d2a4739ea4806b865ccadd0d9af3b57bfe16e6c2e45610fde4deabcb55ac473f

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Origin.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	EALink.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\International\Geo\Nation	Origin.exe
Key value queried	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\International\Geo\Nation	EALink.exe
Key value queried	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\International\Geo\Nation	OriginThinSetupInternal.exe
Key value queried	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\International\Geo\Nation	OriginThinSetupInternal.exe

Loads dropped DLL 64 IoCs

pid	Process
1368	OriginThinSetup.exe
1368	OriginThinSetup.exe
1368	OriginThinSetup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1768	OriginSetup.exe
1768	OriginSetup.exe
1768	OriginSetup.exe
1768	OriginSetup.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1752	QtWebEngineProcess.exe
1752	QtWebEngineProcess.exe
1752	QtWebEngineProcess.exe
616	QtWebEngineProcess.exe
616	QtWebEngineProcess.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\EADM = "\"C:\\Program Files (x86)\\Origin\\Origin.exe\" -AutoStart"	Origin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\EADM = "\"C:\\Program Files (x86)\\Origin\\Origin.exe\" -AutoStart"	OriginThinSetupInternal.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	OriginClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	OriginClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	OriginClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_631AA251B914FF4C1C8C66689B55685D	OriginClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_631AA251B914FF4C1C8C66689B55685D	OriginClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Origin\Telemetry\data	OriginClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Origin\Telemetry\tmh	OriginClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	OriginClientService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Origin\legacyPM\lang\CLIStrings_da_DK.xml	OriginThinSetupInternal.exe
File created	C:\Program Files (x86)\Origin\legacyPM\lang\CLIStrings_en_GB.xml	OriginThinSetupInternal.exe
File created	C:\Program Files (x86)\Origin\libeay32.dll	OriginThinSetupInternal.exe
File created	C:\Program Files (x86)\Origin\sounds\FriendStartsBroadcasting.wav	OriginThinSetupInternal.exe
File created	C:\Program Files (x86)\Origin\support\Privacy and Cookie Policy\WEBPRIVACY_PC_br_G__LU_06072018_T[289].html	OriginThinSetupInternal.exe
File created	C:\Program Files (x86)\Origin\support\User Agreement\WEBTERMS_PC_fr_G__LU_14062018_T[268].html	OriginThinSetupInternal.exe
File opened for modification	C:\Program Files (x86)\Origin\debug.log	QtWebEngineProcess.exe
File created	C:\Program Files (x86)\Origin\legacyPM\lang\CoreStrings_ja_JP.xml	OriginThinSetupInternal.exe
File created	C:\Program Files (x86)\Origin\OriginClientService.exe	OriginThinSetupInternal.exe
File created	C:\Program Files (x86)\Origin\support\User Agreement\WEBTERMS_PC_da_G__LU_14062018_T[252].html	OriginThinSetupInternal.exe
File created	C:\Program Files (x86)\Origin\3RDPARTYLICENSES.HTML	OriginThinSetupInternal.exe
File created	C:\Program Files (x86)\Origin\Qt5QuickWidgets.dll	OriginThinSetupInternal.exe
File created	C:\Program Files (x86)\Origin\support\User Agreement\WEBTERMS_PC_br_G__LU_14062018_T[250].html	OriginThinSetupInternal.exe
File created	C:\Program Files (x86)\Origin\icudt58.dll	OriginThinSetupInternal.exe
File created	C:\Program Files (x86)\Origin\Qt5OpenGL.dll	OriginThinSetupInternal.exe
File created	C:\Program Files (x86)\Origin\qtwebengine_resources_100p.pak	OriginThinSetupInternal.exe
File created	C:\Program Files (x86)\Origin\sounds\FinishedDownload.wav	OriginThinSetupInternal.exe
File created	C:\Program Files (x86)\Origin\support\User Agreement\WEBTERMS_PC_sc_G__LU_27062018_T[343].html	OriginThinSetupInternal.exe
File created	C:\Program Files (x86)\Origin\OriginER.VisualElementsManifest.xml	OriginThinSetupInternal.exe
File created	C:\Program Files (x86)\Origin\sounds\KoreanTimer.wav	OriginThinSetupInternal.exe
File opened for modification	C:\Program Files (x86)\Origin\debug.log	QtWebEngineProcess.exe
File created	C:\Program Files (x86)\Origin\3RDPARTYLICENSES_FR.HTML	OriginThinSetupInternal.exe
File created	C:\Program Files (x86)\Origin\legacyPM\lang\CLIStrings_it_IT.xml	OriginThinSetupInternal.exe
File created	C:\Program Files (x86)\Origin\legacyPM\lang\CoreStrings_da_DK.xml	OriginThinSetupInternal.exe
File created	C:\Program Files (x86)\Origin\legacyPM\OriginUninstall.exe	OriginThinSetupInternal.exe
File created	C:\Program Files (x86)\Origin\support\Privacy and Cookie Policy\WEBPRIVACY_PC_es_G__LU_06072018_T[276].html	OriginThinSetupInternal.exe
File created	C:\Program Files (x86)\Origin\support\Privacy and Cookie Policy\WEBPRIVACY_PC_sk_G__LU_06072018_T[1201].html	OriginThinSetupInternal.exe
File opened for modification	C:\Program Files (x86)\Origin\debug.log	QtWebEngineProcess.exe
File created	C:\Program Files (x86)\Origin\legacyPM\lang\CoreStrings_sv_SE.xml	OriginThinSetupInternal.exe
File opened for modification	C:\Program Files (x86)\Origin\UAC.txt	Origin.exe
File created	C:\Program Files (x86)\Origin\legacyPM\lang\CLIStrings_en_US.xml	OriginThinSetupInternal.exe
File created	C:\Program Files (x86)\Origin\legacyPM\lang\CoreStrings_cs_CZ.xml	OriginThinSetupInternal.exe
File opened for modification	C:\Program Files (x86)\Origin\OriginUninstall.exe	Setup.exe
File created	C:\Program Files (x86)\Origin\legacyPM\lang\CoreStrings_fr_FR.xml	OriginThinSetupInternal.exe
File created	C:\Program Files (x86)\Origin\OriginCrashReporter.exe	OriginThinSetupInternal.exe
File created	C:\Program Files (x86)\Origin\qt.conf	OriginThinSetupInternal.exe
File created	C:\Program Files (x86)\Origin\sounds\FriendSigningOut.wav	OriginThinSetupInternal.exe
File created	C:\Program Files (x86)\Origin\legacyPM\lang\CLIStrings_no_NO.xml	OriginThinSetupInternal.exe
File created	C:\Program Files (x86)\Origin\libGLESv2_Swift.dll	OriginThinSetupInternal.exe
File created	C:\Program Files (x86)\Origin\platforms\qwindows.dll	OriginThinSetupInternal.exe
File created	C:\Program Files (x86)\Origin\support\Privacy and Cookie Policy\WEBPRIVACY_PC_hu_G__LU_06072018_T[279].html	OriginThinSetupInternal.exe
File created	C:\Program Files (x86)\Origin\support\Privacy and Cookie Policy\WEBPRIVACY_PC_pl_G__LU_06072018_T[282].html	OriginThinSetupInternal.exe
File opened for modification	C:\Program Files (x86)\Origin\debug.log	QtWebEngineProcess.exe
File created	C:\Program Files (x86)\Origin\legacyPM\lang\CLIStrings_ko_KR.xml	OriginThinSetupInternal.exe
File created	C:\Program Files (x86)\Origin\legacyPM\lang\CoreStrings_ko_KR.xml	OriginThinSetupInternal.exe
File created	C:\Program Files (x86)\Origin\printsupport\windowsprintersupport.dll	OriginThinSetupInternal.exe
File created	C:\Program Files (x86)\Origin\sounds\FriendStartsGame.wav	OriginThinSetupInternal.exe
File created	C:\Program Files (x86)\Origin\sounds\PushToTalkOff.wav	OriginThinSetupInternal.exe
File opened for modification	C:\Program Files (x86)\Origin\debug.log	QtWebEngineProcess.exe
File created	C:\Program Files (x86)\Origin\imageformats\qwbmp.dll	OriginThinSetupInternal.exe
File created	C:\Program Files (x86)\Origin\Qt5WebSockets.dll	OriginThinSetupInternal.exe
File created	C:\Program Files (x86)\Origin\support\User Agreement\WEBTERMS_PC_ru_G__LU_03072018_T[262].html	OriginThinSetupInternal.exe
File created	C:\Program Files (x86)\Origin\legacyPM\lang\CoreStrings_es_ES.xml	OriginThinSetupInternal.exe
File created	C:\Program Files (x86)\Origin\legacyPM\lang\CoreStrings_fi_FI.xml	OriginThinSetupInternal.exe
File created	C:\Program Files (x86)\Origin\Origin.VisualElementsManifest.xml	OriginThinSetupInternal.exe
File created	C:\Program Files (x86)\Origin\support\User Agreement\WEBTERMS_PC_th_G__LU_05072018_T[334].html	OriginThinSetupInternal.exe
File created	C:\Program Files (x86)\Origin\IGO32.dll	OriginThinSetupInternal.exe
File created	C:\Program Files (x86)\Origin\sounds\IncomingVoiceChat.wav	OriginThinSetupInternal.exe
File created	C:\Program Files (x86)\Origin\support\User Agreement\WEBTERMS_PC_es_G__LU_03072018_T[263].html	OriginThinSetupInternal.exe
File created	C:\Program Files (x86)\Origin\vcredist_x86_vs2010.exe	OriginThinSetupInternal.exe
File created	C:\Program Files (x86)\Origin\legacyPM\CmdPortalClient.dll	OriginThinSetupInternal.exe
File created	C:\Program Files (x86)\Origin\legacyPM\lang\CLIStrings_nl_NL.xml	OriginThinSetupInternal.exe
File created	C:\Program Files (x86)\Origin\legacyPM\lang\CoreStrings_es_MX.xml	OriginThinSetupInternal.exe
File created	C:\Program Files (x86)\Origin\Qt5WebEngineCore.dll	OriginThinSetupInternal.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Origin\Telemetry\tmh	OriginWebHelperService.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Origin\Logs\owh_dserrors.data	OriginWebHelperService.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-19\2f8cfc4c5d2f451da2733f52335e71a0_4d2ef0d5-1240-4a07-93d0-06481c31e0ad	OriginWebHelperService.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Origin\Telemetry\data	OriginWebHelperService.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	perfmon.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	perfmon.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = e0bdcdc23728d901	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 27 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F9242BE1-942A-11ED-8499-660C31E8D015} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	Origin.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\DownloadWindowPlacement = 2c0000000000000000000000ffffffffffffffffffffffffffffffff100100003d000000900300001d020000	iexplore.exe

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	OriginClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	OriginClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	OriginClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	OriginClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	OriginClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	OriginClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	OriginClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	OriginClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	OriginClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	OriginClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	OriginClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	OriginClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	OriginClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	OriginClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	OriginClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	OriginClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	OriginClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	OriginClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	OriginClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	OriginClientService.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	OriginClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	OriginClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	OriginClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	OriginClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	OriginClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	OriginClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	OriginClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	OriginClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	OriginClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	OriginClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	OriginClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	OriginClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	OriginClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	OriginClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	OriginClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	OriginClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	OriginClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	OriginClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	OriginClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	OriginClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	OriginClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	OriginClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	OriginClientService.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D139E7FE48CDB174D86B8A3385904547\SourceList	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\eadm	Origin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\origin2\URL Protocol	Origin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\origin2\shell\open\command	Origin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\origin2\shell	Origin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\eadm\URL Protocol	OriginThinSetupInternal.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\Login.exe	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\eadm\shell\open	Origin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ealink\DefaultIcon	OriginLegacyCLI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\origin\shell\open\command	OriginThinSetupInternal.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ealink\shell	OriginLegacyCLI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\origin2\shell\open	Origin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ealink\URL Protocol	OriginLegacyCLI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\origin2\ = "URL:ORIGIN Protocol"	OriginThinSetupInternal.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\MessageDlg.exe	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\origin\ = "URL:ORIGIN Protocol"	Origin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\origin\ = "URL:ORIGIN Protocol"	OriginThinSetupInternal.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ealink\DefaultIcon	OriginLegacyCLI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\PatchProgress.exe	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\Login.exe\NoStartPage	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ealink\ = "URL:ealink protocol"	OriginLegacyCLI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\eadm	OriginThinSetupInternal.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\origin2	OriginThinSetupInternal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\link2ea\shell\open\command\ = "\"C:\\Program Files (x86)\\Origin\\EALink.exe\" \"%1\" \"%2\" \"%3\" \"%4\" \"%5\" \"%6\" \"%7\" \"%8\" \"%9\""	OriginThinSetupInternal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\origin\shell\open\command\ = "\"C:\\Program Files (x86)\\Origin\\Origin.exe\" \"%1\""	Origin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\origin2\shell\open\command	OriginThinSetupInternal.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\link2ea	OriginThinSetupInternal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\link2ea\URL Protocol	OriginThinSetupInternal.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ealink\shell\open\command	OriginLegacyCLI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\origin\shell\open\command	Origin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\origin\shell\open	Origin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ealink	OriginLegacyCLI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\origin	OriginThinSetupInternal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\link2ea\ = "URL:EALINK Protocol"	OriginThinSetupInternal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ealink\shell\open\command\ = "\"C:\\Program Files (x86)\\Origin\\legacyPM\\OriginLegacyCLI.exe\" \"%1\" -wait"	OriginLegacyCLI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\eadm\shell	Origin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\origin\shell\open\command\ = "\"C:\\Program Files (x86)\\Origin\\Origin.exe\" \"%1\""	OriginThinSetupInternal.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\link2ea\shell\open	OriginThinSetupInternal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ealink\ = "URL:ealink protocol"	OriginLegacyCLI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D139E7FE48CDB174D86B8A3385904547	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D139E7FE48CDB174D86B8A3385904547\SourceList\	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\eadm\shell\open\command	Origin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\eadm\shell\open\command\ = "\"C:\\Program Files (x86)\\Origin\\Origin.exe\" \"%1\""	Origin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\eadm\shell\open\command\ = "\"C:\\Program Files (x86)\\Origin\\Origin.exe\" \"%1\""	OriginThinSetupInternal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ealink\URL Protocol	OriginLegacyCLI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ealink\DefaultIcon\ = "\"C:\\Program Files (x86)\\Origin\\legacyPM\\OriginLegacyCLI.exe\",-107"	OriginLegacyCLI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\origin	Origin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\origin\URL Protocol	Origin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\origin2	Origin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\link2ea\shell	OriginThinSetupInternal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\eadm\ = "URL:EADM Protocol"	Origin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ealink\DefaultIcon\ = "\"C:\\Program Files (x86)\\Origin\\legacyPM\\OriginLegacyCLI.exe\",-107"	OriginLegacyCLI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\origin\shell	Origin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ealink\shell	OriginLegacyCLI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\origin\URL Protocol	OriginThinSetupInternal.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ealink\shell\open	OriginLegacyCLI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\eadm\URL Protocol	Origin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ealink\shell\open	OriginLegacyCLI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ealink\shell\open\command	OriginLegacyCLI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ealink\shell\open\command\ = "\"C:\\Program Files (x86)\\Origin\\legacyPM\\OriginLegacyCLI.exe\" \"%1\" -wait"	OriginLegacyCLI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\eadm\ = "URL:EADM Protocol"	OriginThinSetupInternal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\MessageDlg.exe\NoStartPage	Setup.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 040000000100000010000000cb17e431673ee209fe455793f30afa1c0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c909000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c01400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e5190000000100000010000000d8b5fb368468620275d142ffd2aade372000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a	Origin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5	Origin.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c909000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c01400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e52000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a	Origin.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 190000000100000010000000d8b5fb368468620275d142ffd2aade370300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e51d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610b000000010000001200000056006500720069005300690067006e0000001400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af33313353000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b060105050703030f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c92000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a	Origin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5	Origin.exe

Suspicious behavior: AddClipboardFormatListener 6 IoCs

pid	Process
1540	OriginThinSetupInternal.exe
108	OriginThinSetupInternal.exe
2028	Origin.exe
664	OriginClientService.exe
1020	OriginClientService.exe
2624	EALink.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1368	OriginThinSetup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe
1328	Setup.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
1540	OriginThinSetupInternal.exe
2028	Origin.exe
2624	EALink.exe
1076	perfmon.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1368	OriginThinSetup.exe
Token: SeIncBasePriorityPrivilege	1328	Setup.exe
Token: SeDebugPrivilege	1328	Setup.exe
Token: SeDebugPrivilege	1328	Setup.exe
Token: SeIncBasePriorityPrivilege	1844	Origin.exe
Token: SeIncBasePriorityPrivilege	288	Origin.exe
Token: SeIncBasePriorityPrivilege	1316	Origin.exe
Token: SeIncBasePriorityPrivilege	1972	Origin.exe
Token: SeIncBasePriorityPrivilege	940	Origin.exe
Token: SeIncBasePriorityPrivilege	380	Origin.exe
Token: 33	1712	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1712	AUDIODG.EXE
Token: 33	1712	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1712	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1084	Origin.exe
Token: SeIncBasePriorityPrivilege	1540	OriginThinSetupInternal.exe
Token: SeIncBasePriorityPrivilege	108	OriginThinSetupInternal.exe
Token: SeIncBasePriorityPrivilege	984	OriginClientService.exe
Token: SeIncBasePriorityPrivilege	2024	OriginWebHelperService.exe
Token: SeIncBasePriorityPrivilege	2028	Origin.exe
Token: SeIncBasePriorityPrivilege	2028	Origin.exe
Token: SeIncBasePriorityPrivilege	2028	Origin.exe
Token: SeIncBasePriorityPrivilege	1616	Origin.exe
Token: SeIncBasePriorityPrivilege	664	OriginClientService.exe
Token: SeIncBasePriorityPrivilege	1984	OriginWebHelperService.exe
Token: SeIncBasePriorityPrivilege	1020	OriginClientService.exe
Token: SeIncBasePriorityPrivilege	2624	EALink.exe
Token: SeDebugPrivilege	2240	taskmgr.exe
Token: SeDebugPrivilege	1076	perfmon.exe
Token: SeSystemProfilePrivilege	1076	perfmon.exe
Token: SeCreateGlobalPrivilege	1076	perfmon.exe
Token: 33	1076	perfmon.exe
Token: SeIncBasePriorityPrivilege	1076	perfmon.exe
Token: SeIncBasePriorityPrivilege	2772	Origin.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
1684	iexplore.exe
1684	iexplore.exe
2028	Origin.exe
2028	Origin.exe
2028	Origin.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe

Suspicious use of SendNotifyMessage 51 IoCs

pid	Process
2028	Origin.exe
2028	Origin.exe
2028	Origin.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe
2240	taskmgr.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1316	Origin.exe
1316	Origin.exe
1684	iexplore.exe
1684	iexplore.exe
1524	IEXPLORE.EXE
1524	IEXPLORE.EXE
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
108	OriginThinSetupInternal.exe
108	OriginThinSetupInternal.exe
108	OriginThinSetupInternal.exe
108	OriginThinSetupInternal.exe
108	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
1540	OriginThinSetupInternal.exe
2028	Origin.exe
2028	Origin.exe
2028	Origin.exe
664	OriginClientService.exe
2028	Origin.exe
2028	Origin.exe
2028	Origin.exe
2028	Origin.exe
2028	Origin.exe
2028	Origin.exe
2028	Origin.exe
2028	Origin.exe
2028	Origin.exe
2028	Origin.exe
2028	Origin.exe
2028	Origin.exe
2028	Origin.exe
2028	Origin.exe
2028	Origin.exe
2028	Origin.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 1328	1368	OriginThinSetup.exe	26
PID 1368 wrote to memory of 1328	1368	OriginThinSetup.exe	26
PID 1368 wrote to memory of 1328	1368	OriginThinSetup.exe	26
PID 1368 wrote to memory of 1328	1368	OriginThinSetup.exe	26
PID 1368 wrote to memory of 1328	1368	OriginThinSetup.exe	26
PID 1368 wrote to memory of 1328	1368	OriginThinSetup.exe	26
PID 1368 wrote to memory of 1328	1368	OriginThinSetup.exe	26
PID 1328 wrote to memory of 1844	1328	Setup.exe	28
PID 1328 wrote to memory of 1844	1328	Setup.exe	28
PID 1328 wrote to memory of 1844	1328	Setup.exe	28
PID 1328 wrote to memory of 1844	1328	Setup.exe	28
PID 1328 wrote to memory of 288	1328	Setup.exe	29
PID 1328 wrote to memory of 288	1328	Setup.exe	29
PID 1328 wrote to memory of 288	1328	Setup.exe	29
PID 1328 wrote to memory of 288	1328	Setup.exe	29
PID 1368 wrote to memory of 1316	1368	OriginThinSetup.exe	30
PID 1368 wrote to memory of 1316	1368	OriginThinSetup.exe	30
PID 1368 wrote to memory of 1316	1368	OriginThinSetup.exe	30
PID 1368 wrote to memory of 1316	1368	OriginThinSetup.exe	30
PID 1084 wrote to memory of 1684	1084	Origin.exe	40
PID 1084 wrote to memory of 1684	1084	Origin.exe	40
PID 1084 wrote to memory of 1684	1084	Origin.exe	40
PID 1084 wrote to memory of 1684	1084	Origin.exe	40
PID 1684 wrote to memory of 1524	1684	iexplore.exe	41
PID 1684 wrote to memory of 1524	1684	iexplore.exe	41
PID 1684 wrote to memory of 1524	1684	iexplore.exe	41
PID 1684 wrote to memory of 1524	1684	iexplore.exe	41
PID 1684 wrote to memory of 1768	1684	iexplore.exe	43
PID 1684 wrote to memory of 1768	1684	iexplore.exe	43
PID 1684 wrote to memory of 1768	1684	iexplore.exe	43
PID 1684 wrote to memory of 1768	1684	iexplore.exe	43
PID 1684 wrote to memory of 1768	1684	iexplore.exe	43
PID 1684 wrote to memory of 1768	1684	iexplore.exe	43
PID 1684 wrote to memory of 1768	1684	iexplore.exe	43
PID 1768 wrote to memory of 1540	1768	OriginSetup.exe	44
PID 1768 wrote to memory of 1540	1768	OriginSetup.exe	44
PID 1768 wrote to memory of 1540	1768	OriginSetup.exe	44
PID 1768 wrote to memory of 1540	1768	OriginSetup.exe	44
PID 1768 wrote to memory of 1540	1768	OriginSetup.exe	44
PID 1768 wrote to memory of 1540	1768	OriginSetup.exe	44
PID 1768 wrote to memory of 1540	1768	OriginSetup.exe	44
PID 1540 wrote to memory of 1752	1540	OriginThinSetupInternal.exe	46
PID 1540 wrote to memory of 1752	1540	OriginThinSetupInternal.exe	46
PID 1540 wrote to memory of 1752	1540	OriginThinSetupInternal.exe	46
PID 1540 wrote to memory of 1752	1540	OriginThinSetupInternal.exe	46
PID 1540 wrote to memory of 616	1540	OriginThinSetupInternal.exe	47
PID 1540 wrote to memory of 616	1540	OriginThinSetupInternal.exe	47
PID 1540 wrote to memory of 616	1540	OriginThinSetupInternal.exe	47
PID 1540 wrote to memory of 616	1540	OriginThinSetupInternal.exe	47
PID 1540 wrote to memory of 908	1540	OriginThinSetupInternal.exe	48
PID 1540 wrote to memory of 908	1540	OriginThinSetupInternal.exe	48
PID 1540 wrote to memory of 908	1540	OriginThinSetupInternal.exe	48
PID 1540 wrote to memory of 908	1540	OriginThinSetupInternal.exe	48
PID 1540 wrote to memory of 108	1540	OriginThinSetupInternal.exe	49
PID 1540 wrote to memory of 108	1540	OriginThinSetupInternal.exe	49
PID 1540 wrote to memory of 108	1540	OriginThinSetupInternal.exe	49
PID 1540 wrote to memory of 108	1540	OriginThinSetupInternal.exe	49
PID 1540 wrote to memory of 108	1540	OriginThinSetupInternal.exe	49
PID 1540 wrote to memory of 108	1540	OriginThinSetupInternal.exe	49
PID 1540 wrote to memory of 108	1540	OriginThinSetupInternal.exe	49
PID 108 wrote to memory of 760	108	OriginThinSetupInternal.exe	50
PID 108 wrote to memory of 760	108	OriginThinSetupInternal.exe	50
PID 108 wrote to memory of 760	108	OriginThinSetupInternal.exe	50
PID 108 wrote to memory of 760	108	OriginThinSetupInternal.exe	50

C:\Users\Admin\AppData\Local\Temp\OriginThinSetup.exe
"C:\Users\Admin\AppData\Local\Temp\OriginThinSetup.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Users\Admin\AppData\Local\Temp\Origin\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Origin\Setup.exe" /launcherTime=7105689
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1328
- - C:\Program Files (x86)\Origin\Origin.exe
    "C:\Program Files (x86)\Origin\Origin.exe" /Register
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:1844
- - C:\Program Files (x86)\Origin\Origin.exe
    "C:\Program Files (x86)\Origin\Origin.exe" /SetAutoStart
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    PID:288
- C:\Program Files (x86)\Origin\Origin.exe
  "C:\Program Files (x86)\Origin\Origin.exe" /AutoUpdate /TelemOO /Installing
  2⤵
  - Executes dropped EXE
  - Modifies Internet Explorer settings
  - Modifies system certificate store
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1316

C:\Program Files (x86)\Origin\Origin.exe
"C:\Program Files (x86)\Origin\Origin.exe"
1⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:1972

C:\Program Files (x86)\Origin\Origin.exe
"C:\Program Files (x86)\Origin\Origin.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:940

C:\Program Files (x86)\Origin\Origin.exe
"C:\Program Files (x86)\Origin\Origin.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:380

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x44c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1712

C:\Program Files (x86)\Origin\Origin.exe
"C:\Program Files (x86)\Origin\Origin.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" https://download.dm.origin.com/origin/live/OriginSetup.exe
  2⤵
  - Modifies Internet Explorer Phishing Filter
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1684 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1524
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MK8YK3QV\OriginSetup.exe
    "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MK8YK3QV\OriginSetup.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1768
  - - C:\Users\Admin\AppData\Local\Origin\ThinSetup\10.5.116.52126\OriginThinSetupInternal.exe
      "C:\Users\Admin\AppData\Local\Origin\ThinSetup\10.5.116.52126\OriginThinSetupInternal.exe" "/UseStagedUpdate" "/timing:4196"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Loads dropped DLL
      Adds Run key to start application
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1540
    - - C:\Users\Admin\AppData\Local\Origin\ThinSetup\10.5.116.52126\QtWebEngineProcess.exe
        
        "C:\Users\Admin\AppData\Local\Origin\ThinSetup\10.5.116.52126\QtWebEngineProcess.exe" --type=renderer --disable-accelerated-video-decode --disable-gpu-memory-buffer-video-frames --enable-threaded-compositing --no-sandbox --disable-webrtc-hw-encoding --primordial-pipe-token=CD93864347A5222174C736304A29E8C7 --lang=en-US --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --disable-gpu-compositing --mojo-channel-token=7804E7647542C298D90678F1C58F0117 --mojo-application-channel-token=CD93864347A5222174C736304A29E8C7 --channel="1540.0.364620210\1625329368" --mojo-platform-channel-handle=1692 /prefetch:1
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1752
    - - C:\Users\Admin\AppData\Local\Origin\ThinSetup\10.5.116.52126\QtWebEngineProcess.exe
        
        "C:\Users\Admin\AppData\Local\Origin\ThinSetup\10.5.116.52126\QtWebEngineProcess.exe" --type=renderer --disable-accelerated-video-decode --disable-gpu-memory-buffer-video-frames --enable-threaded-compositing --no-sandbox --disable-webrtc-hw-encoding --primordial-pipe-token=D0312C643949EA0518BA2FADF970985D --lang=en-US --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --disable-gpu-compositing --mojo-channel-token=67CDEC18DB591B0BBB448617A4F17490 --mojo-application-channel-token=D0312C643949EA0518BA2FADF970985D --channel="1540.1.1470691495\1305742853" --mojo-platform-channel-handle=1728 /prefetch:1
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:616
    - - C:\Users\Admin\AppData\Local\Origin\ThinSetup\10.5.116.52126\QtWebEngineProcess.exe
        
        "C:\Users\Admin\AppData\Local\Origin\ThinSetup\10.5.116.52126\QtWebEngineProcess.exe" --type=renderer --disable-accelerated-video-decode --disable-gpu-memory-buffer-video-frames --enable-threaded-compositing --no-sandbox --disable-webrtc-hw-encoding --primordial-pipe-token=DCB2D450F48B3FE04E3E4D42B8038BF6 --lang=en-US --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --disable-gpu-compositing --mojo-channel-token=59A8677FF180BA319A480E78BC68E202 --mojo-application-channel-token=DCB2D450F48B3FE04E3E4D42B8038BF6 --channel="1540.2.592148446\411757177" --mojo-platform-channel-handle=2492 /prefetch:1
        5⤵
        Executes dropped EXE
        
        PID:908
    - - C:\Users\Admin\AppData\Local\Origin\ThinSetup\10.5.116.52126\OriginThinSetupInternal.exe
        
        "C:\Users\Admin\AppData\Local\Origin\ThinSetup\10.5.116.52126\OriginThinSetupInternal.exe" /Elevated "/InstallPath:C:\Program Files (x86)\Origin" /locale:en_US /Version:10.5.116.52126 /DesktopShortcut:true /StartShortcut:true /Autostart:true /Autopatch:true /Autoupdate:true /TelemOO:false /Beta:true /IsBetaBuild:false
        5⤵
        Executes dropped EXE
        Checks computer location settings
        Drops file in Program Files directory
        Modifies registry class
        Suspicious behavior: AddClipboardFormatListener
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:108
      - C:\Program Files (x86)\Origin\legacyPM\OriginLegacyCLI.exe
        
        "C:\Program Files (x86)\Origin\legacyPM\OriginLegacyCLI.exe" -register
        6⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:760
      - C:\Program Files (x86)\Origin\OriginClientService.exe
        
        "C:\Program Files (x86)\Origin\OriginClientService.exe" /nsisinstall
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:984
      - C:\Program Files (x86)\Origin\OriginWebHelperService.exe
        
        "C:\Program Files (x86)\Origin\OriginWebHelperService.exe" /nsisinstall
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2024
    - - C:\Program Files (x86)\Origin\Origin.exe
        
        "C:\Program Files (x86)\Origin\Origin.exe" /noUpdate /timing:4196 /Installed:10.5.116.52126
        5⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks computer location settings
        Suspicious behavior: AddClipboardFormatListener
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:2028
      - C:\Program Files (x86)\Origin\legacyPM\OriginLegacyCLI.exe
        
        "C:\Program Files (x86)\Origin\legacyPM\OriginLegacyCLI.exe" -register
        6⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:652
      - C:\Program Files (x86)\Origin\IGOProxy.exe
        
        "C:\Program Files (x86)\Origin\IGOProxy.exe" -L DX11 -V
        6⤵
        Executes dropped EXE
        
        PID:1352
      - C:\Program Files (x86)\Origin\QtWebEngineProcess.exe
        
        "C:\Program Files (x86)\Origin\QtWebEngineProcess.exe" --type=renderer --disable-accelerated-video-decode --disable-gpu-memory-buffer-video-frames --enable-threaded-compositing --no-sandbox --disable-webrtc-hw-encoding --primordial-pipe-token=A50ACAB917259BCAB3214C61536A26B8 --lang=en-US --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --disable-gpu-compositing --mojo-channel-token=AF7467E297D2E6EB0C12C4FAFB9DF580 --mojo-application-channel-token=A50ACAB917259BCAB3214C61536A26B8 --channel="2028.0.2114687803\420127413" --mojo-platform-channel-handle=2656 /prefetch:1
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:1536
      - C:\Program Files (x86)\Origin\QtWebEngineProcess.exe
        
        "C:\Program Files (x86)\Origin\QtWebEngineProcess.exe" --type=renderer --disable-accelerated-video-decode --disable-gpu-memory-buffer-video-frames --enable-threaded-compositing --no-sandbox --disable-webrtc-hw-encoding --primordial-pipe-token=15DCD40833382023D2BFFA4717302301 --lang=en-US --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --disable-gpu-compositing --mojo-channel-token=DCBD942E6581CE4E0FD5FD0486CA1D63 --mojo-application-channel-token=15DCD40833382023D2BFFA4717302301 --channel="2028.1.1508981480\261537813" --mojo-platform-channel-handle=2668 /prefetch:1
        6⤵
        Executes dropped EXE
        
        PID:1748
      - C:\Program Files (x86)\Origin\IGOProxy.exe
        
        "C:\Program Files (x86)\Origin\IGOProxy.exe" -L DX12 -V
        6⤵
        Executes dropped EXE
        
        PID:1028
      - C:\Program Files (x86)\Origin\IGOProxy.exe
        
        "C:\Program Files (x86)\Origin\IGOProxy.exe" -L DX10 -V
        6⤵
        Executes dropped EXE
        
        PID:2080
      - C:\Program Files (x86)\Origin\IGOProxy.exe
        
        "C:\Program Files (x86)\Origin\IGOProxy.exe" -L DX8 -V
        6⤵
        Executes dropped EXE
        
        PID:2128
      - C:\Program Files (x86)\Origin\IGOProxy.exe
        
        "C:\Program Files (x86)\Origin\IGOProxy.exe" -L DX9 -V
        6⤵
        Executes dropped EXE
        
        PID:2168
      - C:\Program Files (x86)\Origin\IGOProxy64.exe
        
        "C:\Program Files (x86)\Origin\IGOProxy64.exe" -L DX11 -V
        6⤵
        Executes dropped EXE
        
        PID:2188
      - C:\Program Files (x86)\Origin\IGOProxy64.exe
        
        "C:\Program Files (x86)\Origin\IGOProxy64.exe" -L DX12 -V
        6⤵
        Executes dropped EXE
        
        PID:2212
      - C:\Program Files (x86)\Origin\IGOProxy64.exe
        
        "C:\Program Files (x86)\Origin\IGOProxy64.exe" -L DX10 -V
        6⤵
        Executes dropped EXE
        
        PID:2232
      - C:\Program Files (x86)\Origin\IGOProxy64.exe
        
        "C:\Program Files (x86)\Origin\IGOProxy64.exe" -L DX9 -V
        6⤵
        Executes dropped EXE
        
        PID:2256
      - C:\Program Files (x86)\Origin\QtWebEngineProcess.exe
        
        "C:\Program Files (x86)\Origin\QtWebEngineProcess.exe" --type=renderer --disable-accelerated-video-decode --disable-gpu-memory-buffer-video-frames --enable-threaded-compositing --no-sandbox --disable-webrtc-hw-encoding --primordial-pipe-token=67889F8A071E65E42369B0B5C347D8A5 --lang=en-US --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --disable-gpu-compositing --mojo-channel-token=C8253A292ED194F16DBDD4854256A376 --mojo-application-channel-token=67889F8A071E65E42369B0B5C347D8A5 --channel="2028.2.760865901\254207385" --mojo-platform-channel-handle=4184 /prefetch:1
        6⤵
        Executes dropped EXE
        
        PID:2292
      - C:\Program Files (x86)\Origin\QtWebEngineProcess.exe
        
        "C:\Program Files (x86)\Origin\QtWebEngineProcess.exe" --type=renderer --disable-accelerated-video-decode --disable-gpu-memory-buffer-video-frames --enable-threaded-compositing --no-sandbox --disable-webrtc-hw-encoding --primordial-pipe-token=791385460C5D77715A35294501C2BBFC --lang=en-US --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --disable-gpu-compositing --mojo-channel-token=8580FE4B719AE2F8AAA27E72351724DC --mojo-application-channel-token=791385460C5D77715A35294501C2BBFC --channel="2028.3.499061570\1021429398" --mojo-platform-channel-handle=4448 /prefetch:1
        6⤵
        Executes dropped EXE
        
        PID:2356
      - C:\Program Files (x86)\Origin\QtWebEngineProcess.exe
        
        "C:\Program Files (x86)\Origin\QtWebEngineProcess.exe" --type=renderer --disable-accelerated-video-decode --disable-gpu-memory-buffer-video-frames --enable-threaded-compositing --no-sandbox --disable-webrtc-hw-encoding --primordial-pipe-token=554E70FD3B41993AD226BCDAD87EF3C4 --lang=en-US --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --disable-gpu-compositing --mojo-channel-token=F37C5E009D64AB53F25B8BB0CC822614 --mojo-application-channel-token=554E70FD3B41993AD226BCDAD87EF3C4 --channel="2028.4.1738240883\1442499789" --mojo-platform-channel-handle=4784 /prefetch:1
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:2420
      - C:\Program Files (x86)\Origin\QtWebEngineProcess.exe
        
        "C:\Program Files (x86)\Origin\QtWebEngineProcess.exe" --type=renderer --disable-accelerated-video-decode --disable-gpu-memory-buffer-video-frames --enable-threaded-compositing --no-sandbox --disable-webrtc-hw-encoding --primordial-pipe-token=0F9C1400B8AED912E1FF40BB8432763C --lang=en-US --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --disable-gpu-compositing --mojo-channel-token=1E410DC97FD9E59B547AF3DE89FC5AC5 --mojo-application-channel-token=0F9C1400B8AED912E1FF40BB8432763C --channel="2028.5.256873505\1217548189" --mojo-platform-channel-handle=4000 /prefetch:1
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:2480
      - C:\Program Files (x86)\Origin\QtWebEngineProcess.exe
        
        "C:\Program Files (x86)\Origin\QtWebEngineProcess.exe" --type=renderer --disable-accelerated-video-decode --disable-gpu-memory-buffer-video-frames --enable-threaded-compositing --no-sandbox --disable-webrtc-hw-encoding --primordial-pipe-token=C59F26F721C95487EE16E29573DAA052 --lang=en-US --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --disable-gpu-compositing --mojo-channel-token=847A3C07B5C0EEEDE46A461DBD4CEE01 --mojo-application-channel-token=C59F26F721C95487EE16E29573DAA052 --channel="2028.6.321824053\763246851" --mojo-platform-channel-handle=2892 /prefetch:1
        6⤵
        Executes dropped EXE
        
        PID:2556
      - C:\Program Files (x86)\Origin\QtWebEngineProcess.exe
        
        "C:\Program Files (x86)\Origin\QtWebEngineProcess.exe" --type=renderer --disable-accelerated-video-decode --disable-gpu-memory-buffer-video-frames --enable-threaded-compositing --no-sandbox --disable-webrtc-hw-encoding --primordial-pipe-token=05C696E2250FC7F29B8DAEC0BDBD0731 --lang=en-US --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --disable-gpu-compositing --mojo-channel-token=6F77CC08A5AC0E2F607C2AB1ACBCBCB0 --mojo-application-channel-token=05C696E2250FC7F29B8DAEC0BDBD0731 --channel="2028.7.745081656\423467600" --mojo-platform-channel-handle=4148 /prefetch:1
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:2616
      - C:\Program Files (x86)\Origin\QtWebEngineProcess.exe
        
        "C:\Program Files (x86)\Origin\QtWebEngineProcess.exe" --type=renderer --disable-accelerated-video-decode --disable-gpu-memory-buffer-video-frames --enable-threaded-compositing --no-sandbox --disable-webrtc-hw-encoding --primordial-pipe-token=FB4FD1288F0A247298A9700441F828FA --lang=en-US --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --disable-gpu-compositing --mojo-channel-token=2BEAC1B13044E714C4578DA348DCAD78 --mojo-application-channel-token=FB4FD1288F0A247298A9700441F828FA --channel="2028.8.1542728134\1144063338" --mojo-platform-channel-handle=1560 /prefetch:1
        6⤵
        Executes dropped EXE
        
        PID:2680
      - C:\Program Files (x86)\Origin\QtWebEngineProcess.exe
        
        "C:\Program Files (x86)\Origin\QtWebEngineProcess.exe" --type=renderer --disable-accelerated-video-decode --disable-gpu-memory-buffer-video-frames --enable-threaded-compositing --no-sandbox --disable-webrtc-hw-encoding --primordial-pipe-token=EC0C937B866D07CFFBFBB02F0D6A4160 --lang=en-US --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --disable-gpu-compositing --mojo-channel-token=1C5AF18EBD1E8D6B8CBDE081ACAB4439 --mojo-application-channel-token=EC0C937B866D07CFFBFBB02F0D6A4160 --channel="2028.9.189538292\530973672" --mojo-platform-channel-handle=1340 /prefetch:1
        6⤵
        Executes dropped EXE
        
        PID:2756
      - C:\Program Files (x86)\Origin\QtWebEngineProcess.exe
        
        "C:\Program Files (x86)\Origin\QtWebEngineProcess.exe" --type=renderer --disable-accelerated-video-decode --disable-gpu-memory-buffer-video-frames --enable-threaded-compositing --no-sandbox --disable-webrtc-hw-encoding --primordial-pipe-token=CBE145B1943AF84836B0252AFA76AFDD --lang=en-US --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --disable-gpu-compositing --mojo-channel-token=0D4C01A0FB1547018A6D8CAC5091EBCF --mojo-application-channel-token=CBE145B1943AF84836B0252AFA76AFDD --channel="2028.10.1541409913\410265843" --mojo-platform-channel-handle=1724 /prefetch:1
        6⤵
        Executes dropped EXE
        
        PID:2820
      - C:\Program Files (x86)\Origin\QtWebEngineProcess.exe
        
        "C:\Program Files (x86)\Origin\QtWebEngineProcess.exe" --type=renderer --disable-accelerated-video-decode --disable-gpu-memory-buffer-video-frames --enable-threaded-compositing --no-sandbox --disable-webrtc-hw-encoding --primordial-pipe-token=3D81CB2F3347E35CF67EADE0BD4AA406 --lang=en-US --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --disable-gpu-compositing --mojo-channel-token=D8EABD860B8030AA1FB43EFEEA6F9841 --mojo-application-channel-token=3D81CB2F3347E35CF67EADE0BD4AA406 --channel="2028.12.1007995241\2048014477" --mojo-platform-channel-handle=5260 /prefetch:1
        6⤵
        Executes dropped EXE
        
        PID:2908
      - C:\Program Files (x86)\Origin\QtWebEngineProcess.exe
        
        "C:\Program Files (x86)\Origin\QtWebEngineProcess.exe" --type=renderer --disable-accelerated-video-decode --disable-gpu-memory-buffer-video-frames --enable-threaded-compositing --no-sandbox --disable-webrtc-hw-encoding --primordial-pipe-token=B4EB4B27E52B28FCD892C909723726D1 --lang=en-US --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --disable-gpu-compositing --mojo-channel-token=047AE53E0FAB251DAF9AB48549379F3F --mojo-application-channel-token=B4EB4B27E52B28FCD892C909723726D1 --channel="2028.13.1713692211\2031795801" --mojo-platform-channel-handle=6612 /prefetch:1
        6⤵
        Executes dropped EXE
        
        PID:2924
      - C:\Program Files (x86)\Origin\QtWebEngineProcess.exe
        
        "C:\Program Files (x86)\Origin\QtWebEngineProcess.exe" --type=renderer --disable-accelerated-video-decode --disable-gpu-memory-buffer-video-frames --enable-threaded-compositing --no-sandbox --disable-webrtc-hw-encoding --primordial-pipe-token=EC4E60893232EE10AD03529EFA211657 --lang=en-US --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --disable-gpu-compositing --mojo-channel-token=1C5BA3A8702C98177958CA0BB6AB11B2 --mojo-application-channel-token=EC4E60893232EE10AD03529EFA211657 --channel="2028.14.490231806\1053434605" --mojo-platform-channel-handle=6624 /prefetch:1
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:2936
      - C:\Program Files (x86)\Origin\QtWebEngineProcess.exe
        
        "C:\Program Files (x86)\Origin\QtWebEngineProcess.exe" --type=renderer --disable-accelerated-video-decode --disable-gpu-memory-buffer-video-frames --enable-threaded-compositing --no-sandbox --disable-webrtc-hw-encoding --primordial-pipe-token=C04297A877F6C4938F8A1977DBD20E59 --lang=en-US --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --disable-gpu-compositing --mojo-channel-token=9F39BF9A59FED1555EAE329077698C29 --mojo-application-channel-token=C04297A877F6C4938F8A1977DBD20E59 --channel="2028.11.515941351\1945101890" --mojo-platform-channel-handle=6580 /prefetch:1
        6⤵
        Executes dropped EXE
        
        PID:2896

C:\Program Files (x86)\Origin\Origin.exe
"C:\Program Files (x86)\Origin\Origin.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1616

C:\Program Files (x86)\Origin\OriginClientService.exe
"C:\Program Files (x86)\Origin\OriginClientService.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:664

C:\Program Files (x86)\Origin\OriginWebHelperService.exe
"C:\Program Files (x86)\Origin\OriginWebHelperService.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1984

C:\Program Files (x86)\Origin\OriginClientService.exe
"C:\Program Files (x86)\Origin\OriginClientService.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
PID:1020

C:\Program Files (x86)\Origin\EALink.exe
"C:\Program Files (x86)\Origin\EALink.exe"
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks computer location settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2624

C:\Program Files (x86)\Origin\legacyPM\MessageDlg.exe
"C:\Program Files (x86)\Origin\legacyPM\MessageDlg.exe"
1⤵
- Executes dropped EXE
PID:1992
- C:\PROGRA~2\Origin\legacyPM\EACoreServer.exe
  "C:\PROGRA~2\Origin\legacyPM\EACoreServer.exe" -CoreServerId="Admin::DMLEGACY"
  2⤵
  - Executes dropped EXE
  PID:1168

C:\Program Files (x86)\Origin\legacyPM\OriginLegacyCLI.exe
"C:\Program Files (x86)\Origin\legacyPM\OriginLegacyCLI.exe"
1⤵
- Executes dropped EXE
PID:2928

C:\Program Files (x86)\Origin\legacyPM\PatchProgress.exe
"C:\Program Files (x86)\Origin\legacyPM\PatchProgress.exe"
1⤵
- Executes dropped EXE
PID:2140

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2240
- C:\Windows\System32\perfmon.exe
  "C:\Windows\System32\perfmon.exe" /res
  2⤵
  - Checks processor information in registry
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:1076

C:\Program Files (x86)\Origin\legacyPM\EAProxyInstaller.exe
"C:\Program Files (x86)\Origin\legacyPM\EAProxyInstaller.exe"
1⤵
- Executes dropped EXE
PID:3048

C:\Program Files (x86)\Origin\legacyPM\EACoreServer.exe
"C:\Program Files (x86)\Origin\legacyPM\EACoreServer.exe"
1⤵
- Executes dropped EXE
PID:2596

C:\Program Files (x86)\Origin\Origin.exe
"C:\Program Files (x86)\Origin\Origin.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2772

C:\Program Files (x86)\Origin\OriginER.exe
"C:\Program Files (x86)\Origin\OriginER.exe"
1⤵
- Executes dropped EXE
PID:1768

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

System Information Discovery