Overview
overview
9Static
static
37aa9df6811...0a.exe
windows7-x64
97aa9df6811...0a.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3flashplaye...ax.msi
windows7-x64
9flashplaye...ax.msi
windows10-2004-x64
9uninstall_...er.exe
windows7-x64
7uninstall_...er.exe
windows10-2004-x64
7Analysis
-
max time kernel
194s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18/03/2025, 05:19
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
7aa9df6811ccf7f560e7c2f34e26286d5366cbb81b0eed63e3271db785d10f0a.exe
Resource
win7-20240903-en
windows7-x64
23 signatures
300 seconds
Behavioral task
behavioral2
Sample
7aa9df6811ccf7f560e7c2f34e26286d5366cbb81b0eed63e3271db785d10f0a.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
3 signatures
300 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20241010-en
windows7-x64
3 signatures
300 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20250313-en
windows10-2004-x64
3 signatures
300 seconds
Behavioral task
behavioral5
Sample
flashplayer20_0d0_228_winax.msi
Resource
win7-20240903-en
windows7-x64
24 signatures
300 seconds
Behavioral task
behavioral6
Sample
flashplayer20_0d0_228_winax.msi
Resource
win10v2004-20250313-en
windows10-2004-x64
25 signatures
300 seconds
Behavioral task
behavioral7
Sample
uninstall_flash_player.exe
Resource
win7-20241010-en
windows7-x64
4 signatures
300 seconds
Behavioral task
behavioral8
Sample
uninstall_flash_player.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
4 signatures
300 seconds
General
-
Target
flashplayer20_0d0_228_winax.msi
-
Size
18.7MB
-
MD5
5bbdc07c6e6389b5d2ce86765911c879
-
SHA1
fa86f107111fc7def35742097bf0aa29c82d7638
-
SHA256
63cef518bff5b7a8cadd6b2a8c6b738ce3f2fdce231e95db920cbdd75e0f0bc6
-
SHA512
144b7d73094f19cfec404f1c10d133df43f5b67d39b404ecc2c82598bed55b0622dce13e24cfa39d0cbf552a296f4a132922d23e84130fe26480cf1b0dad0e73
-
SSDEEP
393216:AJhhV7thwzSIFadpgMKjSCHDqhadHDk2My5FiO93IYP:UnV76SIUMDSADqhaLMy5l3b
Malware Config
Signatures
-
resource yara_rule behavioral5/files/0x000600000001a4c0-167.dat cryptone -
Blocklisted process makes network request 5 IoCs
flow pid Process 3 1576 msiexec.exe 5 1576 msiexec.exe 7 1576 msiexec.exe 9 1576 msiexec.exe 11 1576 msiexec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe -
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 8 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FlashUtil64_20_0_0_228_ActiveX.exe\DisableExceptionChainValidation = "0" InstallFlashPlayer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FlashUtil32_20_0_0_228_ActiveX.exe InstallAX_20_0_0_228.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FlashUtil32_20_0_0_228_ActiveX.exe\DisableExceptionChainValidation = "0" InstallAX_20_0_0_228.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FlashPlayerApp.exe InstallAX_20_0_0_228.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FlashPlayerApp.exe\DisableExceptionChainValidation = "0" InstallAX_20_0_0_228.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FlashPlayerUpdateService.exe InstallAX_20_0_0_228.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FlashPlayerUpdateService.exe\DisableExceptionChainValidation = "0" InstallAX_20_0_0_228.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FlashUtil64_20_0_0_228_ActiveX.exe InstallFlashPlayer.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
pid Process 620 InstallFlashPlayer.exe -
Drops file in System32 directory 17 IoCs
description ioc Process File created C:\Windows\SysWOW64\Macromed\Flash\Flash32_20_0_0_228.ocx InstallAX_20_0_0_228.exe File opened for modification C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_20_0_0_228_ActiveX.exe InstallAX_20_0_0_228.exe File opened for modification C:\Windows\SysWOW64\Macromed\Flash\Flash32_20_0_0_228.ocx InstallAX_20_0_0_228.exe File opened for modification C:\Windows\SysWOW64\Macromed\Flash\FlashInstall.log InstallAX_20_0_0_228.exe File created C:\Windows\SysWOW64\FlashPlayerApp.exe InstallAX_20_0_0_228.exe File created C:\Windows\system32\Macromed\Flash\Flash64_20_0_0_228.ocx InstallFlashPlayer.exe File created C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe InstallAX_20_0_0_228.exe File created C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl InstallAX_20_0_0_228.exe File created C:\Windows\system32\Macromed\Flash\FlashUtil64_20_0_0_228_ActiveX.exe InstallFlashPlayer.exe File created C:\Windows\system32\Macromed\Flash\FlashUtil64_20_0_0_228_ActiveX.dll