Analysis
- max time kernel
148s - max time network
131s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/09/2026, 02:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe
- Size 5.2MB
- Sample260907-cmkmwsvtft
- SHA256 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c
- MD5 b028a546983129cdb135fb30c583889a
- SHA1 6d6a54d40109f583ef78a36c97110c86d54572ca
- SHA512 c40eaec5a837b74f1b47210fe2fb5a26f0f1407e80deafa327f40b87ef07f06faa9951394e95d03359140129a981f0f6c44d60822adfc4275adfb25d0b9e08f6
- SSDEEP 98304:9N6ynFMPDpKmj4rcETYsTdvlh0AMPVybmHz9JWzPjQs/3r:X6yQcWsK0Prr
- TLSH T16B466B21B69BC126D66F06712A2CDB6F51793EA12FB340DBA3D45E6E08B58C14331F27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 10 IoCs
pid Process 3380 MsiExec.exe 3380 MsiExec.exe 3380 MsiExec.exe 3380 MsiExec.exe 3380 MsiExec.exe 3380 MsiExec.exe 3380 MsiExec.exe 3380 MsiExec.exe 3380 MsiExec.exe 3380 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Y: 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\A: 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe File opened (read-only) \??\D: 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe File opened (read-only) \??\L: 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\N: 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe File opened (read-only) \??\W: 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe File opened (read-only) \??\K: 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe File opened (read-only) \??\P: 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe File opened (read-only) \??\T: 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe File opened (read-only) \??\X: 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe File opened (read-only) \??\Z: 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe File opened (read-only) \??\O: 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe File opened (read-only) \??\R: 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe File opened (read-only) \??\S: 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe File opened (read-only) \??\V: 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe File opened (read-only) \??\J: 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe File opened (read-only) \??\U: 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Q: 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\G: 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Modifies system certificate store 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSecurityPrivilege 5076 msiexec.exe Token: SeCreateTokenPrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeAssignPrimaryTokenPrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeLockMemoryPrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeIncreaseQuotaPrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeMachineAccountPrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeTcbPrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeSecurityPrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeTakeOwnershipPrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeLoadDriverPrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeSystemProfilePrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeSystemtimePrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeProfSingleProcessPrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeIncBasePriorityPrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeCreatePagefilePrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeCreatePermanentPrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeBackupPrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeRestorePrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeShutdownPrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeDebugPrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeAuditPrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeSystemEnvironmentPrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeChangeNotifyPrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeRemoteShutdownPrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeUndockPrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeSyncAgentPrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeEnableDelegationPrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeManageVolumePrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeImpersonatePrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeCreateGlobalPrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeCreateTokenPrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeAssignPrimaryTokenPrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeLockMemoryPrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeIncreaseQuotaPrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeMachineAccountPrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeTcbPrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeSecurityPrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeTakeOwnershipPrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeLoadDriverPrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeSystemProfilePrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeSystemtimePrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeProfSingleProcessPrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeIncBasePriorityPrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeCreatePagefilePrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeCreatePermanentPrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeBackupPrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeRestorePrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeShutdownPrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeDebugPrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeAuditPrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeSystemEnvironmentPrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeChangeNotifyPrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeRemoteShutdownPrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeUndockPrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeSyncAgentPrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeEnableDelegationPrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeManageVolumePrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeImpersonatePrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeCreateGlobalPrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeCreateTokenPrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeAssignPrimaryTokenPrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeLockMemoryPrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeIncreaseQuotaPrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe Token: SeMachineAccountPrivilege 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3376 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5076 msiexec.exe 3380 MsiExec.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5076 wrote to memory of 3380 5076 msiexec.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe"C:\Users\Admin\AppData\Local\Temp\64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c.exe"1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3376
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 8DD86524E4892CA90CA218BDD9B8D4A1 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3380
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_3376\banner
- Size 2KB
- SHA256 0d2715e6689ea0cccc6cdfad328dab66f61df466fbbaf043cef2d05f9ad420c4
- MD5 daf14d3480c7aa73a53415ff483b10a1
- SHA1 db240a22410ac7536f5c833ca98322cca4180c3d
- SHA512 7741a04025317179eaf14f7843f313f0e8922fd219c1d45db91e65e58229a1c948fb12120806507162d064b03dd4a45a8380210545a8a61910e622f0b3c736c7
- TLSH T11D41AB0BFB2AA5C0A3BF2BD1007967355671EC15F30B071B4A087BEEF9A12C11D492AC
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_3376\dialog
- Size 36KB
- SHA256 fb0d133f05de6aa6a7a3491ae532191a60c438b35d9ff7bfec9e63131f6f0c73
- MD5 abf1076064505dee794fa7aed67252b8
- SHA1 358d4e501bb3007feece82a4039cc1050f23fab4
- SHA512 9a4680a8d186c1d7550b5e03cbdd095b0c88b2e0249a3af75fa0253d2c9a6f0aa1dd570ecf1a273683a14e6c7b5fb11678be3da439a3bf23eab790372e96e321
- SSDEEP 96:ZFgstvLTJ/lJzh7nVnnWpinnJ7FNng6H6ityl6Tk:3gstjTJddWpi7vndHDLTk
- TLSH T1ECF21653EB8112EBDA3F57F240EA462587B2A2D5370F26473B00AB397D62F81D901B17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI7FD6.tmp
- Size 380KB
- SHA256 6c7fa74530bb1140309ba0803cb240bc3e54e507c4abd790cf2dd49834435bcb
- MD5 2160822ba37161cbacff695771afa2ed
- SHA1 87b5fd899791d245b1ed7eb5a7f0f0e8ec5cf79f
- SHA512 061454ee65ad95f19890f7336278a72538a805f565ae80a0fe5eabca546d401eae18cf08c2274733ccc755439b7c8d8925919d0131ec0a28789e6c3bc2614011
- SSDEEP 6144:2dj9q7PSf8bOLBgMYtUiaF97Y1YuMuLLbyEzqAOtC2vVKa/SNAK:69JgMYtU5DuMuLLeiqHV/SNAK
- TLSH T151846D2072D6C836D5BE4AB43A3CC99E45297EA59BF2C4EB13C81D5E09739C24634F27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI81BB.tmp
- Size 860KB
- SHA256 f2fd2ccb8d8412753ca7aa3d402f29b8280bbd4f7170d53f613e05f742f13a22
- MD5 e922ff8f49a4734f442bcd26b4a05ba8
- SHA1 13e0dcc761282b31a9e21118035768cf75145045
- SHA512 0d395483f4ac9af3f011990612517641d4e6734e184faa0f17b4525aab729350ad5b9737a1c0f0164ec81775a41fb21dc90b72609a7ab25a37c4d2a19f253a0e
- SSDEEP 24576:IV1XBAfyOmxv64wD+cvCemHzgxqOuVjv2kgyzBph11NRKR2:G1XOqDV64wD+cvbmHz/OUjv2kgyzBph3
- TLSH T1FB155A1E78DA8236FB3E8638A669DB3675F93FE10BB144DB93D0585A4E344C141B1F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI8314.tmp
- Size 544KB
- SHA256 be8f7395647417fbe23dde6f9ec1f27ee2cc72452dcda9701f270194b254869b
- MD5 d2d5a6d86934600087d82315e9622a65
- SHA1 aa6b70b813556bbc55f5c0161f017e3605e3b427
- SHA512 f174420698ec18b6d8c7350c4e43d420fa1363d29711fcdf71073803bd90b2bc84145f8a11e66839aded646b67bca074a83a16a18e93f03ca23293e6156fd5ef
- SSDEEP 12288:IW+l5a0nxpmoDMLlltUkej8WjYCgout8/09wjmwIMNIuT9VyuOzwPYUbR+b:lViMRDU5YWTQnuZV2zwPYUbR+b
- TLSH T135C45A20729AC136D46D45B01AAECB6B51697FB10B7A54EBE3C85A7F09F08C21335F27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\windows10.0-kb5001342-x86.msi
- Size 2.5MB
- SHA256 ce63d3359f2410aadf4d79c465230695bbf2c864b5e8fea4e8e526af0453275d
- MD5 2581bc240a6376e010249b599e1be68b
- SHA1 1d4c5fd21876b1cd5dc3b4939ccfcc62c458e139
- SHA512 1d4c400e37256657abd91486d343a62c3c037dcd476f6e3779ce3bf7062f7ed12ee18d318c968555010483a413957bb5066ecf4429a353afae4549678bfe79e7
- SSDEEP 49152:ksgYsTdvl3VTnqkXVCAYAU1XOqDV64wD+cvbmHz/OUjv2kgyzBph11NRKRMV7Rvr:eYsTdvlh0AMPVybmHz9JW
- TLSH T14FC57C21B59BC132EA7F47702A6DDB3A60793EE13B7344EB67D45A6E09708C10271F26
- MD5 SHA1 SHA512 SSDEEP TLSH