Analysis
- max time kernel
66s - max time network
68s - platform
windows7_x64 - resource
win7-20241010-en - resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system - submitted
11/11/2024, 12:45
Static task
static1
Behavioral task
behavioral1
Sample
2345pic_x64.msi
Resource
win7-20241010-en
windows7-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
2345pic_x64.msi
Resource
win10v2004-20241007-en
windows10-2004-x64
25 signatures
150 seconds
General
- Target 2345pic_x64.msi
- Size 79.4MB
- Sample241111-py3n3aylfx
- SHA256 092ff5eeddfd265d8f37c5a9afbf7c3018ba65fcd0dd59c0237f7e04d1915060
- MD5 fe984489b63aa7cd7aee6c48fe69e08d
- SHA1 b5cac8c66311b7601e0ef2a1d134bf06a8079497
- SHA512 806872b46c843727d4a980e46fef0a662115a6429868e74c8889d9363323008797c5b11ad54bb524709cb26087a8bec42b0051f701af4766ee7227068a7a0e92
- SSDEEP 1572864:NmsJ8LVVmCjLbWQVZq/5u3dOdYMBWkAhIo/qQXAbJqWOm9uUQerttNG2MZ7dE:ojyCjLLZq/5ukpBVMWchl5erttNXMZ7S
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1324 powershell.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: msiexec.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe - Drops file in Program Files directory 13 IoCs
description ioc Process File created C:\Program Files\EnableMagneticOverseer\oFRhddqMXWXkbbeDGqHg msiexec.exe File created C:\Program Files\EnableMagneticOverseer\wBtkOfXYmrXB.exe msiexec.exe File opened for modification C:\Program Files\EnableMagneticOverseer\aAvapbvtIRjv wBtkOfXYmrXB.exe File created C:\Program Files\EnableMagneticOverseer\jnSNQNClfnFm.xml wBtkOfXYmrXB.exe File opened for modification C:\Program Files\EnableMagneticOverseer\jnSNQNClfnFm.xml wBtkOfXYmrXB.exe File opened for modification C:\Program Files\EnableMagneticOverseer\aAvapbvtIRjv.exe wBtkOfXYmrXB.exe File created C:\Program Files\EnableMagneticOverseer\jnSNQNClfnFm.exe wBtkOfXYmrXB.exe File created C:\Program Files\EnableMagneticOverseer\2345pic_x64.exe msiexec.exe File created C:\Program Files\EnableMagneticOverseer\aAvapbvtIRjv.vbs aAvapbvtIRjv.exe File opened for modification C:\Program Files\EnableMagneticOverseer\jnSNQNClfnFm.exe wBtkOfXYmrXB.exe File created C:\Program Files\EnableMagneticOverseer\aAvapbvtIRjv wBtkOfXYmrXB.exe File created C:\Program Files\EnableMagneticOverseer\aAvapbvtIRjv.exe wBtkOfXYmrXB.exe File created C:\Program Files\EnableMagneticOverseer\valibclang2d.dll msiexec.exe - Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\f782e32.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\f782e33.ipi msiexec.exe File created C:\Windows\Installer\f782e35.msi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\Installer\f782e32.msi msiexec.exe File created C:\Windows\Installer\f782e33.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI33AE.tmp msiexec.exe - Executes dropped EXE 3 IoCs
pid Process 1760 wBtkOfXYmrXB.exe 2428 aAvapbvtIRjv.exe 2284 2345pic_x64.exe - Loads dropped DLL 5 IoCs
pid Process 2284 2345pic_x64.exe 2284 2345pic_x64.exe 2284 2345pic_x64.exe 2284 2345pic_x64.exe 2284 2345pic_x64.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2044 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wBtkOfXYmrXB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2345pic_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aAvapbvtIRjv.exe - Modifies data under HKEY_USERS 50 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\GDIPlus\FontCachePath = "C:\\Users\\Admin\\AppData\\Local" 2345pic_x64.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\GDIPlus 2345pic_x64.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 0092b9b13734db01 powershell.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe - Modifies registry class 22 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED7404498CA2B5843B67AD2732E83349\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED7404498CA2B5843B67AD2732E83349\ProductName = "EnableMagneticOverseer" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED7404498CA2B5843B67AD2732E83349\PackageCode = "4FD2201DFC0C4BE40B0948F4609DD271" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED7404498CA2B5843B67AD2732E83349\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED7404498CA2B5843B67AD2732E83349\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED7404498CA2B5843B67AD2732E83349\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED7404498CA2B5843B67AD2732E83349\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\ED7404498CA2B5843B67AD2732E83349\ProductFeature msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED7404498CA2B5843B67AD2732E83349\Version = "16973827" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED7404498CA2B5843B67AD2732E83349\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED7404498CA2B5843B67AD2732E83349\SourceList msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED7404498CA2B5843B67AD2732E83349\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED7404498CA2B5843B67AD2732E83349 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED7404498CA2B5843B67AD2732E83349\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\1EC50D645954B34429904554B396BE7B\ED7404498CA2B5843B67AD2732E83349 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED7404498CA2B5843B67AD2732E83349\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED7404498CA2B5843B67AD2732E83349\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\ED7404498CA2B5843B67AD2732E83349 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED7404498CA2B5843B67AD2732E83349\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\1EC50D645954B34429904554B396BE7B msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED7404498CA2B5843B67AD2732E83349\SourceList\PackageName = "2345pic_x64.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED7404498CA2B5843B67AD2732E83349\SourceList\Media msiexec.exe - Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
pid Process 1760 wBtkOfXYmrXB.exe - Suspicious behavior: EnumeratesProcesses 54 IoCs
pid Process 3000 msiexec.exe 3000 msiexec.exe 1324 powershell.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2428 aAvapbvtIRjv.exe 2284 2345pic_x64.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2044 msiexec.exe Token: SeIncreaseQuotaPrivilege 2044 msiexec.exe Token: SeRestorePrivilege 3000 msiexec.exe Token: SeTakeOwnershipPrivilege 3000 msiexec.exe Token: SeSecurityPrivilege 3000 msiexec.exe Token: SeCreateTokenPrivilege 2044 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2044 msiexec.exe Token: SeLockMemoryPrivilege 2044 msiexec.exe Token: SeIncreaseQuotaPrivilege 2044 msiexec.exe Token: SeMachineAccountPrivilege 2044 msiexec.exe Token: SeTcbPrivilege 2044 msiexec.exe Token: SeSecurityPrivilege 2044 msiexec.exe Token: SeTakeOwnershipPrivilege 2044 msiexec.exe Token: SeLoadDriverPrivilege 2044 msiexec.exe Token: SeSystemProfilePrivilege 2044 msiexec.exe Token: SeSystemtimePrivilege 2044 msiexec.exe Token: SeProfSingleProcessPrivilege 2044 msiexec.exe Token: SeIncBasePriorityPrivilege 2044 msiexec.exe Token: SeCreatePagefilePrivilege 2044 msiexec.exe Token: SeCreatePermanentPrivilege 2044 msiexec.exe Token: SeBackupPrivilege 2044 msiexec.exe Token: SeRestorePrivilege 2044 msiexec.exe Token: SeShutdownPrivilege 2044 msiexec.exe Token: SeDebugPrivilege 2044 msiexec.exe Token: SeAuditPrivilege 2044 msiexec.exe Token: SeSystemEnvironmentPrivilege 2044 msiexec.exe Token: SeChangeNotifyPrivilege 2044 msiexec.exe Token: SeRemoteShutdownPrivilege 2044 msiexec.exe Token: SeUndockPrivilege 2044 msiexec.exe Token: SeSyncAgentPrivilege 2044 msiexec.exe Token: SeEnableDelegationPrivilege 2044 msiexec.exe Token: SeManageVolumePrivilege 2044 msiexec.exe Token: SeImpersonatePrivilege 2044 msiexec.exe Token: SeCreateGlobalPrivilege 2044 msiexec.exe Token: SeBackupPrivilege 2936 vssvc.exe Token: SeRestorePrivilege 2936 vssvc.exe Token: SeAuditPrivilege 2936 vssvc.exe Token: SeBackupPrivilege 3000 msiexec.exe Token: SeRestorePrivilege 3000 msiexec.exe Token: SeRestorePrivilege 2564 DrvInst.exe Token: SeRestorePrivilege 2564 DrvInst.exe Token: SeRestorePrivilege 2564 DrvInst.exe Token: SeRestorePrivilege 2564 DrvInst.exe Token: SeRestorePrivilege 2564 DrvInst.exe Token: SeRestorePrivilege 2564 DrvInst.exe Token: SeRestorePrivilege 2564 DrvInst.exe Token: SeLoadDriverPrivilege 2564 DrvInst.exe Token: SeLoadDriverPrivilege 2564 DrvInst.exe Token: SeLoadDriverPrivilege 2564 DrvInst.exe Token: SeRestorePrivilege 3000 msiexec.exe Token: SeTakeOwnershipPrivilege 3000 msiexec.exe Token: SeRestorePrivilege 3000 msiexec.exe Token: SeTakeOwnershipPrivilege 3000 msiexec.exe Token: SeRestorePrivilege 3000 msiexec.exe Token: SeTakeOwnershipPrivilege 3000 msiexec.exe Token: SeDebugPrivilege 1324 powershell.exe Token: SeRestorePrivilege 1760 wBtkOfXYmrXB.exe Token: 35 1760 wBtkOfXYmrXB.exe Token: SeSecurityPrivilege 1760 wBtkOfXYmrXB.exe Token: SeSecurityPrivilege 1760 wBtkOfXYmrXB.exe Token: SeRestorePrivilege 3000 msiexec.exe Token: SeTakeOwnershipPrivilege 3000 msiexec.exe Token: SeRestorePrivilege 3000 msiexec.exe Token: SeTakeOwnershipPrivilege 3000 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2044 msiexec.exe 2044 msiexec.exe - Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 3000 wrote to memory of 1436 3000 msiexec.exe 34 PID 3000 wrote to memory of 1436 3000 msiexec.exe 34 PID 3000 wrote to memory of 1436 3000 msiexec.exe 34 PID 3000 wrote to memory of 1436 3000 msiexec.exe 34 PID 3000 wrote to memory of 1436 3000 msiexec.exe 34 PID 1436 wrote to memory of 1324 1436 MsiExec.exe 36 PID 1436 wrote to memory of 1324 1436 MsiExec.exe 36 PID 1436 wrote to memory of 1324 1436 MsiExec.exe 36 PID 1436 wrote to memory of 564 1436 MsiExec.exe 38 PID 1436 wrote to memory of 564 1436 MsiExec.exe 38 PID 1436 wrote to memory of 564 1436 MsiExec.exe 38 PID 564 wrote to memory of 1760 564 cmd.exe 40 PID 564 wrote to memory of 1760 564 cmd.exe 40 PID 564 wrote to memory of 1760 564 cmd.exe 40 PID 564 wrote to memory of 1760 564 cmd.exe 40 PID 1436 wrote to memory of 2428 1436 MsiExec.exe 42 PID 1436 wrote to memory of 2428 1436 MsiExec.exe 42 PID 1436 wrote to memory of 2428 1436 MsiExec.exe 42 PID 1436 wrote to memory of 2428 1436 MsiExec.exe 42 PID 1436 wrote to memory of 2284 1436 MsiExec.exe 43 PID 1436 wrote to memory of 2284 1436 MsiExec.exe 43 PID 1436 wrote to memory of 2284 1436 MsiExec.exe 43 PID 1436 wrote to memory of 2284 1436 MsiExec.exe 43 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\2345pic_x64.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2044
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\system32\MsiExec.exeC:\Windows\system32\MsiExec.exe -Embedding B69681387627056E18242157F39FE9F1 M Global\MSI00002⤵
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\EnableMagneticOverseer'3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1324
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start "" "C:\Program Files\EnableMagneticOverseer\wBtkOfXYmrXB.exe" x "C:\Program Files\EnableMagneticOverseer\oFRhddqMXWXkbbeDGqHg" -o"C:\Program Files\EnableMagneticOverseer\" -phZJcWScQuNgsiGBeBDtN -y3⤵
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Program Files\EnableMagneticOverseer\wBtkOfXYmrXB.exe"C:\Program Files\EnableMagneticOverseer\wBtkOfXYmrXB.exe" x "C:\Program Files\EnableMagneticOverseer\oFRhddqMXWXkbbeDGqHg" -o"C:\Program Files\EnableMagneticOverseer\" -phZJcWScQuNgsiGBeBDtN -y4⤵
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of AdjustPrivilegeToken
PID:1760
-
-
-
C:\Program Files\EnableMagneticOverseer\aAvapbvtIRjv.exe"C:\Program Files\EnableMagneticOverseer\aAvapbvtIRjv.exe" -number 182 -file file3 -mode mode3 -flag flag33⤵
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2428
-
-
C:\Program Files\EnableMagneticOverseer\2345pic_x64.exe"C:\Program Files\EnableMagneticOverseer\2345pic_x64.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2284
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2936
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005E0" "0000000000000300"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2564
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\f782e34.rbs
- Size 7KB
- SHA256 60e3206216aa8d0029cf75c84a245b84bedce36352e44be89d518e4a982f66e5
- MD5 00b6dc097b42e49d5042a82f9ba9317a
- SHA1 1ecfded37f75d8c593f94867e3edfb77cea39ab7
- SHA512 03d4d77059b20a4f12ed9c5a7e49e49755e9d2197f9473e021cc569a3f8a926b07e8f5b2bfe26787671fb2dedd3da6fa50a02976e0006e0351b611125d8817d2
- SSDEEP 96:Umu+OemTC5GGe2DdDUx0DCsIiUx0DC6jJmCUIUKO5zmEEWoReJCcpljLS5jBTy:xHOemTiFeFOezOePIFPcpn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\EnableMagneticOverseer\aAvapbvtIRjv.exe
- Size 3.2MB
- SHA256 7dd65fb863051edda07d0f84c65c36cd7388aa28464eb3f6c541f73c9f195f41
- MD5 90a521d21169049fdf1a244fc2989377
- SHA1 e9b0db47e89683444ba886fa8091167e160f6b30
- SHA512 e20e25cf49489861dcb00cb4b38f9c96b26b016b55a9b92ab082ef422db98dad3936b6918b65f1874ba4fe1a0208e8bae701aaf3d7e3bdcca3f046eb0826f8dc
- SSDEEP 49152:DxSLg/l/1N1zPPoshC2YD1QrFckOwncQDJ9v+f3wpdhHX:DxZRdXosJrFkwdDLvqOd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\EnableMagneticOverseer\oFRhddqMXWXkbbeDGqHg
- Size 2.4MB
- SHA256 ffc5b747ee4183aa7b298e7e296981d19321c208ae40b0052f1965033da5ebb4
- MD5 5ac34b87f21ae7fedf4dc629181decf0
- SHA1 3890201e28d44a46b6e810b5bc5eddfec78d92b9
- SHA512 fbfee20bf2795f2e67ef24a1add342d61c131226ab74638447c5be70f4acd0ad9e51db1f58e69e4785446e2af71208a729636c0a79db1415712e67ebad8c2eda
- SSDEEP 49152:/us4vrSwOGx5bK1wZ7HSeEA3qSCOX3Yvm1aSciECQZ4ID:GshwHKi1yZZOHYRnt9D
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\EnableMagneticOverseer\wBtkOfXYmrXB.exe
- Size 577KB
- SHA256 9d182f421381429fd77598feb609fefb54dcaef722ddbf5aa611b68a706c10d3
- MD5 c31c4b04558396c6fabab64dcf366534
- SHA1 fa836d92edc577d6a17ded47641ba1938589b09a
- SHA512 814dcbc1d43bc037dadc2f3f67856dd790b15fc1b0c50fa74a169c8cc02cdc79d44f1f10e200ef662eee20cd6b5ca646ec4e77673e3fe3cb7dfb7649243f6e99
- SSDEEP 12288:fYjvqVX77yaPq7QU5mMGqVlkLJHxKtFhcfFs6evjnwMMLefZXy:fYjyX30cymMGqVlyJH8/hi9YjnwMMLUi
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\nsz626D.tmp\FileInfo.dll
- Size 624KB
- SHA256 a1c9c3b3bc8e75aa91f639da10835210e81aeb7fb5db79ac0703e1594e516b5b
- MD5 cc7eab4f83339cca63f763114ca04c6c
- SHA1 4da526e8b270dc16865813801dc5bcda8162c09d
- SHA512 d1df9bdb61dcc95e579adf4891c000feee83f9f4a3f82debca617fb62afff16707707681c2f2655aa02756873d5251db74d5b843ec56c3e12ab1120355360ef0
- SSDEEP 12288:tbD0uY3imUBv0W2Z+kMPGKqkX8nccyB6py+9moOXU5bS8kf8bkiuNTRUV3YT5J:dILsSMPGLkd5XubSHiPuTRUV3YT5J
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\nsz626D.tmp\RCWidgetPlugin.dll
- Size 2.4MB
- SHA256 9117cafe403e445a291141ee898845799a165c383d3dfcf76c1870f66782e6b1
- MD5 2f2ae26fd88c512ac0feb39fa42ee894
- SHA1 ac50a5fd61933bdd2a54e6503e39438f05af3304
- SHA512 b919244cd08118a2258cb062e5ce3a4626d82ed0ca3600a018bdb97962b9f96d57d1a08d338fd41fbae4af72debf7840707f67d442e53ec8a15cb8002ee725e6
- SSDEEP 49152:EfLaBPZlXM1CSxQtcTT4QsWv1ucXG/4PC+H2OXPQm+:4WBnXM1CFAskJeP
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\nsz626D.tmp\System.dll
- Size 27KB
- SHA256 57947a15ad3215185c7e15a5f0da393570845a13ab7b184a07fcefbf97537e48
- MD5 a568feaa357f44dd50c5e447fa8ee1b2
- SHA1 5c765fad342b756d5ea522087c6f7567b5f3ed57
- SHA512 7c8c36c0123de839e677beeba65c1af56c5e85d8f1ff2c94950aed33e026dff3fbda8c49859012862110117977c928b814c0d91c477583a2b8f83d73f3cdf174
- SSDEEP 384:ixoXlBT3SaMINWf52+4kb1VunYPLb2O1MnnDGaO5C8JN77hh+uA:iypSvIWb3Jko/MnDGxP3hoF
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\nsz626D.tmp\libcurl_x86.dll
- Size 2.1MB
- SHA256 635f988beb849c6510f54f681387bf810c2266bd27834c5a9c160cbfe6df44d4
- MD5 a26e75c0407c87786eea42febdb32532
- SHA1 27e52fdca023cb8f031cd55ac37965d93f7f7da7
- SHA512 fdd9760442579ad2a3df4f31464f9e66bc19a4390fa1c81afb516cce817097b5324024f712d9c1bf1a11ad30324f5a8aa83c72a732e1197e8804ab806d3859e6
- SSDEEP 49152:nGUR9r6hl8IXBPZ68L20v/SU8Y7NriOPquwgtJIpT:nGUR9r6b8IbBLjv/SUp7NriSg
- MD5 SHA1 SHA512 SSDEEP