.173.189.20.in-addr.arpa | udp |
Files
memory/208-1-0x0000000001005000-0x0000000001006000-memory.dmp
C:\Program Files\Common Files\System\symsrv.dll
| MD5 | 7574cf2c64f35161ab1292e2f532aabf |
| SHA1 | 14ba3fa927a06224dfe587014299e834def4644f |
| SHA256 | de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085 |
| SHA512 | 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab |
memory/208-5-0x0000000010000000-0x0000000010030000-memory.dmp
memory/208-7-0x0000000001000000-0x000000000101E000-memory.dmp
C:\6ab220b62523e330606df8\install.exe
| MD5 | 4138c31964fbcb3b7418e086933324c3 |
| SHA1 | 97cc6f58fb064ab6c4a2f02fb665fef77d30532f |
| SHA256 | b72056fc3df6f46069294c243fe5006879bf4a9d8eef388369a590ca41745f29 |
| SHA512 | 40cf2f35c3a944fca93d58d66465f0308197f5485381ff07d3065e0f59e94fc3834313068e4e5e5da395413ff2d3d1c3ff6fa050f2256e118972bf21a5643557 |
\??\c:\6ab220b62523e330606df8\install.ini
| MD5 | f8f6c0e030cb622f065fe47d61da91d7 |
| SHA1 | cf6fa99747de8f35c6aea52df234c9c57583baa3 |
| SHA256 | c16727881c47a40077dc5a1f1ea71cbb28e3f4e156c0ae7074c6d7f5ecece21d |
| SHA512 | b70c6d67dac5e6a0dbd17e3bcf570a95914482abad20d0304c02da22231070b4bc887720dbae972bc5066457e1273b68fde0805f1c1791e9466a5ca343485cde |
\??\c:\6ab220b62523e330606df8\install.res.1033.dll
| MD5 | ff6003014eefc9c30abe20e3e1f5fbe8 |
| SHA1 | 4a5bd05f94545f01efc10232385b8fecad300678 |
| SHA256 | a522c5ea3250cdd538a9ce7b4a06dfd5123e7eb05eef67509f2b975a8e1d3067 |
| SHA512 | 3adc5c705bab7fa7b50517a5eb3301491f5150b56e1088ed436590458e963da204cd1875af75db89742403476a56a94c3f425c05327767bdb4bbee4859667ac2 |
\??\c:\6ab220b62523e330606df8\globdata.ini
| MD5 | 0a6b586fabd072bd7382b5e24194eac7 |
| SHA1 | 60e3c7215c1a40fbfb3016d52c2de44592f8ca95 |
| SHA256 | 7912e3fcf2698cf4f8625e563cd8215c6668739cae18bd6f27af2d25bec5c951 |
| SHA512 | b96b0448e9f0e94a7867b6bb103979e9ef2c0e074bcb85988d450d63de6edcf21dc83bb154aafb7de524af3c3734f0bb1ba649db0408612479322e1aa85be9f4 |
memory/4452-45-0x0000000002880000-0x0000000002881000-memory.dmp
\??\c:\6ab220b62523e330606df8\vc_red.msi
| MD5 | 7e641e6a0b456271745c20c3bb8a18f9 |
| SHA1 | ae6cedcb81dc443611a310140ae4671789dbbf3a |
| SHA256 | 34c5e7d7ea270ee67f92d34843d89603d6d3b6d9ef5247b43ae3c59c909d380d |
| SHA512 | f67d6bf69d094edcc93541332f31b326131ff89672edb30fd349def6952ad8bfd07dc2f0ca5967b48a7589eee5b7a14b9a2c1ebe0cba4ae2324f7957090ea903 |
\??\c:\6ab220b62523e330606df8\vcredist.bmp
| MD5 | 06fba95313f26e300917c6cea4480890 |
| SHA1 | 31beee44776f114078fc403e405eaa5936c4bc3b |
| SHA256 | 594884a8006e24ad5b1578cd7c75aca21171bb079ebdc4f6518905bcf2237ba1 |
| SHA512 | 7dca0f1ab5d3fd1ac8755142a7ca4d085bb0c2f12a7272e56159dadfa22da79ec8261815be71b9f5e7c32f6e8121ecb2443060f7db76feaf01eb193200e67dfd |
C:\6ab220b62523e330606df8\install.res.1033.dll.tmp
| MD5 | 0117b86ae22a53cd03596b4e591d3e90 |
| SHA1 | aca287513c9c8a0f535e1201a19123e78f98a307 |
| SHA256 | 07fc0ea97cd48c03ce2c8429a43e3a8592d847fe093d58087120667984a01348 |
| SHA512 | 78c3aa0e035308ca7de94749f878b4d6dc39a63d23397a1886d6dca4883fbb52e0693abebff986da0fe6705a4381486da4fa873f6bcf7239e8d917ae56bf8f15 |
memory/208-57-0x00000000750D5000-0x00000000750D6000-memory.dmp
memory/208-58-0x00000000750C0000-0x0000000075123000-memory.dmp
memory/208-61-0x0000000001005000-0x0000000001006000-memory.dmp
memory/208-62-0x00000000750C0000-0x0000000075123000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI5158.txt
| MD5 | 2401203ed7472e91a6331a0763003bdf |
| SHA1 | 05eff2e849f201c12a119c98dc46a020aaf5ad8d |
| SHA256 | 0fbbb8f4875c4e723051dd94b5eec0b3665bdaa53b75ae30958767aa3be3f3c9 |
| SHA512 | 8541b42bbd1c08fc6d2181914b35a7a4bbd2b5f4a35af7b9c2172c510228e92bbaeee3ab9803a6f110a813f85a58830d08a04291b69f5ce14866fddff1b0c2de |
memory/208-65-0x0000000010000000-0x0000000010030000-memory.dmp
memory/208-66-0x0000000001000000-0x000000000101E000-memory.dmp
memory/208-67-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4452-68-0x0000000002880000-0x0000000002881000-memory.dmp
memory/4452-69-0x00000000742C0000-0x00000000742D7000-memory.dmp
memory/208-70-0x00000000750C0000-0x0000000075123000-memory.dmp
memory/208-74-0x00000000750D5000-0x00000000750D6000-memory.dmp
memory/208-99-0x0000000010000000-0x0000000010030000-memory.dmp
memory/208-101-0x00000000750C0000-0x0000000075123000-memory.dmp
memory/208-100-0x0000000001000000-0x000000000101E000-memory.dmp