InstallFlashPlayer.exe File opened for modification C:\Windows\system32\Macromed\Flash\Flash64_20_0_0_228.ocx InstallFlashPlayer.exe File opened for modification C:\Windows\system32\Macromed\Flash\FlashInstall.log InstallFlashPlayer.exe File created C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_20_0_0_228_ActiveX.exe InstallAX_20_0_0_228.exe File created C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_20_0_0_228_ActiveX.dll InstallAX_20_0_0_228.exe File created C:\Windows\SysWOW64\Macromed\Flash\activex.vch InstallAX_20_0_0_228.exe File created C:\Windows\system32\Macromed\Flash\activex.vch InstallFlashPlayer.exe File opened for modification C:\Windows\system32\Macromed\Flash\FlashUtil64_20_0_0_228_ActiveX.exe InstallFlashPlayer.exe -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIE208.tmp msiexec.exe File opened for modification C:\Windows\Installer\{7B0961DB-15EB-41AF-85DA-C296924CA408}\ARPPRODUCTICON.exe msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File created C:\Windows\Installer\f76dfc4.msi msiexec.exe File opened for modification C:\Windows\Installer\f76dfc4.msi msiexec.exe File created C:\Windows\Installer\f76dfc5.ipi msiexec.exe File created C:\Windows\Installer\{7B0961DB-15EB-41AF-85DA-C296924CA408}\ARPPRODUCTICON.exe msiexec.exe File created C:\Windows\Installer\f76dfc7.msi msiexec.exe File opened for modification C:\Windows\Installer\f76dfc5.ipi msiexec.exe -
Executes dropped EXE 5 IoCs
pid Process 1672 InstallAX_20_0_0_228.exe 620 InstallFlashPlayer.exe 812 FlashPlayerUpdateService.exe 1664 FlashPlayerUpdateService.exe 1644 FlashPlayerUpdateService.exe -
Loads dropped DLL 16 IoCs
pid Process 2708 MsiExec.exe 2708 MsiExec.exe 1672 InstallAX_20_0_0_228.exe 1672 InstallAX_20_0_0_228.exe 1672 InstallAX_20_0_0_228.exe 1672 InstallAX_20_0_0_228.exe 620 InstallFlashPlayer.exe 620 InstallFlashPlayer.exe 620 InstallFlashPlayer.exe 620 InstallFlashPlayer.exe 620 InstallFlashPlayer.exe 1672 InstallAX_20_0_0_228.exe 1672 InstallAX_20_0_0_228.exe 1672 InstallAX_20_0_0_228.exe 2708 MsiExec.exe 2708 MsiExec.exe -
Checks whether UAC is enabled 1 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA InstallAX_20_0_0_228.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA InstallFlashPlayer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 1576 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language InstallAX_20_0_0_228.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FlashPlayerUpdateService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FlashPlayerUpdateService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FlashPlayerUpdateService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FAF199D2-BFA7-4394-A4DE-044A08E59B32}\AppPath = "C:\\Windows\\system32\\Macromed\\Flash" InstallFlashPlayer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{D27CDB70-AE6D-11cf-96B8-444553540000} InstallFlashPlayer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FAF199D2-BFA7-4394-A4DE-044A08E59B32}\AppName = "FlashUtil64_20_0_0_228_ActiveX.exe" InstallFlashPlayer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{D27CDB70-AE6D-11cf-96B8-444553540000}\Compatibility Flags = "65536" InstallFlashPlayer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\NavigatorPluginsList\Shockwave Flash\application/futuresplash InstallFlashPlayer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\NavigatorPluginsList\Shockwave Flash\application/x-shockwave-flash InstallFlashPlayer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{D27CDB6E-AE6D-11CF-96B8-444553540000} InstallFlashPlayer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{D27CDB70-AE6D-11cf-96B8-444553540000} InstallAX_20_0_0_228.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\NavigatorPluginsList\Shockwave Flash\application/futuresplash InstallAX_20_0_0_228.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{D27CDB6E-AE6D-11CF-96B8-444553540000} InstallAX_20_0_0_228.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FAF199D2-BFA7-4394-A4DE-044A08E59B32} InstallFlashPlayer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FAF199D2-BFA7-4394-A4DE-044A08E59B32}\Policy = "3" InstallFlashPlayer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\NavigatorPluginsList\Shockwave Flash InstallFlashPlayer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{D27CDB6E-AE6D-11CF-96B8-444553540000}\Compatibility Flags = "0" InstallFlashPlayer.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FAF199D2-BFA7-4394-A4DE-044A08E59B32} InstallAX_20_0_0_228.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FAF199D2-BFA7-4394-A4DE-044A08E59B32}\AppPath = "C:\\Windows\\SysWOW64\\Macromed\\Flash" InstallAX_20_0_0_228.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{D27CDB70-AE6D-11cf-96B8-444553540000}\Compatibility Flags = "65536" InstallAX_20_0_0_228.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{D27CDB6E-AE6D-11CF-96B8-444553540000}\Compatibility Flags = "0" InstallAX_20_0_0_228.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FAF199D2-BFA7-4394-A4DE-044A08E59B32}\Policy = "3" InstallAX_20_0_0_228.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FAF199D2-BFA7-4394-A4DE-044A08E59B32}\AppName = "FlashUtil32_20_0_0_228_ActiveX.exe" InstallAX_20_0_0_228.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\NavigatorPluginsList\Shockwave Flash InstallAX_20_0_0_228.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\NavigatorPluginsList\Shockwave Flash\application/x-shockwave-flash InstallAX_20_0_0_228.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad InstallAX_20_0_0_228.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c6-4e-36-e0-b9-b7\WpadDecision = "0" InstallAX_20_0_0_228.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ InstallAX_20_0_0_228.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" InstallAX_20_0_0_228.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0980013B-8D0E-44AE-94C5-023B40F164C2}\WpadDecisionReason = "1" InstallAX_20_0_0_228.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings InstallAX_20_0_0_228.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings InstallAX_20_0_0_228.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0980013B-8D0E-44AE-94C5-023B40F164C2} InstallAX_20_0_0_228.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c6-4e-36-e0-b9-b7\WpadDecisionTime = 901c2a5dc597db01 InstallAX_20_0_0_228.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" InstallFlashPlayer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections InstallAX_20_0_0_228.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 InstallAX_20_0_0_228.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Direct3D\MostRecentApplication\Name = "InstallAX_20_0_0_228.exe" InstallAX_20_0_0_228.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" InstallAX_20_0_0_228.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0980013B-8D0E-44AE-94C5-023B40F164C2}\WpadDecision = "0" InstallAX_20_0_0_228.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Direct3D\MostRecentApplication\Name = "InstallFlashPlayer.exe" InstallFlashPlayer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" InstallAX_20_0_0_228.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\MostRecentApplication InstallAX_20_0_0_228.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" InstallFlashPlayer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c6-4e-36-e0-b9-b7 InstallAX_20_0_0_228.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00cd000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 InstallAX_20_0_0_228.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 InstallAX_20_0_0_228.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix InstallAX_20_0_0_228.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0980013B-8D0E-44AE-94C5-023B40F164C2}\WpadNetworkName = "Network 3" InstallAX_20_0_0_228.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c6-4e-36-e0-b9-b7\WpadDecisionReason = "1" InstallAX_20_0_0_228.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\EnableFullPage InstallAX_20_0_0_228.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000} InstallAX_20_0_0_228.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID InstallAX_20_0_0_228.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD1690B7BE51FA1458AD2C6929C44A80\ProductIcon = "C:\\Windows\\Installer\\{7B0961DB-15EB-41AF-85DA-C296924CA408}\\ARPPRODUCTICON.exe" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib InstallFlashPlayer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.8\ = "Shockwave Flash Object" InstallFlashPlayer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Control InstallFlashPlayer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version\ = "1.0" InstallFlashPlayer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-shockwave-flash InstallFlashPlayer.exe Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0\0\win32 InstallAX_20_0_0_228.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FlashFactory.FlashFactory\CLSID\ = "{D27CDB70-AE6D-11cf-96B8-444553540000}" InstallAX_20_0_0_228.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D27CDB6C-AE6D-11CF-96B8-444553540000}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" InstallFlashPlayer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.6\ = "Shockwave Flash Object" InstallAX_20_0_0_228.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID\ = "ShockwaveFlash.ShockwaveFlash.20" InstallAX_20_0_0_228.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32\ = "C:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_20_0_0_228.ocx, 1" InstallAX_20_0_0_228.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ = "Macromedia Flash Factory Object" InstallAX_20_0_0_228.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib\ = "{D27CDB6B-AE6D-11cf-96B8-444553540000}" InstallAX_20_0_0_228.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.spl\ = "ShockwaveFlash.ShockwaveFlash" InstallAX_20_0_0_228.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.swf\ = "ShockwaveFlash.ShockwaveFlash" InstallAX_20_0_0_228.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.6 InstallFlashPlayer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.17\ = "Shockwave Flash Object" InstallFlashPlayer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus InstallFlashPlayer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{86230738-D762-4C50-A2DE-A753E5B1686F}\TypeLib\ = "{D27CDB6B-AE6D-11CF-96B8-444553540000}" InstallFlashPlayer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32 InstallAX_20_0_0_228.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD1690B7BE51FA1458AD2C6929C44A80\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD1690B7BE51FA1458AD2C6929C44A80\SourceList\Media\1 = "DISK1;1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\ InstallFlashPlayer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MacromediaFlashPaper.MacromediaFlashPaper\ = "Macromedia Flash Paper" InstallFlashPlayer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.8 InstallFlashPlayer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.10\CLSID InstallFlashPlayer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ = "Shockwave Flash Object" InstallFlashPlayer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D27CDB6C-AE6D-11CF-96B8-444553540000} InstallFlashPlayer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.13\CLSID\ = "{D27CDB6E-AE6D-11cf-96B8-444553540000}" InstallAX_20_0_0_228.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib\ = "{D27CDB6B-AE6D-11cf-96B8-444553540000}" InstallAX_20_0_0_228.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ = "IFlashBroker6" InstallFlashPlayer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0\ = "FlashBroker" InstallFlashPlayer.exe Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0\FLAGS InstallFlashPlayer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Implemented Categories\{31CAF6E4-D6AA-4090-A050-A5AC8972E9EF} InstallFlashPlayer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{86230738-D762-4C50-A2DE-A753E5B1686F}\TypeLib InstallFlashPlayer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32 InstallAX_20_0_0_228.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\EnableFullPage\.mfp InstallAX_20_0_0_228.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mfp\ = "MacromediaFlashPaper.MacromediaFlashPaper" InstallAX_20_0_0_228.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib\ = "{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" InstallFlashPlayer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.8\CLSID\ = "{D27CDB6E-AE6D-11cf-96B8-444553540000}" InstallFlashPlayer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.14\ = "Shockwave Flash Object" InstallFlashPlayer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.17 InstallFlashPlayer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D27CDB6C-AE6D-11CF-96B8-444553540000}\TypeLib\Version = "1.0" InstallFlashPlayer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.sor\Content Type = "text/plain" InstallAX_20_0_0_228.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD1690B7BE51FA1458AD2C6929C44A80\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D27CDB6D-AE6D-11CF-96B8-444553540000}\ProxyStubClsid32 InstallFlashPlayer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD1690B7BE51FA1458AD2C6929C44A80\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\ = "FlashBroker" InstallFlashPlayer.exe Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9} InstallFlashPlayer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MacromediaFlashPaper.MacromediaFlashPaper InstallFlashPlayer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.4\ = "Shockwave Flash Object" InstallFlashPlayer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.13 InstallFlashPlayer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus\1 InstallFlashPlayer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.swf\Content Type = "application/x-shockwave-flash" InstallFlashPlayer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/futuresplash InstallFlashPlayer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.sor\Content Type = "text/plain" InstallFlashPlayer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{57A0E746-3863-4D20-A811-950C84F1DB9B}\1.1\0\win64 InstallFlashPlayer.exe Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0 InstallAX_20_0_0_228.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID\ = "ShockwaveFlash.ShockwaveFlash" InstallAX_20_0_0_228.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version\ = "1.0" InstallAX_20_0_0_228.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2684 msiexec.exe 2684 msiexec.exe 1672 InstallAX_20_0_0_228.exe 1672 InstallAX_20_0_0_228.exe 620 InstallFlashPlayer.exe 620 InstallFlashPlayer.exe 620 InstallFlashPlayer.exe 620 InstallFlashPlayer.exe 1672 InstallAX_20_0_0_228.exe 1672 InstallAX_20_0_0_228.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1576 msiexec.exe Token: SeIncreaseQuotaPrivilege 1576 msiexec.exe Token: SeRestorePrivilege 2684 msiexec.exe Token: SeTakeOwnershipPrivilege 2684 msiexec.exe Token: SeSecurityPrivilege 2684 msiexec.exe Token: SeCreateTokenPrivilege 1576 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1576 msiexec.exe Token: SeLockMemoryPrivilege 1576 msiexec.exe Token: SeIncreaseQuotaPrivilege 1576 msiexec.exe Token: SeMachineAccountPrivilege 1576 msiexec.exe Token: SeTcbPrivilege 1576 msiexec.exe Token: SeSecurityPrivilege 1576 msiexec.exe Token: SeTakeOwnershipPrivilege 1576 msiexec.exe Token: SeLoadDriverPrivilege 1576 msiexec.exe Token: SeSystemProfilePrivilege 1576 msiexec.exe Token: SeSystemtimePrivilege 1576 msiexec.exe Token: SeProfSingleProcessPrivilege 1576 msiexec.exe Token: SeIncBasePriorityPrivilege 1576 msiexec.exe Token: SeCreatePagefilePrivilege 1576 msiexec.exe Token: SeCreatePermanentPrivilege 1576 msiexec.exe Token: SeBackupPrivilege 1576 msiexec.exe Token: SeRestorePrivilege 1576 msiexec.exe Token: SeShutdownPrivilege 1576 msiexec.exe Token: SeDebugPrivilege 1576 msiexec.exe Token: SeAuditPrivilege 1576 msiexec.exe Token: SeSystemEnvironmentPrivilege 1576 msiexec.exe Token: SeChangeNotifyPrivilege 1576 msiexec.exe Token: SeRemoteShutdownPrivilege 1576 msiexec.exe Token: SeUndockPrivilege 1576 msiexec.exe Token: SeSyncAgentPrivilege 1576 msiexec.exe Token: SeEnableDelegationPrivilege 1576 msiexec.exe Token: SeManageVolumePrivilege 1576 msiexec.exe Token: SeImpersonatePrivilege 1576 msiexec.exe Token: SeCreateGlobalPrivilege 1576 msiexec.exe Token: SeCreateTokenPrivilege 1576 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1576 msiexec.exe Token: SeLockMemoryPrivilege 1576 msiexec.exe Token: SeIncreaseQuotaPrivilege 1576 msiexec.exe Token: SeMachineAccountPrivilege 1576 msiexec.exe Token: SeTcbPrivilege 1576 msiexec.exe Token: SeSecurityPrivilege 1576 msiexec.exe Token: SeTakeOwnershipPrivilege 1576 msiexec.exe Token: SeLoadDriverPrivilege 1576 msiexec.exe Token: SeSystemProfilePrivilege 1576 msiexec.exe Token: SeSystemtimePrivilege 1576 msiexec.exe Token: SeProfSingleProcessPrivilege 1576 msiexec.exe Token: SeIncBasePriorityPrivilege 1576 msiexec.exe Token: SeCreatePagefilePrivilege 1576 msiexec.exe Token: SeCreatePermanentPrivilege 1576 msiexec.exe Token: SeBackupPrivilege 1576 msiexec.exe Token: SeRestorePrivilege 1576 msiexec.exe Token: SeShutdownPrivilege 1576 msiexec.exe Token: SeDebugPrivilege 1576 msiexec.exe Token: SeAuditPrivilege 1576 msiexec.exe Token: SeSystemEnvironmentPrivilege 1576 msiexec.exe Token: SeChangeNotifyPrivilege 1576 msiexec.exe Token: SeRemoteShutdownPrivilege 1576 msiexec.exe Token: SeUndockPrivilege 1576 msiexec.exe Token: SeSyncAgentPrivilege 1576 msiexec.exe Token: SeEnableDelegationPrivilege 1576 msiexec.exe Token: SeManageVolumePrivilege 1576 msiexec.exe Token: SeImpersonatePrivilege 1576 msiexec.exe Token: SeCreateGlobalPrivilege 1576 msiexec.exe Token: SeCreateTokenPrivilege 1576 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1576 msiexec.exe 1576 msiexec.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1672 InstallAX_20_0_0_228.exe 620 InstallFlashPlayer.exe -
Suspicious use of WriteProcessMemory 46 IoCs
description pid Process procid_target PID 2684 wrote to memory of 2708 2684 msiexec.exe 31 PID 2684 wrote to memory of 2708 2684 msiexec.exe 31 PID 2684 wrote to memory of 2708 2684 msiexec.exe 31 PID 2684 wrote to memory of 2708 2684 msiexec.exe 31 PID 2684 wrote to memory of 2708 2684 msiexec.exe 31 PID 2684 wrote to memory of 2708 2684 msiexec.exe 31 PID 2684 wrote to memory of 2708 2684 msiexec.exe 31 PID 2684 wrote to memory of 2508 2684 msiexec.exe 36 PID 2684 wrote to memory of 2508 2684 msiexec.exe 36 PID 2684 wrote to memory of 2508 2684 msiexec.exe 36 PID 2684 wrote to memory of 2508 2684 msiexec.exe 36 PID 2684 wrote to memory of 2508 2684 msiexec.exe 36 PID 2684 wrote to memory of 2508 2684 msiexec.exe 36 PID 2684 wrote to memory of 2508 2684 msiexec.exe 36 PID 2684 wrote to memory of 1672 2684 msiexec.exe 37 PID 2684 wrote to memory of 1672 2684 msiexec.exe 37 PID 2684 wrote to memory of 1672 2684 msiexec.exe 37 PID 2684 wrote to memory of 1672 2684 msiexec.exe 37 PID 2684 wrote to memory of 1672 2684 msiexec.exe 37 PID 2684 wrote to memory of 1672 2684 msiexec.exe 37 PID 2684 wrote to memory of 1672 2684 msiexec.exe 37 PID 1672 wrote to memory of 620 1672 InstallAX_20_0_0_228.exe 38 PID 1672 wrote to memory of 620 1672 InstallAX_20_0_0_228.exe 38 PID 1672 wrote to memory of 620 1672 InstallAX_20_0_0_228.exe 38 PID 1672 wrote to memory of 620 1672 InstallAX_20_0_0_228.exe 38 PID 620 wrote to memory of 2520 620 InstallFlashPlayer.exe 39 PID 620 wrote to memory of 2520 620 InstallFlashPlayer.exe 39 PID 620 wrote to memory of 2520 620 InstallFlashPlayer.exe 39 PID 1672 wrote to memory of 812 1672 InstallAX_20_0_0_228.exe 41 PID 1672 wrote to memory of 812 1672 InstallAX_20_0_0_228.exe 41 PID 1672 wrote to memory of 812 1672 InstallAX_20_0_0_228.exe 41 PID 1672 wrote to memory of 812 1672 InstallAX_20_0_0_228.exe 41 PID 1672 wrote to memory of 812 1672 InstallAX_20_0_0_228.exe 41 PID 1672 wrote to memory of 812 1672 InstallAX_20_0_0_228.exe 41 PID 1672 wrote to memory of 812 1672 InstallAX_20_0_0_228.exe 41 PID 1672 wrote to memory of 2428 1672 InstallAX_20_0_0_228.exe 43 PID 1672 wrote to memory of 2428 1672 InstallAX_20_0_0_228.exe 43 PID 1672 wrote to memory of 2428 1672 InstallAX_20_0_0_228.exe 43 PID 1672 wrote to memory of 2428 1672 InstallAX_20_0_0_228.exe 43 PID 1592 wrote to memory of 1664 1592 taskeng.exe 46 PID 1592 wrote to memory of 1664 1592 taskeng.exe 46 PID 1592 wrote to memory of 1664 1592 taskeng.exe 46 PID 1592 wrote to memory of 1664 1592 taskeng.exe 46 PID 1592 wrote to memory of 1664 1592 taskeng.exe 46 PID 1592 wrote to memory of 1664 1592 taskeng.exe 46 PID 1592 wrote to memory of 1664 1592 taskeng.exe 46 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\flashplayer20_0d0_228_winax.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1576
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 33DFBA81004DD9C1869C521CA424B15E C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2708
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5CD7C4A0C7DF636DF5A5C27F814329052⤵
- System Location Discovery: System Language Discovery
PID:2508
-
-
C:\Users\Admin\AppData\Local\Temp\InstallAX_20_0_0_228.exe"C:\Users\Admin\AppData\Local\Temp\InstallAX_20_0_0_228.exe" -install -msi2⤵
- Event Triggered Execution: Image File Execution Options Injection
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\{384B3B3C-4FF7-4EA9-ADB3-A340EC429255}\InstallFlashPlayer.exe"C:\Users\Admin\AppData\Local\Temp\{384B3B3C-4FF7-4EA9-ADB3-A340EC429255}\InstallFlashPlayer.exe" -install -skipARPEntry -iv 2 -au 42949672953⤵
- Event Triggered Execution: Image File Execution Options Injection
- Network Service Discovery
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\{384B3B3C-4FF7-4EA9-ADB3-A340EC429255}\InstallFlashPlayer.exe" >> NUL4⤵PID:2520
-
-
-
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exeC:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -install3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:812
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\InstallAX_20_0_0_228.exe" >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:2428
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:1116
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "000000000000054C" "00000000000002D0"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2036
-
C:\Windows\system32\taskeng.exetaskeng.exe {2B735B4B-F54F-4EB4-8311-11DCFB82D640} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exeC:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1664
-
-
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exeC:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1644
Network
MITRE ATT&CK Enterprise v15
Persistence
Event Triggered Execution
3Component Object Model Hijacking
1Image File Execution Options Injection
1Installer Packages
1Privilege Escalation
Event Triggered Execution
3Component Object Model Hijacking
1Image File Execution Options Injection
1Installer Packages
1Defense Evasion
Indicator Removal
1File Deletion
1Modify Registry
1System Binary Proxy Execution
1Msiexec
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD549b207f82ed4f4976d397c6bd51ed99f
SHA12da8ac53f00695e0b43ab66ce4c90044b0e45963
SHA256d862e3141136047f46007be797196f1612a37888b923988413f059658ef72d89
SHA512d08f16a3f6c4bd9817128ffe6c0735d1f2ecf99c551710b31518127d073a0ba5be0cb65f99d94485b0613e96affe864f47c7b9795686518f3433d30d872bcb18
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0972B7C417F696E06E186AEB26286F01_3EAEAB67121169D5C037E4B1278DEA7C
Filesize5B
MD55bfa51f3a417b98e7443eca90fc94703
SHA18c015d80b8a23f780bdd215dc842b0f5551f63bd
SHA256bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
SHA5124cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
-
Filesize
16KB
MD5f3c162704d3b510ad6e20ed70e5f7652
SHA14e9091c9c519fe60e1509364f9120a4c1f1f5bdb
SHA25606cbf2c10e9e9fccc983aca05d438a3d11a3f8fb3a28ca000fe579b0b8e18a03
SHA51297cca43da45a1f3b236ab455f72a4784174fac1a2ea513751008b1a42774e14a9eb8c302e9c8f090198953846affd4886178ef9af27b6ba3f8434d9c695c04ba
-
Filesize
71KB
MD583142242e97b8953c386f988aa694e4a
SHA1833ed12fc15b356136dcdd27c61a50f59c5c7d50
SHA256d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755
SHA512bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10
-
Filesize
834B
MD55cb16e48b582bf86a4b396fcbc235981
SHA13e7cbf189fbbff1efb9b04c398ceb902e816f15b
SHA256ba479af493eeefdf7de4c86890f5d87886bc0bc92522d39dd09eb21f85cf23f9
SHA51255210eb21fd974bb189063d4e377c37b2cf1c2e0d7ec056dee48f8619cfe04a7a8c1ba329abcfa7edb4785fac08375df4c8261e98dc3a8294f0f4fc29cf61eee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0972B7C417F696E06E186AEB26286F01_3EAEAB67121169D5C037E4B1278DEA7C
Filesize398B
MD58fbab61f92ae9738df8d7b6e0044b885
SHA1a93dbb12e49a05b78a9b16a9a542b35144895cc5
SHA25663b83e1496f1957ee56996f0150bce73b09ad2af75f5783bb85914fb407f2575
SHA5121851d1577b73898d4162e3dd5a741cb633ac345a3453fe524b82a280e88df64daa32537799455f0049099047b588e65f594b1fbd9aeaf9062ad8b742968bf3f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3D0AC26322348780E90E022EA217C58C
Filesize170B
MD548ff82c29b79468aa7f2c93eb0f33eb8
SHA1da2ed96f39d89354d8b31064e712e754822cb724
SHA256bbd46bb328f9a8a6c378bbcea8b220a7ddbe939d36a55a944750a3d5dec40b6b
SHA51222a7a83994d7a160e2eef63db9ddcbc34fed29ae79ee3b6284a8ab433f0092ae004cbebba809b4ff1c2ee69e96439f2fe137379133f4be02e9a7021d7e4a6712
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F
Filesize392B
MD57151f5435f27472e3a2e82b471c633dd
SHA196eeb10b23a892b62dcfc8211cf84a2dfa386564
SHA25677b7a3cf36b4f99d5c1b8d721929d50b6d68cb0ffa4d4169e0cedfd0653d1bb8
SHA512e1086b40938314f7d3f6e7326956b24720cb801c56e664378553f57325d5addba854fc11379c4681d5439481fa892d4b3dddc08a0b77b3420810b9d142e142cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD503ab73ba87389a0c28bdf8e871cae5bf
SHA16bfd35567f76693e234409e28aa8396e1c57af9f
SHA2561de7e500cc31bc6433053344c26c647e6f35b601bb1b3fa38d626714e29ce345
SHA512304ba8d864ca4cc5faa7c4e138116f8c99a2502ed5bb6bd2549168c1c5318954eff0e4b80cd36550f834eaf2d6588a0f9d56bd1e7a8f2f8f879c92af90fb061c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A3D5BF1283C2E63D8C8A8C72F0051F5A
Filesize178B
MD576709272b9d0a9db164146952a1776bd
SHA1815f25cee8d5f3e3aa10d115bd1954c1f5f78046
SHA25637c5cf2bdcad4b6546deabdc238c0e76eaaeb044ff1e63508e607d19d57946bc
SHA512bb509438126c53912e548e53c7d56b0c3071c711c564553ca477de75b944e7db2d2f36b0de9c428064303d8b15b1ff5348c08790b5505ac21394ebbb8af5d299
-
Filesize
17.5MB
MD58028ab3fa3c7f3c3468a714db788f2b1
SHA12035f1356438d7ed28db46b3e2a4eeb11ade4579
SHA2562998f50b750ad49dc49b9a46e8c1a69a6fe636a3f0f10705deab9a4ea31d7209
SHA5126c6dd8bd10a6a543eada17e54e4a7ef7fdcb5f080041be275e377fa15f63a730d210f04bcb0880222e38ca28932c531128f5e537a03b7b95ee56a6742bf25e6d
-
Filesize
63KB
MD5715432bd0d2e49b58b28d3932fd89cad
SHA16e4ad494e48b9cc4a75ad8a95238dc62c5280dfe
SHA256b8d74bb855c240f11dd3d781d667b306832f67c741c9fece2cd42da07e4fba91
SHA5129a107934e7ce007ca055cc3cd47b27ccb526e82c86b4dfc2e9d407b6c0e547170b58530005e1d24d4f04a455e594c803a1b8aea59882b23a1a743b33ec6ad1b6
-
Filesize
57KB
MD5c23d4d5a87e08f8a822ad5a8dbd69592
SHA1317df555bc309dace46ae5c5589bec53ea8f137e
SHA2566d149866246e79919bde5a0b45569ea41327c32ee250f37ad8216275a641bb27
SHA512fa584655ae241004af44774a1f43508e53e95028ce96b39f8b5c62742f38acdf2b1df8871b468ac70c6043ca0e7ae8241bad2db6bc4f700d78471f12bb809e6b
-
Filesize
141KB
MD5edb88affffd67bca3523b41d3e2e4810
SHA10055b93907665fed56d22a7614a581a87d060ead
SHA2564c3d85e7c49928af0f43623dcbed474a157ef50af3cba40b7fd7ac3fe3df2f15
SHA5122b9d99c57bfa9ab00d8582d55b18c5bf155a4ac83cf4c92247be23c35be818b082b3d6fe38fa905d304d2d8b957f3db73428da88e46acc3a7e3fee99d05e4daf
-
Filesize
183KB
MD5109cab5505f5e065b63d01361467a83b
SHA14ed78955b9272a9ed689b51bf2bf4a86a25e53fc
SHA256ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673
SHA512753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc
-
Filesize
18.7MB
MD55bbdc07c6e6389b5d2ce86765911c879
SHA1fa86f107111fc7def35742097bf0aa29c82d7638
SHA25663cef518bff5b7a8cadd6b2a8c6b738ce3f2fdce231e95db920cbdd75e0f0bc6
SHA512144b7d73094f19cfec404f1c10d133df43f5b67d39b404ecc2c82598bed55b0622dce13e24cfa39d0cbf552a296f4a132922d23e84130fe26480cf1b0dad0e73
-
Filesize
9.1MB
MD52c307edcbbbd6ad698c4e47067aa8641
SHA14b5c6b933d71b56fa01ed53e74b257944708ae55
SHA256f34939585a10764d45a87c535873aec4e28a0e8016f581ff339436be034ba52a
SHA512bd3bae96ddf9a00eae39b3f954984f3b834b32d15e6537e747d049ecc8dcde31b9a35a906dcb77d2e3e97c36f895b4ef6f9188d5a981a882db3adaa5b988ecfa
-
Filesize
562KB
MD5f6c9330cc45fdd0caef7f5f8bdb51ff5
SHA1278fcfa827257e37f91e6f3005dd7774b50d29d9
SHA2562d5895550819a89d7a8346dac2ac3043baeea6705148456d8649969cf88bde79
SHA512ac1e5141956e3bc3f4167f3676a10a2ea674c89ca4eadac195411b62ebcf4f51dcf0e8dbd1bd3d5443d441aa9a228c8558f1789d8d2292ec7d14607fe28df01a
-
Filesize
496KB
MD5ba4ae84720ed3fb1e0f04481f03c928f
SHA13071b7b4fe8fce29dd6afbf2630d0396f795c6f4
SHA256c52f5f7ce908a9a3bab64ec8e765f53012f6bdcb8736b31fede77cb1dc268bdc
SHA51237baeb41c55b5cfb10c92cc3e682d1b229d5cbc9063fc70c74d9befcf655ef1939d244574e2f97e10226ff6c210e54a1eb1660a082bb8a34d112e59f39fe163a
-
Filesize
1.1MB
MD54b5578b92aa9b6c8e456606adf962bb3
SHA160bcace18b601036cdf6a659e502be7ae1fa28b2
SHA2569c3f2d1fa670a0ddd3781e7e8e86c4fb1b516fa9f3ae970f4d4c581e5939fdc1
SHA5123ff95d64c8afdc8c8ab974f513db873e99d0d3fde897db55574c13f7f38f37b2ad03a6354b8321e696c5790fe071133e0fe4b5ef2f7dbcbb76ea3f521abe898a
-
Filesize
858KB
MD5ab8b7d5e808226f8e4279f6a779dcf2d
SHA1213cebfa80f179468c79296a7e5d038bb3ed84a2
SHA25660048a8f9395ec1dd6160ee7bed035f106ae13cccd714cc2c40173cfb3fbd242
SHA512b43fbfb51a014be44f43b6abb252e3f1be74b825f0c18c1bf7775e0eafa7e1c602e46a46307e35bbe9ebafddbbf3cf384c4d366e8b8bfc11632c2ad2291cf43a
-
Filesize
16.9MB
MD52f45875867bf0dc006d1a11e795abc8e
SHA1bf1de85b83200ad8e8913183226b76aabc122986
SHA25677e1e64227ba610f010f3742349114a4859daf57650ac676b220d1e1cf547450
SHA5127b848c65d07bbfee2f369c0ebb4571fc8af8c739a74852fe6dda9f4df9287ac45ffa40f0b9d07c39f85fc49b31d8e7ec8765b4707e5e7314b54a1005ced92961
-
Filesize
263KB
MD5bdd170a319b7a9f7b11f58e59f827a31
SHA105ce443e1f44449b07ad3d45a8ae4e3465697bf6
SHA256ca8355f72b3d8e000e60670f717508a8dbde163d26f0e6e6255f6dee2027124b
SHA512eca9431d7e40f88a8c51ba0533e63c001b340be81c330f61f082d85c55b4fee489eee85776494ee723b051f2b982b5669144b8f2d8d33b92e924ca02a870b0df
-
Filesize
23.6MB
MD5914fc3a3c30f3f5d7906308067b9ae2f
SHA16ab5f83269500809bbed37081dc7cdb8c08fecfc
SHA25693d92c4e66a91535bd1a2b17445c183ade43fb0a94bffb96e693704bdbd28c43
SHA5128c0f8d6815fae339624985b2977f1d5abd8f75a7109071428eb70b66770473cb3913a87394c6201e9046d25657e7c58851c9f8474aada1d5afcdfd9874ecfbd0