bazarbackdoor | 96f064469322b8361b430624d9e06885c7244c25341ad5b7b5af266705983a65

Modify Registry

Processes:

ie4uinit.exeie4uinit.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\IsInstalled = "1"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}	ie4uinit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\IsInstalled = "1"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\Locale = "*"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\Version = "11,1081,19041,0"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\Locale = "*"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\Version = "11,1081,19041,0"	ie4uinit.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

MSIDA12.tmpsetup_com.kiloo.subwaysurf_flow6mkt_38903555.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	MSIDA12.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	setup_com.kiloo.subwaysurf_flow6mkt_38903555.exe

Executes dropped EXE 16 IoCs

Processes:

MSIFF19.tmpMSI4469.tmpMSIDA12.tmpsetup_com.kiloo.subwaysurf_flow6mkt_38903555.exesetup_com.kiloo.subwaysurf_flow6mkt_38903555.exesysinfo-app.exeMobiHelper.exesubinacl.exeaeg_launcher.exesubinacl.exeMobiVBoxSVC.exeSUPInstall.exeMobiVBoxSVC.exeNetLwfUninstall.exeUSBUninstall.exeSUPUninstall.exe

pid	process
4692	MSIFF19.tmp
2016	MSI4469.tmp
2268	MSIDA12.tmp
2272	setup_com.kiloo.subwaysurf_flow6mkt_38903555.exe
3204	setup_com.kiloo.subwaysurf_flow6mkt_38903555.exe
4560	sysinfo-app.exe
5784	MobiHelper.exe
5176	subinacl.exe
5420	aeg_launcher.exe
688	subinacl.exe
5440	MobiVBoxSVC.exe
5796	SUPInstall.exe
3476	MobiVBoxSVC.exe
4644	NetLwfUninstall.exe
4948	USBUninstall.exe
6020	SUPUninstall.exe

Loads dropped DLL 64 IoCs

Processes:

MsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exerundll32.exerundll32.exerundll32.exeMsiExec.exeMsiExec.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exe

pid	process
4312	MsiExec.exe
4312	MsiExec.exe
4312	MsiExec.exe
4312	MsiExec.exe
4312	MsiExec.exe
4312	MsiExec.exe
4312	MsiExec.exe
4312	MsiExec.exe
4312	MsiExec.exe
4312	MsiExec.exe
4312	MsiExec.exe
4312	MsiExec.exe
984	MsiExec.exe
984	MsiExec.exe
984	MsiExec.exe
984	MsiExec.exe
984	MsiExec.exe
984	MsiExec.exe
984	MsiExec.exe
2920	MsiExec.exe
2920	MsiExec.exe
2920	MsiExec.exe
2920	MsiExec.exe
2920	MsiExec.exe
2920	MsiExec.exe
2920	MsiExec.exe
1640	MsiExec.exe
1640	MsiExec.exe
1640	MsiExec.exe
1640	MsiExec.exe
1640	MsiExec.exe
1640	MsiExec.exe
1640	MsiExec.exe
4312	MsiExec.exe
4312	MsiExec.exe
4312	MsiExec.exe
4312	MsiExec.exe
4312	MsiExec.exe
4312	MsiExec.exe
5992	MsiExec.exe
5168	rundll32.exe
5992	MsiExec.exe
2300	rundll32.exe
5992	MsiExec.exe
5580	rundll32.exe
5992	MsiExec.exe
5752	MsiExec.exe
5752	MsiExec.exe
5992	MsiExec.exe
5832	MsiExec.exe
2024	rundll32.exe
5832	MsiExec.exe
5412	rundll32.exe
5832	MsiExec.exe
5648	rundll32.exe
5832	MsiExec.exe
2436	rundll32.exe
5832	MsiExec.exe
5892	rundll32.exe
5832	MsiExec.exe
5440	rundll32.exe
5832	MsiExec.exe
5648	rundll32.exe
5832	MsiExec.exe

Registers COM server for autorun 1 TTPs 16 IoCs

persistence

Registry Run Keys / Startup Folder

Processes:

ie4uinit.exeie4uinit.exeregsvr32.exeregsvr32.exeMobiVBoxSVC.exeMobiVBoxSVC.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0002DF01-0000-0000-C000-000000000046}\LocalServer32	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0002DF01-0000-0000-C000-000000000046}\LocalServer32	ie4uinit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c5e220c6-f6c2-11e7-aeb4-080027376349}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c5e220c6-f6c2-11e7-aeb4-080027376349}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c5e220c6-f6c2-11e7-aeb4-080027376349}\InprocServer32\ThreadingModel = "Free"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c5e23f7a-f6c2-11e7-aeb4-080027376349}\InprocServer32\ = "C:\\Program Files\\MobiGame\\vbox\\VBoxC.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c5e23f7a-f6c2-11e7-aeb4-080027376349}\InprocServer32\ThreadingModel = "Free"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c5e23f7a-f6c2-11e7-aeb4-080027376349}\InprocServer32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c5e23f7a-f6c2-11e7-aeb4-080027376349}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c5e1ec0a-f6c2-11e7-aeb4-080027376349}\LocalServer32	MobiVBoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c5e1ec0a-f6c2-11e7-aeb4-080027376349}\LocalServer32\ = "\"C:\\Program Files\\MobiGame\\vbox\\MobiVBoxSVC.exe\""	MobiVBoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c5e220c6-f6c2-11e7-aeb4-080027376349}\InprocServer32\ = "C:\\Program Files\\MobiGame\\vbox\\VBoxC.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c5e23f7a-f6c2-11e7-aeb4-080027376349}\InprocServer32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c5e220c6-f6c2-11e7-aeb4-080027376349}\InprocServer32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c5e1ec0a-f6c2-11e7-aeb4-080027376349}\LocalServer32	MobiVBoxSVC.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c5e1ec0a-f6c2-11e7-aeb4-080027376349}\LocalServer32	MobiVBoxSVC.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Windows\CurrentVersion\Run	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WCUpate = "powershell.exe -WindowStyle Hidden -ExecutionPolicy bypass -c \"& 'C:\\Users\\Admin\\AppData\\Roaming\\BBWC\\updater.exe' /silentall -nofreqcheck\""	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WCStartup = "powershell.exe -ExecutionPolicy bypass -c \"$w=\"$env:APPDATA\"+'/BBWC/'; [Reflection.Assembly]::Load([System.IO.File]::ReadAllBytes($w+'WebCompanion.dll'));[WebCompanion.StartUp]::Start()\""	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WCEUpdater = "powershell.exe -WindowStyle Hidden -ExecutionPolicy bypass -c \"$w='C:\\Users\\Admin\\AppData\\Roaming\\Browser Extension\\updater.exe' & $w /silentall -nofreqcheck\""	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WCEStartup = "powershell.exe -ExecutionPolicy bypass -c \"$w=\"$env:APPDATA\"+'/Browser Extension/';[Reflection.Assembly]::Load([System.IO.File]::ReadAllBytes($w+'BrowserExtension.dll'));[WebCompanion.BrowserExtension.S]::Start()\""	msiexec.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Drops file in Program Files directory 64 IoCs

Processes:

msiexec.exeInstallUtil.exesetup.exe

description	ioc	process
File created	C:\Program Files\MobiGame\playstore\dist\static\js\main.b2a432a1.js	msiexec.exe
File created	C:\Program Files\MobiGame\player\API-MS-Win-core-xstate-l2-1-0.dll	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\System.Collections.Concurrent.dll	msiexec.exe
File created	C:\Program Files\MobiGame\MobiGameUpdater.InstallState	InstallUtil.exe
File created	C:\Program Files\MobiGame\playstore\api-ms-win-core-string-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\MobiGame\player\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230224213926.pma	setup.exe
File created	C:\Program Files\MobiGame\playstore\System.Diagnostics.Contracts.dll	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\System.Security.Cryptography.OpenSsl.dll	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\System.Windows.Extensions.dll	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\System.Console.dll	msiexec.exe
File created	C:\Program Files\MobiGame\vbox\MobiVMMR0.sys	msiexec.exe
File created	C:\Program Files\MobiGame\player\styles\qwindowsvistastyle.dll	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\locales\uk.pak	msiexec.exe
File created	C:\Program Files\MobiGame\vbox\VBoxUSBMon.cat	msiexec.exe
File created	C:\Program Files\MobiGame\player\api-ms-win-crt-runtime-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\chromely.ico	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\createdump.exe	msiexec.exe
File created	C:\Program Files\MobiGame\NetCoreEx.Geometry.dll	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\System.Management.dll	msiexec.exe
File created	C:\Program Files\MobiGame\System.Memory.dll	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\System.Web.HttpUtility.dll	msiexec.exe
File created	C:\Program Files\MobiGame\vbox\drivers\VBoxNetAdp\VBoxNetAdp.sys	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\api-ms-win-core-debug-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\System.IO.Compression.dll	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\System.ValueTuple.dll	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\locales\te.pak	msiexec.exe
File created	C:\Program Files\MobiGame\player\libGLESv2_angle.dll	msiexec.exe
File created	C:\Program Files\MobiGame\player\api-ms-win-core-synch-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\Microsoft.Extensions.FileProviders.Physical.dll	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\NetCoreEx.Geometry.dll	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\System.Diagnostics.Tools.dll	msiexec.exe
File created	C:\Program Files\MobiGame\player\api-ms-win-core-heap-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\MobiGame\vbox\NetFltUninstall.exe	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\dist\static\media\fa-regular-400.a3f7358b4bd2b708c04d.woff2	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\cef_sandbox.lib	msiexec.exe
File created	C:\Program Files\MobiGame\player\libGLESv1_CM_angle.dll	msiexec.exe
File created	C:\Program Files\MobiGame\player\msvcp140_1.dll	msiexec.exe
File created	C:\Program Files\MobiGame\vbox\NetAdp6Install.exe	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\System.ComponentModel.EventBasedAsync.dll	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\System.Security.Cryptography.Csp.dll	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\System.Security.Principal.Windows.dll	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\api-ms-win-core-rtlsupport-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\Playstore.Services.dll	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\System.Reflection.DispatchProxy.dll	msiexec.exe
File created	C:\Program Files\MobiGame\vbox\VBoxDD2.dll	msiexec.exe
File created	C:\Program Files\MobiGame\vbox\VBoxNetAdp.sys	msiexec.exe
File created	C:\Program Files\MobiGame\vbox\NetFltInstall.exe	msiexec.exe
File created	C:\Program Files\MobiGame\player\GLES_V2_translator.dll	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\dist\static\media\ProximaNova-Regular.ea03f826587148b7335d.otf	msiexec.exe
File created	C:\Program Files\MobiGame\player\Qt6Core.dll	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\System.Diagnostics.StackTrace.dll	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\System.Text.RegularExpressions.dll	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\System.Xml.dll	msiexec.exe
File created	C:\Program Files\MobiGame\vbox\certificate\windows_install_cert.cmd	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\dist\static\media\fa-regular-400.be3e8b3fa320d2772c19.svg	msiexec.exe
File created	C:\Program Files\MobiGame\vbox\SDL.dll	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\System.Net.Security.dll	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\System.Net.WebSockets.Client.dll	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\vulkan-1.dll	msiexec.exe
File created	C:\Program Files\MobiGame\vbox\NetLwfInstall.exe	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\api-ms-win-core-sysinfo-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\api-ms-win-crt-stdio-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\MobiGame\Communicator.exe	msiexec.exe

Drops file in Windows directory 64 IoCs

Processes:

rundll32.exerundll32.exerundll32.exemsiexec.exerundll32.exerundll32.exerundll32.exeNetLwfUninstall.exerundll32.exerundll32.exerundll32.exeInstallUtil.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exeInstallUtil.exerundll32.exerundll32.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSI4974.tmp-\VirtualBoxSetup.pdb	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI5CCF.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIB5BF.tmp-\WixSharp.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIDE0E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI35E1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE92B.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIEB6E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8C0.tmp-\WixSharp.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI2B1F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE92B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEB6E.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI8C0.tmp-\VirtualBoxSetup.exe	rundll32.exe
File created	C:\Windows\INF\oem0.PNF	NetLwfUninstall.exe
File opened for modification	C:\Windows\Installer\MSIE561.tmp-\WixSharp.UI.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI5CCF.tmp-\VirtualBoxSetup.pdb	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIB5BF.tmp-\VirtualBoxSetup.exe	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIBD14.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIC2F3.tmp-\VirtualBoxSetup.exe	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIC6FC.tmp-\InstallUtil.InstallLog	InstallUtil.exe
File opened for modification	C:\Windows\Installer\e5adbbb.msi	msiexec.exe
File created	C:\Windows\Installer\e5adbc5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8C0.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI5BD4.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIB5BF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEB6E.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI9F9.tmp	msiexec.exe
File created	C:\Windows\Installer\{0CD5AE2D-BB58-4E35-8B5C-AFE9A8E8AE1A}\app_icon.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF7D2.tmp-\WixSharp.UI.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIE561.tmp-\WixSharp.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI9F9.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIBD14.tmp-\VirtualBoxSetup.exe	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIC0CE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC2F3.tmp-\VirtualBoxSetup.pdb	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIC682.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE561.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI5DCA.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5adbbf.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC5F5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB785.tmp-\VirtualBoxSetup.pdb	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIC3CF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5BD4.tmp-\VirtualBoxSetup.pdb	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIB785.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIBD14.tmp-\VirtualBoxSetup.pdb	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIC6FC.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\{0CD5AE2D-BB58-4E35-8B5C-AFE9A8E8AE1A}\app_icon.ico	msiexec.exe
File created	C:\Windows\Installer\e5adbbb.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9F9.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI5CCF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB785.tmp-\InstallUtil.InstallLog	InstallUtil.exe
File opened for modification	C:\Windows\Installer\MSIC0CE.tmp-\VirtualBoxSetup.pdb	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIF312.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB2C5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC5B5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5DCA.tmp-\WixSharp.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIB5BF.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIC2F3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEE7B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{1873F7B9-BA2B-4E8E-AF7B-EEC7B9090BC7}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{0CD5AE2D-BB58-4E35-8B5C-AFE9A8E8AE1A}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9F9.tmp-\WixSharp.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIC2F3.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIC2F3.tmp-\WixSharp.UI.dll	rundll32.exe

Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

5152 sc.exe
3864 sc.exe
6024 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
5152	sc.exe
3864	sc.exe
6024	sc.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

vssvc.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000f9d6c693febb2fce0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000f9d6c6930000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff000000000700010000680900f9d6c693000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000f9d6c69300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000f9d6c69300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 11 IoCs

adware spyware

Modify Registry

Processes:

ie4uinit.exeie4uinit.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\OperationalData = "12"	ie4uinit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Capabilities\Hidden = "0"	ie4uinit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\BrowserEmulation\CVListTTL = "0"	ie4uinit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Capabilities\Hidden = "0"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Main	ie4uinit.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Capabilities	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	ie4uinit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\BrowserEmulation\CVListTTL = "0"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Main	ie4uinit.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Capabilities	ie4uinit.exe

Modifies data under HKEY_USERS 22 IoCs

Processes:

rundll32.exeInstallUtil.exemsiexec.exerundll32.exeInstallUtil.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CTLs	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\E74B8BC01BC843C34D710E29DE0411564BADC2F2	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	InstallUtil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\E74B8BC01BC843C34D710E29DE0411564BADC2F2\Blob = 030000000100000014000000e74b8bc01bc843c34d710e29de0411564badc2f22000000001000000900500003082058c30820474a00302010202100d7b87bf9200d82906f619b5ee6c603f300d06092a864886f70d01010b0500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b302906035504031322446967694365727420455620436f6465205369676e696e6720434120285348413229301e170d3137303731343030303030305a170d3138303731383132303030305a3081ab31133011060b2b0601040182373c02010313025647311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e3110300e0603550405130731383137383033310b30090603550406130256473112301006035504071309526f616420546f776e3120301e060355040a131749726f6e20456e7465727461696e6d656e7420496e632e3120301e0603550403131749726f6e20456e7465727461696e6d656e7420496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100adccd719ce3b4f84d425e2b3dbbf3273f8367a02e55980fb8b12d0ec202c5bbc0d40ed46059f647e65139a82317acf7f6c441043d6143f8e23097502d3c6ea25255b91fd27949261f4eac63539b1435624791be516dbf3e5d5803fd396a07c238e7c3a7e7be480b8f1e36a08d4fb7ff1ef640c7a6f00904dd3fb5f96ef5f4e7e47baeeed47bdf254fee13bf4a4e72ce5eb7451ae0cf675ad9d19dfed29621f3cc64b3bcdd7dca22b601c39ea6039603128748b1ab4acd40d3d4f53a41a862687424a55e2a56ede2909a81b695cdc2f6e16dc54864eab896765a75d10c0d156156029c91ac22daa455c8d1b853d4a330fce0de6c83b9ad632646509889134d6930203010001a38201e8308201e4301f0603551d230418301680148fe87ef06d326a000523c770976a3a90ff6bead4301d0603551d0e041604149709754f51dc8fa3bf2e4540e443dc015d8816ca30250603551d11041e301ca01a06082b06010505070803a00e300c0c0a56472d31383137383033300e0603551d0f0101ff04040302078030130603551d25040c300a06082b06010505070303307b0603551d1f047430723037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c3037a035a0338631687474703a2f2f63726c342e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c304b0603551d2004443042303706096086480186fd6c0302302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f4350533007060567810c0103307e06082b0601050507010104723070302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304806082b06010505073002863c687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572744556436f64655369676e696e6743412d534841322e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820101002f9a80a913a1d71b909c639c165ca1603d5ce7fdac7b50a4eb5d18d334d2f9d35cda3aea2e9239994a6910e122d312ad9211aebc525b54d6b480bdc1c969ff237aae64718cc06ddc194bfd735794d9d889019c1903ef81fbb1eb993aae57ef2dd9665b8a4e8265e15da21281a6526dee2c183e84c696f40a9072df9bfe5c878f3fbbc6826c780a136b05d4f97aa21c671e0a0b58f36be031a532979fbb57879b7772c50cb394ce0ea1e6688936168621ce55f9c83a7589a501d67cdd75616748aa6524f0c0867971b56b73f1e5beb3f6e4341dc6d7f4acac6f0438317b0e6d3c35116f7d9c3a2d401ff79579d791621a3500525bf068199d2ecb0c77040a9d28	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	InstallUtil.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	InstallUtil.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4D56E7AC803733AEB63F6B8217F4BE35DFE6C42E	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	InstallUtil.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	InstallUtil.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	InstallUtil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	InstallUtil.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4D56E7AC803733AEB63F6B8217F4BE35DFE6C42E\Blob = 0300000001000000140000004d56e7ac803733aeb63f6b8217f4be35dfe6c42e20000000010000007c0500003082057830820460a0030201020210019549f3e9c1fd841c29b1f2c2bdd013300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b446967694365727420455620436f6465205369676e696e67204341301e170d3138303230313030303030305a170d3139303132343132303030305a3081ab31133011060b2b0601040182373c02010313025647311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e3110300e0603550405130731383137383033310b30090603550406130256473112301006035504071309526f616420546f776e3120301e060355040a131749726f6e20456e7465727461696e6d656e7420496e632e3120301e0603550403131749726f6e20456e7465727461696e6d656e7420496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100a69529c8ded2a23c241b5d3223350310da8bc4c1e27e4f38de191a07c5c3e54105693aa3ecda48b1a6be745a22f6d2617e99ee326e2ee0aff2d2fb01d02a3c2aa03b0a9048d0ada52e6bce2dff81d755729ac88e1818c2665fd9007e9036b0b44a29cbfe4717c0fbbf4370768fe22f37c8be5367db93801592886db3031f7e6a67a36187480957700863fd585152c1b47c4ee0a425533fb659f96b3c826e2a3b43d83e182d06d1eaded7f282b4b375b66ec18ad6e2c2612075644ae549112d938f62647c8904720c810976bf982fb27d0b32674f36945d4515f357616429bfba6975b141c22b59ab705d063aecd315a67fd29ddef8ee550acee03e4ab3b256ff0203010001a38201db308201d7301f0603551d23041830168014ad690670fc801b16b3a918946b9402865ef7278c301d0603551d0e04160414ecafaebf1f8d1389e1c8a95226a9938391dcf69130250603551d11041e301ca01a06082b06010505070803a00e300c0c0a56472d31383137383033300e0603551d0f0101ff04040302078030130603551d25040c300a06082b0601050507030330730603551d1f046c306a3033a031a02f862d687474703a2f2f63726c332e64696769636572742e636f6d2f4556436f64655369676e696e672d67312e63726c3033a031a02f862d687474703a2f2f63726c342e64696769636572742e636f6d2f4556436f64655369676e696e672d67312e63726c304b0603551d2004443042303706096086480186fd6c0302302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f4350533007060567810c0103307906082b06010505070101046d306b302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304306082b060105050730028637687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572744556436f64655369676e696e6743412e637274300c0603551d130101ff04023000300d06092a864886f70d01010505000382010100a8590e5af448e75c68937d3c422d3edf1fe3e34f7cb11190a01bfd96c8c1b9c35a473e310ea84296fba0025a747f6247a3d87f2fdbf4a605897c4664567428eb2587b24cbcbb98e73f297bb94470e9d9332d490c5991be31835da48d9d0ff75d15107a81e1779acfc716f41d502c75527e0f2014e8af38de3f051fe2dc0e0dc0582d0f85c87d489e5608fa62044ea83503931b7016675d90f1f56e161d2ec066cd3147239c120eea6b1386f254a4d83d83f4d907652a1e9b3d36d88d21b9af7e5db8bf412e333b503d23b23144b0b0c219435182674e9d503984f820d374707031daed98ed8c44b9d540ab8cd94cab9991d72c5e6518db258236dc44eacb5305	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	InstallUtil.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	InstallUtil.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	InstallUtil.exe

Modifies registry class 64 IoCs

Processes:

MobiVBoxSVC.exeregsvr32.exeie4uinit.exeie4uinit.exeregsvr32.exeregsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C47CAE9A-F6C2-11E7-AEB4-080027376349}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MobiVBoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C5C60C56-F6C2-11E7-AEB4-080027376349}\TypeLib\ = "{C39F7A20-F6C2-11E7-AEB4-080027376349}"	MobiVBoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C5CC5FF2-F6C2-11E7-AEB4-080027376349}\ = "IGuestProcessOutputEvent"	MobiVBoxSVC.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C59E6D04-F6C2-11E7-AEB4-080027376349}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C5599134-F6C2-11E7-AEB4-080027376349}\TypeLib\ = "{C39F7A20-F6C2-11E7-AEB4-080027376349}"	MobiVBoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C5A4906C-F6C2-11E7-AEB4-080027376349}	MobiVBoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C5B87F82-F6C2-11E7-AEB4-080027376349}\TypeLib\Version = "1.3"	MobiVBoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C3C813B8-F6C2-11E7-AEB4-080027376349}\TypeLib\ = "{C39F7A20-F6C2-11E7-AEB4-080027376349}"	MobiVBoxSVC.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C585CBDC-F6C2-11E7-AEB4-080027376349}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C4D0F3A6-F6C2-11E7-AEB4-080027376349}	MobiVBoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C535DED8-F6C2-11E7-AEB4-080027376349}\ = "IDisplay"	MobiVBoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C570D1DC-F6C2-11E7-AEB4-080027376349}\ProxyStubClsid32	MobiVBoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C5B8EA08-F6C2-11E7-AEB4-080027376349}\TypeLib\Version = "1.3"	MobiVBoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C5CC5FF2-F6C2-11E7-AEB4-080027376349}\ = "IGuestProcessOutputEvent"	MobiVBoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C5A4906C-F6C2-11E7-AEB4-080027376349}\TypeLib\Version = "1.3"	MobiVBoxSVC.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C470B59A-F6C2-11E7-AEB4-080027376349}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C54026FE-F6C2-11E7-AEB4-080027376349}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C5C144FA-F6C2-11E7-AEB4-080027376349}\ = "INetworkAdapterChangedEvent"	MobiVBoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C5C2F39A-F6C2-11E7-AEB4-080027376349}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MobiVBoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C5CE4AE2-F6C2-11E7-AEB4-080027376349}	MobiVBoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C5DC7BBC-F6C2-11E7-AEB4-080027376349}	MobiVBoxSVC.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C5C4FDE8-F6C2-11E7-AEB4-080027376349}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C3BC6216-F6C2-11E7-AEB4-080027376349}\TypeLib	MobiVBoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C5CB5A4E-F6C2-11E7-AEB4-080027376349}\ProxyStubClsid32	MobiVBoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C5D51FAC-F6C2-11E7-AEB4-080027376349}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MobiVBoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.Website\shellex\IconHandler	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C3C3C600-F6C2-11E7-AEB4-080027376349}\ProxyStubClsid32	MobiVBoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C565BC8E-F6C2-11E7-AEB4-080027376349}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MobiVBoxSVC.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C5B87F82-F6C2-11E7-AEB4-080027376349}\TypeLib	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C5CC5FF2-F6C2-11E7-AEB4-080027376349}\TypeLib	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C470B59A-F6C2-11E7-AEB4-080027376349}\TypeLib	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C56B3FBA-F6C2-11E7-AEB4-080027376349}\TypeLib	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C52E62A2-F6C2-11E7-AEB4-080027376349}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithProgIds\mhtmlfile	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C5C29828-F6C2-11E7-AEB4-080027376349}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MobiVBoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C5C4FDE8-F6C2-11E7-AEB4-080027376349}\ProxyStubClsid32	MobiVBoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C5E0873E-F6C2-11E7-AEB4-080027376349}\TypeLib\ = "{C39F7A20-F6C2-11E7-AEB4-080027376349}"	MobiVBoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VirtualBox.VirtualBoxClient\CLSID\ = "{c5e220c6-f6c2-11e7-aeb4-080027376349}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C5DB0D4A-F6C2-11E7-AEB4-080027376349}\ProxyStubClsid32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C5DFA648-F6C2-11E7-AEB4-080027376349}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C5BA062C-F6C2-11E7-AEB4-080027376349}\TypeLib\Version = "1.3"	MobiVBoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C5C4240E-F6C2-11E7-AEB4-080027376349}\TypeLib\Version = "1.3"	MobiVBoxSVC.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C5969C1E-F6C2-11E7-AEB4-080027376349}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C54846AE-F6C2-11E7-AEB4-080027376349}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C5DEC84A-F6C2-11E7-AEB4-080027376349}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command	ie4uinit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\svgfile\shell\open\command	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\open\command	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C5A4906C-F6C2-11E7-AEB4-080027376349}\ProxyStubClsid32	MobiVBoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C5C3C7B6-F6C2-11E7-AEB4-080027376349}	MobiVBoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C5DB0D4A-F6C2-11E7-AEB4-080027376349}\TypeLib\Version = "1.3"	MobiVBoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c5e220c6-f6c2-11e7-aeb4-080027376349}\InprocServer32\ThreadingModel = "Free"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.html\OpenWithProgIds	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\URL Protocol	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mhtml\OpenWithProgIds\mhtmlfile	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C45CE754-F6C2-11E7-AEB4-080027376349}	MobiVBoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D0A748-F6C2-11E7-AEB4-080027376349}\ = "IGuestProcess"	MobiVBoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c5e1ec0a-f6c2-11e7-aeb4-080027376349}\LocalServer32	MobiVBoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C5BD023C-F6C2-11E7-AEB4-080027376349}\TypeLib	MobiVBoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut\shell\open\command	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xhtml\OpenWithProgIds\xhtmlfile	ie4uinit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C58B5D9A-F6C2-11E7-AEB4-080027376349}\TypeLib	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C5CF9104-F6C2-11E7-AEB4-080027376349}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C51D5AC0-F6C2-11E7-AEB4-080027376349}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MobiVBoxSVC.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

Processes:

rundll32.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\E74B8BC01BC843C34D710E29DE0411564BADC2F2\Blob = 030000000100000014000000e74b8bc01bc843c34d710e29de0411564badc2f22000000001000000900500003082058c30820474a00302010202100d7b87bf9200d82906f619b5ee6c603f300d06092a864886f70d01010b0500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b302906035504031322446967694365727420455620436f6465205369676e696e6720434120285348413229301e170d3137303731343030303030305a170d3138303731383132303030305a3081ab31133011060b2b0601040182373c02010313025647311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e3110300e0603550405130731383137383033310b30090603550406130256473112301006035504071309526f616420546f776e3120301e060355040a131749726f6e20456e7465727461696e6d656e7420496e632e3120301e0603550403131749726f6e20456e7465727461696e6d656e7420496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100adccd719ce3b4f84d425e2b3dbbf3273f8367a02e55980fb8b12d0ec202c5bbc0d40ed46059f647e65139a82317acf7f6c441043d6143f8e23097502d3c6ea25255b91fd27949261f4eac63539b1435624791be516dbf3e5d5803fd396a07c238e7c3a7e7be480b8f1e36a08d4fb7ff1ef640c7a6f00904dd3fb5f96ef5f4e7e47baeeed47bdf254fee13bf4a4e72ce5eb7451ae0cf675ad9d19dfed29621f3cc64b3bcdd7dca22b601c39ea6039603128748b1ab4acd40d3d4f53a41a862687424a55e2a56ede2909a81b695cdc2f6e16dc54864eab896765a75d10c0d156156029c91ac22daa455c8d1b853d4a330fce0de6c83b9ad632646509889134d6930203010001a38201e8308201e4301f0603551d230418301680148fe87ef06d326a000523c770976a3a90ff6bead4301d0603551d0e041604149709754f51dc8fa3bf2e4540e443dc015d8816ca30250603551d11041e301ca01a06082b06010505070803a00e300c0c0a56472d31383137383033300e0603551d0f0101ff04040302078030130603551d25040c300a06082b06010505070303307b0603551d1f047430723037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c3037a035a0338631687474703a2f2f63726c342e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c304b0603551d2004443042303706096086480186fd6c0302302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f4350533007060567810c0103307e06082b0601050507010104723070302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304806082b06010505073002863c687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572744556436f64655369676e696e6743412d534841322e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820101002f9a80a913a1d71b909c639c165ca1603d5ce7fdac7b50a4eb5d18d334d2f9d35cda3aea2e9239994a6910e122d312ad9211aebc525b54d6b480bdc1c969ff237aae64718cc06ddc194bfd735794d9d889019c1903ef81fbb1eb993aae57ef2dd9665b8a4e8265e15da21281a6526dee2c183e84c696f40a9072df9bfe5c878f3fbbc6826c780a136b05d4f97aa21c671e0a0b58f36be031a532979fbb57879b7772c50cb394ce0ea1e6688936168621ce55f9c83a7589a501d67cdd75616748aa6524f0c0867971b56b73f1e5beb3f6e4341dc6d7f4acac6f0438317b0e6d3c35116f7d9c3a2d401ff79579d791621a3500525bf068199d2ecb0c77040a9d28	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4D56E7AC803733AEB63F6B8217F4BE35DFE6C42E	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4D56E7AC803733AEB63F6B8217F4BE35DFE6C42E\Blob = 0300000001000000140000004d56e7ac803733aeb63f6b8217f4be35dfe6c42e20000000010000007c0500003082057830820460a0030201020210019549f3e9c1fd841c29b1f2c2bdd013300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b446967694365727420455620436f6465205369676e696e67204341301e170d3138303230313030303030305a170d3139303132343132303030305a3081ab31133011060b2b0601040182373c02010313025647311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e3110300e0603550405130731383137383033310b30090603550406130256473112301006035504071309526f616420546f776e3120301e060355040a131749726f6e20456e7465727461696e6d656e7420496e632e3120301e0603550403131749726f6e20456e7465727461696e6d656e7420496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100a69529c8ded2a23c241b5d3223350310da8bc4c1e27e4f38de191a07c5c3e54105693aa3ecda48b1a6be745a22f6d2617e99ee326e2ee0aff2d2fb01d02a3c2aa03b0a9048d0ada52e6bce2dff81d755729ac88e1818c2665fd9007e9036b0b44a29cbfe4717c0fbbf4370768fe22f37c8be5367db93801592886db3031f7e6a67a36187480957700863fd585152c1b47c4ee0a425533fb659f96b3c826e2a3b43d83e182d06d1eaded7f282b4b375b66ec18ad6e2c2612075644ae549112d938f62647c8904720c810976bf982fb27d0b32674f36945d4515f357616429bfba6975b141c22b59ab705d063aecd315a67fd29ddef8ee550acee03e4ab3b256ff0203010001a38201db308201d7301f0603551d23041830168014ad690670fc801b16b3a918946b9402865ef7278c301d0603551d0e04160414ecafaebf1f8d1389e1c8a95226a9938391dcf69130250603551d11041e301ca01a06082b06010505070803a00e300c0c0a56472d31383137383033300e0603551d0f0101ff04040302078030130603551d25040c300a06082b0601050507030330730603551d1f046c306a3033a031a02f862d687474703a2f2f63726c332e64696769636572742e636f6d2f4556436f64655369676e696e672d67312e63726c3033a031a02f862d687474703a2f2f63726c342e64696769636572742e636f6d2f4556436f64655369676e696e672d67312e63726c304b0603551d2004443042303706096086480186fd6c0302302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f4350533007060567810c0103307906082b06010505070101046d306b302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304306082b060105050730028637687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572744556436f64655369676e696e6743412e637274300c0603551d130101ff04023000300d06092a864886f70d01010505000382010100a8590e5af448e75c68937d3c422d3edf1fe3e34f7cb11190a01bfd96c8c1b9c35a473e310ea84296fba0025a747f6247a3d87f2fdbf4a605897c4664567428eb2587b24cbcbb98e73f297bb94470e9d9332d490c5991be31835da48d9d0ff75d15107a81e1779acfc716f41d502c75527e0f2014e8af38de3f051fe2dc0e0dc0582d0f85c87d489e5608fa62044ea83503931b7016675d90f1f56e161d2ec066cd3147239c120eea6b1386f254a4d83d83f4d907652a1e9b3d36d88d21b9af7e5db8bf412e333b503d23b23144b0b0c219435182674e9d503984f820d374707031daed98ed8c44b9d540ab8cd94cab9991d72c5e6518db258236dc44eacb5305	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\E74B8BC01BC843C34D710E29DE0411564BADC2F2	rundll32.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exepowershell.exepowershell.exemsiexec.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exemsedge.exemsedge.exesetup_com.kiloo.subwaysurf_flow6mkt_38903555.exeidentity_helper.exerundll32.exerundll32.exemsedge.exe

pid	process
4368	powershell.exe
4368	powershell.exe
612	powershell.exe
612	powershell.exe
2332	powershell.exe
2332	powershell.exe
1288	msiexec.exe
1288	msiexec.exe
1688	powershell.exe
1688	powershell.exe
1340	powershell.exe
4612	powershell.exe
1340	powershell.exe
4612	powershell.exe
4612	powershell.exe
1008	powershell.exe
1008	powershell.exe
1600	powershell.exe
1600	powershell.exe
1288	msiexec.exe
1288	msiexec.exe
2396	powershell.exe
2396	powershell.exe
4488	powershell.exe
4488	powershell.exe
4488	powershell.exe
1700	powershell.exe
1700	powershell.exe
1288	msiexec.exe
1288	msiexec.exe
3740	powershell.exe
3740	powershell.exe
3284	powershell.exe
3284	powershell.exe
4040	msedge.exe
4040	msedge.exe
3096	msedge.exe
3096	msedge.exe
3204	setup_com.kiloo.subwaysurf_flow6mkt_38903555.exe
3204	setup_com.kiloo.subwaysurf_flow6mkt_38903555.exe
2816	identity_helper.exe
2816	identity_helper.exe
2300	rundll32.exe
2300	rundll32.exe
2300	rundll32.exe
2300	rundll32.exe
2300	rundll32.exe
2300	rundll32.exe
2300	rundll32.exe
1288	msiexec.exe
1288	msiexec.exe
2024	rundll32.exe
2024	rundll32.exe
2024	rundll32.exe
2024	rundll32.exe
2024	rundll32.exe
2024	rundll32.exe
2024	rundll32.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
3204	setup_com.kiloo.subwaysurf_flow6mkt_38903555.exe
3204	setup_com.kiloo.subwaysurf_flow6mkt_38903555.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

648
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

3096 msedge.exe
3096 msedge.exe
3096 msedge.exe
3096 msedge.exe
3096 msedge.exe
3096 msedge.exe
3096 msedge.exe
3096 msedge.exe

pid	process
648

pid	process
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	2228	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2228	msiexec.exe
Token: SeSecurityPrivilege	1288	msiexec.exe
Token: SeCreateTokenPrivilege	2228	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2228	msiexec.exe
Token: SeLockMemoryPrivilege	2228	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2228	msiexec.exe
Token: SeMachineAccountPrivilege	2228	msiexec.exe
Token: SeTcbPrivilege	2228	msiexec.exe
Token: SeSecurityPrivilege	2228	msiexec.exe
Token: SeTakeOwnershipPrivilege	2228	msiexec.exe
Token: SeLoadDriverPrivilege	2228	msiexec.exe
Token: SeSystemProfilePrivilege	2228	msiexec.exe
Token: SeSystemtimePrivilege	2228	msiexec.exe
Token: SeProfSingleProcessPrivilege	2228	msiexec.exe
Token: SeIncBasePriorityPrivilege	2228	msiexec.exe
Token: SeCreatePagefilePrivilege	2228	msiexec.exe
Token: SeCreatePermanentPrivilege	2228	msiexec.exe
Token: SeBackupPrivilege	2228	msiexec.exe
Token: SeRestorePrivilege	2228	msiexec.exe
Token: SeShutdownPrivilege	2228	msiexec.exe
Token: SeDebugPrivilege	2228	msiexec.exe
Token: SeAuditPrivilege	2228	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2228	msiexec.exe
Token: SeChangeNotifyPrivilege	2228	msiexec.exe
Token: SeRemoteShutdownPrivilege	2228	msiexec.exe
Token: SeUndockPrivilege	2228	msiexec.exe
Token: SeSyncAgentPrivilege	2228	msiexec.exe
Token: SeEnableDelegationPrivilege	2228	msiexec.exe
Token: SeManageVolumePrivilege	2228	msiexec.exe
Token: SeImpersonatePrivilege	2228	msiexec.exe
Token: SeCreateGlobalPrivilege	2228	msiexec.exe
Token: SeCreateTokenPrivilege	2228	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2228	msiexec.exe
Token: SeLockMemoryPrivilege	2228	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2228	msiexec.exe
Token: SeMachineAccountPrivilege	2228	msiexec.exe
Token: SeTcbPrivilege	2228	msiexec.exe
Token: SeSecurityPrivilege	2228	msiexec.exe
Token: SeTakeOwnershipPrivilege	2228	msiexec.exe
Token: SeLoadDriverPrivilege	2228	msiexec.exe
Token: SeSystemProfilePrivilege	2228	msiexec.exe
Token: SeSystemtimePrivilege	2228	msiexec.exe
Token: SeProfSingleProcessPrivilege	2228	msiexec.exe
Token: SeIncBasePriorityPrivilege	2228	msiexec.exe
Token: SeCreatePagefilePrivilege	2228	msiexec.exe
Token: SeCreatePermanentPrivilege	2228	msiexec.exe
Token: SeBackupPrivilege	2228	msiexec.exe
Token: SeRestorePrivilege	2228	msiexec.exe
Token: SeShutdownPrivilege	2228	msiexec.exe
Token: SeDebugPrivilege	2228	msiexec.exe
Token: SeAuditPrivilege	2228	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2228	msiexec.exe
Token: SeChangeNotifyPrivilege	2228	msiexec.exe
Token: SeRemoteShutdownPrivilege	2228	msiexec.exe
Token: SeUndockPrivilege	2228	msiexec.exe
Token: SeSyncAgentPrivilege	2228	msiexec.exe
Token: SeEnableDelegationPrivilege	2228	msiexec.exe
Token: SeManageVolumePrivilege	2228	msiexec.exe
Token: SeImpersonatePrivilege	2228	msiexec.exe
Token: SeCreateGlobalPrivilege	2228	msiexec.exe
Token: SeCreateTokenPrivilege	2228	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2228	msiexec.exe
Token: SeLockMemoryPrivilege	2228	msiexec.exe

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

msiexec.exemsedge.exesetup_com.kiloo.subwaysurf_flow6mkt_38903555.exe

pid process

2228 msiexec.exe
3096 msedge.exe
3096 msedge.exe
2228 msiexec.exe
3204 setup_com.kiloo.subwaysurf_flow6mkt_38903555.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

sysinfo-app.exesetup_com.kiloo.subwaysurf_flow6mkt_38903555.exe

pid process

4560 sysinfo-app.exe
3204 setup_com.kiloo.subwaysurf_flow6mkt_38903555.exe
3204 setup_com.kiloo.subwaysurf_flow6mkt_38903555.exe

pid	process
2228	msiexec.exe
3096	msedge.exe
3096	msedge.exe
2228	msiexec.exe
3204	setup_com.kiloo.subwaysurf_flow6mkt_38903555.exe

pid	process
4560	sysinfo-app.exe
3204	setup_com.kiloo.subwaysurf_flow6mkt_38903555.exe
3204	setup_com.kiloo.subwaysurf_flow6mkt_38903555.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msiexec.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exemsiexec.exeMSIDA12.tmp

description	pid	process	target process
PID 1288 wrote to memory of 4312	1288	msiexec.exe	MsiExec.exe
PID 1288 wrote to memory of 4312	1288	msiexec.exe	MsiExec.exe
PID 1288 wrote to memory of 4312	1288	msiexec.exe	MsiExec.exe
PID 4312 wrote to memory of 4368	4312	MsiExec.exe	powershell.exe
PID 4312 wrote to memory of 4368	4312	MsiExec.exe	powershell.exe
PID 4312 wrote to memory of 4368	4312	MsiExec.exe	powershell.exe
PID 4312 wrote to memory of 612	4312	MsiExec.exe	powershell.exe
PID 4312 wrote to memory of 612	4312	MsiExec.exe	powershell.exe
PID 4312 wrote to memory of 612	4312	MsiExec.exe	powershell.exe
PID 4312 wrote to memory of 5096	4312	MsiExec.exe	msiexec.exe
PID 4312 wrote to memory of 5096	4312	MsiExec.exe	msiexec.exe
PID 4312 wrote to memory of 5096	4312	MsiExec.exe	msiexec.exe
PID 1288 wrote to memory of 984	1288	msiexec.exe	MsiExec.exe
PID 1288 wrote to memory of 984	1288	msiexec.exe	MsiExec.exe
PID 1288 wrote to memory of 984	1288	msiexec.exe	MsiExec.exe
PID 984 wrote to memory of 2332	984	MsiExec.exe	powershell.exe
PID 984 wrote to memory of 2332	984	MsiExec.exe	powershell.exe
PID 984 wrote to memory of 2332	984	MsiExec.exe	powershell.exe
PID 984 wrote to memory of 1688	984	MsiExec.exe	powershell.exe
PID 984 wrote to memory of 1688	984	MsiExec.exe	powershell.exe
PID 984 wrote to memory of 1688	984	MsiExec.exe	powershell.exe
PID 1288 wrote to memory of 4692	1288	msiexec.exe	MSIFF19.tmp
PID 1288 wrote to memory of 4692	1288	msiexec.exe	MSIFF19.tmp
PID 1288 wrote to memory of 4692	1288	msiexec.exe	MSIFF19.tmp
PID 984 wrote to memory of 1340	984	MsiExec.exe	powershell.exe
PID 984 wrote to memory of 1340	984	MsiExec.exe	powershell.exe
PID 984 wrote to memory of 1340	984	MsiExec.exe	powershell.exe
PID 4312 wrote to memory of 3284	4312	MsiExec.exe	msiexec.exe
PID 4312 wrote to memory of 3284	4312	MsiExec.exe	msiexec.exe
PID 4312 wrote to memory of 3284	4312	MsiExec.exe	msiexec.exe
PID 1288 wrote to memory of 2920	1288	msiexec.exe	MsiExec.exe
PID 1288 wrote to memory of 2920	1288	msiexec.exe	MsiExec.exe
PID 1288 wrote to memory of 2920	1288	msiexec.exe	MsiExec.exe
PID 2920 wrote to memory of 1008	2920	MsiExec.exe	powershell.exe
PID 2920 wrote to memory of 1008	2920	MsiExec.exe	powershell.exe
PID 2920 wrote to memory of 1008	2920	MsiExec.exe	powershell.exe
PID 2920 wrote to memory of 1600	2920	MsiExec.exe	powershell.exe
PID 2920 wrote to memory of 1600	2920	MsiExec.exe	powershell.exe
PID 2920 wrote to memory of 1600	2920	MsiExec.exe	powershell.exe
PID 2920 wrote to memory of 2396	2920	MsiExec.exe	powershell.exe
PID 2920 wrote to memory of 2396	2920	MsiExec.exe	powershell.exe
PID 2920 wrote to memory of 2396	2920	MsiExec.exe	powershell.exe
PID 1288 wrote to memory of 2016	1288	msiexec.exe	MSI4469.tmp
PID 1288 wrote to memory of 2016	1288	msiexec.exe	MSI4469.tmp
PID 1288 wrote to memory of 2016	1288	msiexec.exe	MSI4469.tmp
PID 1288 wrote to memory of 1628	1288	msiexec.exe	srtasks.exe
PID 1288 wrote to memory of 1628	1288	msiexec.exe	srtasks.exe
PID 1288 wrote to memory of 1640	1288	msiexec.exe	MsiExec.exe
PID 1288 wrote to memory of 1640	1288	msiexec.exe	MsiExec.exe
PID 1288 wrote to memory of 1640	1288	msiexec.exe	MsiExec.exe
PID 1640 wrote to memory of 1700	1640	MsiExec.exe	powershell.exe
PID 1640 wrote to memory of 1700	1640	MsiExec.exe	powershell.exe
PID 1640 wrote to memory of 1700	1640	MsiExec.exe	powershell.exe
PID 4312 wrote to memory of 3740	4312	MsiExec.exe	powershell.exe
PID 4312 wrote to memory of 3740	4312	MsiExec.exe	powershell.exe
PID 4312 wrote to memory of 3740	4312	MsiExec.exe	powershell.exe
PID 2228 wrote to memory of 2268	2228	msiexec.exe	MSIDA12.tmp
PID 2228 wrote to memory of 2268	2228	msiexec.exe	MSIDA12.tmp
PID 2228 wrote to memory of 2268	2228	msiexec.exe	MSIDA12.tmp
PID 2268 wrote to memory of 3096	2268	MSIDA12.tmp	msedge.exe
PID 2268 wrote to memory of 3096	2268	MSIDA12.tmp	msedge.exe
PID 4312 wrote to memory of 3284	4312	MsiExec.exe	powershell.exe
PID 4312 wrote to memory of 3284	4312	MsiExec.exe	powershell.exe
PID 4312 wrote to memory of 3284	4312	MsiExec.exe	powershell.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Roblox_installer_38903555.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Users\Admin\AppData\Local\Temp\MSIDA12.tmp
  "C:\Users\Admin\AppData\Local\Temp\MSIDA12.tmp" https://kksv292.com/ext/ruftyp/38903555
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://kksv292.com/ext/ruftyp/38903555
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:3096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc3fb546f8,0x7ffc3fb54708,0x7ffc3fb54718
      4⤵
      PID:1132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,17003411440917463531,16358637297523967517,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
      4⤵
      PID:1432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,17003411440917463531,16358637297523967517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,17003411440917463531,16358637297523967517,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
      4⤵
      PID:1572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17003411440917463531,16358637297523967517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
      4⤵
      PID:3624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17003411440917463531,16358637297523967517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
      4⤵
      PID:628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17003411440917463531,16358637297523967517,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
      4⤵
      PID:3252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17003411440917463531,16358637297523967517,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
      4⤵
      PID:3872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17003411440917463531,16358637297523967517,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
      4⤵
      PID:4908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17003411440917463531,16358637297523967517,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
      4⤵
      PID:116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,17003411440917463531,16358637297523967517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 /prefetch:8
      4⤵
      PID:1676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      PID:1868
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff615475460,0x7ff615475470,0x7ff615475480
        5⤵
        
        PID:1072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,17003411440917463531,16358637297523967517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17003411440917463531,16358637297523967517,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
      4⤵
      PID:740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17003411440917463531,16358637297523967517,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
      4⤵
      PID:4784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,17003411440917463531,16358637297523967517,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5080 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4548

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 569C4AF380A860A82FE7AA52530AA1CB C
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4312
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss8D33.tmp.ps1"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4368
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssA5E0.tmp.ps1"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:612
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Eclipse Media Inc\Installer Assistant\prerequisites\WCSetup_EmuWC.msi" /q
    3⤵
    PID:5096
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Eclipse Media Inc\Installer Assistant\prerequisites\BESetup_EmuWC.msi" /q
    3⤵
    PID:3284
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssCD2A.tmp.ps1"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:3740
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssDED2.tmp.ps1"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3284
  - - C:\Users\Admin\AppData\Local\Temp\setup_com.kiloo.subwaysurf_flow6mkt_38903555.exe
      "C:\Users\Admin\AppData\Local\Temp\setup_com.kiloo.subwaysurf_flow6mkt_38903555.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:2272
    - - C:\Users\Admin\AppData\Local\Temp\pcgame_12E2B7DB\setup_com.kiloo.subwaysurf_flow6mkt_38903555.exe
        
        "C:\Users\Admin\AppData\Local\Temp\pcgame_12E2B7DB\setup_com.kiloo.subwaysurf_flow6mkt_38903555.exe" /app "C:\Users\Admin\AppData\Local\MobiGame\\"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:3204
      - C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\pcgame_12E2B7DB\utils\sysinfo-app.exe"
        6⤵
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\pcgame_12E2B7DB\utils\sysinfo-app.exe
        
        C:\Users\Admin\AppData\Local\Temp\pcgame_12E2B7DB\utils\sysinfo-app.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4560
      - C:\Users\Admin\AppData\Local\Temp\pcgame_12E2B7DB\MobiHelper.exe
        
        "MobiHelper.exe" --install-path="C:\Program Files\MobiGame" --desktop-path="C:\Users\Admin\Desktop" --local-app-data-path="C:\Users\Admin\AppData\Local\MobiGame" --parent="C:\Users\Admin\AppData\Local\Temp\pcgame_12E2B7DB\setup_com.kiloo.subwaysurf_flow6mkt_38903555.exe" --playstore-json-file-path="C:\Users\Admin\AppData\Local\MobiGame\playstore.json" --google-analytics-id="38903555" --create-playstore-shortcut --api-url="https://gamestore30.emu.codes" --source="flow6mkt"
        6⤵
        Executes dropped EXE
        
        PID:5784
        
        C:\Windows\system32\ie4uinit.exe
        
        "C:\Windows\system32\ie4uinit.exe" -show
        7⤵
        Modifies Installed Components in the registry
        Registers COM server for autorun
        Modifies Internet Explorer settings
        Modifies registry class
        
        PID:6116
      - C:\Windows\system32\ie4uinit.exe
        
        "C:\Windows\system32\ie4uinit.exe" -show
        6⤵
        Modifies Installed Components in the registry
        Registers COM server for autorun
        Modifies Internet Explorer settings
        Modifies registry class
        
        PID:5160
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B155941228E4F61F4A9AFECD961FD40E
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:984
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssDEEA.tmp.ps1"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:2332
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssF38F.tmp.ps1"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:1688
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssFF3B.tmp.ps1"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1340
- C:\Windows\Installer\MSIFF19.tmp
  "C:\Windows\Installer\MSIFF19.tmp" /DontWait /HideWindow /dir "C:\Users\Admin\AppData\Roaming\BBWC\" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -noninteractive -ExecutionPolicy bypass -c "$w="$env:APPDATA"+'/BBWC/'; [Reflection.Assembly]::Load([System.IO.File]::ReadAllBytes($w+'WebCompanion.dll'));[WebCompanion.StartUp]::Start()"
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 774C76A0440EE36FF0D7E8072475D2BB
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2920
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss1C02.tmp.ps1"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:1008
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss2C14.tmp.ps1"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1600
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss387C.tmp.ps1"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:2396
- C:\Windows\Installer\MSI4469.tmp
  "C:\Windows\Installer\MSI4469.tmp" /DontWait /HideWindow /dir "C:\Users\Admin\AppData\Roaming\Browser Extension\" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy bypass -c "$w="$env:APPDATA"+'/Browser Extension/';[Reflection.Assembly]::Load([System.IO.File]::ReadAllBytes($w+'BrowserExtension.dll'));[WebCompanion.BrowserExtension.S]::Start()"
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1628
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1F7EA5C8D2FCBA8F594263417897D61E
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1640
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssB2F3.tmp.ps1"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:1700
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding E211236100D7F133E9E9E17FDDECB1DF
  2⤵
  - Loads dropped DLL
  PID:5992
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIE561.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240969125 449 WixSharp!WixSharp.ManagedProjectActions.WixSharp_InitRuntime_Action
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:5168
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIE92B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240970015 458 WixSharp!WixSharp.ManagedProjectActions.WixSharp_Load_Action
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    PID:2300
  - - C:\Windows\system32\cmd.exe
      "cmd.exe" /c set
      4⤵
      PID:5416
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIEB6E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240970578 479 VirtualBoxSetup!VirtualBoxSetup.CustomActions.SetSessionPropertiesFromConfig
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:5580
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 57DFAEB0D8A2D318934D2692CB41E40A
  2⤵
  - Loads dropped DLL
  PID:5752
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 9520F08D4AEFC25479A6C1C430618A9E E Global\MSI0000
  2⤵
  - Loads dropped DLL
  PID:5832
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI8C0.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240978140 530 VirtualBoxSetup!VirtualBoxSetup.CustomActions.CloseProcessesAndUsedFiles
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    PID:2024
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI9F9.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240978453 537 VirtualBoxSetup!VirtualBoxSetup.CustomActions.DeletePlayStoreAutorun
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:5412
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI4974.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240994640 541 VirtualBoxSetup!VirtualBoxSetup.CustomActions.CreatePlaystore
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    PID:5648
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI5BD4.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240999359 560 VirtualBoxSetup!VirtualBoxSetup.CustomActions.CreateRegistryForAegLauncher
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:2436
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI5CCF.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240999609 564 VirtualBoxSetup!VirtualBoxSetup.CustomActions.InstallCertificate
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Modifies system certificate store
    PID:5892
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI5DCA.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240999859 568 VirtualBoxSetup!VirtualBoxSetup.CustomActions.SaveSessionPropertiesToConfig
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:5440
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIB5BF.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241022359 576 VirtualBoxSetup!VirtualBoxSetup.CustomActions.SubstitutePath
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:5648
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIB785.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241022812 593 VirtualBoxSetup!VirtualBoxSetup.CustomActions.InstallService
    3⤵
    - Drops file in Windows directory
    PID:2080
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe" "C:\Program Files\MobiGame\MobiGameUpdater.exe"
      4⤵
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies data under HKEY_USERS
      PID:6004
  - - C:\Windows\system32\sc.exe
      "sc.exe" config MobiGameUpdater start= demand
      4⤵
      Launches sc.exe
      PID:5152
  - - C:\Program Files\MobiGame\utils\subinacl.exe
      "C:\Program Files\MobiGame\utils\subinacl.exe" /service MobiGameUpdater /grant=S-1-5-21-1675742406-747946869-1029867430-1000=F
      4⤵
      Executes dropped EXE
      PID:5176
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIBD14.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241024265 606 VirtualBoxSetup!VirtualBoxSetup.CustomActions.InstallAegLauncherService
    3⤵
    - Drops file in Windows directory
    PID:5308
  - - C:\Program Files\MobiGame\aeg_launcher.exe
      "C:\Program Files\MobiGame\aeg_launcher.exe" -service=install
      4⤵
      Executes dropped EXE
      PID:5420
  - - C:\Windows\system32\sc.exe
      "sc.exe" config AegLauncher start= auto
      4⤵
      Launches sc.exe
      PID:3864
  - - C:\Program Files\MobiGame\utils\subinacl.exe
      "C:\Program Files\MobiGame\utils\subinacl.exe" /service AegLauncher /grant=S-1-5-21-1675742406-747946869-1029867430-1000=F
      4⤵
      Executes dropped EXE
      PID:688
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIC0CE.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241025203 617 VirtualBoxSetup!VirtualBoxSetup.CustomActions.UpdateUninstallData
    3⤵
    - Drops file in Windows directory
    PID:5600
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIC2F3.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241025750 626 VirtualBoxSetup!VirtualBoxSetup.CustomActions.RegisterCustomProtocol
    3⤵
    - Drops file in Windows directory
    PID:1920
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIC6FC.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241026765 635 VirtualBoxSetup!VirtualBoxSetup.CustomActions.InstallVirtualBox
    3⤵
    - Drops file in Windows directory
    PID:3764
  - - C:\Windows\system32\cmd.exe
      "cmd.exe" /c "C:\Program Files\MobiGame\vbox\register_services.cmd"
      4⤵
      PID:3844
    - - C:\Windows\system32\net.exe
        
        NET FILE
        5⤵
        
        PID:3652
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 FILE
        6⤵
        
        PID:2044
    - - C:\Windows\syswow64\regsvr32.exe
        
        C:\Windows\syswow64\regsvr32 /s /u "C:\Program Files\MobiGame\vbox\x86\VBoxClient-x86.dll"
        5⤵
        
        PID:1368
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32 /s /u "C:\Program Files\MobiGame\vbox\VBoxC.dll"
        5⤵
        
        PID:5872
    - - C:\Program Files\MobiGame\vbox\MobiVBoxSVC.exe
        
        "C:\Program Files\MobiGame\vbox\MobiVBoxSVC.exe" /RegServer
        5⤵
        Executes dropped EXE
        Registers COM server for autorun
        Modifies registry class
        
        PID:5440
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32 /s "C:\Program Files\MobiGame\vbox\VBoxC.dll"
        5⤵
        Registers COM server for autorun
        Modifies registry class
        
        PID:5740
    - - C:\Windows\syswow64\regsvr32.exe
        
        C:\Windows\syswow64\regsvr32 /s "C:\Program Files\MobiGame\vbox\x86\VBoxClient-x86.dll"
        5⤵
        Modifies registry class
        
        PID:5316
    - - C:\Program Files\MobiGame\vbox\SUPInstall.exe
        
        "C:\Program Files\MobiGame\vbox\\SUPInstall.exe"
        5⤵
        Executes dropped EXE
        
        PID:5796
    - - C:\Windows\system32\net.exe
        
        NET FILE
        5⤵
        
        PID:1960
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 FILE
        6⤵
        
        PID:5800
    - - C:\Windows\syswow64\regsvr32.exe
        
        C:\Windows\syswow64\regsvr32 /s /u "C:\Program Files\MobiGame\vbox\x86\VBoxClient-x86.dll"
        5⤵
        
        PID:5920
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32 /s /u "C:\Program Files\MobiGame\vbox\VBoxC.dll"
        5⤵
        Registers COM server for autorun
        Modifies registry class
        
        PID:4372
    - - C:\Program Files\MobiGame\vbox\MobiVBoxSVC.exe
        
        "C:\Program Files\MobiGame\vbox\MobiVBoxSVC.exe" /UnregServer
        5⤵
        Executes dropped EXE
        Registers COM server for autorun
        
        PID:3476
    - - C:\Program Files\MobiGame\vbox\NetLwfUninstall.exe
        
        "C:\Program Files\MobiGame\vbox\\NetLwfUninstall.exe"
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4644
    - - C:\Program Files\MobiGame\vbox\USBUninstall.exe
        
        "C:\Program Files\MobiGame\vbox\\USBUninstall.exe"
        5⤵
        Executes dropped EXE
        
        PID:4948
    - - C:\Program Files\MobiGame\vbox\SUPUninstall.exe
        
        "C:\Program Files\MobiGame\vbox\\SUPUninstall.exe"
        5⤵
        Executes dropped EXE
        
        PID:6020
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" stop "MobiGameUpdater"
      4⤵
      Launches sc.exe
      PID:6024
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe" /u "C:\Program Files\MobiGame\MobiGameUpdater.exe"
      4⤵
      Drops file in Windows directory
      Modifies data under HKEY_USERS
      PID:1888
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIF7D2.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241039281 649 VirtualBoxSetup!VirtualBoxSetup.CustomActions.RemoveRegistryForAegLauncher
    3⤵
    - Drops file in Windows directory
    PID:5284
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 4175BC53355F3C147FAEFC40A5BD216C E Global\MSI0000
  2⤵
  PID:4812

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noninteractive -ExecutionPolicy bypass -c "$w="$env:APPDATA"+'/BBWC/'; [Reflection.Assembly]::Load([System.IO.File]::ReadAllBytes($w+'WebCompanion.dll'));[WebCompanion.StartUp]::Start()"
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:4612

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy bypass -c "$w="$env:APPDATA"+'/Browser Extension/';[Reflection.Assembly]::Load([System.IO.File]::ReadAllBytes($w+'BrowserExtension.dll'));[WebCompanion.BrowserExtension.S]::Start()"
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:4488

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:5032

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c
1⤵
PID:1740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4332

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:4120

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Install Root Certificate

T1130

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery