151882993d9e1330dd39ad495ede37d811ccb3b441ac3ddd73a74ab20031084d

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}	installer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}\NoExplorer = "1"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}	installer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\NoExplorer = "1"	installer.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\WindowsAccessBridge-64.dll	installer.exe
File created	C:\Windows\SysWOW64\WindowsAccessBridge-32.dll	installer.exe
File opened for modification	C:\Windows\SysWOW64\WindowsAccessBridge-32.dll	installer.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Java\jre1.8.0_361\lib\calendars.properties	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\bin\bci.dll	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\lib\tzmappings	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\legal\javafx\directshow.md	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\bin\sunmscapi.dll	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\lib\management\jmxremote.access	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\lib\ext\nashorn.jar	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\bin\t2k.dll	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\bin\plugin2\msvcp140.dll	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\lib\deploy\messages_it.properties	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\legal\javafx\icu_web.md	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\bin\jfxwebkit.dll	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\lib\plugin.jar	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\bin\fontmanager.dll	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\bin\api-ms-win-core-handle-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\bin\api-ms-win-core-rtlsupport-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\bin\hprof.dll	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\bin\dtplugin\npdeployJava1.dll	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\legal\jdk\lcms.md	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\bin\dt_shmem.dll	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\legal\jdk\cldr.md	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\lib\security\java.security	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\lib\accessibility.properties	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\bin\jp2ssv.dll	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\lib\fonts\LucidaTypewriterBold.ttf	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\lib\currency.data	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\bin\kinit.exe	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\lib\security\policy\limited\local_policy.jar	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\bin\API-MS-Win-core-xstate-l2-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\bin\jpeg.dll	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\lib\ext\cldrdata.jar	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\bin\jp2native.dll	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\bin\tnameserv.exe	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\lib\deploy\[email protected]	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\legal\jdk\relaxngom.md	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\legal\jdk\santuario.md	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\legal\javafx\jpeg_fx.md	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\lib\security\javaws.policy	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\lib\psfontj2d.properties	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\lib\logging.properties	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\bin\client\classes.jsa	javaw.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\bin\api-ms-win-core-processthreads-l1-1-1.dll	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\lib\javafx.properties	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\lib\images\cursors\invalid32x32.gif	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\bin\api-ms-win-crt-environment-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\bin\api-ms-win-core-memory-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\lib\meta-index	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\lib\cmm\CIEXYZ.pf	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\THIRDPARTYLICENSEREADME-JAVAFX.txt	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\legal\javafx\public_suffix.md	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\bin\ucrtbase.dll	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\legal\jdk\jpeg.md	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\legal\jdk\relaxngdatatype.md	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\bin\api-ms-win-core-synch-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\bin\awt.dll	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\lib\charsets.jar	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\bin\api-ms-win-core-console-l1-2-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\lib\rt.jar	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\lib\content-types.properties	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\lib\images\cursors\win32_LinkNoDrop32x32.gif	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\bin\api-ms-win-crt-math-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\legal\jdk\cryptix.md	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\lib\deploy\messages_pt_BR.properties	msiexec.exe
File created	C:\Program Files (x86)\Java\jre1.8.0_361\bin\policytool.exe	msiexec.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\Installer\6e17a7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\6e17a7.msi	msiexec.exe
File created	C:\Windows\Installer\6e17a9.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1EAC.tmp	msiexec.exe
File created	C:\Windows\Installer\6e17ab.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1A95.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2310.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI239D.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msiexec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msiexec.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9167671E-7E42-49E1-97FC-4F4712EB4CEE}\Policy = "3"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppName = "javaws.exe"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9167671E-7E42-49E1-97FC-4F4712EB4CEE}\AppName = "jp2launcher.exe"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9167671E-7E42-49E1-97FC-4F4712EB4CEE}\AppPath = "C:\\Program Files (x86)\\Java\\jre1.8.0_361\\bin"	installer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\Policy = "0"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9167671E-7E42-49E1-97FC-4F4712EB4CEE}	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	JavaSetup8u361.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppPath = "C:\\Windows\\SysWOW64"	installer.exe

Modifies data under HKEY_USERS 25 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Java VM	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Environment	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{E19F9331-3110-11D4-991C-005004D3B3DB}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_361\\bin\\jp2iexp.dll"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\EUDC	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{E19F9331-3110-11D4-991C-005004D3B3DB}\InprocServer32	installer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Java VM\EnableJavaConsole = "0"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{E19F9331-3110-11D4-991C-005004D3B3DB}	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{E19F9331-3110-11D4-991C-005004D3B3DB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_361\\bin\\jp2iexp.dll"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Keyboard Layout	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Printers	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\ImageStoreRandomFolder = "gxnris2"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{E19F9331-3110-11D4-991C-005004D3B3DB}\ = "Java Plug-in 1.3.0_02"	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}\ = "Java Plug-in 1.3.0_03"	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}\InprocServer32	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	installer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	installer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	installer.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4EA42A62D9304AC4784BF2238130160F\Version = "134221338"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\JavaWebStart.isInstalled.1.8.0.0\ = "isInstalled Class"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\jnlps	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\APPLICATION/X-JAVA-APPLET	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4EA42A62D9304AC4784BF2238130160F	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4EA42A62D9304AC4784BF2238130160F\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4EA42A62D9304AC4784BF2238130160F\SourceList\Media\1 = "DISK1;1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_361\\bin\\wsdetect.dll"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.jnlp\ = "JNLPFile"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JNLPFile\Shell\Open	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\InProcServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_361\\bin\\ssv.dll"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-java-jnlp-file\Extension = ".jnlp"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\VersionIndependentProgID	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\JavaWebStart.isInstalled.1.8.0.0\CLSID\ = "{5852F5ED-8BF4-11D4-A245-0080C6F74284}"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\InProcServer32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\InProcServer32\ThreadingModel = "Apartment"	installer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4EA42A62D9304AC4784BF2238130160F\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4EA42A62D9304AC4784BF2238130160F\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\LocalLow\\Oracle\\Java\\jre1.8.0_361\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JavaWebStart.isInstalled.1.8.0.0\CLSID	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\ProgID\ = "JavaWebStart.isInstalled.1.8.0.0"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\ = "Java(tm) Plug-In SSV Helper"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4EA42A62D9304AC4784BF2238130160F\SourceList\PackageName = "jre1.8.0_361.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9}\Implemented Categories	installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4EA42A62D9304AC4784BF2238130160F\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Applications\javaw.exe	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\javaw.exe\IsHostApp	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9}\ = "Java(tm) Plug-In 2 SSV Helper"	installer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4EA42A62D9304AC4784BF2238130160F\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\java.exe\IsHostApp	installer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\jarfile\shell\open\command	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.jar\ = "jarfile"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\jnlps\ = "URL:jnlps Protocol"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4EA42A62D9304AC4784BF2238130160F\jrecore	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4EA42A62D9304AC4784BF2238130160F\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9}\InProcServer32\ThreadingModel = "Apartment"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4EA42A62D9304AC4784BF2238130160F\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\MiscStatus\1	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640}	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4EA42A62D9304AC4784BF2238130160F\PackageCode = "981E223E97ADC494296CF3A988577585"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4EA42A62D9304AC4784BF2238130160F\AuthorizedLUAApp = "0"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\JNLPFile	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5852F5E0-8BF4-11D4-A245-0080C6F74284}\1.0\0\win32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_361\\bin\\wsdetect.dll"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\jnlps\Shell\Open	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\JavaWebStart.isInstalled\CurVer\ = "JavaWebStart.isInstalled.1.8.0.0"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E19F9331-3110-11D4-991C-005004D3B3DB}\ = "Java Plug-in 1.3.0_02"	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\APPLICATION/X-JAVA-JNLP-FILE	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\jnlp	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JNLPFile	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\6C5ADB75C34456D42B33823239120800	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4EA42A62D9304AC4784BF2238130160F\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\JavaWebStart.isInstalled\ = "isInstalled Class"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\JavaWebStart.isInstalled\CLSID\ = "{5852F5ED-8BF4-11D4-A245-0080C6F74284}"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\Implemented Categories	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E19F9331-3110-11D4-991C-005004D3B3DB}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JavaWebStart.isInstalled.1.8.0.0	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.JNLP	installer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\JNLPFile\Shell\Open\COMMAND	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\6C5ADB75C34456D42B33823239120800\4EA42A62D9304AC4784BF2238130160F	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640}	installer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4EA42A62D9304AC4784BF2238130160F\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Applications\java.exe	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-java-jnlp-file	installer.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec529030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47409000000010000000c000000300a06082b060105050703011d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c00b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f00740000000f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	LabyMod3_Installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474	LabyMod3_Installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	LabyMod3_Installer.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1316	LabyMod3_Installer.exe
1316	LabyMod3_Installer.exe
1316	LabyMod3_Installer.exe
1004	chrome.exe
676	chrome.exe
676	chrome.exe
2964	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1316	LabyMod3_Installer.exe
Token: SeRestorePrivilege	1316	LabyMod3_Installer.exe
Token: SeBackupPrivilege	1316	LabyMod3_Installer.exe
Token: 33	1616	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1616	AUDIODG.EXE
Token: 33	1616	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1616	AUDIODG.EXE
Token: SeShutdownPrivilege	2100	JavaSetup8u361.exe
Token: SeIncreaseQuotaPrivilege	2100	JavaSetup8u361.exe
Token: SeRestorePrivilege	748	msiexec.exe
Token: SeTakeOwnershipPrivilege	748	msiexec.exe
Token: SeSecurityPrivilege	748	msiexec.exe
Token: SeCreateTokenPrivilege	2100	JavaSetup8u361.exe
Token: SeAssignPrimaryTokenPrivilege	2100	JavaSetup8u361.exe
Token: SeLockMemoryPrivilege	2100	JavaSetup8u361.exe
Token: SeIncreaseQuotaPrivilege	2100	JavaSetup8u361.exe
Token: SeMachineAccountPrivilege	2100	JavaSetup8u361.exe
Token: SeTcbPrivilege	2100	JavaSetup8u361.exe
Token: SeSecurityPrivilege	2100	JavaSetup8u361.exe
Token: SeTakeOwnershipPrivilege	2100	JavaSetup8u361.exe
Token: SeLoadDriverPrivilege	2100	JavaSetup8u361.exe
Token: SeSystemProfilePrivilege	2100	JavaSetup8u361.exe
Token: SeSystemtimePrivilege	2100	JavaSetup8u361.exe
Token: SeProfSingleProcessPrivilege	2100	JavaSetup8u361.exe
Token: SeIncBasePriorityPrivilege	2100	JavaSetup8u361.exe
Token: SeCreatePagefilePrivilege	2100	JavaSetup8u361.exe
Token: SeCreatePermanentPrivilege	2100	JavaSetup8u361.exe
Token: SeBackupPrivilege	2100	JavaSetup8u361.exe
Token: SeRestorePrivilege	2100	JavaSetup8u361.exe
Token: SeShutdownPrivilege	2100	JavaSetup8u361.exe
Token: SeDebugPrivilege	2100	JavaSetup8u361.exe
Token: SeAuditPrivilege	2100	JavaSetup8u361.exe
Token: SeSystemEnvironmentPrivilege	2100	JavaSetup8u361.exe
Token: SeChangeNotifyPrivilege	2100	JavaSetup8u361.exe
Token: SeRemoteShutdownPrivilege	2100	JavaSetup8u361.exe
Token: SeUndockPrivilege	2100	JavaSetup8u361.exe
Token: SeSyncAgentPrivilege	2100	JavaSetup8u361.exe
Token: SeEnableDelegationPrivilege	2100	JavaSetup8u361.exe
Token: SeManageVolumePrivilege	2100	JavaSetup8u361.exe
Token: SeImpersonatePrivilege	2100	JavaSetup8u361.exe
Token: SeCreateGlobalPrivilege	2100	JavaSetup8u361.exe
Token: SeRestorePrivilege	748	msiexec.exe
Token: SeTakeOwnershipPrivilege	748	msiexec.exe
Token: SeRestorePrivilege	748	msiexec.exe
Token: SeTakeOwnershipPrivilege	748	msiexec.exe
Token: SeRestorePrivilege	748	msiexec.exe
Token: SeTakeOwnershipPrivilege	748	msiexec.exe
Token: SeRestorePrivilege	748	msiexec.exe
Token: SeTakeOwnershipPrivilege	748	msiexec.exe
Token: SeRestorePrivilege	748	msiexec.exe
Token: SeTakeOwnershipPrivilege	748	msiexec.exe
Token: SeRestorePrivilege	748	msiexec.exe
Token: SeTakeOwnershipPrivilege	748	msiexec.exe
Token: SeRestorePrivilege	748	msiexec.exe
Token: SeTakeOwnershipPrivilege	748	msiexec.exe
Token: SeRestorePrivilege	748	msiexec.exe
Token: SeTakeOwnershipPrivilege	748	msiexec.exe
Token: SeRestorePrivilege	748	msiexec.exe
Token: SeTakeOwnershipPrivilege	748	msiexec.exe
Token: SeRestorePrivilege	748	msiexec.exe
Token: SeTakeOwnershipPrivilege	748	msiexec.exe
Token: SeRestorePrivilege	748	msiexec.exe
Token: SeTakeOwnershipPrivilege	748	msiexec.exe
Token: SeRestorePrivilege	748	msiexec.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe
676	chrome.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1316	LabyMod3_Installer.exe
1316	LabyMod3_Installer.exe
2100	JavaSetup8u361.exe
2100	JavaSetup8u361.exe
2100	JavaSetup8u361.exe
2100	JavaSetup8u361.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 676 wrote to memory of 548	676	chrome.exe	30
PID 676 wrote to memory of 548	676	chrome.exe	30
PID 676 wrote to memory of 548	676	chrome.exe	30
PID 676 wrote to memory of 1764	676	chrome.exe	31
PID 676 wrote to memory of 1764	676	chrome.exe	31
PID 676 wrote to memory of 1764	676	chrome.exe	31
PID 676 wrote to memory of 1764	676	chrome.exe	31
PID 676 wrote to memory of 1764	676	chrome.exe	31
PID 676 wrote to memory of 1764	676	chrome.exe	31
PID 676 wrote to memory of 1764	676	chrome.exe	31
PID 676 wrote to memory of 1764	676	chrome.exe	31
PID 676 wrote to memory of 1764	676	chrome.exe	31
PID 676 wrote to memory of 1764	676	chrome.exe	31
PID 676 wrote to memory of 1764	676	chrome.exe	31
PID 676 wrote to memory of 1764	676	chrome.exe	31
PID 676 wrote to memory of 1764	676	chrome.exe	31
PID 676 wrote to memory of 1764	676	chrome.exe	31
PID 676 wrote to memory of 1764	676	chrome.exe	31
PID 676 wrote to memory of 1764	676	chrome.exe	31
PID 676 wrote to memory of 1764	676	chrome.exe	31
PID 676 wrote to memory of 1764	676	chrome.exe	31
PID 676 wrote to memory of 1764	676	chrome.exe	31
PID 676 wrote to memory of 1764	676	chrome.exe	31
PID 676 wrote to memory of 1764	676	chrome.exe	31
PID 676 wrote to memory of 1764	676	chrome.exe	31
PID 676 wrote to memory of 1764	676	chrome.exe	31
PID 676 wrote to memory of 1764	676	chrome.exe	31
PID 676 wrote to memory of 1764	676	chrome.exe	31
PID 676 wrote to memory of 1764	676	chrome.exe	31
PID 676 wrote to memory of 1764	676	chrome.exe	31
PID 676 wrote to memory of 1764	676	chrome.exe	31
PID 676 wrote to memory of 1764	676	chrome.exe	31
PID 676 wrote to memory of 1764	676	chrome.exe	31
PID 676 wrote to memory of 1764	676	chrome.exe	31
PID 676 wrote to memory of 1764	676	chrome.exe	31
PID 676 wrote to memory of 1764	676	chrome.exe	31
PID 676 wrote to memory of 1764	676	chrome.exe	31
PID 676 wrote to memory of 1764	676	chrome.exe	31
PID 676 wrote to memory of 1764	676	chrome.exe	31
PID 676 wrote to memory of 1764	676	chrome.exe	31
PID 676 wrote to memory of 1764	676	chrome.exe	31
PID 676 wrote to memory of 1764	676	chrome.exe	31
PID 676 wrote to memory of 1764	676	chrome.exe	31
PID 676 wrote to memory of 1764	676	chrome.exe	31
PID 676 wrote to memory of 1004	676	chrome.exe	32
PID 676 wrote to memory of 1004	676	chrome.exe	32
PID 676 wrote to memory of 1004	676	chrome.exe	32
PID 676 wrote to memory of 1344	676	chrome.exe	33
PID 676 wrote to memory of 1344	676	chrome.exe	33
PID 676 wrote to memory of 1344	676	chrome.exe	33
PID 676 wrote to memory of 1344	676	chrome.exe	33
PID 676 wrote to memory of 1344	676	chrome.exe	33
PID 676 wrote to memory of 1344	676	chrome.exe	33
PID 676 wrote to memory of 1344	676	chrome.exe	33
PID 676 wrote to memory of 1344	676	chrome.exe	33
PID 676 wrote to memory of 1344	676	chrome.exe	33
PID 676 wrote to memory of 1344	676	chrome.exe	33
PID 676 wrote to memory of 1344	676	chrome.exe	33
PID 676 wrote to memory of 1344	676	chrome.exe	33
PID 676 wrote to memory of 1344	676	chrome.exe	33
PID 676 wrote to memory of 1344	676	chrome.exe	33
PID 676 wrote to memory of 1344	676	chrome.exe	33
PID 676 wrote to memory of 1344	676	chrome.exe	33
PID 676 wrote to memory of 1344	676	chrome.exe	33

C:\Users\Admin\AppData\Local\Temp\LabyMod3_Installer.exe
"C:\Users\Admin\AppData\Local\Temp\LabyMod3_Installer.exe"
1⤵
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1316

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6b34f50,0x7fef6b34f60,0x7fef6b34f70
  2⤵
  PID:548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1100,7338141276216240944,18102491549078165200,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1120 /prefetch:2
  2⤵
  PID:1764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1100,7338141276216240944,18102491549078165200,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1248 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1100,7338141276216240944,18102491549078165200,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1820 /prefetch:8
  2⤵
  PID:1344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1100,7338141276216240944,18102491549078165200,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2052 /prefetch:1
  2⤵
  PID:768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1100,7338141276216240944,18102491549078165200,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2008 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1100,7338141276216240944,18102491549078165200,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1100,7338141276216240944,18102491549078165200,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3344 /prefetch:2
  2⤵
  PID:1640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1100,7338141276216240944,18102491549078165200,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=972 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1100,7338141276216240944,18102491549078165200,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3568 /prefetch:8
  2⤵
  PID:2092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1100,7338141276216240944,18102491549078165200,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3684 /prefetch:8
  2⤵
  PID:2100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1100,7338141276216240944,18102491549078165200,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3688 /prefetch:8
  2⤵
  PID:2164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1100,7338141276216240944,18102491549078165200,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3748 /prefetch:8
  2⤵
  PID:2172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1100,7338141276216240944,18102491549078165200,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3736 /prefetch:8
  2⤵
  PID:2180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1100,7338141276216240944,18102491549078165200,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3720 /prefetch:8
  2⤵
  PID:2188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1100,7338141276216240944,18102491549078165200,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3672 /prefetch:8
  2⤵
  PID:2196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1100,7338141276216240944,18102491549078165200,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3752 /prefetch:8
  2⤵
  PID:2204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1100,7338141276216240944,18102491549078165200,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4220 /prefetch:8
  2⤵
  PID:2216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1100,7338141276216240944,18102491549078165200,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4268 /prefetch:8
  2⤵
  PID:2224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1100,7338141276216240944,18102491549078165200,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4328 /prefetch:1
  2⤵
  PID:2464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1100,7338141276216240944,18102491549078165200,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2116 /prefetch:1
  2⤵
  PID:2528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1100,7338141276216240944,18102491549078165200,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3780 /prefetch:1
  2⤵
  PID:2596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1100,7338141276216240944,18102491549078165200,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2444 /prefetch:1
  2⤵
  PID:2632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1100,7338141276216240944,18102491549078165200,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1100,7338141276216240944,18102491549078165200,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4572 /prefetch:1
  2⤵
  PID:2828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1100,7338141276216240944,18102491549078165200,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4904 /prefetch:8
  2⤵
  PID:2892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1100,7338141276216240944,18102491549078165200,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4952 /prefetch:8
  2⤵
  PID:2900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1100,7338141276216240944,18102491549078165200,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5004 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1100,7338141276216240944,18102491549078165200,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5016 /prefetch:8
  2⤵
  PID:3036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1100,7338141276216240944,18102491549078165200,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3688 /prefetch:8
  2⤵
  PID:3028
- C:\Users\Admin\Downloads\JavaSetup8u361.exe
  "C:\Users\Admin\Downloads\JavaSetup8u361.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2104
- - C:\Users\Admin\AppData\Local\Temp\jds7168105.tmp\JavaSetup8u361.exe
    "C:\Users\Admin\AppData\Local\Temp\jds7168105.tmp\JavaSetup8u361.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies Internet Explorer settings
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2100
  - - C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_361\LZMA_EXE
      "C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_361\LZMA_EXE" d "C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_361\au.msi" "C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_361\msi.tmp"
      4⤵
      Executes dropped EXE
      PID:1764
  - - C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_361\LZMA_EXE
      "C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_361\LZMA_EXE" d "C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_361\jre1.8.0_361.msi" "C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_361\msi.tmp"
      4⤵
      Executes dropped EXE
      PID:112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1100,7338141276216240944,18102491549078165200,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1524 /prefetch:8
  2⤵
  PID:2560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1100,7338141276216240944,18102491549078165200,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:2748

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2428

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x560
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1616

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:748
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 51497129E985DCA4533303C11B43B752
  2⤵
  - Loads dropped DLL
  PID:1760
- C:\Program Files (x86)\Java\jre1.8.0_361\installer.exe
  "C:\Program Files (x86)\Java\jre1.8.0_361\installer.exe" /s INSTALLDIR="C:\Program Files (x86)\Java\jre1.8.0_361\\" INSTALL_SILENT=1 REPAIRMODE=0 ProductCode={26A24AE4-039D-4CA4-87B4-2F32180361F0}
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - Drops file in System32 directory
  - Modifies Internet Explorer settings
  - Modifies data under HKEY_USERS
  - Modifies registry class
  PID:2440
- - C:\Program Files (x86)\Java\jre1.8.0_361\bin\javaw.exe
    "C:\Program Files (x86)\Java\jre1.8.0_361\bin\javaw.exe" -Xshare:dump -Djdk.disableLastUsageTracking
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    PID:2420

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery