937d07239cbfee2d34b7f1fae762ac72b52fb2b710e87e02fa758f452aa62913

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 22:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Form_W-9_Ver-083_030913350-67084228u8857-460102.js
Size

467KB
MD5

6682dc1281579bd8789a8d2c09ca4251
SHA1

67bb21c9665fc12d8dc6ef2ac775c3f6274bd0ed
SHA256

937d07239cbfee2d34b7f1fae762ac72b52fb2b710e87e02fa758f452aa62913
SHA512

629219ec7dd6d1ca529daabeffe7b4430467d089054876c203d7be9979c32bb6d01901d018d88a81699ae18ba1be1421ec5fcbea6610f3e96953b1ab07b048bb
SSDEEP

6144:I/sTY54eD0MDV96cPh7siYttNfIR3zKEyX90q+jTEkyZxUwwkykmQmByuPatD/ey:8uu96FjIR3MN24Uk1

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 64 IoCs

Processes:

wscript.exemsiexec.exerundll32.exe

flow	pid	process
3	1668	wscript.exe
5	1668	wscript.exe
6	1960	msiexec.exe
11	1456	rundll32.exe
13	1456	rundll32.exe
15	1456	rundll32.exe
17	1456	rundll32.exe
18	1456	rundll32.exe
19	1456	rundll32.exe
20	1456	rundll32.exe
22	1456	rundll32.exe
23	1456	rundll32.exe
24	1456	rundll32.exe
25	1456	rundll32.exe
26	1456	rundll32.exe
27	1456	rundll32.exe
28	1456	rundll32.exe
29	1456	rundll32.exe
32	1456	rundll32.exe
33	1456	rundll32.exe
34	1456	rundll32.exe
35	1456	rundll32.exe
36	1456	rundll32.exe
38	1456	rundll32.exe
39	1456	rundll32.exe
40	1456	rundll32.exe
41	1456	rundll32.exe
42	1456	rundll32.exe
43	1456	rundll32.exe
45	1456	rundll32.exe
46	1456	rundll32.exe
47	1456	rundll32.exe
48	1456	rundll32.exe
53	1456	rundll32.exe
54	1456	rundll32.exe
55	1456	rundll32.exe
56	1456	rundll32.exe
57	1456	rundll32.exe
58	1456	rundll32.exe
59	1456	rundll32.exe
60	1456	rundll32.exe
61	1456	rundll32.exe
62	1456	rundll32.exe
63	1456	rundll32.exe
64	1456	rundll32.exe
65	1456	rundll32.exe
66	1456	rundll32.exe
67	1456	rundll32.exe
68	1456	rundll32.exe
69	1456	rundll32.exe
70	1456	rundll32.exe
71	1456	rundll32.exe
72	1456	rundll32.exe
73	1456	rundll32.exe
74	1456	rundll32.exe
75	1456	rundll32.exe
76	1456	rundll32.exe
77	1456	rundll32.exe
78	1456	rundll32.exe
79	1456	rundll32.exe
80	1456	rundll32.exe
81	1456	rundll32.exe
82	1456	rundll32.exe
83	1456	rundll32.exe

Executes dropped EXE 1 IoCs

Processes:

MSI2745.tmp

pid process

2192 MSI2745.tmp
Loads dropped DLL 7 IoCs

Processes:

MsiExec.exerundll32.exe

pid process

1188 MsiExec.exe
1188 MsiExec.exe
1188 MsiExec.exe
1456 rundll32.exe
1456 rundll32.exe
1456 rundll32.exe
1456 rundll32.exe

pid	process
2192	MSI2745.tmp

pid	process
1188	MsiExec.exe
1188	MsiExec.exe
1188	MsiExec.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe

Drops file in Windows directory 8 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSI1D41.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2473.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI257D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI25BC.tmp	msiexec.exe
File created	C:\Windows\Installer\f7625ea.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2705.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2745.tmp	msiexec.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

wscript.exerundll32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	wscript.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	wscript.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	wscript.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msiexec.exeMSI2745.tmprundll32.exe

pid	process
1960	msiexec.exe
1960	msiexec.exe
2192	MSI2745.tmp
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe
1456	rundll32.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

Processes:

wscript.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	1668	wscript.exe
Token: SeIncreaseQuotaPrivilege	1668	wscript.exe
Token: SeRestorePrivilege	1960	msiexec.exe
Token: SeTakeOwnershipPrivilege	1960	msiexec.exe
Token: SeSecurityPrivilege	1960	msiexec.exe
Token: SeCreateTokenPrivilege	1668	wscript.exe
Token: SeAssignPrimaryTokenPrivilege	1668	wscript.exe
Token: SeLockMemoryPrivilege	1668	wscript.exe
Token: SeIncreaseQuotaPrivilege	1668	wscript.exe
Token: SeMachineAccountPrivilege	1668	wscript.exe
Token: SeTcbPrivilege	1668	wscript.exe
Token: SeSecurityPrivilege	1668	wscript.exe
Token: SeTakeOwnershipPrivilege	1668	wscript.exe
Token: SeLoadDriverPrivilege	1668	wscript.exe
Token: SeSystemProfilePrivilege	1668	wscript.exe
Token: SeSystemtimePrivilege	1668	wscript.exe
Token: SeProfSingleProcessPrivilege	1668	wscript.exe
Token: SeIncBasePriorityPrivilege	1668	wscript.exe
Token: SeCreatePagefilePrivilege	1668	wscript.exe
Token: SeCreatePermanentPrivilege	1668	wscript.exe
Token: SeBackupPrivilege	1668	wscript.exe
Token: SeRestorePrivilege	1668	wscript.exe
Token: SeShutdownPrivilege	1668	wscript.exe
Token: SeDebugPrivilege	1668	wscript.exe
Token: SeAuditPrivilege	1668	wscript.exe
Token: SeSystemEnvironmentPrivilege	1668	wscript.exe
Token: SeChangeNotifyPrivilege	1668	wscript.exe
Token: SeRemoteShutdownPrivilege	1668	wscript.exe
Token: SeUndockPrivilege	1668	wscript.exe
Token: SeSyncAgentPrivilege	1668	wscript.exe
Token: SeEnableDelegationPrivilege	1668	wscript.exe
Token: SeManageVolumePrivilege	1668	wscript.exe
Token: SeImpersonatePrivilege	1668	wscript.exe
Token: SeCreateGlobalPrivilege	1668	wscript.exe
Token: SeRestorePrivilege	1960	msiexec.exe
Token: SeTakeOwnershipPrivilege	1960	msiexec.exe
Token: SeRestorePrivilege	1960	msiexec.exe
Token: SeTakeOwnershipPrivilege	1960	msiexec.exe
Token: SeRestorePrivilege	1960	msiexec.exe
Token: SeTakeOwnershipPrivilege	1960	msiexec.exe
Token: SeRestorePrivilege	1960	msiexec.exe
Token: SeTakeOwnershipPrivilege	1960	msiexec.exe
Token: SeRestorePrivilege	1960	msiexec.exe
Token: SeTakeOwnershipPrivilege	1960	msiexec.exe
Token: SeRestorePrivilege	1960	msiexec.exe
Token: SeTakeOwnershipPrivilege	1960	msiexec.exe
Token: SeRestorePrivilege	1960	msiexec.exe
Token: SeTakeOwnershipPrivilege	1960	msiexec.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

msiexec.exe

description	pid	process	target process
PID 1960 wrote to memory of 1188	1960	msiexec.exe	MsiExec.exe
PID 1960 wrote to memory of 1188	1960	msiexec.exe	MsiExec.exe
PID 1960 wrote to memory of 1188	1960	msiexec.exe	MsiExec.exe
PID 1960 wrote to memory of 1188	1960	msiexec.exe	MsiExec.exe
PID 1960 wrote to memory of 1188	1960	msiexec.exe	MsiExec.exe
PID 1960 wrote to memory of 1188	1960	msiexec.exe	MsiExec.exe
PID 1960 wrote to memory of 1188	1960	msiexec.exe	MsiExec.exe
PID 1960 wrote to memory of 2192	1960	msiexec.exe	MSI2745.tmp
PID 1960 wrote to memory of 2192	1960	msiexec.exe	MSI2745.tmp
PID 1960 wrote to memory of 2192	1960	msiexec.exe	MSI2745.tmp
PID 1960 wrote to memory of 2192	1960	msiexec.exe	MSI2745.tmp
PID 1960 wrote to memory of 2192	1960	msiexec.exe	MSI2745.tmp
PID 1960 wrote to memory of 2192	1960	msiexec.exe	MSI2745.tmp
PID 1960 wrote to memory of 2192	1960	msiexec.exe	MSI2745.tmp

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Form_W-9_Ver-083_030913350-67084228u8857-460102.js
1⤵
- Blocklisted process makes network request
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:1668

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1960

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 3152710E5E24FC33C06E85C0BA29575C
2⤵
- Loads dropped DLL
PID:1188

C:\Windows\Installer\MSI2745.tmp
"C:\Windows\Installer\MSI2745.tmp" C:/Windows/System32/rundll32.exe C:\Users\Admin\AppData\Roaming\upfilles.dll, stow
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2192

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\upfilles.dll, stow
1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:1456

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
190058c1ad89f117873189a87eb167d8

SHA1
aa5354acee3cf684f76dfa585b50f39e63c10c13

SHA256
22eb26d3d891e21651fcc3a41f9240b110ce38168d5b259e5ea0c5b3026a5dd2

SHA512
7e127106adeacebfc6bb430c82cac10d3c616e43147a1a2ab9a3d4e2b0e449ac1a09d3e5c702afc338b82dd756e06fa818ffd669059bfecca4de2f66db390062

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1A37.tmp
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1AB7.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Roaming\upfilles.dll
Filesize
508KB

MD5
ccb6d3cb020f56758622911ddd2f1fcb

SHA1
4a013f752c2bf84ca37e418175e0d9b6f61f636d

SHA256
f4cb6b684ea097f867d406a978b3422bbf2ecfea39236bf3ab99340996b825de

SHA512
6ed929967005eaa6407e273b53a1fedcb2b084d775bed17272fd05b1ce143dbf921ac201246dfbfdbe663c7351e44c12f162e6f03343548b69b5d4598bb3492e

Download Submit
C:\Windows\Installer\MSI1D41.tmp
Filesize
1.5MB

MD5
b4a482a7e96cfdef632a7af286120156

SHA1
73e3639a9388af84b9c0f172b3aeaf3823014596

SHA256
ead5ebf464c313176174ff0fdc3360a3477f6361d0947221d31287eeb04691b3

SHA512
15661f1dc751a48f5d213ec99c046e0b9fa1a2201d238d26bee0f15341e9d84611c30f152c463368c6d59f3e7cccb5ae991b1f3127ad65eb3a2ea7823d3b598b

Download Submit
C:\Windows\Installer\MSI2473.tmp
Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSI2745.tmp
Filesize
389KB

MD5
b9545ed17695a32face8c3408a6a3553

SHA1
f6c31c9cd832ae2aebcd88e7b2fa6803ae93fc83

SHA256
1e0e63b446eecf6c9781c7d1cae1f46a3bb31654a70612f71f31538fb4f4729a

SHA512
f6d6dc40dcba5ff091452d7cc257427dcb7ce2a21816b4fec2ee249e63246b64667f5c4095220623533243103876433ef8c12c9b612c0e95fdfffe41d1504e04

Download Submit
memory/1456-109-0x000000026E7A0000-0x000000026E7EA000-memory.dmp

Filesize
296KB

Download
memory/1456-112-0x000000026E7A0000-0x000000026E7EA000-memory.dmp

Filesize
296KB

Download
memory/1456-110-0x0000000001F50000-0x0000000001F8E000-memory.dmp

Filesize
248KB

Download
memory/1456-113-0x0000000001F90000-0x0000000001FDC000-memory.dmp

Filesize
304KB

Download
memory/1456-138-0x0000000001F90000-0x0000000001FDC000-memory.dmp

Filesize
304KB

Download
memory/2192-103-0x0000000000120000-0x0000000000122000-memory.dmp

Filesize
8KB

Download