723c5657fa6c7b60e0dc195a7250af56603b4be485042540397f703f266ee1ba

Analysis

max time kernel
33s
max time network
35s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 13:40

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

Installer.msi
Size

12.4MB
MD5

0b6f567d2d08cf51fab3a4c156973ec5
SHA1

3693e4e6eb7ac5fad966c77eb4b38cd2cc4c9a20
SHA256

55bcd5d30a281d4df8ab11da0b6bc8773ee09b9da0537f826ae9bfa06d91b441
SHA512

d9fda950dcb9811e0e3c1d5542933754286fb5335e4062ab49622aba86636ab771f02c6d0d9c46942f2dc9c6d0c86bc3057d862fbd35483fd7e60a635a8048b0
SSDEEP

196608:E34AwVjpluzSl00psVS1HmLPFKwurgtJfG/u8WA/5w8jKcxRi5ilN6QCfjhKb0:RAwVjpD6S2/uoJfe1RwSLTNT

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2868	MsiExec.exe
2868	MsiExec.exe

Drops file in Program Files directory 21 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows NT\INIT.DAT	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Windows NT\locale.bin	7za.exe
File created	C:\Program Files (x86)\Windows NT\locale2.bin	7za.exe
File opened for modification	C:\Program Files (x86)\Windows NT\tProtect.dll	7za.exe
File created	C:\Program Files (x86)\Windows NT\7za.bin	msiexec.exe
File created	C:\Program Files (x86)\Windows NT\Update.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Windows NT\locale2.bin	7za.exe
File created	C:\Program Files (x86)\Windows NT\locale3.bin	7za.exe
File created	C:\Program Files (x86)\Windows NT\locale4.bin	7za.exe
File opened for modification	C:\Program Files (x86)\Windows NT\locale4.bin	7za.exe
File created	C:\Program Files (x86)\Windows NT\tProtect.dll	7za.exe
File created	C:\Program Files (x86)\Windows NT\data.bin	msiexec.exe
File created	C:\Program Files (x86)\Windows NT\data.dat	MsiExec.exe
File created	C:\Program Files (x86)\Windows NT\7za.exe	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Update.png	MsiExec.exe
File created	C:\Program Files (x86)\Windows NT\locale.bin	7za.exe
File opened for modification	C:\Program Files (x86)\Windows NT\locale3.bin	7za.exe
File created	C:\Program Files (x86)\Windows NT\locale.dat	MsiExec.exe
File created	C:\Program Files (x86)\Windows NT\locale2.dat	MsiExec.exe
File created	C:\Program Files (x86)\Windows NT\locale3.dat	MsiExec.exe
File created	C:\Program Files (x86)\Windows NT\locale4.dat	MsiExec.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIDB51.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\f76da48.msi	msiexec.exe
File created	C:\Windows\Installer\f76da49.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\f76da4b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDCE9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f76da49.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\Installer\f76da48.msi	msiexec.exe

Executes dropped EXE 2 IoCs

pid	Process
2036	7za.exe
2164	7za.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1584	sc.exe
2244	sc.exe
1336	sc.exe
1916	sc.exe
372	sc.exe
2976	sc.exe
2628	sc.exe
2040	sc.exe
1696	sc.exe
2052	sc.exe
2172	sc.exe
1360	sc.exe
2444	sc.exe
2284	sc.exe
2372	sc.exe
708	sc.exe
1704	sc.exe
2328	sc.exe
2736	sc.exe
2044	sc.exe
2188	sc.exe
2056	sc.exe
2732	sc.exe
1060	sc.exe
2088	sc.exe
1504	sc.exe
3024	sc.exe
1624	sc.exe
1336	sc.exe
1040	sc.exe
1680	sc.exe
2236	sc.exe
3064	sc.exe
2104	sc.exe
1940	sc.exe
2892	sc.exe
1496	sc.exe
1596	sc.exe
1316	sc.exe
1868	sc.exe
2744	sc.exe
2224	sc.exe
2968	sc.exe
2956	sc.exe
2192	sc.exe
672	sc.exe
2996	sc.exe
2220	sc.exe
2668	sc.exe
1620	sc.exe
2520	sc.exe
2684	sc.exe
2176	sc.exe
1700	sc.exe
1956	sc.exe
272	sc.exe
2132	sc.exe
1816	sc.exe
1040	sc.exe
2816	sc.exe
2152	sc.exe
2896	sc.exe
1908	sc.exe
1696	sc.exe

Loads dropped DLL 1 IoCs

pid	Process
2868	MsiExec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
1924	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe

Modifies data under HKEY_USERS 46 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe

Modifies registry class 22 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DEF96737D80A8B49B7F51984F3C38C7\ProductName = "Setup"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DEF96737D80A8B49B7F51984F3C38C7\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DEF96737D80A8B49B7F51984F3C38C7\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DEF96737D80A8B49B7F51984F3C38C7\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DEF96737D80A8B49B7F51984F3C38C7\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DEF96737D80A8B49B7F51984F3C38C7\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\ABCBC521D000113428DCA4ABCB7D434C	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DEF96737D80A8B49B7F51984F3C38C7\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DEF96737D80A8B49B7F51984F3C38C7\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DEF96737D80A8B49B7F51984F3C38C7\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2DEF96737D80A8B49B7F51984F3C38C7\ProdFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DEF96737D80A8B49B7F51984F3C38C7\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DEF96737D80A8B49B7F51984F3C38C7\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DEF96737D80A8B49B7F51984F3C38C7\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\ABCBC521D000113428DCA4ABCB7D434C\2DEF96737D80A8B49B7F51984F3C38C7	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DEF96737D80A8B49B7F51984F3C38C7\SourceList\PackageName = "Installer.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2DEF96737D80A8B49B7F51984F3C38C7	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DEF96737D80A8B49B7F51984F3C38C7	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DEF96737D80A8B49B7F51984F3C38C7\PackageCode = "CD1F68DD74BB536438560605A247339F"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DEF96737D80A8B49B7F51984F3C38C7\Version = "16973828"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DEF96737D80A8B49B7F51984F3C38C7\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2DEF96737D80A8B49B7F51984F3C38C7\SourceList\Media	msiexec.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2164	7za.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2560	msiexec.exe
2560	msiexec.exe
2868	MsiExec.exe
2868	MsiExec.exe
2868	MsiExec.exe
2868	MsiExec.exe
2868	MsiExec.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found
476	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1924	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1924	msiexec.exe
Token: SeRestorePrivilege	2560	msiexec.exe
Token: SeTakeOwnershipPrivilege	2560	msiexec.exe
Token: SeSecurityPrivilege	2560	msiexec.exe
Token: SeCreateTokenPrivilege	1924	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1924	msiexec.exe
Token: SeLockMemoryPrivilege	1924	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1924	msiexec.exe
Token: SeMachineAccountPrivilege	1924	msiexec.exe
Token: SeTcbPrivilege	1924	msiexec.exe
Token: SeSecurityPrivilege	1924	msiexec.exe
Token: SeTakeOwnershipPrivilege	1924	msiexec.exe
Token: SeLoadDriverPrivilege	1924	msiexec.exe
Token: SeSystemProfilePrivilege	1924	msiexec.exe
Token: SeSystemtimePrivilege	1924	msiexec.exe
Token: SeProfSingleProcessPrivilege	1924	msiexec.exe
Token: SeIncBasePriorityPrivilege	1924	msiexec.exe
Token: SeCreatePagefilePrivilege	1924	msiexec.exe
Token: SeCreatePermanentPrivilege	1924	msiexec.exe
Token: SeBackupPrivilege	1924	msiexec.exe
Token: SeRestorePrivilege	1924	msiexec.exe
Token: SeShutdownPrivilege	1924	msiexec.exe
Token: SeDebugPrivilege	1924	msiexec.exe
Token: SeAuditPrivilege	1924	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1924	msiexec.exe
Token: SeChangeNotifyPrivilege	1924	msiexec.exe
Token: SeRemoteShutdownPrivilege	1924	msiexec.exe
Token: SeUndockPrivilege	1924	msiexec.exe
Token: SeSyncAgentPrivilege	1924	msiexec.exe
Token: SeEnableDelegationPrivilege	1924	msiexec.exe
Token: SeManageVolumePrivilege	1924	msiexec.exe
Token: SeImpersonatePrivilege	1924	msiexec.exe
Token: SeCreateGlobalPrivilege	1924	msiexec.exe
Token: SeBackupPrivilege	2920	vssvc.exe
Token: SeRestorePrivilege	2920	vssvc.exe
Token: SeAuditPrivilege	2920	vssvc.exe
Token: SeBackupPrivilege	2560	msiexec.exe
Token: SeRestorePrivilege	2560	msiexec.exe
Token: SeRestorePrivilege	2336	DrvInst.exe
Token: SeRestorePrivilege	2336	DrvInst.exe
Token: SeRestorePrivilege	2336	DrvInst.exe
Token: SeRestorePrivilege	2336	DrvInst.exe
Token: SeRestorePrivilege	2336	DrvInst.exe
Token: SeRestorePrivilege	2336	DrvInst.exe
Token: SeRestorePrivilege	2336	DrvInst.exe
Token: SeLoadDriverPrivilege	2336	DrvInst.exe
Token: SeLoadDriverPrivilege	2336	DrvInst.exe
Token: SeLoadDriverPrivilege	2336	DrvInst.exe
Token: SeRestorePrivilege	2560	msiexec.exe
Token: SeTakeOwnershipPrivilege	2560	msiexec.exe
Token: SeRestorePrivilege	2560	msiexec.exe
Token: SeTakeOwnershipPrivilege	2560	msiexec.exe
Token: SeRestorePrivilege	2560	msiexec.exe
Token: SeTakeOwnershipPrivilege	2560	msiexec.exe
Token: SeRestorePrivilege	2560	msiexec.exe
Token: SeTakeOwnershipPrivilege	2560	msiexec.exe
Token: SeRestorePrivilege	2560	msiexec.exe
Token: SeTakeOwnershipPrivilege	2560	msiexec.exe
Token: SeRestorePrivilege	2560	msiexec.exe
Token: SeTakeOwnershipPrivilege	2560	msiexec.exe
Token: SeRestorePrivilege	2560	msiexec.exe
Token: SeTakeOwnershipPrivilege	2560	msiexec.exe
Token: SeRestorePrivilege	2560	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1924	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 2868	2560	msiexec.exe	35
PID 2560 wrote to memory of 2868	2560	msiexec.exe	35
PID 2560 wrote to memory of 2868	2560	msiexec.exe	35
PID 2560 wrote to memory of 2868	2560	msiexec.exe	35
PID 2560 wrote to memory of 2868	2560	msiexec.exe	35
PID 2968 wrote to memory of 2956	2968	cmd.exe	37
PID 2968 wrote to memory of 2956	2968	cmd.exe	37
PID 2968 wrote to memory of 2956	2968	cmd.exe	37
PID 2868 wrote to memory of 2036	2868	MsiExec.exe	39
PID 2868 wrote to memory of 2036	2868	MsiExec.exe	39
PID 2868 wrote to memory of 2036	2868	MsiExec.exe	39
PID 2868 wrote to memory of 2036	2868	MsiExec.exe	39
PID 2868 wrote to memory of 3032	2868	MsiExec.exe	41
PID 2868 wrote to memory of 3032	2868	MsiExec.exe	41
PID 2868 wrote to memory of 3032	2868	MsiExec.exe	41
PID 3032 wrote to memory of 2164	3032	cmd.exe	43
PID 3032 wrote to memory of 2164	3032	cmd.exe	43
PID 3032 wrote to memory of 2164	3032	cmd.exe	43
PID 3032 wrote to memory of 2164	3032	cmd.exe	43
PID 2724 wrote to memory of 2132	2724	cmd.exe	45
PID 2724 wrote to memory of 2132	2724	cmd.exe	45
PID 2724 wrote to memory of 2132	2724	cmd.exe	45
PID 2156 wrote to memory of 1276	2156	cmd.exe	48
PID 2156 wrote to memory of 1276	2156	cmd.exe	48
PID 2156 wrote to memory of 1276	2156	cmd.exe	48
PID 1956 wrote to memory of 2192	1956	cmd.exe	51
PID 1956 wrote to memory of 2192	1956	cmd.exe	51
PID 1956 wrote to memory of 2192	1956	cmd.exe	51
PID 848 wrote to memory of 1384	848	cmd.exe	54
PID 848 wrote to memory of 1384	848	cmd.exe	54
PID 848 wrote to memory of 1384	848	cmd.exe	54
PID 1408 wrote to memory of 1916	1408	cmd.exe	57
PID 1408 wrote to memory of 1916	1408	cmd.exe	57
PID 1408 wrote to memory of 1916	1408	cmd.exe	57
PID 2356 wrote to memory of 2172	2356	cmd.exe	60
PID 2356 wrote to memory of 2172	2356	cmd.exe	60
PID 2356 wrote to memory of 2172	2356	cmd.exe	60
PID 1868 wrote to memory of 2328	1868	cmd.exe	63
PID 1868 wrote to memory of 2328	1868	cmd.exe	63
PID 1868 wrote to memory of 2328	1868	cmd.exe	63
PID 1772 wrote to memory of 1360	1772	cmd.exe	66
PID 1772 wrote to memory of 1360	1772	cmd.exe	66
PID 1772 wrote to memory of 1360	1772	cmd.exe	66
PID 2512 wrote to memory of 1680	2512	cmd.exe	69
PID 2512 wrote to memory of 1680	2512	cmd.exe	69
PID 2512 wrote to memory of 1680	2512	cmd.exe	69
PID 2364 wrote to memory of 1816	2364	cmd.exe	72
PID 2364 wrote to memory of 1816	2364	cmd.exe	72
PID 2364 wrote to memory of 1816	2364	cmd.exe	72
PID 1184 wrote to memory of 2236	1184	cmd.exe	75
PID 1184 wrote to memory of 2236	1184	cmd.exe	75
PID 1184 wrote to memory of 2236	1184	cmd.exe	75
PID 1968 wrote to memory of 3064	1968	cmd.exe	78
PID 1968 wrote to memory of 3064	1968	cmd.exe	78
PID 1968 wrote to memory of 3064	1968	cmd.exe	78
PID 1912 wrote to memory of 1908	1912	cmd.exe	81
PID 1912 wrote to memory of 1908	1912	cmd.exe	81
PID 1912 wrote to memory of 1908	1912	cmd.exe	81
PID 1692 wrote to memory of 2520	1692	cmd.exe	84
PID 1692 wrote to memory of 2520	1692	cmd.exe	84
PID 1692 wrote to memory of 2520	1692	cmd.exe	84
PID 1392 wrote to memory of 2736	1392	cmd.exe	90
PID 1392 wrote to memory of 2736	1392	cmd.exe	90
PID 1392 wrote to memory of 2736	1392	cmd.exe	90

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Installer.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1924

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding 71C0A10043A399DF1C52F1E1DBB85C87 M Global\MSI0000
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Program Files directory
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2868
- - C:\Program Files (x86)\Windows NT\7za.exe
    7za.exe x -y data.dat -pa8dtyw9eyfd9aslyd9iald
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2036
- - C:\Windows\system32\cmd.exe
    cmd.exe /c 7za.exe x -bd -y locale3.dat -pasfasdf79yf9layslofs
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3032
  - - C:\Program Files (x86)\Windows NT\7za.exe
      7za.exe x -bd -y locale3.dat -pasfasdf79yf9layslofs
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: CmdExeWriteProcessMemorySpam
      PID:2164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c shutdown -f -r -t 00
    3⤵
    PID:2496
  - - C:\Windows\system32\shutdown.exe
      shutdown -f -r -t 00
      4⤵
      PID:844

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2920

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000320" "0000000000000318"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2336

C:\Windows\system32\cmd.exe
cmd /c start sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto
1⤵
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Windows\system32\sc.exe
  sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto
  2⤵
  - Launches sc.exe
  PID:2956

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:2132

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  PID:1276

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:2192

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
- Suspicious use of WriteProcessMemory
PID:848
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  PID:1384

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:1916

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:2172

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:2328

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:1360

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:1680

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:1816

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:2236

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:3064

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:1908

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:2520

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:2292
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:1584

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:2736

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:2744
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:2892

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:2848
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:2684

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:2528
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:2444

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:2240
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:2244

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:1112
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:1040

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:2972
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:1496

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:2880
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  PID:2696

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:1348
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:2044

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:1316
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:672

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:2804
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  PID:1272

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:3028
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:372

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:2372
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:2996

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:556
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:2104

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:3032
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:2668

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:2304
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:1060

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:2348
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:1940

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:2192
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:2284

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:956
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  PID:3040

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:316
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:1696

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:1528
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:1868

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:1772
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:2088

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:2224
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:2220

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:3052
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:2176

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:2960
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  PID:2236

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:2332
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:2188

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:1908
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:1336

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:852
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  PID:1780

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:1808
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:2816

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:2072
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  PID:2744

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:1344
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  PID:1296

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:344
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:2040

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:1624
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:2056

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:2980
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:1040

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:3004
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  PID:3012

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:1280
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:2976

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:2044
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:1504

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:672
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:3024

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:2616
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:1620

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:2004
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:2372

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:1656
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:2152

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:2724
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  PID:2156

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:1560
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  PID:2496

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:2160
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:1956

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:844
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:272

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:3040
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:708

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:1652
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:1696

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:1268
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  PID:2964

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:776
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:2224

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:1756
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:1704

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:2960
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:1700

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:1688
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  PID:1892

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:2268
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:1336

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:2588
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:1596

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:2816
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:2732

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:2336
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:2744

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:2912
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:2628

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:2444
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:1624

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:2692
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  PID:1788

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:3004
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:2968

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:1348
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:2896

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:2460
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:1316

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:2384
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  PID:1272

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:3028
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  - Launches sc.exe
  PID:2052

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:2372
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  PID:1944

C:\Windows\system32\cmd.exe
cmd /c start sc start CleverSoar
1⤵
PID:2352
- C:\Windows\system32\sc.exe
  sc start CleverSoar
  2⤵
  PID:1712

C:\Windows\system32\cmd.exe
cmd /c start shutdown -f -r -t 00
1⤵
PID:2156
- C:\Windows\system32\shutdown.exe
  shutdown -f -r -t 00
  2⤵
  PID:1560

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:2484

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:2224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f76da4a.rbs

Filesize
11.8MB

MD5
5f791ed70d649ceecbc73ae1d393e9ef

SHA1
fd18bbbd700849a4a121717900bb147a63146dda

SHA256
921f4639b0f3d3af1a7b22b347c3266c8607f1e5905b72420be4cdb1970d6c3a

SHA512
662dfe2956b9324117f5c37181d242e901145c9d1bd518e72a3acebf859419b780b9f5ffa32c83ff3c5dd04e3b0aa2fa9d1ee42bb491792ef490d337d0c2da4b

Download Submit
C:\Program Files (x86)\Windows NT\7za.bin

Filesize
577KB

MD5
f77c0b61806b6865c888592e178294c3

SHA1
e9e0b393cc977fbdbc44fe19d92879a38a4dad0c

SHA256
b85490de04744a2e30a815bfad752b520e87f71a1ce92dd23a0ed975b4836c82

SHA512
b4214f31ce76ba40d57ff64d204b3e0943a66e0b58302a22a92dbba98b847cbd6191a780e8940bea0498771a207c7024370b61fcbf310b22824d2b632efa7f12

Download Submit
C:\Program Files (x86)\Windows NT\7za.exe

Filesize
577KB

MD5
fbc6e272e89203cb9ddb3f88b4954deb

SHA1
fc75778e7e0c9f1bb67bc1097fdb9a5bcd5e7a0d

SHA256
99026dc8b99c6ea934b943f41a543f39040d837650d7f185ebd9f147a49ea1b6

SHA512
b010571d7924e35feedc32ad82020dc85903cf4e8a606ee055f6f4f6485982839ad1bad83f56301610d9b063a7fe55d403e6113a8c285c06d96c9b3ec8783425

Download Submit
C:\Program Files (x86)\Windows NT\data.bin

Filesize
212KB

MD5
a299612c32a1f0ed19692cb5b8ce8b52

SHA1
af17fd3ebe8887438542e5747f3158fed262dcbd

SHA256
0a31fdd828093a5f0e2f3521c79bc20c38473092a03cca583e91bbb4e436d6a4

SHA512
1df0e5ed0650b05114cb779e02d8a584aaf4921ef88dd14123be8eb9398dbe09da3d180d06bbb3da586baf56952b18e5f9cbadc4ce4a2ef56ac720ba00f6c5e4

Download Submit
C:\Program Files (x86)\Windows NT\data.dat

Filesize
212KB

MD5
d730267cc55e05f10d6610340b18df20

SHA1
be4fcea88a53230ca9277fe714bf0e7b38b08909

SHA256
25e85831759cf8217db51aef24346c78368d5d87362e13ce2ef68fd515b03fed

SHA512
0bfcd1ace4c9674c388d5c2bec470674e1c1a6cc6d6482aa2268af2695a5eac2300e7ec144d703d483f1894adbd5e94070917f76590f7397a6e500a3bc5619ea

Download Submit
C:\Program Files (x86)\Windows NT\locale.bin

Filesize
55KB

MD5
95ef3afe0bc5d1cbdba8ea52fed6b9d5

SHA1
01557bdd7b3cd39fe0aa769d49408d69bf951e63

SHA256
f57bd6fadf5db0ad99e06ae48a356cefb3f2436183eda266a7fb3c4aea8d991e

SHA512
53b3d20076e7a38cafa2d064cefd80f3232b82e96b9325c607e2c68e5aa3d18c6a13b948ef7166da73189942b0ccbfebd472423aa7aa7f6e4c9a3a0b9e0e864d

Download Submit
C:\Program Files (x86)\Windows NT\locale2.bin

Filesize
55KB

MD5
73f8d8d2e4f083b8673a84709528f695

SHA1
456ef9e17cd704050b8a65adaad6ef4f8b620a1d

SHA256
55df9a058d76a769841aae219da1d464436dd1434e3528200b01ded2b7c750f6

SHA512
8ba2150bc24c70146b763d22238c0b569870088e24ea272708820badfad26fbbf6d6e0a4d413de61e0a019ef2d0f7d9f2634ef55cc1cf1584522206a7b5452f1

Download Submit
C:\Program Files (x86)\Windows NT\locale3.bin

Filesize
29KB

MD5
a8135a41e08677cad9122aa96361b1fa

SHA1
3fe0adf5dd66dec528bd7b5252a785425a9b608a

SHA256
14c1dd444a3e0604da6b30542d409fe3917fe8548473f16bb49d26c0d61eeb4a

SHA512
6064f813f887672b41d212c3170249da0451fbe79335af3afe96f7cbe7df14ee98f27bcf158abf4da5c74e6120bd3a12ebc6cdc28b14851a8c910b598351d224

Download Submit
C:\Program Files (x86)\Windows NT\locale3.dat

Filesize
29KB

MD5
c6cd33f25c71000e089e3ba2a18e907a

SHA1
853f963fd6edcb07e199c20eac25177f2894c5ba

SHA256
161196b017d1fa466c9b806e2d62614026e9d34958eb47af0dab270f4eca881c

SHA512
a27b014fc0df449a39111067ce21ba3ef2ead39d1a2abad9d9e61a60b43f53d50d2789a61961dced1fe3782d55e42fc084fa06eec335a51b802d6a4c13436bd7

Download Submit
C:\Program Files (x86)\Windows NT\locale4.bin

Filesize
73KB

MD5
3f1d2a17a706268d2ca80576e6906c59

SHA1
89e95ddad035a61baf47a737ae5fb6067d10d57e

SHA256
f7c0f83a521d1a157f86b9643513e726985300c374193b1256696a041225a213

SHA512
dd1f841da013ada0a753fac4a41383e9c490903f09a2e543eb8488fbf21e8ca7c2dbb6a4142c38eadb983e02fde0134a71acdcf91308959c249c795ebea1e9f7

Download Submit
C:\Windows\Installer\MSIDCE9.tmp

Filesize
11.8MB

MD5
14ebd2b284bfded84986345558e6c8b4

SHA1
a69be1a9f80146915cbb26264b015c5240fa1650

SHA256
8ff935a4b5d7ff3b39025de7bb7fcb301995d70006edf1488bbd0880926d82c9

SHA512
b7339d43648895e1490e9d618aa5259bb00b37df416534eca4e97dc6cb46c2de83e6ce4a82c534a5b610e74eabe51bbc694f908268dcd91127f0cbc1b243e60c

Download Submit
C:\Windows\Installer\f76da48.msi

Filesize
12.4MB

MD5
0b6f567d2d08cf51fab3a4c156973ec5

SHA1
3693e4e6eb7ac5fad966c77eb4b38cd2cc4c9a20

SHA256
55bcd5d30a281d4df8ab11da0b6bc8773ee09b9da0537f826ae9bfa06d91b441

SHA512
d9fda950dcb9811e0e3c1d5542933754286fb5335e4062ab49622aba86636ab771f02c6d0d9c46942f2dc9c6d0c86bc3057d862fbd35483fd7e60a635a8048b0

Download Submit
memory/2868-23-0x0000000077280000-0x0000000077282000-memory.dmp

Filesize
8KB

Download
memory/2868-28-0x0000000077290000-0x0000000077292000-memory.dmp

Filesize
8KB

Download
memory/2868-21-0x0000000077280000-0x0000000077282000-memory.dmp

Filesize
8KB

Download
memory/2868-24-0x0000000077290000-0x0000000077292000-memory.dmp

Filesize
8KB

Download
memory/2868-26-0x0000000077290000-0x0000000077292000-memory.dmp

Filesize
8KB

Download
memory/2868-29-0x000007FEF4AB0000-0x000007FEF5E27000-memory.dmp

Filesize
19.5MB

Download
memory/2868-19-0x0000000077280000-0x0000000077282000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads