neshta | 9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db

Change Default File Association

T1042

Processes:

9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Blocklisted process makes network request 3 IoCs

Processes:

msiexec.exe

flow pid process

37 4228 msiexec.exe
39 4228 msiexec.exe
41 4228 msiexec.exe

flow	pid	process
37	4228	msiexec.exe
39	4228	msiexec.exe
41	4228	msiexec.exe

Executes dropped EXE 17 IoCs

Processes:

9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exeMSI68BC.tmpMSI6AA3.tmpWMStatusbarSync.exeMSI7041.tmpsvchost.comsvchost.comIE_TO_~1.EXEsvchost.comWMStatusbarSync.exemsedge.exemsedge.exesvchost.comWMSTAT~1.EXEmsedge.exemsedge.exemsedge.exe

pid	process
4440	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
2872	MSI68BC.tmp
744	MSI6AA3.tmp
476	WMStatusbarSync.exe
3056	MSI7041.tmp
3592	svchost.com
4032	svchost.com
4992	IE_TO_~1.EXE
4880	svchost.com
2156	WMStatusbarSync.exe
4264	msedge.exe
484	msedge.exe
1084	svchost.com
868	WMSTAT~1.EXE
448	msedge.exe
4440	msedge.exe
956	msedge.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

WMStatusbarSync.exemsedge.exe9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exeMSI7041.tmpIE_TO_~1.EXE

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	WMStatusbarSync.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	MSI7041.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	IE_TO_~1.EXE

Loads dropped DLL 19 IoCs

Processes:

MsiExec.exeIEXPLORE.EXE

pid	process
3212	MsiExec.exe
3212	MsiExec.exe
3212	MsiExec.exe
3212	MsiExec.exe
3212	MsiExec.exe
3212	MsiExec.exe
3212	MsiExec.exe
3212	MsiExec.exe
3212	MsiExec.exe
2024	IEXPLORE.EXE
2024	IEXPLORE.EXE
2024	IEXPLORE.EXE
2024	IEXPLORE.EXE
2024	IEXPLORE.EXE
2024	IEXPLORE.EXE
2024	IEXPLORE.EXE
2024	IEXPLORE.EXE
2024	IEXPLORE.EXE
2024	IEXPLORE.EXE

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Adds Run key to start application 2 TTPs 1 IoCs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

msedge.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA msedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	msedge.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

Browser Extensions

T1176

Processes:

MsiExec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}\ = "TBSB03374"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}\NoExplorer = "1"	MsiExec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}	MsiExec.exe

Drops file in System32 directory 16 IoCs

Processes:

MsiExec.exe

description	ioc	process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\16x16x32b.bmp	MsiExec.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\booble.html	MsiExec.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\tbs_include_script_wmadvisor.js	MsiExec.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\version.txt	MsiExec.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\basis.xml	MsiExec.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\favicon.ico	MsiExec.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\SecurityHelper.exe	MsiExec.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\wmadvisor.crc	MsiExec.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\WMStatusbarSync.exe	MsiExec.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\favicon.png	MsiExec.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\tbs_include_script_statusbar.js	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\16x16x32b.bmp	MsiExec.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\anim.gif	MsiExec.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\info.txt	MsiExec.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\uninstall.exe	MsiExec.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Toolbar4\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\update.exe	MsiExec.exe

Drops file in Program Files directory 64 IoCs

Processes:

msiexec.exe9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exesvchost.comsvchost.comWMStatusbarSync.exe

description	ioc	process
File created	C:\Program Files (x86)\WebMoney Advisor\tbhelper.dll	msiexec.exe
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File created	C:\Program Files (x86)\WebMoney Advisor\favicon.png	msiexec.exe
File created	C:\Program Files (x86)\WebMoney Advisor\SecurityHelper.exe	msiexec.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13167~1.21\MICROS~2.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File created	C:\Program Files (x86)\WebMoney Advisor\tbs_include_script_wmadvisor.js	msiexec.exe
File opened for modification	C:\PROGRA~2\WEBMON~1\WMSTAT~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmplayer.exe	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13167~1.21\MI9C33~1.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpconfig.exe	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File created	C:\Program Files (x86)\WebMoney Advisor\basis.xml	msiexec.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmplayer.exe	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmprph.exe	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File created	C:\Program Files (x86)\WebMoney Advisor\update.exe	msiexec.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	svchost.com
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	svchost.com
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	svchost.com
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE	WMStatusbarSync.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe	WMStatusbarSync.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13167~1.21\MICROS~1.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmlaunch.exe	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File created	C:\Program Files (x86)\WebMoney Advisor\16x16x32b.bmp	msiexec.exe
File created	C:\Program Files (x86)\WebMoney Advisor\anim.gif	msiexec.exe
File created	C:\Program Files (x86)\WebMoney Advisor\tbs_include_script_statusbar.js	msiexec.exe
File created	C:\Program Files (x86)\WebMoney Advisor\WMPlugin.dll	msiexec.exe

Drops file in Windows directory 22 IoCs

Processes:

msiexec.exeWMStatusbarSync.exesvchost.comsvchost.comsvchost.com9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exesvchost.com

description	ioc	process
File created	C:\Windows\Installer\e575bad.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6AA3.tmp	msiexec.exe
File opened for modification	C:\Windows\directx.sys	WMStatusbarSync.exe
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\svchost.com	svchost.com
File opened for modification	C:\Windows\Installer\MSI68BC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{F0C20717-DA7A-4949-B979-8CBF57EE359D}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7041.tmp	msiexec.exe
File created	C:\Windows\Installer\e575bb0.msi	msiexec.exe
File opened for modification	C:\Windows\svchost.com	WMStatusbarSync.exe
File opened for modification	C:\Windows\svchost.com	svchost.com
File opened for modification	C:\Windows\Installer\e575bad.msi	msiexec.exe
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\svchost.com	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
File opened for modification	C:\Windows\Installer\MSI6A25.tmp	msiexec.exe
File opened for modification	C:\Windows\svchost.com	svchost.com
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\svchost.com	svchost.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\3582-490\9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\3582-490\9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe	nsis_installer_1

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

vssvc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000045e03923b2b2bc3e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000045e039230000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff00000000070001000068090045e03923000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000045e0392300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000045e0392300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

Processes:

IEXPLORE.EXEMsiExec.exeiexplore.exemsiexec.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\TBSB03374\Toolbar\toolbar_version = "1.0.15"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\TBSB03374\Toolbar\m_bWorking = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\TBSB03374\Toolbar\firstTime = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\CLSID = "{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}"	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\TBSB03374\Toolbar\TBShow = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000000700005e01000006000000090100007b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f7d7ff3a3dfd9d4c8f8303296a1a88400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\wmtransfer.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0cd227509fcd801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{07AFC698-4760-4d3f-8985-122D8EE1249F}	MsiExec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\TBSB03374\Toolbar\Toolbar Path = "C:\\Users\\Admin\\AppData\\LocalLow\\Toolbar4\\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\\"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\TBSB03374\Toolbar\updateXML = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\TBSB03374\Toolbar\C:\Users\Admin\AppData\LocalLow\Toolbar4\{3AFFD7F7-FD3 = "1668857011"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry\REGISTRY	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\TBSB03374\Toolbar\RunSearchDragAutomatically = "0"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\MAO Settings\DiscardLoadTimes = 89be75672cbed801	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\TBSB03374\Toolbar\FloatMode = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{07AFC698-4760-4d3f-8985-122D8EE1249F}\AppName = "SecurityHelper.exe"	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\MAO Settings	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\Icon = "C:\\Program Files (x86)\\WebMoney Advisor\\favicon.ico"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{07AFC698-4760-4d3f-8985-122D8EE1249F}\AppPath = "C:\\Program Files (x86)\\WebMoney Advisor"	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A324D072-F118-4135-9F87-6ED60AFA7507}\AppName = "wmstatusbarsync.exe"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\ButtonText = "WebMoney Advisor"	MsiExec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\TBSB03374\Toolbar\CountOS = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\TBSB03374\Toolbar\m_bWorking = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1653658209"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043e2eb2e51ccf149ab640c8bdb0d7906000000000200000000001066000000010000200000005f85676a8e4f6d9a3a21ee015ba792d10cb9b8506e2c77b1fe7fcc1c6fae0d3a000000000e8000000002000020000000abf8b98052826b7a206cb28fe7054df42b3ebe14d0f6fd0a24a5cd79d3d6f52f2000000051f4905d749c669d4a793154a7644aa12043da35ba5685a596a687f4d207659a40000000794e41281ea92abef0104bfe0c21ea6565523d88122da1abe05ef2101b3ec928ac64edeb118dfd2f203ed98d2672e050c3687999081020187c9bfcb3378301b7	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBar7Layout = 13000000000000000000000020000000100000001600000001000000000700005e01000006000000010300002c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f7d7ff3a3dfd9d4c8f8303296a1a88400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBar7Layout = 13000000000000000000000020000000100001001600000001000000000700005e01000006000000010300002c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f7d7ff3a3dfd9d4c8f8303296a1a88400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30997513"	iexplore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A324D072-F118-4135-9F87-6ED60AFA7507}	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043e2eb2e51ccf149ab640c8bdb0d79060000000002000000000010660000000100002000000021613a352d4d128fc65a31966c1de5a03a490ac3dd80a6c86351dfefd3f81b6d000000000e800000000200002000000004f78919a5cff627a5cd6f0b5eb8fddafd0b3b766db960a694bae95e3c14e23320000000204da5e5908a5c39372b7a25ef2fa585d6ee5e33808a3632466fc365cc31081740000000e83816456c916f252afd9f7f122e7b3fcc3beb438194baf3c3fe215bc20c345db3be9443af03b2d208db379375d29cb5fde42feb3503636f1d94ad56ecb71258	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\advisor.wmtransfer.com\ = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\TBSB03374\Toolbar	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\TBSB03374\Toolbar\ShowHighlightButton = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\TBSB03374\Toolbar\OldOS = "0"	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\MenuText = "WebMoney Advisor"	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Toolbar	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\TBSB03374\Toolbar\tb_items\tbs_separator_1 = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\TBSB03374\Toolbar\tb_items\tbs_button_016857 = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\TBSB03374\Toolbar\CurrentLayout = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{8CA96E2C-67FC-11ED-A0EE-EAB2B6EB986A} = "0"	iexplore.exe

Modifies data under HKEY_USERS 26 IoCs

Processes:

MsiExec.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-18\Software\TBSB03374\Toolbar\Height = "22"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-18\Software\TBSB03374\Toolbar\toolbar_version = "1.0.15"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-18\Software\TBSB03374\Toolbar\firstTime = "1"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\FeatureControl	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\iexplore.exe = "0"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-18\Software	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-18\Software\TBSB03374\Toolbar\RTL = "0"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-18\Software\TBSB03374\Toolbar\updateXML = "1"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-18\Software\TBSB03374\Toolbar\TBShow = "1"	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-18\Software\TBSB03374\Toolbar	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-18	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-18\Software\TBSB03374\Toolbar\toolbar_id = "{742749D7-4956-4f57-B650-5BFCBA6D1B44}"	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\InternetRegistry	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-18\Software\TBSB03374	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-18\Software\TBSB03374\Toolbar\CurrentLayout = "0"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-18\Software\TBSB03374\Toolbar\rtime = "1668856988"	MsiExec.exe

Modifies registry class 64 IoCs

Processes:

MsiExec.exeWMStatusbarSync.exe9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exemsiexec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{77AA25E8-6083-4949-A831-9CB11861DC10}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\WebMoney Advisor"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{835CD9AE-BAB0-4BC3-BA17-BA7008754395}\TypeLib\ = "{77AA25E8-6083-4949-A831-9CB11861DC10}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4897BBA6-48D9-468C-8EFA-846275D7701B}\TypeLib	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TBSB03374.TBSB03374.3\	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\WMStatusbarSync.EXE\AppID = "{67A93A36-F3D2-4BD3-8F45-894E88E16F4A}"	WMStatusbarSync.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{90BA1AE4-915B-4889-88BB-E0E203E28051}\Programmable	WMStatusbarSync.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E27EE513-9327-425E-90C7-444AFDBAEB58}\InprocServer32\ = "C:\\Program Files (x86)\\WebMoney Advisor\\statusbar_pluginU.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar3.TBSB03374\ = "WebMoney Advisor - BHO Helper"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{77AA25E8-6083-4949-A831-9CB11861DC10}\1.0\0\win32\ = "C:\\Program Files (x86)\\WebMoney Advisor\\tbcore3.dll"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F3F6A4A3-4C1E-4983-8C21-7C9D4BCAC8D3}\1.0\HELPDIR	WMStatusbarSync.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B6BF015A-21A5-48BA-BCCD-4BC3ED2DC510}	WMStatusbarSync.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9E6A3564-6F10-4CC1-ADFD-929AE8D8F58A}\ProxyStubClsid32	WMStatusbarSync.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}\VersionIndependentProgID	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar3.TBSB03374.1	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{835CD9AE-BAB0-4BC3-BA17-BA7008754395}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\ = "WebMoney Advisor"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F3F6A4A3-4C1E-4983-8C21-7C9D4BCAC8D3}\1.0\FLAGS\ = "0"	WMStatusbarSync.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B6BF015A-21A5-48BA-BCCD-4BC3ED2DC510}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	WMStatusbarSync.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0D180E85-C059-4322-8761-DDD07796CAEE}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0D180E85-C059-4322-8761-DDD07796CAEE}\TypeLib\ = "{0044D840-7B8D-4186-853C-82BE5D95FDD2}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A7DD59035184bd24889CEF62B7334CCE	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E45787B-E6F5-41DE-A50F-F6823DFE38E8}\TypeLib	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D565B35E-B787-40FA-95E3-E3562F8FC1A0}\ = "CustomInternetSecurityImpl Class"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F3F6A4A3-4C1E-4983-8C21-7C9D4BCAC8D3}\1.0\FLAGS	WMStatusbarSync.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{23CC1657-F2E0-447B-9570-94BE33258999}\TypeLib	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TBSB03374.IEToolbar	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\URLSearchHook.ToolbarURLSearchHook\CLSID\ = "{CA3EB689-8F09-4026-AA10-B9534C691CE0}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\VersionIndependentProgID\ = "TBSB03374.TBSB03374"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B6BF015A-21A5-48BA-BCCD-4BC3ED2DC510}\ProxyStubClsid32	WMStatusbarSync.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\statusbar.SyncClient.1\ = "SyncClient Class"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E45787B-E6F5-41DE-A50F-F6823DFE38E8}\TypeLib\ = "{0044D840-7B8D-4186-853C-82BE5D95FDD2}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\71702C0FA7AD94949B97C8FB75EE53D9\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\URLSearchHook.ToolbarURLSearchHook	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WMStatusbarSync.WMStatusbarSyncObj\CLSID	WMStatusbarSync.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F3F6A4A3-4C1E-4983-8C21-7C9D4BCAC8D3}\1.0\0	WMStatusbarSync.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{96456B75-E6F7-4E95-9A4D-6DCDA54CEEF1}\ = "ICustomInternetSecurityImpl"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\statusbar.BandHoster	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E27EE513-9327-425E-90C7-444AFDBAEB58}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\URLSearchHook.ToolbarURLSearchHook\ = "ToolbarURLSearchHook Class"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{77AA25E8-6083-4949-A831-9CB11861DC10}\1.0\ = "Toolbar3 1.0 Type Library"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{96456B75-E6F7-4E95-9A4D-6DCDA54CEEF1}\TypeLib\Version = "1.0"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0044D840-7B8D-4186-853C-82BE5D95FDD2}\1.0\FLAGS	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TBSB03374.IEToolbar.1\ = "WebMoney Advisor - Toolbar"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{96456B75-E6F7-4E95-9A4D-6DCDA54CEEF1}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\statusbar.SyncClient\CLSID	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0044D840-7B8D-4186-853C-82BE5D95FDD2}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\WebMoney Advisor"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3AFFD7F7-FD3D-4C9D-8F83-03296A1A8840}\InprocServer32\ = "C:\\Program Files (x86)\\WebMoney Advisor\\tbcore3.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D565B35E-B787-40FA-95E3-E3562F8FC1A0}\TypeLib\ = "{EC4085F2-8DB3-45a6-AD0B-CA289F3C5D7E}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{96456B75-E6F7-4E95-9A4D-6DCDA54CEEF1}\TypeLib	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TBSB03374.TBSB03374\	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F3F6A4A3-4C1E-4983-8C21-7C9D4BCAC8D3}\1.0\0\win32\ = "C:\\Program Files (x86)\\WebMoney Advisor\\WMStatusbarSync.exe"	WMStatusbarSync.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9E6A3564-6F10-4CC1-ADFD-929AE8D8F58A}\TypeLib\Version = "1.0"	WMStatusbarSync.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E27EE513-9327-425E-90C7-444AFDBAEB58}\ = "SyncClient Class"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E27EE513-9327-425E-90C7-444AFDBAEB58}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Toolbar3.TBSB03374	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\71702C0FA7AD94949B97C8FB75EE53D9	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{23CC1657-F2E0-447B-9570-94BE33258999}\ = "ISyncClient"	MsiExec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}\PROGRAMMABLE	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{90BA1AE4-915B-4889-88BB-E0E203E28051}\VersionIndependentProgID	WMStatusbarSync.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B6BF015A-21A5-48BA-BCCD-4BC3ED2DC510}\TypeLib\ = "{F3F6A4A3-4C1E-4983-8C21-7C9D4BCAC8D3}"	WMStatusbarSync.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\statusbar.SyncClient	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E27EE513-9327-425E-90C7-444AFDBAEB58}\ProgID\ = "statusbar.SyncClient.1"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E27EE513-9327-425E-90C7-444AFDBAEB58}\TypeLib	MsiExec.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

MSI68BC.tmpmsiexec.exemsedge.exemsedge.exe

pid	process
2872	MSI68BC.tmp
2872	MSI68BC.tmp
2872	MSI68BC.tmp
2872	MSI68BC.tmp
2872	MSI68BC.tmp
2872	MSI68BC.tmp
4228	msiexec.exe
4228	msiexec.exe
4264	msedge.exe
4264	msedge.exe
4440	msedge.exe
4440	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exe

description	pid	process
Token: SeShutdownPrivilege	448	msiexec.exe
Token: SeIncreaseQuotaPrivilege	448	msiexec.exe
Token: SeSecurityPrivilege	4228	msiexec.exe
Token: SeCreateTokenPrivilege	448	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	448	msiexec.exe
Token: SeLockMemoryPrivilege	448	msiexec.exe
Token: SeIncreaseQuotaPrivilege	448	msiexec.exe
Token: SeMachineAccountPrivilege	448	msiexec.exe
Token: SeTcbPrivilege	448	msiexec.exe
Token: SeSecurityPrivilege	448	msiexec.exe
Token: SeTakeOwnershipPrivilege	448	msiexec.exe
Token: SeLoadDriverPrivilege	448	msiexec.exe
Token: SeSystemProfilePrivilege	448	msiexec.exe
Token: SeSystemtimePrivilege	448	msiexec.exe
Token: SeProfSingleProcessPrivilege	448	msiexec.exe
Token: SeIncBasePriorityPrivilege	448	msiexec.exe
Token: SeCreatePagefilePrivilege	448	msiexec.exe
Token: SeCreatePermanentPrivilege	448	msiexec.exe
Token: SeBackupPrivilege	448	msiexec.exe
Token: SeRestorePrivilege	448	msiexec.exe
Token: SeShutdownPrivilege	448	msiexec.exe
Token: SeDebugPrivilege	448	msiexec.exe
Token: SeAuditPrivilege	448	msiexec.exe
Token: SeSystemEnvironmentPrivilege	448	msiexec.exe
Token: SeChangeNotifyPrivilege	448	msiexec.exe
Token: SeRemoteShutdownPrivilege	448	msiexec.exe
Token: SeUndockPrivilege	448	msiexec.exe
Token: SeSyncAgentPrivilege	448	msiexec.exe
Token: SeEnableDelegationPrivilege	448	msiexec.exe
Token: SeManageVolumePrivilege	448	msiexec.exe
Token: SeImpersonatePrivilege	448	msiexec.exe
Token: SeCreateGlobalPrivilege	448	msiexec.exe
Token: SeBackupPrivilege	1860	vssvc.exe
Token: SeRestorePrivilege	1860	vssvc.exe
Token: SeAuditPrivilege	1860	vssvc.exe
Token: SeBackupPrivilege	4228	msiexec.exe
Token: SeRestorePrivilege	4228	msiexec.exe
Token: SeRestorePrivilege	4228	msiexec.exe
Token: SeTakeOwnershipPrivilege	4228	msiexec.exe
Token: SeRestorePrivilege	4228	msiexec.exe
Token: SeTakeOwnershipPrivilege	4228	msiexec.exe
Token: SeRestorePrivilege	4228	msiexec.exe
Token: SeTakeOwnershipPrivilege	4228	msiexec.exe
Token: SeRestorePrivilege	4228	msiexec.exe
Token: SeTakeOwnershipPrivilege	4228	msiexec.exe
Token: SeRestorePrivilege	4228	msiexec.exe
Token: SeTakeOwnershipPrivilege	4228	msiexec.exe
Token: SeRestorePrivilege	4228	msiexec.exe
Token: SeTakeOwnershipPrivilege	4228	msiexec.exe
Token: SeRestorePrivilege	4228	msiexec.exe
Token: SeTakeOwnershipPrivilege	4228	msiexec.exe
Token: SeRestorePrivilege	4228	msiexec.exe
Token: SeTakeOwnershipPrivilege	4228	msiexec.exe
Token: SeRestorePrivilege	4228	msiexec.exe
Token: SeTakeOwnershipPrivilege	4228	msiexec.exe
Token: SeRestorePrivilege	4228	msiexec.exe
Token: SeTakeOwnershipPrivilege	4228	msiexec.exe
Token: SeRestorePrivilege	4228	msiexec.exe
Token: SeTakeOwnershipPrivilege	4228	msiexec.exe
Token: SeRestorePrivilege	4228	msiexec.exe
Token: SeTakeOwnershipPrivilege	4228	msiexec.exe
Token: SeRestorePrivilege	4228	msiexec.exe
Token: SeTakeOwnershipPrivilege	4228	msiexec.exe
Token: SeRestorePrivilege	4228	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

msiexec.exeiexplore.exe

pid process

448 msiexec.exe
448 msiexec.exe
3764 iexplore.exe
Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

3764 iexplore.exe
3764 iexplore.exe
2024 IEXPLORE.EXE
2024 IEXPLORE.EXE
2024 IEXPLORE.EXE
2024 IEXPLORE.EXE
2024 IEXPLORE.EXE

pid	process
448	msiexec.exe
448	msiexec.exe
3764	iexplore.exe

pid	process
3764	iexplore.exe
3764	iexplore.exe
2024	IEXPLORE.EXE
2024	IEXPLORE.EXE
2024	IEXPLORE.EXE
2024	IEXPLORE.EXE
2024	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exemsiexec.exeMsiExec.exeMSI7041.tmpsvchost.comiexplore.exeIEXPLORE.EXEsvchost.comIE_TO_~1.EXEsvchost.commsedge.exeWMStatusbarSync.exesvchost.com

description	pid	process	target process
PID 5004 wrote to memory of 4440	5004	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
PID 5004 wrote to memory of 4440	5004	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
PID 5004 wrote to memory of 4440	5004	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
PID 4440 wrote to memory of 448	4440	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe	msiexec.exe
PID 4440 wrote to memory of 448	4440	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe	msiexec.exe
PID 4440 wrote to memory of 448	4440	9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe	msiexec.exe
PID 4228 wrote to memory of 404	4228	msiexec.exe	srtasks.exe
PID 4228 wrote to memory of 404	4228	msiexec.exe	srtasks.exe
PID 4228 wrote to memory of 812	4228	msiexec.exe	MsiExec.exe
PID 4228 wrote to memory of 812	4228	msiexec.exe	MsiExec.exe
PID 4228 wrote to memory of 812	4228	msiexec.exe	MsiExec.exe
PID 4228 wrote to memory of 2872	4228	msiexec.exe	MSI68BC.tmp
PID 4228 wrote to memory of 2872	4228	msiexec.exe	MSI68BC.tmp
PID 4228 wrote to memory of 2872	4228	msiexec.exe	MSI68BC.tmp
PID 4228 wrote to memory of 744	4228	msiexec.exe	MSI6AA3.tmp
PID 4228 wrote to memory of 744	4228	msiexec.exe	MSI6AA3.tmp
PID 4228 wrote to memory of 744	4228	msiexec.exe	MSI6AA3.tmp
PID 4228 wrote to memory of 3212	4228	msiexec.exe	MsiExec.exe
PID 4228 wrote to memory of 3212	4228	msiexec.exe	MsiExec.exe
PID 4228 wrote to memory of 3212	4228	msiexec.exe	MsiExec.exe
PID 3212 wrote to memory of 476	3212	MsiExec.exe	WMStatusbarSync.exe
PID 3212 wrote to memory of 476	3212	MsiExec.exe	WMStatusbarSync.exe
PID 3212 wrote to memory of 476	3212	MsiExec.exe	WMStatusbarSync.exe
PID 4228 wrote to memory of 3056	4228	msiexec.exe	MSI7041.tmp
PID 4228 wrote to memory of 3056	4228	msiexec.exe	MSI7041.tmp
PID 4228 wrote to memory of 3056	4228	msiexec.exe	MSI7041.tmp
PID 3056 wrote to memory of 3592	3056	MSI7041.tmp	svchost.com
PID 3056 wrote to memory of 3592	3056	MSI7041.tmp	svchost.com
PID 3056 wrote to memory of 3592	3056	MSI7041.tmp	svchost.com
PID 3592 wrote to memory of 3764	3592	svchost.com	iexplore.exe
PID 3592 wrote to memory of 3764	3592	svchost.com	iexplore.exe
PID 3764 wrote to memory of 2024	3764	iexplore.exe	IEXPLORE.EXE
PID 3764 wrote to memory of 2024	3764	iexplore.exe	IEXPLORE.EXE
PID 3764 wrote to memory of 2024	3764	iexplore.exe	IEXPLORE.EXE
PID 2024 wrote to memory of 4032	2024	IEXPLORE.EXE	svchost.com
PID 2024 wrote to memory of 4032	2024	IEXPLORE.EXE	svchost.com
PID 2024 wrote to memory of 4032	2024	IEXPLORE.EXE	svchost.com
PID 4032 wrote to memory of 4992	4032	svchost.com	IE_TO_~1.EXE
PID 4032 wrote to memory of 4992	4032	svchost.com	IE_TO_~1.EXE
PID 4992 wrote to memory of 4880	4992	IE_TO_~1.EXE	svchost.com
PID 4992 wrote to memory of 4880	4992	IE_TO_~1.EXE	svchost.com
PID 4992 wrote to memory of 4880	4992	IE_TO_~1.EXE	svchost.com
PID 4880 wrote to memory of 4264	4880	svchost.com	msedge.exe
PID 4880 wrote to memory of 4264	4880	svchost.com	msedge.exe
PID 4264 wrote to memory of 484	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 484	4264	msedge.exe	msedge.exe
PID 2156 wrote to memory of 1084	2156	WMStatusbarSync.exe	svchost.com
PID 2156 wrote to memory of 1084	2156	WMStatusbarSync.exe	svchost.com
PID 2156 wrote to memory of 1084	2156	WMStatusbarSync.exe	svchost.com
PID 1084 wrote to memory of 868	1084	svchost.com	WMSTAT~1.EXE
PID 1084 wrote to memory of 868	1084	svchost.com	WMSTAT~1.EXE
PID 1084 wrote to memory of 868	1084	svchost.com	WMSTAT~1.EXE
PID 4264 wrote to memory of 448	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 448	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 448	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 448	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 448	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 448	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 448	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 448	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 448	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 448	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 448	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 448	4264	msedge.exe	msedge.exe

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	msedge.exe

C:\Users\Admin\AppData\Local\Temp\9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
"C:\Users\Admin\AppData\Local\Temp\9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe"
1⤵
- Modifies system executable filetype association
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5004

C:\Users\Admin\AppData\Local\Temp\3582-490\9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\9a49c739b0528015f5544faf8d646d0e32f40868f4b61becb5f6fcb7892f91db.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440

C:\Windows\SysWOW64\msiexec.exe
msiexec /i "C:\Users\Admin\AppData\Local\Temp\tmp.msi" /passive
3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:448

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4228

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
2⤵
PID:404

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding CF6E24B3A0FDAFAF8C3C37AA6F753750
2⤵
PID:812

C:\Windows\Installer\MSI68BC.tmp
"C:\Windows\Installer\MSI68BC.tmp"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2872

C:\Windows\Installer\MSI6AA3.tmp
"C:\Windows\Installer\MSI6AA3.tmp"
2⤵
- Executes dropped EXE
PID:744

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 66BEB425E8758BCF72568B2C2B8DB64A E Global\MSI0000
2⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3212

C:\Program Files (x86)\WebMoney Advisor\WMStatusbarSync.exe
"C:\Program Files (x86)\WebMoney Advisor\WMStatusbarSync.exe" -RegServer
3⤵
- Executes dropped EXE
- Modifies registry class
PID:476

C:\Windows\Installer\MSI7041.tmp
"C:\Windows\Installer\MSI7041.tmp" "http://advisor.wmtransfer.com/URLFirst.aspx"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3056

C:\Windows\svchost.com
"C:\Windows\svchost.com" "C:\PROGRA~1\INTERN~1\iexplore.exe" "http://advisor.wmtransfer.com/URLFirst.aspx"
3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3592

C:\PROGRA~1\INTERN~1\iexplore.exe
C:\PROGRA~1\INTERN~1\iexplore.exe http://advisor.wmtransfer.com/URLFirst.aspx
4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3764

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3764 CREDAT:17410 /prefetch:2
5⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2024

C:\Windows\svchost.com
"C:\Windows\svchost.com" "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE" --from-ie-to-edge=3 --ie-frame-hwnd=a0062
6⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4032

C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE
C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE --from-ie-to-edge=3 --ie-frame-hwnd=a0062
7⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4992

C:\Windows\svchost.com
"C:\Windows\svchost.com" "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=a0062
8⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4880

C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe --from-ie-to-edge=3 --ie-frame-hwnd=a0062
9⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4264

C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 --annotation=exe=C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd4fad46f8,0x7ffd4fad4708,0x7ffd4fad4718
10⤵
- Executes dropped EXE
PID:484

C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
"C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=gpu-process --field-trial-handle=2168,6144466191355419262,5444914330945047870,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
10⤵
- Executes dropped EXE
PID:448

C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
"C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,6144466191355419262,5444914330945047870,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
10⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4440

C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
"C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,6144466191355419262,5444914330945047870,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
10⤵
- Executes dropped EXE
PID:956

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1860

C:\Program Files (x86)\WebMoney Advisor\WMStatusbarSync.exe
"C:\Program Files (x86)\WebMoney Advisor\WMStatusbarSync.exe" -Embedding
1⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2156

C:\Windows\svchost.com
"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\WMSTAT~1.EXE" -Embedding
2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1084

C:\Users\Admin\AppData\Local\Temp\3582-490\WMSTAT~1.EXE
C:\Users\Admin\AppData\Local\Temp\3582-490\WMSTAT~1.EXE -Embedding
3⤵
- Executes dropped EXE
PID:868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2684

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Change Default File Association

T1042

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery