Analysis
-
max time kernel
66s -
max time network
68s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
11-11-2024 12:45
Static task
static1
Behavioral task
behavioral1
Sample
2345pic_x64.msi
Resource
win7-20241010-en
windows7-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
2345pic_x64.msi
Resource
win10v2004-20241007-en
windows10-2004-x64
25 signatures
150 seconds
General
-
Target
2345pic_x64.msi
-
Size
79.4MB
-
MD5
fe984489b63aa7cd7aee6c48fe69e08d
-
SHA1
b5cac8c66311b7601e0ef2a1d134bf06a8079497
-
SHA256
092ff5eeddfd265d8f37c5a9afbf7c3018ba65fcd0dd59c0237f7e04d1915060
-
SHA512
806872b46c843727d4a980e46fef0a662115a6429868e74c8889d9363323008797c5b11ad54bb524709cb26087a8bec42b0051f701af4766ee7227068a7a0e92
-
SSDEEP
1572864:NmsJ8LVVmCjLbWQVZq/5u3dOdYMBWkAhIo/qQXAbJqWOm9uUQerttNG2MZ7dE:ojyCjLLZq/5ukpBVMWchl5erttNXMZ7S
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1324 powershell.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: msiexec.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Drops file in Program Files directory 13 IoCs
description ioc Process File created C:\Program Files\EnableMagneticOverseer\oFRhddqMXWXkbbeDGqHg msiexec.exe File created C:\Program Files\EnableMagneticOverseer\wBtkOfXYmrXB.exe msiexec.exe File opened for modification C:\Program Files\EnableMagneticOverseer\aAvapbvtIRjv wBtkOfXYmrXB.exe File created C:\Program Files\EnableMagneticOverseer\jnSNQNClfnFm.xml wBtkOfXYmrXB.exe File opened for modification C:\Program Files\EnableMagneticOverseer\jnSNQNClfnFm.xml wBtkOfXYmrXB.exe File opened for modification C:\Program Files\EnableMagneticOverseer\aAvapbvtIRjv.exe wBtkOfXYmrXB.exe File created C:\Program Files\EnableMagneticOverseer\jnSNQNClfnFm.exe wBtkOfXYmrXB.exe File created C:\Program Files\EnableMagneticOverseer\2345pic_x64.exe msiexec.exe File created C:\Program Files\EnableMagneticOverseer\aAvapbvtIRjv.vbs aAvapbvtIRjv.exe File opened for modification C:\Program Files\EnableMagneticOverseer\jnSNQNClfnFm.exe wBtkOfXYmrXB.exe File created C:\Program Files\EnableMagneticOverseer\aAvapbvtIRjv wBtkOfXYmrXB.exe File created C:\Program Files\EnableMagneticOverseer\aAvapbvtIRjv.exe wBtkOfXYmrXB.exe File created C:\Program Files\EnableMagneticOverseer\valibclang2d.dll msiexec.exe -
Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\f782e32.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\f782e33.ipi msiexec.exe File created C:\Windows\Installer\f782e35.msi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\Installer\f782e32.msi msiexec.exe File created C:\Windows\Installer\f782e33.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI33AE.tmp msiexec.exe -
Executes dropped EXE 3 IoCs
pid Process 1760 wBtkOfXYmrXB.exe 2428 aAvapbvtIRjv.exe 2284 2345pic_x64.exe -
Loads dropped DLL 5 IoCs
pid Process 2284 2345pic_x64.exe 2284 2345pic_x64.exe 2284 2345pic_x64.exe 2284 2345pic_x64.exe 2284 2345pic_x64.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2044 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wBtkOfXYmrXB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2345pic_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aAvapbvtIRjv.exe -
Modifies data under HKEY_USERS 50 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\GDIPlus\FontCachePath = "C:\\Users\\Admin\\AppData\\Local" 2345pic_x64.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\GDIPlus 2345pic_x64.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 0092b9b13734db01 powershell.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe -
Modifies registry class 22 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED7404498CA2B5843B67AD2732E83349\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED7404498CA2B5843B67AD2732E83349\ProductName = "EnableMagneticOverseer" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED7404498CA2B5843B67AD2732E83349\PackageCode = "4FD2201DFC0C4BE40B0948F4609DD271" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED7404498CA2B5843B67AD2732E83349\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED7404498CA2B5843B67AD2732E83349\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED7404498CA2B5843B67AD2732E83349\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED7404498CA2B5843B67AD2732E83349\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\ED7404498CA2B5843B67AD2732E83349\ProductFeature msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED7404498CA2B5843B67AD2732E83349\Version = "16973827" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED7404498CA2B5843B67AD2732E83349\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED7404498CA2B5843B67AD2732E83349\SourceList msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED7404498CA2B5843B67AD2732E83349\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED7404498CA2B5843B67AD2732E83349 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED7404498CA2B5843B67AD2732E83349\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\1EC50D645954B34429904554B396BE7B\ED7404498CA2B5843B67AD2732E83349 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED7404498CA2B5843B67AD2732E83349\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED7404498CA2B5843B67AD2732E83349\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\ED7404498CA2B5843B67AD2732E83349 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED7404498CA2B5843B67AD2732E83349\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\1EC50D645954B34429904554B396BE7B msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED7404498CA2B5843B67AD2732E83349\SourceList\PackageName = "2345pic_x64.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED7404498CA2B5843B67AD2732E83349\SourceList\Media msiexec.exe -
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
pid Process 1760 wBtkOfXYmrXB.exe -
Suspicious behavior: EnumeratesProcesses 54 IoCs
pid Process 3000 msiexec.exe 3000 msiexec.exe 1324 powershell.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2284 2345pic_x64.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2044 msiexec.exe Token: SeIncreaseQuotaPrivilege 2044 msiexec.exe Token: SeRestorePrivilege 3000 msiexec.exe Token: SeTakeOwnershipPrivilege 3000 msiexec.exe Token: SeSecurityPrivilege 3000 msiexec.exe Token: SeCreateTokenPrivilege 2044 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2044 msiexec.exe Token: SeLockMemoryPrivilege 2044 msiexec.exe Token: SeIncreaseQuotaPrivilege 2044 msiexec.exe Token: SeMachineAccountPrivilege 2044 msiexec.exe Token: SeTcbPrivilege 2044 msiexec.exe Token: SeSecurityPrivilege 2044 msiexec.exe Token: SeTakeOwnershipPrivilege 2044 msiexec.exe Token: SeLoadDriverPrivilege 2044 msiexec.exe Token: SeSystemProfilePrivilege 2044 msiexec.exe Token: SeSystemtimePrivilege 2044 msiexec.exe Token: SeProfSingleProcessPrivilege 2044 msiexec.exe Token: SeIncBasePriorityPrivilege 2044 msiexec.exe Token: SeCreatePagefilePrivilege 2044 msiexec.exe Token: SeCreatePermanentPrivilege 2044 msiexec.exe Token: SeBackupPrivilege 2044 msiexec.exe Token: SeRestorePrivilege 2044 msiexec.exe Token: SeShutdownPrivilege 2044 msiexec.exe Token: SeDebugPrivilege 2044 msiexec.exe Token: SeAuditPrivilege 2044 msiexec.exe Token: SeSystemEnvironmentPrivilege 2044 msiexec.exe Token: SeChangeNotifyPrivilege 2044 msiexec.exe Token: SeRemoteShutdownPrivilege 2044 msiexec.exe Token: SeUndockPrivilege 2044 msiexec.exe Token: SeSyncAgentPrivilege 2044 msiexec.exe Token: SeEnableDelegationPrivilege 2044 msiexec.exe Token: SeManageVolumePrivilege 2044 msiexec.exe Token: SeImpersonatePrivilege 2044 msiexec.exe Token: SeCreateGlobalPrivilege 2044 msiexec.exe Token: SeBackupPrivilege 2936 vssvc.exe Token: SeRestorePrivilege 2936 vssvc.exe Token: SeAuditPrivilege 2936 vssvc.exe Token: SeBackupPrivilege 3000 msiexec.exe Token: SeRestorePrivilege 3000 msiexec.exe Token: SeRestorePrivilege 2564 DrvInst.exe Token: SeRestorePrivilege 2564 DrvInst.exe Token: SeRestorePrivilege 2564 DrvInst.exe Token: SeRestorePrivilege 2564 DrvInst.exe Token: SeRestorePrivilege 2564 DrvInst.exe Token: SeRestorePrivilege 2564 DrvInst.exe Token: SeRestorePrivilege 2564 DrvInst.exe Token: SeLoadDriverPrivilege 2564 DrvInst.exe Token: SeLoadDriverPrivilege 2564 DrvInst.exe Token: SeLoadDriverPrivilege 2564 DrvInst.exe Token: SeRestorePrivilege 3000 msiexec.exe Token: SeTakeOwnershipPrivilege 3000 msiexec.exe Token: SeRestorePrivilege 3000 msiexec.exe Token: SeTakeOwnershipPrivilege 3000 msiexec.exe Token: SeRestorePrivilege 3000 msiexec.exe Token: SeTakeOwnershipPrivilege 3000 msiexec.exe Token: SeDebugPrivilege 1324 powershell.exe Token: SeRestorePrivilege 1760 wBtkOfXYmrXB.exe Token: 35 1760 wBtkOfXYmrXB.exe Token: SeSecurityPrivilege 1760 wBtkOfXYmrXB.exe Token: SeSecurityPrivilege 1760 wBtkOfXYmrXB.exe Token: SeRestorePrivilege 3000 msiexec.exe Token: SeTakeOwnershipPrivilege 3000 msiexec.exe Token: SeRestorePrivilege 3000 msiexec.exe Token: SeTakeOwnershipPrivilege 3000 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2044 msiexec.exe 2044 msiexec.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 3000 wrote to memory of 1436 3000 msiexec.exe 34 PID 3000 wrote to memory of 1436 3000 msiexec.exe 34 PID 3000 wrote to memory of 1436 3000 msiexec.exe 34 PID 3000 wrote to memory of 1436 3000 msiexec.exe 34 PID 3000 wrote to memory of 1436 3000 msiexec.exe 34 PID 1436 wrote to memory of 1324 1436 MsiExec.exe 36 PID 1436 wrote to memory of 1324 1436 MsiExec.exe 36 PID 1436 wrote to memory of 1324 1436 MsiExec.exe 36 PID 1436 wrote to memory of 564 1436 MsiExec.exe 38 PID 1436 wrote to memory of 564 1436 MsiExec.exe 38 PID 1436 wrote to memory of 564 1436 MsiExec.exe 38 PID 564 wrote to memory of 1760 564 cmd.exe 40 PID 564 wrote to memory of 1760 564 cmd.exe 40 PID 564 wrote to memory of 1760 564 cmd.exe 40 PID 564 wrote to memory of 1760 564 cmd.exe 40 PID 1436 wrote to memory of 2428 1436 MsiExec.exe 42 PID 1436 wrote to memory of 2428 1436 MsiExec.exe 42 PID 1436 wrote to memory of 2428 1436 MsiExec.exe 42 PID 1436 wrote to memory of 2428 1436 MsiExec.exe 42 PID 1436 wrote to memory of 2284 1436 MsiExec.exe 43 PID 1436 wrote to memory of 2284 1436 MsiExec.exe 43 PID 1436 wrote to memory of 2284 1436 MsiExec.exe 43 PID 1436 wrote to memory of 2284 1436 MsiExec.exe 43 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\2345pic_x64.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2044
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\system32\MsiExec.exeC:\Windows\system32\MsiExec.exe -Embedding B69681387627056E18242157F39FE9F1 M Global\MSI00002⤵
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\EnableMagneticOverseer'3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1324
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start "" "C:\Program Files\EnableMagneticOverseer\wBtkOfXYmrXB.exe" x "C:\Program Files\EnableMagneticOverseer\oFRhddqMXWXkbbeDGqHg" -o"C:\Program Files\EnableMagneticOverseer\" -phZJcWScQuNgsiGBeBDtN -y3⤵
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Program Files\EnableMagneticOverseer\wBtkOfXYmrXB.exe"C:\Program Files\EnableMagneticOverseer\wBtkOfXYmrXB.exe" x "C:\Program Files\EnableMagneticOverseer\oFRhddqMXWXkbbeDGqHg" -o"C:\Program Files\EnableMagneticOverseer\" -phZJcWScQuNgsiGBeBDtN -y4⤵
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of AdjustPrivilegeToken
PID:1760
-
-
-
C:\Program Files\EnableMagneticOverseer\aAvapbvtIRjv.exe"C:\Program Files\EnableMagneticOverseer\aAvapbvtIRjv.exe" -number 182 -file file3 -mode mode3 -flag flag33⤵
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2428
-
-
C:\Program Files\EnableMagneticOverseer\2345pic_x64.exe"C:\Program Files\EnableMagneticOverseer\2345pic_x64.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2284
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2936
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005E0" "0000000000000300"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2564
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD500b6dc097b42e49d5042a82f9ba9317a
SHA11ecfded37f75d8c593f94867e3edfb77cea39ab7
SHA25660e3206216aa8d0029cf75c84a245b84bedce36352e44be89d518e4a982f66e5
SHA51203d4d77059b20a4f12ed9c5a7e49e49755e9d2197f9473e021cc569a3f8a926b07e8f5b2bfe26787671fb2dedd3da6fa50a02976e0006e0351b611125d8817d2
-
Filesize
3.2MB
MD590a521d21169049fdf1a244fc2989377
SHA1e9b0db47e89683444ba886fa8091167e160f6b30
SHA2567dd65fb863051edda07d0f84c65c36cd7388aa28464eb3f6c541f73c9f195f41
SHA512e20e25cf49489861dcb00cb4b38f9c96b26b016b55a9b92ab082ef422db98dad3936b6918b65f1874ba4fe1a0208e8bae701aaf3d7e3bdcca3f046eb0826f8dc
-
Filesize
2.4MB
MD55ac34b87f21ae7fedf4dc629181decf0
SHA13890201e28d44a46b6e810b5bc5eddfec78d92b9
SHA256ffc5b747ee4183aa7b298e7e296981d19321c208ae40b0052f1965033da5ebb4
SHA512fbfee20bf2795f2e67ef24a1add342d61c131226ab74638447c5be70f4acd0ad9e51db1f58e69e4785446e2af71208a729636c0a79db1415712e67ebad8c2eda
-
Filesize
577KB
MD5c31c4b04558396c6fabab64dcf366534
SHA1fa836d92edc577d6a17ded47641ba1938589b09a
SHA2569d182f421381429fd77598feb609fefb54dcaef722ddbf5aa611b68a706c10d3
SHA512814dcbc1d43bc037dadc2f3f67856dd790b15fc1b0c50fa74a169c8cc02cdc79d44f1f10e200ef662eee20cd6b5ca646ec4e77673e3fe3cb7dfb7649243f6e99
-
Filesize
624KB
MD5cc7eab4f83339cca63f763114ca04c6c
SHA14da526e8b270dc16865813801dc5bcda8162c09d
SHA256a1c9c3b3bc8e75aa91f639da10835210e81aeb7fb5db79ac0703e1594e516b5b
SHA512d1df9bdb61dcc95e579adf4891c000feee83f9f4a3f82debca617fb62afff16707707681c2f2655aa02756873d5251db74d5b843ec56c3e12ab1120355360ef0
-
Filesize
2.4MB
MD52f2ae26fd88c512ac0feb39fa42ee894
SHA1ac50a5fd61933bdd2a54e6503e39438f05af3304
SHA2569117cafe403e445a291141ee898845799a165c383d3dfcf76c1870f66782e6b1
SHA512b919244cd08118a2258cb062e5ce3a4626d82ed0ca3600a018bdb97962b9f96d57d1a08d338fd41fbae4af72debf7840707f67d442e53ec8a15cb8002ee725e6
-
Filesize
27KB
MD5a568feaa357f44dd50c5e447fa8ee1b2
SHA15c765fad342b756d5ea522087c6f7567b5f3ed57
SHA25657947a15ad3215185c7e15a5f0da393570845a13ab7b184a07fcefbf97537e48
SHA5127c8c36c0123de839e677beeba65c1af56c5e85d8f1ff2c94950aed33e026dff3fbda8c49859012862110117977c928b814c0d91c477583a2b8f83d73f3cdf174
-
Filesize
2.1MB
MD5a26e75c0407c87786eea42febdb32532
SHA127e52fdca023cb8f031cd55ac37965d93f7f7da7
SHA256635f988beb849c6510f54f681387bf810c2266bd27834c5a9c160cbfe6df44d4
SHA512fdd9760442579ad2a3df4f31464f9e66bc19a4390fa1c81afb516cce817097b5324024f712d9c1bf1a11ad30324f5a8aa83c72a732e1197e8804ab806d3859e6