Analysis
- max time kernel
150s - max time network
136s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/07/2026, 16:06
Static task
static1
Behavioral task
behavioral1
Sample
NiniteMalwarebytesInstaller.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
NiniteMalwarebytesInstaller.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target NiniteMalwarebytesInstaller.exe
- Size 422KB
- Sample260705-tkfplaht9q
- SHA256 816e3bd1ab6df6c13d8b1195b3de822009c36e066a7ac1636d741a59bc6921fe
- MD5 8f31304c5cedfc6de2a709e17a24a9ce
- SHA1 a6b2746c52142636e6994adcde4317398d00a0a6
- SHA512 1c3c8acad2c3e480d00772c369ce89b652608eb625bffc614e3efb16b8551de9e5c346033b8201645f8f3679150c153efe2f2869ab94635ff2a491443b3ea6d7
- SSDEEP 6144:esRr4d37hIfdm92sxySHJ12wznFYf8Er49qGEi3psi7ksvmacPSQxLq:T+dafqxySH/NErqAi7BvmZPSQxO
- TLSH T19394AE11FA40E436D66709316B69D7694D7DBCB03F6196CBB3C01AEDA9306C0AB24F27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\mbamtestfile.dat MBSetup-119603.119603-5.5.7.255.exe File created C:\Windows\SysWOW64\drivers\mbamtestfile.dat MBSetup-119603.119603-5.5.7.255.exe - Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion MBSetup-119603.119603-5.5.7.255.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate MBSetup-119603.119603-5.5.7.255.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\api-ms-win-core-file-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Threading.Timer.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\it\WindowsFormsIntegration.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\pl\ReachFramework.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\api-ms-win-crt-utility-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\Microsoft.NETCore.App.runtimeconfig.json MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Net.WebHeaderCollection.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\es\System.Windows.Forms.Primitives.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\ja\System.Windows.Input.Manipulations.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\pt-BR\UIAutomationClient.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.IO.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Reflection.Primitives.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Text.Encoding.Extensions.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\it\System.Windows.Controls.Ribbon.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\.version MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\api-ms-win-crt-multibyte-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.ServiceProcess.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Xml.XDocument.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\fr\PresentationUI.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\ru\UIAutomationClientSideProviders.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\tr\WindowsFormsIntegration.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Private.Xml.Linq.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Runtime.InteropServices.RuntimeInformation.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Runtime.Serialization.Primitives.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\de\WindowsFormsIntegration.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\ko\PresentationFramework.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\api-ms-win-core-console-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\api-ms-win-core-interlocked-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Diagnostics.DiagnosticSource.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Security.Cryptography.X509Certificates.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\es\System.Windows.Input.Manipulations.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\zh-Hans\WindowsBase.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Private.Xml.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\System.Diagnostics.EventLog.Messages.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\zh-Hant\System.Windows.Controls.Ribbon.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\api-ms-win-core-sysinfo-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Net.Mail.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\ja\UIAutomationTypes.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\Microsoft.Win32.SystemEvents.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Net.Requests.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\PresentationFramework-SystemCore.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\tr\System.Windows.Forms.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\tr\UIAutomationProvider.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\zh-Hant\PresentationUI.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\System.Windows.Controls.Ribbon.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\api-ms-win-core-fibers-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\api-ms-win-crt-time-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\Microsoft.VisualBasic.Core.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Threading.Channels.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\ko\WindowsFormsIntegration.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\pl\UIAutomationClient.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\UIAutomationClient.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\Microsoft.VisualBasic.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Linq.Expressions.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Xml.XmlDocument.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\fr\UIAutomationProvider.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\ja\PresentationFramework.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\UIAutomationClientSideProviders.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\UIAutomationTypes.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\api-ms-win-core-console-l1-2-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\api-ms-win-crt-locale-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Private.DataContractSerialization.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Reflection.Extensions.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Security.Cryptography.Algorithms.dll MBAMInstallerService.exe - Executes dropped EXE 3 IoCs
pid Process 4928 MBSetup-119603.119603-5.5.7.255.exe 5400 MBAMInstallerService.exe 4508 MBAMInstallerService.exe - Loads dropped DLL 3 IoCs
pid Process 3092 NiniteMalwarebytesInstaller.exe 4508 MBAMInstallerService.exe 4508 MBAMInstallerService.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NiniteMalwarebytesInstaller.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MBSetup-119603.119603-5.5.7.255.exe - Modifies system certificate store 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F NiniteMalwarebytesInstaller.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F\Blob = 0f00000001000000200000001504593902ec8a0bab29f03bf35c3058b5fd1807a74dab92cb61ed4a9908afa40b000000010000006200000041006d0061007a006f006e00200053006500720076006900630065007300200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020002d002d002000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000002500000030233021060b6086480186fd6e0107180330123010060a2b0601040182373c0101030200c0620000000100000020000000568d6905a2c88708a4b3025190edcfedb1974a606a13c6e5290fcb2ae63edab51400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf21191831d000000010000001000000052135310639a10f77f886b229b9f7afc7f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000925a8f8d2c6d04e0665f596aff22d863e8256f3f2000000001000000f3030000308203ef308202d7a003020102020100300d06092a864886f70d01010b0500308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183300d06092a864886f70d01010b050003820101004b36a6847769dd3b199f6723086f0e61c9fd84dc5fd83681cdd81b412d9f60ddc71a68d9d16e86e18823cf13de43cfe234b3049d1f29d5bff85ec8d5c1bdee926f3274f291822fbd82427aad2ab7207d4dbc7a5512c215eabdf76a952e6c749fcf1cb4f2c501a385d0723ead73ab0b9b750c6d45b78e94ac9637b5a0d08f15470ee3e883dd8ffdef410177cc27a9628533f23708ef71cf7706dec8191d8840cf7d461dff1ec7e1ceff23dbc6fa8d554ea902e74711463ef4fdbd7b2926bba961623728b62d2af6108664c970a7d2adb7297079ea3cda63259ffd68b730ec70fb758ab76d6067b21ec8b9e9d8a86f028b670d4d265771da20fcc14a508db128ba NiniteMalwarebytesInstaller.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F\Blob = 19000000010000001000000014d4b19434670e6dc091d154abb20edc030000000100000014000000925a8f8d2c6d04e0665f596aff22d863e8256f3f7e00000001000000080000000080c82b6886d7017f000000010000000c000000300a06082b060105050703031d000000010000001000000052135310639a10f77f886b229b9f7afc1400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf2119183620000000100000020000000568d6905a2c88708a4b3025190edcfedb1974a606a13c6e5290fcb2ae63edab553000000010000002500000030233021060b6086480186fd6e0107180330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000006200000041006d0061007a006f006e00200053006500720076006900630065007300200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020002d002d0020004700320000000f00000001000000200000001504593902ec8a0bab29f03bf35c3058b5fd1807a74dab92cb61ed4a9908afa42000000001000000f3030000308203ef308202d7a003020102020100300d06092a864886f70d01010b0500308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183300d06092a864886f70d01010b050003820101004b36a6847769dd3b199f6723086f0e61c9fd84dc5fd83681cdd81b412d9f60ddc71a68d9d16e86e18823cf13de43cfe234b3049d1f29d5bff85ec8d5c1bdee926f3274f291822fbd82427aad2ab7207d4dbc7a5512c215eabdf76a952e6c749fcf1cb4f2c501a385d0723ead73ab0b9b750c6d45b78e94ac9637b5a0d08f15470ee3e883dd8ffdef410177cc27a9628533f23708ef71cf7706dec8191d8840cf7d461dff1ec7e1ceff23dbc6fa8d554ea902e74711463ef4fdbd7b2926bba961623728b62d2af6108664c970a7d2adb7297079ea3cda63259ffd68b730ec70fb758ab76d6067b21ec8b9e9d8a86f028b670d4d265771da20fcc14a508db128ba NiniteMalwarebytesInstaller.exe - Suspicious behavior: EnumeratesProcesses 36 IoCs
pid Process 3092 NiniteMalwarebytesInstaller.exe 3092 NiniteMalwarebytesInstaller.exe 4928 MBSetup-119603.119603-5.5.7.255.exe 4928 MBSetup-119603.119603-5.5.7.255.exe 4928 MBSetup-119603.119603-5.5.7.255.exe 4928 MBSetup-119603.119603-5.5.7.255.exe 4508 MBAMInstallerService.exe 4508 MBAMInstallerService.exe 4508 MBAMInstallerService.exe 4508 MBAMInstallerService.exe 4508 MBAMInstallerService.exe 4508 MBAMInstallerService.exe 4508 MBAMInstallerService.exe 4508 MBAMInstallerService.exe 4508 MBAMInstallerService.exe 4508 MBAMInstallerService.exe 4508 MBAMInstallerService.exe 4508 MBAMInstallerService.exe 4508 MBAMInstallerService.exe 4508 MBAMInstallerService.exe 4508 MBAMInstallerService.exe 4508 MBAMInstallerService.exe 4508 MBAMInstallerService.exe 4508 MBAMInstallerService.exe 4508 MBAMInstallerService.exe 4508 MBAMInstallerService.exe 4508 MBAMInstallerService.exe 4508 MBAMInstallerService.exe 4508 MBAMInstallerService.exe 4508 MBAMInstallerService.exe 4508 MBAMInstallerService.exe 4508 MBAMInstallerService.exe 4508 MBAMInstallerService.exe 4508 MBAMInstallerService.exe 4508 MBAMInstallerService.exe 4508 MBAMInstallerService.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTcbPrivilege 3092 NiniteMalwarebytesInstaller.exe Token: SeCreateTokenPrivilege 3092 NiniteMalwarebytesInstaller.exe Token: SeAssignPrimaryTokenPrivilege 3092 NiniteMalwarebytesInstaller.exe Token: SeLoadDriverPrivilege 3092 NiniteMalwarebytesInstaller.exe Token: SeBackupPrivilege 3092 NiniteMalwarebytesInstaller.exe Token: SeRestorePrivilege 3092 NiniteMalwarebytesInstaller.exe Token: SeDebugPrivilege 3092 NiniteMalwarebytesInstaller.exe Token: SeTakeOwnershipPrivilege 3092 NiniteMalwarebytesInstaller.exe Token: SeLockMemoryPrivilege 3092 NiniteMalwarebytesInstaller.exe Token: SeIncreaseQuotaPrivilege 3092 NiniteMalwarebytesInstaller.exe Token: SeMachineAccountPrivilege 3092 NiniteMalwarebytesInstaller.exe Token: SeTcbPrivilege 3092 NiniteMalwarebytesInstaller.exe Token: SeSecurityPrivilege 3092 NiniteMalwarebytesInstaller.exe Token: SeSystemProfilePrivilege 3092 NiniteMalwarebytesInstaller.exe Token: SeSystemtimePrivilege 3092 NiniteMalwarebytesInstaller.exe Token: SeProfSingleProcessPrivilege 3092 NiniteMalwarebytesInstaller.exe Token: SeIncBasePriorityPrivilege 3092 NiniteMalwarebytesInstaller.exe Token: SeCreatePagefilePrivilege 3092 NiniteMalwarebytesInstaller.exe Token: SeCreatePermanentPrivilege 3092 NiniteMalwarebytesInstaller.exe Token: SeShutdownPrivilege 3092 NiniteMalwarebytesInstaller.exe Token: SeAuditPrivilege 3092 NiniteMalwarebytesInstaller.exe Token: SeSystemEnvironmentPrivilege 3092 NiniteMalwarebytesInstaller.exe Token: SeChangeNotifyPrivilege 3092 NiniteMalwarebytesInstaller.exe Token: SeRemoteShutdownPrivilege 3092 NiniteMalwarebytesInstaller.exe Token: SeUndockPrivilege 3092 NiniteMalwarebytesInstaller.exe Token: SeSyncAgentPrivilege 3092 NiniteMalwarebytesInstaller.exe Token: SeEnableDelegationPrivilege 3092 NiniteMalwarebytesInstaller.exe Token: SeManageVolumePrivilege 3092 NiniteMalwarebytesInstaller.exe Token: SeImpersonatePrivilege 3092 NiniteMalwarebytesInstaller.exe Token: SeCreateGlobalPrivilege 3092 NiniteMalwarebytesInstaller.exe Token: 31 3092 NiniteMalwarebytesInstaller.exe Token: 32 3092 NiniteMalwarebytesInstaller.exe Token: 33 3092 NiniteMalwarebytesInstaller.exe Token: 34 3092 NiniteMalwarebytesInstaller.exe Token: 35 3092 NiniteMalwarebytesInstaller.exe Token: SeDebugPrivilege 3092 NiniteMalwarebytesInstaller.exe Token: SeAssignPrimaryTokenPrivilege 3092 NiniteMalwarebytesInstaller.exe Token: SeTcbPrivilege 3092 NiniteMalwarebytesInstaller.exe Token: SeDebugPrivilege 3092 NiniteMalwarebytesInstaller.exe Token: SeDebugPrivilege 3092 NiniteMalwarebytesInstaller.exe Token: SeDebugPrivilege 3092 NiniteMalwarebytesInstaller.exe Token: SeDebugPrivilege 3092 NiniteMalwarebytesInstaller.exe Token: SeDebugPrivilege 3092 NiniteMalwarebytesInstaller.exe Token: SeDebugPrivilege 3092 NiniteMalwarebytesInstaller.exe Token: SeDebugPrivilege 3092 NiniteMalwarebytesInstaller.exe Token: SeDebugPrivilege 3092 NiniteMalwarebytesInstaller.exe Token: SeDebugPrivilege 3092 NiniteMalwarebytesInstaller.exe Token: SeDebugPrivilege 3092 NiniteMalwarebytesInstaller.exe Token: SeDebugPrivilege 3092 NiniteMalwarebytesInstaller.exe Token: SeDebugPrivilege 3092 NiniteMalwarebytesInstaller.exe Token: SeDebugPrivilege 3092 NiniteMalwarebytesInstaller.exe Token: SeDebugPrivilege 3092 NiniteMalwarebytesInstaller.exe Token: SeDebugPrivilege 3092 NiniteMalwarebytesInstaller.exe Token: SeDebugPrivilege 3092 NiniteMalwarebytesInstaller.exe Token: SeDebugPrivilege 3092 NiniteMalwarebytesInstaller.exe Token: SeDebugPrivilege 3092 NiniteMalwarebytesInstaller.exe Token: SeDebugPrivilege 3092 NiniteMalwarebytesInstaller.exe Token: SeDebugPrivilege 3092 NiniteMalwarebytesInstaller.exe Token: SeDebugPrivilege 3092 NiniteMalwarebytesInstaller.exe Token: SeDebugPrivilege 3092 NiniteMalwarebytesInstaller.exe Token: SeDebugPrivilege 3092 NiniteMalwarebytesInstaller.exe Token: SeDebugPrivilege 3092 NiniteMalwarebytesInstaller.exe Token: SeDebugPrivilege 3092 NiniteMalwarebytesInstaller.exe Token: SeDebugPrivilege 3092 NiniteMalwarebytesInstaller.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3092 wrote to memory of 4944 3092 NiniteMalwarebytesInstaller.exe 89 PID 4944 wrote to memory of 4928 4944 cmd.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\NiniteMalwarebytesInstaller.exe"C:\Users\Admin\AppData\Local\Temp\NiniteMalwarebytesInstaller.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Ninite.tmp\8CE335~1\MBSetup-119603.119603-5.5.7.255.exe" /verysilent /NORESTART2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\Ninite.tmp\8CE335~1\MBSetup-119603.119603-5.5.7.255.exeC:\Users\Admin\AppData\Local\Temp\Ninite.tmp\8CE335~1\MBSetup-119603.119603-5.5.7.255.exe /verysilent /NORESTART3⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4928
-
-
-
C:\Users\Admin\AppData\Local\Temp\MBAMInstallerService.exe"C:\Users\Admin\AppData\Local\Temp\MBAMInstallerService.exe"1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4508
-
C:\Users\Admin\AppData\Local\Temp\MBAMInstallerService.exe"C:\Users\Admin\AppData\Local\Temp\MBAMInstallerService.exe"1⤵
- Executes dropped EXE
PID:5400
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_d724adf0788b11f19973e23c7fb9066e\7z.dll
- Size 1.6MB
- SHA256 bb01c6fbb29590d6d144a9038c2a7736d6925a6dbd31889538af033e03e4f5fa
- MD5 3430e2544637cebf8ba1f509ed5a27b1
- SHA1 7e5bd7af223436081601413fb501b8bd20b67a1e
- SHA512 91c4eb3d341a8b30594ee4c08a638c3fb7f3a05248b459bcf07ca9f4c2a185959313a68741bdcec1d76014009875fa7cbfa47217fb45d57df3b9b1c580bc889d
- SSDEEP 24576:29raURTF/5pe2g5RpBDxSjv9IrqLwRpFEDbt7y0MVoAAlziG3B:29hP/5petvSjWZR8DxO0mo5MG3B
- TLSH T175756D5BF67400A4D5D6C034C5276B1BEAB1B88B8330A6EF12D15E6B6F13BF19979320
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_d724adf0788b11f19973e23c7fb9066e\ctlrpkg\MBAMService.exe
- Size 75KB
- SHA256 52ce5540521ad92fd19dd60b21258bb55a6faeca6921560519b2a354d62f1f8c
- MD5 997d906ef10bd4dc6d53930a3fb77c49
- SHA1 402b6ff90f77904ba44f50c3c3f6eb098d98aeaa
- SHA512 430d0fc800c5e271f0e402d2b9bd388111e9a5f136d1a1e3b195a670eae2333dc140602f6c3099171a8bdc48fcdcc3634cdd45619edd6ff29e1548d75ad5bb36
- SSDEEP 1536:XzswUZzmBvsuUl/OwyWBB4mUipz/rBxdXo:XzsT+vsuM2mUipz/rBY
- TLSH T188735F49E753519BCD31E1F8C683733BE3A2762E8321DED742645D2A6D3A5F0A13AC24
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_d724adf0788b11f19973e23c7fb9066e\ctlrpkg\MBAMWsc.exe
- Size 128KB
- SHA256 1c9c37e8aafb37a528277b23fd79c5f8634a88ca0e7b5116ccacaf59f71f973c
- MD5 cded817fce626e1aa4570d53547be0f6
- SHA1 cfe3bc8187189a8524ee96057ab678a7c7c1549d
- SHA512 b5f46a180e1543385707157e5c216006a635f180c11fb28a050a1b78f3b591f10f1b4dd7d2182bd3d49ec7eb4434c07f3ad176ca4c0dfd3cb180b8a4ac5df004
- SSDEEP 3072:ukxxrEKGcV0ygwfSoePiVNiafGQ/uU6Y7nJvq6MGjIxZCL8eYiali:dxrvsoePiVNxh6YVfYLi
- TLSH T1A6D31B1752A901FCD0BBE1BC8A47AA46E7BB740A437165CF0A5084772FB7BE01E7E650
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_d724adf0788b11f19973e23c7fb9066e\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.36\mscordaccore_amd64_amd64_6.0.3624.51421.dll
- Size 1.3MB
- SHA256 97468531d7009e36c338b47fb19e0c6bf210f013610f413c852a4cc27e84b514
- MD5 3050af9152d6bb255c4b6753821bc32c
- SHA1 7a20c030a6473422607661ffa996e34a245b3e2d
- SHA512 ad07c4b0bb995e80a1718d74992afdeb6c2c4f217e72f361691e2d04dae9be9cd8e55b50fd7172d73755b02b6105c00a3b67534ba9469d92f9e0fbaab8e8f1a9
- SSDEEP 24576:c3ccAqMv7jLs0eJqwnSA/RSwn20qv6InSITDHtPVct3:c7s7jsjS4znnqyIn7TrfU3
- TLSH T1F1553A56D6BD4499CEAAD1F9C507490FE7B23801037067EF4AE08B196F3BBE56A78310
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Ninite.tmp\85c7550f-788b-11f1-a884-e23c7fb9066e\Ninite.dll
- Size 1.7MB
- SHA256 c63fd2680fa7bbb6b7736257dd8d995e4ca2d0db1bf1d9909da9a1eff85068cd
- MD5 780a9399146febdaf770c03b4b68a1bf
- SHA1 caff092f1ca05755d3eab3e7edf88096ebcba12e
- SHA512 e112151a9495f3943e5338037eef5da9fdc86064ee0668c03d87139d841fb7869633716da28036d4472aa49633a5f14f4144f9d4fb92847df672c3871702efb2
- SSDEEP 49152:/FyJS7/8jVM1OAHmOp0fYrpH5wwhEFqfeI/t9UEDWqkL1o0hRS8K:/Fh7EjVqOhOp0foytFqoEDn
- TLSH T18F858E23B699C439E07E0270752C97552AB6FC304A72C49B77D03B8E79B8BC1A625F17
- MD5 SHA1 SHA512 SSDEEP TLSH