Analysis
- max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/11/2026, 16:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
GoNavi-dev-a0d90fa-Windows-Amd64-Installer.msi
Resource
win10v2004-20260911-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
GoNavi-dev-a0d90fa-Windows-Amd64-Installer.msi
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
General
- Target GoNavi-dev-a0d90fa-Windows-Amd64-Installer.msi
- Size 26.9MB
- Sample261102-vbc3sabw2w
- SHA256 28101588832b45d2f3feb29a7831f10a6199aed0a0311314e206e087ebf3b397
- MD5 e2a39cb484f71d0fea860f141896440b
- SHA1 0b4501409f255c64de09f1f74e76c3b356734804
- SHA512 4a5b356e32c8f90910fa32d8d2ca515031b5d06a6dd0ef756c38d6f8422fe81ee47dc6f454b14fa3241d45b9c5cd857861972c29103fcedfa47afbb1ef229a15
- SSDEEP 786432:PnmaEWR8+f+cDroWACnSjHXh1LL5YKe/64xJc:PWn+f+gfArX3LiPE
- TLSH T1BE5733177C848938C5578F7196F58B094B877C242B605D6B323CB75AEAF36F82A385E0
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 5092 MsiExec.exe - Modifies file permissions 1 TTPs 2 IoCs
pid Process 4436 icacls.exe 4656 icacls.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe - Drops file in Program Files directory 5 IoCs
description ioc Process File created C:\Program Files\GoNavi\.gonavi-msi-install msiexec.exe File created C:\Program Files\GoNavi\GoNavi.exe msiexec.exe File created C:\Program Files\GoNavi\LICENSE.txt msiexec.exe File created C:\Program Files\GoNavi\NOTICE.txt msiexec.exe File created C:\Program Files\GoNavi\apply-brand-icon.ps1 msiexec.exe - Drops file in Windows directory 10 IoCs
description ioc Process File created C:\Windows\Installer\e592dbd.msi msiexec.exe File opened for modification C:\Windows\Installer\e592dbd.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{4F0473E8-1378-438D-9A33-9768FEE67F26} msiexec.exe File created C:\Windows\Installer\{4F0473E8-1378-438D-9A33-9768FEE67F26}\GoNaviIcon msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI2F15.tmp msiexec.exe File opened for modification C:\Windows\Installer\{4F0473E8-1378-438D-9A33-9768FEE67F26}\GoNaviIcon msiexec.exe File created C:\Windows\Installer\e592dbf.msi msiexec.exe -
pid Process 1152 powershell.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 832 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000095d3837de88660fc0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000095d3837d0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090095d3837d000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a95d3837d000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d95d3837d000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Modifies data under HKEY_USERS 44 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E msiexec.exe - Modifies registry class 23 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8E3740F48731D834A9337986EF6EF762 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8E3740F48731D834A9337986EF6EF762\MainFeature msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E3740F48731D834A9337986EF6EF762\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E3740F48731D834A9337986EF6EF762\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\F2FB6DDCE1DE54340ABACDBDE751BF32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E3740F48731D834A9337986EF6EF762\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E3740F48731D834A9337986EF6EF762\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E3740F48731D834A9337986EF6EF762\PackageCode = "5D00E993240403E4C868667E4301D722" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E3740F48731D834A9337986EF6EF762\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E3740F48731D834A9337986EF6EF762\Version = "4278190140" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E3740F48731D834A9337986EF6EF762\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E3740F48731D834A9337986EF6EF762 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E3740F48731D834A9337986EF6EF762\ProductName = "GoNavi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E3740F48731D834A9337986EF6EF762\ProductIcon = "C:\\Windows\\Installer\\{4F0473E8-1378-438D-9A33-9768FEE67F26}\\GoNaviIcon" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E3740F48731D834A9337986EF6EF762\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E3740F48731D834A9337986EF6EF762\SourceList\PackageName = "GoNavi-dev-a0d90fa-Windows-Amd64-Installer.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E3740F48731D834A9337986EF6EF762\SourceList\Media msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E3740F48731D834A9337986EF6EF762\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E3740F48731D834A9337986EF6EF762\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E3740F48731D834A9337986EF6EF762\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\F2FB6DDCE1DE54340ABACDBDE751BF32\8E3740F48731D834A9337986EF6EF762 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E3740F48731D834A9337986EF6EF762\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E3740F48731D834A9337986EF6EF762\Clients = 3a0000000000 msiexec.exe - Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 404 msiexec.exe 404 msiexec.exe 1152 powershell.exe 1152 powershell.exe 1152 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 832 msiexec.exe Token: SeIncreaseQuotaPrivilege 832 msiexec.exe Token: SeSecurityPrivilege 404 msiexec.exe Token: SeCreateTokenPrivilege 832 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 832 msiexec.exe Token: SeLockMemoryPrivilege 832 msiexec.exe Token: SeIncreaseQuotaPrivilege 832 msiexec.exe Token: SeMachineAccountPrivilege 832 msiexec.exe Token: SeTcbPrivilege 832 msiexec.exe Token: SeSecurityPrivilege 832 msiexec.exe Token: SeTakeOwnershipPrivilege 832 msiexec.exe Token: SeLoadDriverPrivilege 832 msiexec.exe Token: SeSystemProfilePrivilege 832 msiexec.exe Token: SeSystemtimePrivilege 832 msiexec.exe Token: SeProfSingleProcessPrivilege 832 msiexec.exe Token: SeIncBasePriorityPrivilege 832 msiexec.exe Token: SeCreatePagefilePrivilege 832 msiexec.exe Token: SeCreatePermanentPrivilege 832 msiexec.exe Token: SeBackupPrivilege 832 msiexec.exe Token: SeRestorePrivilege 832 msiexec.exe Token: SeShutdownPrivilege 832 msiexec.exe Token: SeDebugPrivilege 832 msiexec.exe Token: SeAuditPrivilege 832 msiexec.exe Token: SeSystemEnvironmentPrivilege 832 msiexec.exe Token: SeChangeNotifyPrivilege 832 msiexec.exe Token: SeRemoteShutdownPrivilege 832 msiexec.exe Token: SeUndockPrivilege 832 msiexec.exe Token: SeSyncAgentPrivilege 832 msiexec.exe Token: SeEnableDelegationPrivilege 832 msiexec.exe Token: SeManageVolumePrivilege 832 msiexec.exe Token: SeImpersonatePrivilege 832 msiexec.exe Token: SeCreateGlobalPrivilege 832 msiexec.exe Token: SeCreateTokenPrivilege 832 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 832 msiexec.exe Token: SeLockMemoryPrivilege 832 msiexec.exe Token: SeIncreaseQuotaPrivilege 832 msiexec.exe Token: SeMachineAccountPrivilege 832 msiexec.exe Token: SeTcbPrivilege 832 msiexec.exe Token: SeSecurityPrivilege 832 msiexec.exe Token: SeTakeOwnershipPrivilege 832 msiexec.exe Token: SeLoadDriverPrivilege 832 msiexec.exe Token: SeSystemProfilePrivilege 832 msiexec.exe Token: SeSystemtimePrivilege 832 msiexec.exe Token: SeProfSingleProcessPrivilege 832 msiexec.exe Token: SeIncBasePriorityPrivilege 832 msiexec.exe Token: SeCreatePagefilePrivilege 832 msiexec.exe Token: SeCreatePermanentPrivilege 832 msiexec.exe Token: SeBackupPrivilege 832 msiexec.exe Token: SeRestorePrivilege 832 msiexec.exe Token: SeShutdownPrivilege 832 msiexec.exe Token: SeDebugPrivilege 832 msiexec.exe Token: SeAuditPrivilege 832 msiexec.exe Token: SeSystemEnvironmentPrivilege 832 msiexec.exe Token: SeChangeNotifyPrivilege 832 msiexec.exe Token: SeRemoteShutdownPrivilege 832 msiexec.exe Token: SeUndockPrivilege 832 msiexec.exe Token: SeSyncAgentPrivilege 832 msiexec.exe Token: SeEnableDelegationPrivilege 832 msiexec.exe Token: SeManageVolumePrivilege 832 msiexec.exe Token: SeImpersonatePrivilege 832 msiexec.exe Token: SeCreateGlobalPrivilege 832 msiexec.exe Token: SeCreateTokenPrivilege 832 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 832 msiexec.exe Token: SeLockMemoryPrivilege 832 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 832 msiexec.exe 832 msiexec.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 404 wrote to memory of 5092 404 msiexec.exe 96 PID 404 wrote to memory of 4440 404 msiexec.exe 104 PID 404 wrote to memory of 4436 404 msiexec.exe 106 PID 404 wrote to memory of 4656 404 msiexec.exe 108 PID 404 wrote to memory of 1152 404 msiexec.exe 110 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\GoNavi-dev-a0d90fa-Windows-Amd64-Installer.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:832
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding C6CEF71FCA5FBB02B5485C4A0C549BFC C2⤵
- Loads dropped DLL
PID:5092
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4440
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\SysWOW64\icacls.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GoNavi.lnk" /grant *S-1-5-32-545:M2⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:4436
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\SysWOW64\icacls.exe" "C:\Users\Public\Desktop\GoNavi.lnk" /grant *S-1-5-32-545:M2⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:4656
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Program Files\GoNavi\apply-brand-icon.ps1" -ApplicationDataFolder "C:\Users\Admin\AppData\Roaming\." -StartMenuShortcut "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GoNavi.lnk" -DesktopShortcut "C:\Users\Public\Desktop\GoNavi.lnk"2⤵
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1152
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:2072
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e592dbe.rbs
- Size 8KB
- SHA256 0a509bc0f401596f7b9543232cfe5bc0f87b6ce50afc694809b6242b9d41c0fa
- MD5 baa8035f9211dd451bdacc4f91399107
- SHA1 6a49b916a82003607f1a752e6e4e0d8b248b4852
- SHA512 a7e25d90b9e6174cbb1479efb00b1635bb09fd5093d00c1468a19e20c4a3ed739676b1a1383ffbec3459aa3bf379056ca62f70c6e1d49344a655a43120971ad2
- SSDEEP 96:amWG0slCpT4kG3m2JeiFWxUTEqCsTlrUTEqC6j+zdOTlVgs5e5Whwhc0CCghplji:7ZJlQ4Q2JehqA5I6A5ybia0BYpE
- TLSH T176020E06BB0085E3ED951B3CCB1B6B2937A3C6D8C315631F46CDE1681F5278A5F6C1AA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\GoNavi\apply-brand-icon.ps1
- Size 22KB
- SHA256 63bacd353d59a4343437a5c259164f888b5f37f714d2449436e263003ac4aa98
- MD5 85b5d9c7a7744e870e0aaef20c754b65
- SHA1 56e7679b0c807c03bd89244ddacc818b63aeed0b
- SHA512 74facafd71157c03741f399a162fb7271286fae5141d220502595c54af7482bd94956a9720690866affe3657a4c03e84a3f37c3469a963074cbff28110c0b030
- SSDEEP 384:AOTFvm45aHsxaA/UhNuxCyYmMAdMnuR6klaZMcEMUXQOlcK+:p9m45aHskA/UhNuYyYPAdMnuMuaQQL9
- TLSH T106A2C626B505A2B11DB31375D9CA5455EB1300AB45FB9D38BEDE834C2FB140883BAF9A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GoNavi.lnk
- Size 1KB
- SHA256 a603c6d43e982d914dec7c79aca32908099b6433d6cab0ef751691db341584fb
- MD5 ed45ef5c69c6792a60cbd801697c2370
- SHA1 c986a49b4ec062b56a2603433d2020463eb421f9
- SHA512 05ad130642afacaedc21334bb85d8d1885da2700ebda2aeb091e7f61b95865da327ecb9b0997b7bcf9e8775bb064df6651dab506544422dc7c0eca075eb8db2a
- TLSH T1BA419E309BF4077EF6F386395D70A6115632F947E6108F3A028541C90965642DAEDF7F
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\~oNavi.tmp
- Size 1KB
- SHA256 bb8ea180140f380bf24062897e45098a183ef51f347091819b58f57b5ed383b8
- MD5 822868665d3b04e70fd21c4bab69d2c4
- SHA1 86fbc4e5e8de1f6b28ea8483ea80251eb094b2d0
- SHA512 f23c064893895237a2f4af9460bc72a7354e18160299033b3b5d9de7772e3d4e52d7f83c563a75a45eb2e5c5da5c1badd854842cef867389305cca09f930db4c
- TLSH T17C41AB30ABE9076EF6B38A399C60A6055632FC47E6108F3A028540C90965642DAEDF7F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIDACB.tmp
- Size 155KB
- SHA256 f506eb822c6438d752323a1b252885208a178a2c0ad41333fc498b3402bc82d3
- MD5 2edeb4cbd8dc4cb4e53a736e8f4dc656
- SHA1 34a8e5adb830446fb687d0b8e960f8261848f967
- SHA512 caefcc73748f4c8584e645ead0761b156869d69047047db2ef199ef3891bf696fe68554615b0bc2bb266eaf2f85065d8cbf711c0590025ce77232474e099e1ef
- SSDEEP 3072:7LKxfjVI402ARONicMAD6xyui9+SCbrDAWAE/8Y:7LIJmtd/ADO3Vf
- TLSH T181F37C1B77A500BBE5B38278C9A34A45F772B8551B608BEF03A442761F273D19D3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hjuzmj2e.zjp.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\Desktop\GoNavi.lnk
- Size 1KB
- SHA256 3c3234f9f34763366562e495014a3cc3e8a17ea19c6d1fccbada377d9c03211d
- MD5 e4495e866e853ae1401d721ebed500b8
- SHA1 21bb6a370756893eb79ff229fe7cd28148b77c79
- SHA512 af0e87111b8fadcbdd9dedaa54f45d70e39d0bee6da317ac40fc0eda456b288345df849aacaf6eaf9c873f3c2f43e6fb7f2fcb5d4ffe32492762f9cb910b15f5
- TLSH T152319E309BF5066EF6F386399D70A6056A31F947EA108F2A0244418909B5742DAE9F7F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\Desktop\~oNavi.tmp
- Size 1KB
- SHA256 584d19b932289cb898855e0ce2672c557b164b34fe02d625998654bd8fe368e4
- MD5 6cd7a4066fab6414ce3df07f08601c89
- SHA1 61c4f99907fdbfef26136863a9b343bd2387c210
- SHA512 174d1bd28d4476dd8af43237218909aa8a8fc4979ac37e9e3f9e986a0ef7f29e288b6c6ace7a1359f0d406c9dcef672f368227017efa042e8fc89eacf3a79f0d
- TLSH T154419D30ABE5066EF6F38A399D60A6055631F947EA108F3A024441C90975742DAEDF7F
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\e592dbf.msi
- Size 26.9MB
- SHA256 28101588832b45d2f3feb29a7831f10a6199aed0a0311314e206e087ebf3b397
- MD5 e2a39cb484f71d0fea860f141896440b
- SHA1 0b4501409f255c64de09f1f74e76c3b356734804
- SHA512 4a5b356e32c8f90910fa32d8d2ca515031b5d06a6dd0ef756c38d6f8422fe81ee47dc6f454b14fa3241d45b9c5cd857861972c29103fcedfa47afbb1ef229a15
- SSDEEP 786432:PnmaEWR8+f+cDroWACnSjHXh1LL5YKe/64xJc:PWn+f+gfArX3LiPE
- TLSH T1BE5733177C848938C5578F7196F58B094B877C242B605D6B323CB75AEAF36F82A385E0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 9c07c6d60feedc4798b28b4b180212f085591a2a16e2ad180679b6be0a1c1a14
- MD5 9bf59f5f2854bf79ed5fb4d3b4d8814c
- SHA1 6cb98ad1612cae61fc8fdd99e76f2a171531dc90
- SHA512 638b81e7bfb0d1a56b2f0dffa77f57833ad62c1869dbac78072dac84b6e533930b101c5e301d3263ea2dc46dd65a71337baa5381703b24b1009bcc47892d5bb3
- SSDEEP 24576:Uu8m+1zMdoO/vvTLL2WezWqCHvkTel2y6gGNUJX1O0K3+x/L4vlvuwdhz:T
- TLSH T15847F42436F92210E7F39F3CA8F16A2B493A7D5B9C15DE8D05411F4E0921BB1E872F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{7d83d395-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{5a2918c7-2fa8-4786-808f-4e7db8431a0a}_OnDiskSnapshotProp
- Size 6KB
- SHA256 8aaf606779bd696c8aedc57ccee6a7330607c994baacd4d3495657480d8077a6
- MD5 49565c25597f082785fdae0c974a539d
- SHA1 8300e4df438b392d0b10681b58e6565959153c29
- SHA512 6f524400e4d8e02d83b6ebc2d7baa9a3fcc312cf446bfedd5ba33a4770119a4184faf01aa0077c36ad4c9a738f7e1e39638c5fe77de7e40a0ed365ab5ffbd379
- SSDEEP 96:F6ATGZ4f2kvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:59b++ZVm
- TLSH T157D199085AF54711E2B3AB3129F18557A477B912EF33CB8E0298238E2670A10F975F5F
- MD5 SHA1 SHA512 SSDEEP TLSH