b8d8de6fd2cab0eadfc2a654b19240edaaf49501e87165a2414322a4ea6ce7d6

Modify Existing Service

T1031

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\{DF58609B-7294-4D7B-8E9A-A4EABA727F0B} = "v2.10\|Action=Allow\|Active=TRUE\|Dir=In\|Protocol=6\|Profile=Private\|Profile=Public\|LPort=3580\|App=C:\\Program Files (x86)\\National Instruments\\Shared\\nisvcloc\\nisvcloc.exe\|Name=NI Service Locator\|"	msiexec.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\{C229CA86-D1D2-4089-A45B-2E31E803BAF1} = "v2.10\|Action=Allow\|Active=TRUE\|Dir=In\|Protocol=17\|Profile=Private\|Profile=Public\|App=C:\\Program Files\\National Instruments\\Shared\\NI WebServer\\ApplicationWebServer.exe\|Name=NI Application Web Server (64-bit)\|"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\{4F08CF52-B016-4A68-944C-1304C9C0BE35} = "v2.10\|Action=Allow\|Active=TRUE\|Dir=In\|Protocol=6\|Profile=Private\|Profile=Public\|App=C:\\Program Files\\National Instruments\\Shared\\NI WebServer\\ApplicationWebServer.exe\|Name=NI Application Web Server (64-bit)\|"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\{CD4A55A3-AC69-4910-B11D-11764353D2A1} = "v2.10\|Action=Allow\|Active=TRUE\|Dir=In\|Protocol=17\|Profile=Private\|Profile=Public\|LPort=3581-3582\|App=C:\\Program Files (x86)\\National Instruments\\Shared\\NI WebServer\\SystemWebServer.exe\|Name=NI System Web Server\|"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\{8A3BB187-468E-4D84-9792-02A814D0A23C} = "v2.10\|Action=Allow\|Active=TRUE\|Dir=In\|Protocol=17\|Profile=Private\|Profile=Public\|LPort=3580\|App=C:\\Program Files (x86)\\National Instruments\\Shared\\nisvcloc\\nisvcloc.exe\|Name=NI Service Locator\|"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\{A9C2A7E2-75FE-4C61-8B15-6FCD44513AE3} = "v2.10\|Action=Allow\|Active=TRUE\|Dir=In\|Protocol=17\|Profile=Domain\|Profile=Private\|Profile=Public\|LPort=5353\|App=C:\\Program Files (x86)\\National Instruments\\Shared\\mDNS Responder\\nimdnsResponder.exe\|Name=NI mDNS Responder\|"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\{3B848BF1-A2CB-49D8-BEDD-6E15C4BDB929} = "v2.10\|Action=Allow\|Active=TRUE\|Dir=In\|Protocol=17\|Profile=Private\|Profile=Public\|App=C:\\Program Files (x86)\\National Instruments\\Shared\\NI WebServer\\ApplicationWebServer.exe\|Name=NI Application Web Server\|"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\{22EC3136-CADE-4416-9D77-F40268D55AD2} = "v2.10\|Action=Allow\|Active=TRUE\|Dir=In\|Protocol=6\|Profile=Private\|Profile=Public\|App=C:\\Program Files (x86)\\National Instruments\\Shared\\NI WebServer\\ApplicationWebServer.exe\|Name=NI Application Web Server\|"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\{E9F3CA92-CAD3-46F6-BDA4-C9D733553497} = "v2.10\|Action=Allow\|Active=TRUE\|Dir=In\|Protocol=6\|Profile=Private\|Profile=Public\|LPort=3581-3582\|App=C:\\Program Files (x86)\\National Instruments\\Shared\\NI WebServer\\SystemWebServer.exe\|Name=NI System Web Server\|"	msiexec.exe

Modifies Installed Components in the registry 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\software\WOW6432Node\microsoft\Active Setup\Installed Components	MSI1EC6.tmp

Sets service image path in registry 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NILM License Manager\ImagePath = "\"C:\\Program Files (x86)\\National Instruments\\Shared\\License Manager\\Bin\\lmgrd.exe\""	MsiExec.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

ACProtect 1.3x - 1.4x DLL software 9 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral4/files/0x00060000000233e3-731.dat	acprotect
behavioral4/files/0x00060000000233e3-732.dat	acprotect
behavioral4/files/0x00060000000233e3-730.dat	acprotect
behavioral4/files/0x00060000000233e2-742.dat	acprotect
behavioral4/files/0x00060000000233e2-743.dat	acprotect
behavioral4/files/0x00060000000233e2-744.dat	acprotect
behavioral4/files/0x00060000000233d9-745.dat	acprotect
behavioral4/files/0x00060000000233d9-746.dat	acprotect
behavioral4/files/0x00060000000233d9-747.dat	acprotect

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	NI_Circuit_Design_Suite_14_0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	autorun.exe

Executes dropped EXE 31 IoCs

pid	Process
4020	autorun.exe
2228	setup.exe
4280	uninst.exe
3100	usiBoomer.exe
1912	usireg.exe
4808	usireg.exe
4404	usireg.exe
2984	MsiExec.exe
3264	usireg.exe
532	usireg.exe
4664	usireg.exe
3836	usireg.exe
444	usireg.exe
4308	usireg.exe
3752	usiReg.exe
2536	MSI1EC6.tmp
632	MSI88A9.tmp
1280	nimdnsNSPTool.exe
4824	nimdnsNSPTool.exe
3388	MSI4336.tmp
4368	MSI4376.tmp
652	MSI4704.tmp
208	MSI8C04.tmp
4404	MSI929F.tmp
4772	HC51-lite-9.60.exe
4260	picc-9_82-win.exe
2852	nilmMessage.exe
1748	nilmMigration.exe
2484	NIUSScheduler.exe
3700	nierserver.exe
4608	NIUpdateService.exe

Loads dropped DLL 64 IoCs

pid	Process
4020	autorun.exe
4020	autorun.exe
2228	setup.exe
4516	MsiExec.exe
4516	MsiExec.exe
2228	setup.exe
2228	setup.exe
4516	MsiExec.exe
4516	MsiExec.exe
4516	MsiExec.exe
2228	setup.exe
2228	setup.exe
2228	setup.exe
2228	setup.exe
2228	setup.exe
2228	setup.exe
5068	MsiExec.exe
5068	MsiExec.exe
5068	MsiExec.exe
5068	MsiExec.exe
5068	MsiExec.exe
5068	MsiExec.exe
5068	MsiExec.exe
5068	MsiExec.exe
5068	MsiExec.exe
5068	MsiExec.exe
5068	MsiExec.exe
364	MsiExec.exe
364	MsiExec.exe
364	MsiExec.exe
364	MsiExec.exe
364	MsiExec.exe
364	MsiExec.exe
364	MsiExec.exe
364	MsiExec.exe
364	MsiExec.exe
364	MsiExec.exe
364	MsiExec.exe
3884	MsiExec.exe
3884	MsiExec.exe
3884	MsiExec.exe
3884	MsiExec.exe
3884	MsiExec.exe
3884	MsiExec.exe
3884	MsiExec.exe
3884	MsiExec.exe
3884	MsiExec.exe
3884	MsiExec.exe
5108	MsiExec.exe
5108	MsiExec.exe
5108	MsiExec.exe
5108	MsiExec.exe
5108	MsiExec.exe
5108	MsiExec.exe
5108	MsiExec.exe
5108	MsiExec.exe
5108	MsiExec.exe
1764	MsiExec.exe
1764	MsiExec.exe
1764	MsiExec.exe
1764	MsiExec.exe
1764	MsiExec.exe
1764	MsiExec.exe
1764	MsiExec.exe

Registers COM server for autorun 1 TTPs 64 IoCs

Registry Run Keys / Startup Folder

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{B9CD5ABA-72AB-42a1-B7F8-B0B510233A9E}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36F5B0A5-2343-11D3-8CBF-0050049FD5AD}\InprocServer32\ = "C:\\PROGRA~1\\NATION~1\\Shared\\nicontdt.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C1A4EE12-D37D-447C-BE42-3AF002F8EA17}\InprocServer32\ = "C:\\Program Files\\National Instruments\\Shared\\USI\\Bin\\gusiex.ocx"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0E9C272-65C7-42B2-83FF-CDE86BB882EA}\InprocServer32\ = "C:\\Program Files\\National Instruments\\Shared\\USI\\Bin\\gusiex.ocx"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{97C81FAE-7A51-11D2-938C-00A02411EBE6}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EBDD2042-F62A-414C-8A99-CF6D2B9B0861}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{15FA07EE-6DC2-4C05-A89B-58C120EFF513}\InprocServer32\ = "C:\\Program Files\\National Instruments\\Shared\\USI\\Bin\\DataStoreElements.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0E9C272-65C7-42B2-83FF-CDE86BB882EA}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{81124122-34F7-11D3-B548-444553540000}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6E9D01DB-FDF2-11D6-90EF-00C0F04C1E46}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5DB0D4A3-2D6C-452E-B289-B08A31344392}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{81124122-34F7-11D3-B548-444553540000}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{81124122-34F7-11D3-B548-444553540000}\InprocServer32\ = "C:\\PROGRA~1\\NATION~1\\Shared\\nicontdt.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{83AFA016-5FBE-44CA-9ECE-1EB404CE6D25}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B13C88F1-FB9F-48DB-875B-C126490B14B4}\InprocServer32\ = "C:\\Program Files\\National Instruments\\Shared\\USI\\Bin\\gusiex.ocx"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C7BDA319-B47A-485B-9BD0-15D5F530DE96}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EF298114-3E4A-482C-AF9D-CB53FD8D5563}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{97C81FAE-7A51-11D2-938C-00A02411EBE6}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{515CA62C-596B-439C-8E8D-269C6471C8C6}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{515CA62C-596B-439C-8E8D-269C6471C8C6}\LocalServer32\ThreadingModel = "free"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EBDD2042-F62A-414C-8A99-CF6D2B9B0861}\InprocServer32\ = "C:\\Program Files\\National Instruments\\Shared\\USI\\Bin\\DataStoreElements.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6E9D01DC-FDF2-11D6-90EF-00C0F04C1E46}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DAA4DFC5-10BC-11D2-9AE6-008048D99010}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DAA4DFC5-10BC-11D2-9AE6-008048D99010}\InprocServer32\ = "C:\\Program Files\\National Instruments\\Shared\\USI\\Bin\\iBrowXr.ocx"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{97C81FAE-7A51-11D2-938C-00A02411EBE6}\InprocServer32\ = "C:\\PROGRA~1\\NATION~1\\Shared\\nicontdt.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36F5B0A5-2343-11D3-8CBF-0050049FD5AD}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B9CD5ABA-72AB-42a1-B7F8-B0B510233A9E}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C7BDA319-B47A-485B-9BD0-15D5F530DE96}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5B115901-387C-11D3-8CC3-0050049FD5AD}\InprocServer32\ = "C:\\PROGRA~1\\NATION~1\\Shared\\nicontdt.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36F5B0A5-2343-11D3-8CBF-0050049FD5AD}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{B1F4583B-666A-4e5a-A807-EC33FD8F54BA}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ECF534A6-DD00-4409-B315-BF5532F8D17D}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EF7EB9D6-E4FA-483C-BF0E-C1A5096B0CCB}\InprocServer32\ = "C:\\Program Files\\National Instruments\\Shared\\USI\\Bin\\gusiex.ocx"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2A9C5836-05FB-4585-81AB-749687D8CBFB}\InprocServer32\ = "C:\\Program Files\\National Instruments\\Shared\\USI\\Bin\\DataStoreElements.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C80E9B61-47EC-4405-9A12-4615FCAC0A7F}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6E9D01DC-FDF2-11D6-90EF-00C0F04C1E46}\InprocServer32\ = "C:\\Program Files\\National Instruments\\Shared\\USI\\Bin\\gusiex.ocx"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3D5609B7-5304-11D7-9133-00C0F04C1E46}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6E9D01DB-FDF2-11D6-90EF-00C0F04C1E46}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{515CA62C-596B-439C-8E8D-269C6471C8C6}\LocalServer32\ = "C:\\PROGRA~3\\NATION~1\\MDF\\BinRTE\\MDFINT~1.EXE"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2A9C5836-05FB-4585-81AB-749687D8CBFB}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EF7EB9D6-E4FA-483C-BF0E-C1A5096B0CCB}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5DB0D4A3-2D6C-452E-B289-B08A31344392}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7E985DEE-3D20-11D2-A3EA-006008CA119A}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5B115901-387C-11D3-8CC3-0050049FD5AD}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{97C81FAE-7A51-11D2-938C-00A02411EBE6}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ECF534A6-DD00-4409-B315-BF5532F8D17D}\InprocServer32\ = "C:\\Program Files\\National Instruments\\Shared\\USI\\Bin\\DataStoreElements.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C1A4EE12-D37D-447C-BE42-3AF002F8EA17}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0E9C272-65C7-42B2-83FF-CDE86BB882EA}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{36F5B0A5-2343-11D3-8CBF-0050049FD5AD}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5B115901-387C-11D3-8CC3-0050049FD5AD}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2CA3575C-6F5C-4AEF-B15D-4397D28B7BE7}\InprocServer32\ = "C:\\Program Files\\National Instruments\\Shared\\USI\\Bin\\gusiex.ocx"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3D5609B7-5304-11D7-9133-00C0F04C1E46}\InprocServer32\ = "C:\\Program Files\\National Instruments\\Shared\\USI\\Bin\\gusiex.ocx"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1A548D30-04B7-4200-BCE5-5AE9E7B14238}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{50FA0387-CA6C-4165-AED3-D83B1C0C8F3C}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{15FA07EE-6DC2-4C05-A89B-58C120EFF513}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1818EF8-BCFE-448C-9391-272D4516658B}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EF298114-3E4A-482C-AF9D-CB53FD8D5563}\InprocServer32\ = "C:\\Program Files\\National Instruments\\Shared\\USI\\Bin\\STreer.ocx"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{81124122-34F7-11D3-B548-444553540000}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F9052D99-F6C6-44F1-A411-C55B0A73C546}\InprocServer32\ = "C:\\Program Files\\National Instruments\\Shared\\HelpAsst\\helpasst64.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1A548D30-04B7-4200-BCE5-5AE9E7B14238}\InprocServer32\ = "C:\\Program Files\\National Instruments\\Shared\\USI\\Bin\\DataStoreElements.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{50FA0387-CA6C-4165-AED3-D83B1C0C8F3C}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1818EF8-BCFE-448C-9391-272D4516658B}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2CA3575C-6F5C-4AEF-B15D-4397D28B7BE7}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DAA4DFC5-10BC-11D2-9AE6-008048D99010}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe

UPX packed file 43 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral4/files/0x00060000000233d1-666.dat	upx
behavioral4/files/0x00060000000233d1-667.dat	upx
behavioral4/memory/2228-668-0x0000000000400000-0x0000000000917000-memory.dmp	upx
behavioral4/memory/2228-727-0x0000000000400000-0x0000000000917000-memory.dmp	upx
behavioral4/memory/2228-728-0x0000000000400000-0x0000000000917000-memory.dmp	upx
behavioral4/memory/2228-729-0x0000000000400000-0x0000000000917000-memory.dmp	upx
behavioral4/files/0x00060000000233e3-731.dat	upx
behavioral4/files/0x00060000000233e3-732.dat	upx
behavioral4/files/0x00060000000233e3-730.dat	upx
behavioral4/memory/2228-733-0x0000000007F30000-0x0000000008250000-memory.dmp	upx
behavioral4/memory/2228-740-0x0000000000400000-0x0000000000917000-memory.dmp	upx
behavioral4/memory/2228-741-0x0000000007F30000-0x0000000008250000-memory.dmp	upx
behavioral4/files/0x00060000000233e2-742.dat	upx
behavioral4/files/0x00060000000233e2-743.dat	upx
behavioral4/files/0x00060000000233e2-744.dat	upx
behavioral4/files/0x00060000000233d9-745.dat	upx
behavioral4/files/0x00060000000233d9-746.dat	upx
behavioral4/files/0x00060000000233d9-747.dat	upx
behavioral4/memory/2228-748-0x00000000085D0000-0x000000000878A000-memory.dmp	upx
behavioral4/memory/2228-749-0x0000000000400000-0x0000000000917000-memory.dmp	upx
behavioral4/memory/2228-750-0x0000000007F30000-0x0000000008250000-memory.dmp	upx
behavioral4/memory/2228-752-0x0000000008790000-0x0000000008803000-memory.dmp	upx
behavioral4/memory/2228-753-0x00000000085D0000-0x000000000878A000-memory.dmp	upx
behavioral4/memory/2228-755-0x0000000000400000-0x0000000000917000-memory.dmp	upx
behavioral4/memory/2228-756-0x0000000007F30000-0x0000000008250000-memory.dmp	upx
behavioral4/memory/2228-757-0x00000000085D0000-0x000000000878A000-memory.dmp	upx
behavioral4/memory/2228-758-0x0000000008790000-0x0000000008803000-memory.dmp	upx
behavioral4/memory/2228-759-0x0000000000400000-0x0000000000917000-memory.dmp	upx
behavioral4/memory/2228-760-0x0000000007F30000-0x0000000008250000-memory.dmp	upx
behavioral4/memory/2228-787-0x0000000000400000-0x0000000000917000-memory.dmp	upx
behavioral4/memory/2228-789-0x00000000085D0000-0x000000000878A000-memory.dmp	upx
behavioral4/memory/2228-790-0x0000000008790000-0x0000000008803000-memory.dmp	upx
behavioral4/memory/2228-795-0x0000000000400000-0x0000000000917000-memory.dmp	upx
behavioral4/memory/2228-983-0x0000000000400000-0x0000000000917000-memory.dmp	upx
behavioral4/memory/2228-985-0x0000000007F30000-0x0000000008250000-memory.dmp	upx
behavioral4/memory/2228-986-0x00000000085D0000-0x000000000878A000-memory.dmp	upx
behavioral4/memory/2228-987-0x0000000008790000-0x0000000008803000-memory.dmp	upx
behavioral4/memory/2228-1470-0x0000000000400000-0x0000000000917000-memory.dmp	upx
behavioral4/memory/2228-1622-0x0000000000400000-0x0000000000917000-memory.dmp	upx
behavioral4/memory/2228-15362-0x0000000000400000-0x0000000000917000-memory.dmp	upx
behavioral4/memory/2228-15363-0x0000000007F30000-0x0000000008250000-memory.dmp	upx
behavioral4/memory/2228-15364-0x00000000085D0000-0x000000000878A000-memory.dmp	upx
behavioral4/memory/2228-15365-0x0000000008790000-0x0000000008803000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	setup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	NIUpdateService.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\I:	setup.exe
File opened (read-only)	\??\S:	setup.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	setup.exe
File opened (read-only)	\??\E:	setup.exe
File opened (read-only)	\??\L:	setup.exe
File opened (read-only)	\??\X:	setup.exe
File opened (read-only)	\??\Y:	setup.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	setup.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\F:	setup.exe
File opened (read-only)	\??\M:	setup.exe
File opened (read-only)	\??\Z:	setup.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\N:	setup.exe
File opened (read-only)	\??\O:	setup.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	setup.exe
File opened (read-only)	\??\G:	setup.exe
File opened (read-only)	\??\J:	setup.exe
File opened (read-only)	\??\R:	setup.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	setup.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\H:	setup.exe
File opened (read-only)	\??\K:	setup.exe
File opened (read-only)	\??\Q:	setup.exe
File opened (read-only)	\??\T:	setup.exe
File opened (read-only)	\??\U:	setup.exe
File opened (read-only)	\??\W:	setup.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Drops autorun.inf file 1 TTPs 1 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\National Instruments Downloads\NI Circuit Design Suite\14.0.0\Autorun.inf	NI_Circuit_Design_Suite_14_0.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\instrsup.dll	msiexec.exe
File created	C:\Windows\SysWOW64\cviUSI.dll	msiexec.exe
File created	C:\Windows\SysWOW64\nierInterface.dll	msiexec.exe
File created	C:\Windows\system32\nidscmem.dll	msiexec.exe
File created	C:\Windows\system32\nisysapi.dll	msiexec.exe
File created	C:\Windows\SysWOW64\cw3dgrph.dep	msiexec.exe
File created	C:\Windows\SysWOW64\cvirte\bin\msgrte.txt	msiexec.exe
File created	C:\Windows\system32\cvi_omp.dll	msiexec.exe
File created	C:\Windows\system32\cvirte\fonts\nisystem.ttf	msiexec.exe
File created	C:\Windows\SysWOW64\lkstime.dll	msiexec.exe
File created	C:\Windows\SysWOW64\lksec.dll	msiexec.exe
File created	C:\Windows\SysWOW64\lksock.dll	msiexec.exe
File created	C:\Windows\SysWOW64\cvirte\fonts\nisystem.ttf	msiexec.exe
File created	C:\Windows\system32\cvirte\bin\English\cviengerror.ver	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\SET1ECF.tmp	MSI1EC6.tmp
File opened for modification	C:\Windows\SysWOW64\SET1F32.tmp	MSI1EC6.tmp
File created	C:\Windows\system32\nimdnsResponder.dll	msiexec.exe
File created	C:\Windows\system32\lkobenv.dll	msiexec.exe
File created	C:\Windows\SysWOW64\cvirte\bin\cvirte.rsc	msiexec.exe
File created	C:\Windows\SysWOW64\NIScale.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\SET1D3D.tmp	MSI1EC6.tmp
File created	C:\Windows\SysWOW64\SET1D5E.tmp	MSI1EC6.tmp
File opened for modification	C:\Windows\SysWOW64\SET1F21.tmp	MSI1EC6.tmp
File created	C:\Windows\SysWOW64\SET1FF0.tmp	MSI1EC6.tmp
File opened for modification	C:\Windows\SysWOW64\SET2073.tmp	MSI1EC6.tmp
File created	C:\Windows\SysWOW64\cw3dgrph.ocx	msiexec.exe
File created	C:\Windows\SysWOW64\cvintwrk.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\SET1E2E.tmp	MSI1EC6.tmp
File created	C:\Windows\system32\lkdynam.dll	msiexec.exe
File created	C:\Windows\system32\lkproc.dll	msiexec.exe
File created	C:\Windows\system32\nirpc.ini	msiexec.exe
File created	C:\Windows\SysWOW64\cvirte\bin\English\cvierror.txt	msiexec.exe
File created	C:\Windows\system32\cvirte\bin\msgrte.txt	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\SET1F52.tmp	MSI1EC6.tmp
File created	C:\Windows\SysWOW64\SET1F52.tmp	MSI1EC6.tmp
File created	C:\Windows\SysWOW64\cvitdms.dll	msiexec.exe
File created	C:\Windows\system32\cvitdms.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp71.dll	msiexec.exe
File created	C:\Windows\SysWOW64\comctl32.ocx	msiexec.exe
File created	C:\Windows\SysWOW64\msstkprp.dll	msiexec.exe
File created	C:\Windows\system32\logos_scs_wrapper.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\SET2001.tmp	MSI1EC6.tmp
File created	C:\Windows\SysWOW64\mfc71.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\SET1EEF.tmp	MSI1EC6.tmp
File created	C:\Windows\SysWOW64\nirpc.ini	msiexec.exe
File created	C:\Windows\SysWOW64\msvcr71.dll	msiexec.exe
File created	C:\Windows\system32\cviUSI.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc71.dll	msiexec.exe
File created	C:\Windows\system32\lksec.dll	msiexec.exe
File created	C:\Windows\system32\nirpc.dll	msiexec.exe
File created	C:\Windows\SysWOW64\cvi_omp.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp71.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc71u.dll	msiexec.exe
File created	C:\Windows\SysWOW64\SET1F00.tmp	MSI1EC6.tmp
File created	C:\Windows\SysWOW64\lookout.sec	msiexec.exe
File created	C:\Windows\SysWOW64\lkads.exe	msiexec.exe
File created	C:\Windows\system32\instrsup.dll	msiexec.exe
File created	C:\Windows\SysWOW64\lkhistdl.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\SET1E9F.tmp	MSI1EC6.tmp
File created	C:\Windows\SysWOW64\SET2073.tmp	MSI1EC6.tmp
File opened for modification	C:\Windows\SysWOW64\msstkprp.dll	msiexec.exe
File created	C:\Windows\system32\lkrealt.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\SET1E4E.tmp	MSI1EC6.tmp
File opened for modification	C:\Windows\SysWOW64\SET1F00.tmp	MSI1EC6.tmp

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2013\models\tab.ptc	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Circuit Design Suite 14.0\buttons\DIN\FAMILY\IDC_DSW.BMP	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Circuit Design Suite 14.0\MPASM Suite\LKR\16f946_g.lkr	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\MDF\Legal\license\DotNet35\DotNet 3.5 License Agreement - Korean.rtf	MsiExec.exe
File created	C:\Program Files (x86)\National Instruments\Circuit Design Suite 14.0\buttons\DIN\FAMILY\RPACKD.BMP	msiexec.exe
File created	C:\Program Files (x86)\HI-TECH Software\PICC\9.82\lib\eeprom\ee16f1782-p.lpp	picc-9_82-win.exe
File created	C:\Program Files (x86)\HI-TECH Software\PICC\9.82\samples\BootLoaderDemo\bootldr.h	picc-9_82-win.exe
File created	C:\Program Files (x86)\HI-TECH Software\PICC\9.82\samples\A2Demo\adc.h	picc-9_82-win.exe
File created	C:\Program Files (x86)\National Instruments\Shared\MDF\Legal\license\NIReleased\NI Released License Agreement - Japanese.rtf	MsiExec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\MDF\Legal\license\Oscilloscope Instrument Design Library\NI Oscilloscope Instrument Design Library License - English.rtf	MsiExec.exe
File created	C:\Program Files (x86)\National Instruments\Circuit Design Suite 14.0\MPASM Suite\Template\Object\16CE623TMPO.ASM	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Circuit Design Suite 14.0\MPASM Suite\P18F4321.INC	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Circuit Design Suite 14.0\MPASM Suite\LKR\12ce519_g.lkr	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Circuit Design Suite 14.0\Spiceifs.dll	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Circuit Design Suite 14.0\stringfiles\English\sharutil.ewstr	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Circuit Design Suite 14.0\MPASM Suite\LKR\16c715_g.lkr	msiexec.exe
File created	C:\Program Files (x86)\HI-TECH Software\HC51\9.60\include\saa56xx.h	HC51-lite-9.60.exe
File created	C:\Program Files (x86)\National Instruments\Circuit Design Suite 14.0\modelmk\Transf_Ideal.dll	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Circuit Design Suite 14.0\MPASM Suite\LKR\17c44_g.lkr	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Circuit Design Suite 14.0\stringfiles\German\Autoroute.ewstr	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2013\variable\props\varprop.xsd	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Circuit Design Suite 14.0\buttons\ANSI\FAMILY\FUSE_SW.BMP	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Circuit Design Suite 14.0\buttons\ANSI\FAMILY\3TEN_SW.BMP	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Circuit Design Suite 14.0\buttons\DIN\FAMILY\ZEN_DSW.BMP	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Circuit Design Suite 14.0\MPASM Suite\LKR\18lf25j11_g.lkr	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2013\webserver\LVModules\lvsnapshotmodule.dll	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Circuit Design Suite 14.0\MPASM Suite\P18F8390.INC	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\MDF\Manifests\NI LabWindows_CVI 2013 SP2 TDM Streaming Library {00BD6260-2A45-423C-9150-2D1516BD96B3}.xml	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Circuit Design Suite 14.0\MPASM Suite\Template\Code\16F76TEMP.ASM	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2013\models\pb_h.ptc	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\USI\Bin\SQLDriv.ocx	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Circuit Design Suite 14.0\MPASM Suite\Template\Code\RF509AFTEMP.ASM	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\MDF\Legal\license\Xilinx\Vivado2013.4\Xilinx Unified Third Party - English.rtf	MsiExec.exe
File created	C:\Program Files (x86)\HI-TECH Software\HC51\9.60\include\sd30c26x.h	HC51-lite-9.60.exe
File created	C:\Program Files (x86)\HI-TECH Software\PICC\9.82\include\cas16c55.h	picc-9_82-win.exe
File opened for modification	C:\Program Files (x86)\National Instruments\Shared\MDF\Legal\license\MPL\	MsiExec.exe
File created	C:\Program Files (x86)\National Instruments\Circuit Design Suite 14.0\buttons\ANSI\FAMILY\FWB_SW.BMP	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Circuit Design Suite 14.0\MPASM Suite\P18LF45J10.INC	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Circuit Design Suite 14.0\MetaLinkAsm\MOD451	msiexec.exe
File created	C:\Program Files (x86)\HI-TECH Software\HC51\9.60\lib\51--nll.lib	HC51-lite-9.60.exe
File created	C:\Program Files (x86)\National Instruments\Shared\MDF\Legal\license\HDF\HDF5\HDF5License.rtf	MsiExec.exe
File created	C:\Program Files (x86)\National Instruments\Circuit Design Suite 14.0\buttons\DIN\FAMILY\CMP_DSW.BMP	msiexec.exe
File created	C:\Program Files (x86)\HI-TECH Software\PICC\9.82\include\cas12c508.h	picc-9_82-win.exe
File created	C:\Program Files (x86)\National Instruments\Circuit Design Suite 14.0\MPASM Suite\P18F8622.INC	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Circuit Design Suite 14.0\MPASM Suite\LKR\18f4321_g.lkr	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2013\dialog\variable\types\SCT 023 Array of UInt64.ctl	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2014\dialog\variable\types\SCT 020 Array of Int32.ctl.png	msiexec.exe
File created	C:\Program Files\National Instruments\Shared\USI\Bin\STreer.ocx	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Circuit Design Suite 14.0\config\class6.tc7	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\License Manager\Bin\readmeDeu-nilm.html	msiexec.exe
File created	C:\Program Files (x86)\HI-TECH Software\PICC\9.82\include\as16f676.h	picc-9_82-win.exe
File opened for modification	C:\Program Files (x86)\National Instruments\Shared\MDF\Legal\license\CRC32\	MsiExec.exe
File opened for modification	C:\Program Files (x86)\National Instruments\Shared\MDF\Legal\license\LVWSN\	MsiExec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\MDF\Legal\license\ImageMagick\1.0.0\ImageMagick 1.0 License - English.pdf	MsiExec.exe
File opened for modification	C:\Program Files (x86)\National Instruments\Shared\MDF\Legal\license\MSPermissive\1.0.0\	MsiExec.exe
File created	C:\Program Files (x86)\National Instruments\Circuit Design Suite 14.0\buttons\DIN\FAMILY\5TAMPDSW.BMP	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2013\Framework\Providers\Icons\sampleoverlay2.png	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Circuit Design Suite 14.0\buttons\DIN\FAMILY\SW_DSW.BMP	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Circuit Design Suite 14.0\stringfiles\German\OscilloscopeManager_AT_SnapIn.ewstr	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Circuit Design Suite 14.0\MPASM Suite\Example\tut452.asm	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\LabVIEW Run-Time\2013\dialog\variable\Qt\plugins\alarming\vdlgalrm.dll	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Circuit Design Suite 14.0\MPASM Suite\P16F785.INC	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Shared\Network Variable\ninetv.dll	msiexec.exe
File created	C:\Program Files (x86)\National Instruments\Circuit Design Suite 14.0\MPASM Suite\P16F83.INC	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSICFC9.tmp	msiexec.exe
File created	C:\Windows\Installer\e5d9cc4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6C35.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\3CE495CBCA17FFE40940D2BA9E7CD9A7\14.1.101\mfc71u.dll.C2974737_6E36_4F25_AE3D_AE3111AD5EC7	msiexec.exe
File created	C:\Windows\Installer\SourceHash{369C78CD-B38C-40B7-B116-A8EF413CEDC6}	msiexec.exe
File opened for modification	C:\Windows\Installer\e5d9d3a.msi	msiexec.exe
File created	C:\Windows\Installer\e5d9da4.msi	msiexec.exe
File created	C:\Windows\Installer\e5d9e1e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5d9e41.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\3CE495CBCA17FFE40940D2BA9E7CD9A7\14.1.101\msvcr71.dll.3225627B_FD88_482B_9436_5376DA6DF9E6	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230317030820896.0\mfc90chs.dll	msiexec.exe
File opened for modification	C:\Windows\assembly\pubpol24.dat	msiexec.exe
File opened for modification	C:\Windows\assembly\pubpol27.dat	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1781.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9C9E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI10A7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2D65.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230317030821021.0\9.0.30729.5054.cat	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\448A5CFAA3AC6654987EE3426EFA9F3A\10.0.100\F_CENTRAL_vcomp100_x64.BFF61907_AA2D_3A26_8666_98D956A62ABC	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\7AF3722FC7117D34DB95000B52354524\10.0.100\F_CENTRAL_msvcp100_x86.AFA96EB4_FA9F_335C_A7CB_36079407553D	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA304.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAF47.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5d9d31.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5d9d64.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4F38.tmp	msiexec.exe
File created	C:\Windows\assembly\pubpol40.dat	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4E4A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4E5B.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{956DC995-1997-43DC-ACFA-EA31652D6131}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB601.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230317030820443.0\msvcp90.dll	msiexec.exe
File created	C:\Windows\Installer\SourceHash{27E16AD2-391D-4078-BF7F-077CBAB6E2CA}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFFF7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA34B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3D6E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI442D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID5FA.tmp	msiexec.exe
File created	C:\Windows\Installer\e5d9cd8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91644F7EB21AC7044AEAE95882E03FBA\13.1.125	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3726.tmp	msiexec.exe
File created	C:\Windows\assembly\tmp\HC165HB2\GemBox.Spreadsheet.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4634.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB208.tmp	msiexec.exe
File created	C:\Windows\Installer\e5d9e58.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A1248570-7C3B-467B-B6A7-3CA1F720EE09}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI843D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7CF4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5BFD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5d9db9.msi	msiexec.exe
File created	C:\Windows\Installer\e5d9cdc.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{80D288F4-FC24-4A66-86DB-5807068C3645}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC2B5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\448A5CFAA3AC6654987EE3426EFA9F3A\10.0.100\F_CENTRAL_msvcr100_x64.BFF61907_AA2D_3A26_8666_98D956A62ABC	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAD05.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF7A4.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{2B2BC0C2-C36B-4DC9-9DAE-E003180470BD}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI51E5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEA21.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI15AB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDCA7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE7F7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE913.tmp	msiexec.exe
File created	C:\Windows\Installer\e5d9d78.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5d9db1.msi	msiexec.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4016	sc.exe
3952	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{14EA1427-B71C-11D3-A126-006097B79EFD}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{14EA142A-B71C-11D3-A126-006097B79EFD}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6F25F9F8-C870-4811-BD08-05D92D157CEE}\Compatibility Flags = "1024"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{D5AC7921-F16E-11D0-BB3E-006097B77FF4}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{A7244E66-5F5F-4DA2-95B0-2EEE3F455C9A}\AlternateCLSID = "{7B0793B4-BC9F-48F3-B7D8-957C05F2342E}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{638BA9A7-5F8A-4254-0DB6-F756DEA0F756}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{76BE52CF-1314-4524-8480-5E6F6F904E52}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6A7A1B8D-EE6E-4509-A2E3-33E31207CE01}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{780F8DA3-6623-11D3-B034-00A024D8324D}\Compatibility Flags = "1024"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F75736FD-F925-4C6C-97F6-FFF31200D209}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{97F3BD7F-1FB2-4750-A9C4-348405CA2256}\Compatibility Flags = "1024"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{721D7011-F66A-11D1-947E-006008CA11C5}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{E1360549-CAF3-4C4E-AE15-E62B0EF5FB42}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{334D93A7-66D0-49B4-B51F-481FCAE6C6AC}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{14EA1425-B71C-11D3-A126-006097B79EFD}\Compatibility Flags = "1024"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{5B483B99-B335-11D3-A122-006097B79EFD}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{765BFCE0-EC4D-11CE-9C82-0020AF6845F6}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{B4D990A1-0620-4337-B805-DD3B10133EA3}\Compatibility Flags = "1024"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{B5D82F02-9D44-4C8C-AA10-C4193B575C5A}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{5B483B94-B335-11D3-A122-006097B79EFD}\Compatibility Flags = "1024"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{8D5CEF0A-26DA-4C49-B275-89C8FAB21538}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{780F8DA3-6623-11D3-B034-00A024D8324D}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{C6EE8845-9F64-4E54-B783-1B5B59E4FFDE}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F7A7C71B-246C-4B62-B3A2-40666F95BB8D}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{2C52B999-2F4C-4F42-9F7B-911D9EA6C7AB}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{924B3A15-0FF0-4AC4-8499-170C7CE3C63E}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{FC1B9916-351E-488E-8F43-AC242C3E6B4E}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F2D73C46-C308-4666-8CB4-B54E84132E4C}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{17301DA3-C84D-11CF-AE6F-0020AF31CEF9}\Compatibility Flags = "1024"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{2474BDF4-02F4-4DA2-9CB8-A00685079351}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{574DF87B-96CC-4EB0-BBBE-0E9B1F1FF8ED}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{A5BA6A4D-1DFC-4122-A985-EC1601341FB9}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F75736FD-F925-4C6C-97F6-FFF31200D209}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{57A5CDC6-AFA4-40C2-A76C-C858A718F92D}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{7064282D-8BD4-42A3-AFCC-069D49EBF28C}\Compatibility Flags = "1024"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{A6CC68EF-F165-4EDC-AF64-DB6193F18713}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{B6278523-81C8-4EAD-8D5D-8F074C989B09}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{26A963E0-5DFD-49BF-8B14-9692EE5CFC18}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{7F8F83B0-AD5A-11D1-B66E-00A024D63828}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{830F2C9C-6664-46DE-9EA5-B2A35E1AE1E4}\Compatibility Flags = "1024"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{20C4591C-52D1-44BE-932F-39896DDDF4BC}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F2375F04-B71B-11D3-A126-006097B79EFD}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{14EA1428-B71C-11D3-A126-006097B79EFD}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{D03C059F-EED8-4551-B2C6-D9D9400BF734}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{9988331B-A409-4474-8342-18F886FE2939}\Compatibility Flags = "1024"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CAAC7369-A5F8-41F5-B680-B905B8470A4A}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{550149C0-7F25-43DE-8C77-7CB14B4CF7D9}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{C10CCDD0-3A41-40C1-BE43-CA81200ABDF4}\Compatibility Flags = "1024"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{FC1B9916-351E-488E-8F43-AC242C3E6B4E}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6C95BC5B-4175-4C88-BD64-BCE11A180D40}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{5B483B99-B335-11D3-A122-006097B79EFD}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{5B483B9A-B335-11D3-A122-006097B79EFD}\Compatibility Flags = "1024"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{D9CF7AEB-28FB-11D0-8B73-0020AF31CEF9}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{82D34D1D-3F01-4802-BB4F-03AA18799097}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{8A593D8D-758F-42C4-A585-5534DF8FBDCE}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F2375F04-B71B-11D3-A126-006097B79EFD}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{D5AC7929-F16E-11D0-BB3E-006097B77FF4}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{7F6E4E41-993C-11D0-B979-0020AFE6BEB3}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{06E87949-A0CA-4E53-BA68-00E990A14DE1}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{08142A91-D50C-4B55-84E3-C386C1962D70}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{14D72A71-ED6F-11D0-B559-00A024D63828}\Compatibility Flags = "1024"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{9988331B-A409-4474-8342-18F886FE2939}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{ADBF7240-2B8D-11D1-B5C5-00A024D63828}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{DF1F2BE9-A3D5-49BC-86AF-C38356FB966C}\Compatibility Flags = "1024"	msiexec.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\73	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\44	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\79	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\38	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\4E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\31	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\57	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\64	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\36	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\48	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\54	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\6d	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\7e	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\42	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\5A	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\68	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\34	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\4e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\52	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\70	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\79	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2D	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\3B	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\40	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\42	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\6E	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\35	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\65	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\68	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\25	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\4a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\5D	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\7D	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\7a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\65	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\31	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\32	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\35	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\3E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\74	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\74	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\6F	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\60	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\67	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\38	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\44	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\4d	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\50	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\53	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\78	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\3F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\5d	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{1F85F222-22D7-4C45-9ACE-3E98B0BF1DBB}\ProxyStubClsid	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\49E00E7087A7AF04B9FE171C099E0814\MFC.MIFVC08X64 = "VC2008MSMs_x64.MIFVC08X64"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7AF3722FC7117D34DB95000B52354524\SourceList\LastUsedSource = "n;1;C:\\National Instruments Downloads\\NI Circuit Design Suite\\14.0.0\\Products\\VC2010MSMs\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2A1D7661-205F-46B3-B5C8-2E2CE8C0693B}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E3674E674CD05914CB05801439FF8AB4\7290BDEE8DB3943458E624A541C66C08	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9ED94441-E5E8-101B-B9B5-444553540000}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{7791BA60-E020-11CF-8E74-00A0C90F26F8}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\77823FDFC6B376D4183A8775BCFA1401\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2AFA9F10-0B6A-11D2-A250-00A024D8324D}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3DED18CA-8529-4D20-9D08-9986A061A5BD}\TypeLib	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6431C219-69D8-4A3A-9D02-539F051BAA81}\1.0\HELPDIR	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\FC230D445EA3B524BA84885444075C45\B63868D7AFFE37B479C65E4EEA1917AD	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F3AF50F7-2633-4720-BE5E-752CDDCBB7C8}\TypeLib	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\897B434E28B0C6548B20B6B2F3CE3A4B\SourceList\LastUsedSource = "n;1;C:\\National Instruments Downloads\\NI Circuit Design Suite\\14.0.0\\Products\\UpdateService\\Updat00\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ms7file\ = "Multisim 7 Design File"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0000003B-0000-0010-8000-00AA006D2EA4}\ = "Workspaces"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9256BC3E93CF5E64CAD69AD72D1E82F6\NIMUFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\NiReports.ReportTableColumns\CurVer	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5B115901-387C-11D3-8CC3-0050049FD5AD}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{B9CD5ABA-72AB-42a1-B7F8-B0B510233A9E}\VersionIndependentProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{0713E451-850A-101B-AFC0-4210102A8DA7}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{46E1F5FB-D0EA-4F7E-8E51-B345043AA885}\TypeLib	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{515CA62C-596B-439C-8E8D-269C6471C8C6}\VersionIndependentProgID\ = "MdfInterop.MdfInteropServer"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A93F8B81-BD2A-4B02-930B-89AE830BE28C}\1.0\0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\897B434E28B0C6548B20B6B2F3CE3A4B\SourceList\Net\1 = "C:\\National Instruments Downloads\\NI Circuit Design Suite\\14.0.0\\Products\\UpdateService\\Updat00\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00000029-0000-0010-8000-00AA006D2EA4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4B778A5EFC851524D84F9A83694FBB56\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{F4D83602-895E-11D0-B0A6-000000000000}\ProxyStubClsid	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1CF6D074207D9E04EA62CCD8512C03DE\CoreDLLs.EWB.CORE.140	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1C319B6023C16EF4F82ED02EEC9CFBAD\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D293872FE74576E4DAC152672C58B205	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\NI.HelpAssistant	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\92DCC21F930F9C04C9A2973F89DB58B7\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A7501A3C5A6269843AD907D0E63CCB49\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F32E05B0-15B6-11D2-A253-00A024D8324D}	MsiExec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\NI.HelpAssistant.1\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\17DCB08BFBD72DE4A9652BE31C3A1563\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D5C01ACACDB90BC49A7635C9B5620DF9\SourceList\LastUsedSource = "n;1;C:\\National Instruments Downloads\\NI Circuit Design Suite\\14.0.0\\Products\\Remote_Configuration\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ms7file\DefaultIcon	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\217AE181260279A418C4C1243D24D94A\Version = "234881241"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\935EB16E0AAED644B92338079FA9133A\ProductName = "NI LabWindows/CVI 2013 SP2 Analysis Library (64-bit)"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{50FA0387-CA6C-4165-AED3-D83B1C0C8F3C}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\8CC5A66A5BEE2894B8295F19FA6360E0\6908EE0AF55E2E746A2E7CCCA0DA0222	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3067962563D3DDB47A006866A704AB59\SourceList\LastUsedSource = "n;1;C:\\National Instruments Downloads\\NI Circuit Design Suite\\14.0.0\\Products\\UpdateService\\Updat01\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8CC6DF2F5E283DD439A3CDE7F036E655	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\95A27E13445FC934D982710C068B6A7C\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3CE495CBCA17FFE40940D2BA9E7CD9A7\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5DB0D4A3-2D6C-452E-B289-B08A31344392}\Version	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CC50580F7AE8184C9547BE4AD27728F\SourceList\LastUsedSource = "n;1;C:\\National Instruments Downloads\\NI Circuit Design Suite\\14.0.0\\Products\\VC2008MSMs_Redist\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\oeclfile\shell\Open\command\ = "\"C:\\Program Files (x86)\\National Instruments\\Circuit Design Suite 14.0\\multisim.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{58DA8D8C-9D6A-101B-AFC0-4210102A8DA7}\TypeLib\Version = "1.3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{056E6C72-146F-4876-9CF0-9BCC4E989E4E}\ProxyStubClsid32	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.CRT,version="9.0.30729.4148",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32-policy" = 650037006700560073005d003d006500660038004a004f0045007900520053006e004f003d0060004c0056005200540045002e004c0056002e0052005400450032003000310033003e0036007d0040005900620030003000420024003400710028003200760079005d0046002b007e002e0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NICITUSI.USIConfigDlgVIL.1	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{5405109A-FA63-4EF7-BC33-622A8CA0BFFA}\TypeLib	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B7A1789CA7C6AA4A8DED41DF1BED8D5\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A0780178-D29A-46D2-AD3A-025DA9326960}\TypeLib	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A40B0AD4-B50E-4E58-8A1D-8544233807B5}\Implemented Categories\	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0713E8D1-850A-101B-AFC0-4210102A8DA7}\ = "IProgressBarEvents"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1A548D30-04B7-4200-BCE5-5AE9E7B14238}\ProgID\ = "USI.DataStoretextQuery"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\49E00E7087A7AF04B9FE171C099E0814	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D96-9D6A-101B-AFC0-4210102A8DA7}\InprocServer32\InprocServer32 = 650037006700560073005d003d006500660038004a004f0045007900520053006e004f003d0060004c0056005200540045002e004c0056002e0052005400450032003000310033003e0078007500500069007300490067006f00660028003200720039006500660047006a0079006f00310000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7791BA42-E020-11CF-8E74-00A0C90F26F8}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\USI.DataStoreResultsDisplay.1	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2972	msiexec.exe
Token: SeCreateTokenPrivilege	2228	setup.exe
Token: SeAssignPrimaryTokenPrivilege	2228	setup.exe
Token: SeLockMemoryPrivilege	2228	setup.exe
Token: SeIncreaseQuotaPrivilege	2228	setup.exe
Token: SeMachineAccountPrivilege	2228	setup.exe
Token: SeTcbPrivilege	2228	setup.exe
Token: SeSecurityPrivilege	2228	setup.exe
Token: SeTakeOwnershipPrivilege	2228	setup.exe
Token: SeLoadDriverPrivilege	2228	setup.exe
Token: SeSystemProfilePrivilege	2228	setup.exe
Token: SeSystemtimePrivilege	2228	setup.exe
Token: SeProfSingleProcessPrivilege	2228	setup.exe
Token: SeIncBasePriorityPrivilege	2228	setup.exe
Token: SeCreatePagefilePrivilege	2228	setup.exe
Token: SeCreatePermanentPrivilege	2228	setup.exe
Token: SeBackupPrivilege	2228	setup.exe
Token: SeRestorePrivilege	2228	setup.exe
Token: SeShutdownPrivilege	2228	setup.exe
Token: SeDebugPrivilege	2228	setup.exe
Token: SeAuditPrivilege	2228	setup.exe
Token: SeSystemEnvironmentPrivilege	2228	setup.exe
Token: SeChangeNotifyPrivilege	2228	setup.exe
Token: SeRemoteShutdownPrivilege	2228	setup.exe
Token: SeUndockPrivilege	2228	setup.exe
Token: SeSyncAgentPrivilege	2228	setup.exe
Token: SeEnableDelegationPrivilege	2228	setup.exe
Token: SeManageVolumePrivilege	2228	setup.exe
Token: SeImpersonatePrivilege	2228	setup.exe
Token: SeCreateGlobalPrivilege	2228	setup.exe
Token: SeCreateTokenPrivilege	2228	setup.exe
Token: SeAssignPrimaryTokenPrivilege	2228	setup.exe
Token: SeLockMemoryPrivilege	2228	setup.exe
Token: SeIncreaseQuotaPrivilege	2228	setup.exe
Token: SeMachineAccountPrivilege	2228	setup.exe
Token: SeTcbPrivilege	2228	setup.exe
Token: SeSecurityPrivilege	2228	setup.exe
Token: SeTakeOwnershipPrivilege	2228	setup.exe
Token: SeLoadDriverPrivilege	2228	setup.exe
Token: SeSystemProfilePrivilege	2228	setup.exe
Token: SeSystemtimePrivilege	2228	setup.exe
Token: SeProfSingleProcessPrivilege	2228	setup.exe
Token: SeIncBasePriorityPrivilege	2228	setup.exe
Token: SeCreatePagefilePrivilege	2228	setup.exe
Token: SeCreatePermanentPrivilege	2228	setup.exe
Token: SeBackupPrivilege	2228	setup.exe
Token: SeRestorePrivilege	2228	setup.exe
Token: SeShutdownPrivilege	2228	setup.exe
Token: SeDebugPrivilege	2228	setup.exe
Token: SeAuditPrivilege	2228	setup.exe
Token: SeSystemEnvironmentPrivilege	2228	setup.exe
Token: SeChangeNotifyPrivilege	2228	setup.exe
Token: SeRemoteShutdownPrivilege	2228	setup.exe
Token: SeUndockPrivilege	2228	setup.exe
Token: SeSyncAgentPrivilege	2228	setup.exe
Token: SeEnableDelegationPrivilege	2228	setup.exe
Token: SeManageVolumePrivilege	2228	setup.exe
Token: SeImpersonatePrivilege	2228	setup.exe
Token: SeCreateGlobalPrivilege	2228	setup.exe
Token: SeCreateTokenPrivilege	2228	setup.exe
Token: SeAssignPrimaryTokenPrivilege	2228	setup.exe
Token: SeLockMemoryPrivilege	2228	setup.exe
Token: SeIncreaseQuotaPrivilege	2228	setup.exe
Token: SeMachineAccountPrivilege	2228	setup.exe

Suspicious use of SetWindowsHookEx 32 IoCs

pid	Process
4020	autorun.exe
4020	autorun.exe
2228	setup.exe
2228	setup.exe
2228	setup.exe
2228	setup.exe
2228	setup.exe
2228	setup.exe
2228	setup.exe
2228	setup.exe
2228	setup.exe
2228	setup.exe
2228	setup.exe
2228	setup.exe
2228	setup.exe
2228	setup.exe
2228	setup.exe
2228	setup.exe
2228	setup.exe
2228	setup.exe
2228	setup.exe
2228	setup.exe
4280	uninst.exe
2228	setup.exe
2852	nilmMessage.exe
2228	setup.exe
2228	setup.exe
2484	NIUSScheduler.exe
2484	NIUSScheduler.exe
2228	setup.exe
2228	setup.exe
4316	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 4020	2368	NI_Circuit_Design_Suite_14_0.exe	102
PID 2368 wrote to memory of 4020	2368	NI_Circuit_Design_Suite_14_0.exe	102
PID 2368 wrote to memory of 4020	2368	NI_Circuit_Design_Suite_14_0.exe	102
PID 4020 wrote to memory of 2228	4020	autorun.exe	103
PID 4020 wrote to memory of 2228	4020	autorun.exe	103
PID 4020 wrote to memory of 2228	4020	autorun.exe	103
PID 2972 wrote to memory of 4516	2972	msiexec.exe	106
PID 2972 wrote to memory of 4516	2972	msiexec.exe	106
PID 2972 wrote to memory of 4516	2972	msiexec.exe	106
PID 2972 wrote to memory of 5068	2972	msiexec.exe	107
PID 2972 wrote to memory of 5068	2972	msiexec.exe	107
PID 2972 wrote to memory of 5068	2972	msiexec.exe	107
PID 2972 wrote to memory of 4280	2972	msiexec.exe	108
PID 2972 wrote to memory of 4280	2972	msiexec.exe	108
PID 2972 wrote to memory of 4280	2972	msiexec.exe	108
PID 2972 wrote to memory of 364	2972	msiexec.exe	109
PID 2972 wrote to memory of 364	2972	msiexec.exe	109
PID 2972 wrote to memory of 364	2972	msiexec.exe	109
PID 2972 wrote to memory of 3884	2972	msiexec.exe	110
PID 2972 wrote to memory of 3884	2972	msiexec.exe	110
PID 2972 wrote to memory of 3884	2972	msiexec.exe	110
PID 2972 wrote to memory of 5108	2972	msiexec.exe	111
PID 2972 wrote to memory of 5108	2972	msiexec.exe	111
PID 2972 wrote to memory of 5108	2972	msiexec.exe	111
PID 2972 wrote to memory of 1764	2972	msiexec.exe	112
PID 2972 wrote to memory of 1764	2972	msiexec.exe	112
PID 2972 wrote to memory of 1764	2972	msiexec.exe	112
PID 2972 wrote to memory of 2544	2972	msiexec.exe	115
PID 2972 wrote to memory of 2544	2972	msiexec.exe	115
PID 2972 wrote to memory of 2544	2972	msiexec.exe	115
PID 2972 wrote to memory of 60	2972	msiexec.exe	116
PID 2972 wrote to memory of 60	2972	msiexec.exe	116
PID 2972 wrote to memory of 60	2972	msiexec.exe	116
PID 2972 wrote to memory of 3292	2972	msiexec.exe	117
PID 2972 wrote to memory of 3292	2972	msiexec.exe	117
PID 2972 wrote to memory of 3292	2972	msiexec.exe	117
PID 2972 wrote to memory of 3976	2972	msiexec.exe	120
PID 2972 wrote to memory of 3976	2972	msiexec.exe	120
PID 2972 wrote to memory of 3976	2972	msiexec.exe	120
PID 2972 wrote to memory of 1536	2972	msiexec.exe	121
PID 2972 wrote to memory of 1536	2972	msiexec.exe	121
PID 2972 wrote to memory of 1536	2972	msiexec.exe	121
PID 2972 wrote to memory of 5100	2972	msiexec.exe	123
PID 2972 wrote to memory of 5100	2972	msiexec.exe	123
PID 2972 wrote to memory of 5100	2972	msiexec.exe	123
PID 2972 wrote to memory of 3700	2972	msiexec.exe	124
PID 2972 wrote to memory of 3700	2972	msiexec.exe	124
PID 2972 wrote to memory of 3700	2972	msiexec.exe	124
PID 2972 wrote to memory of 2768	2972	msiexec.exe	125
PID 2972 wrote to memory of 2768	2972	msiexec.exe	125
PID 2972 wrote to memory of 2768	2972	msiexec.exe	125
PID 2972 wrote to memory of 5032	2972	msiexec.exe	126
PID 2972 wrote to memory of 5032	2972	msiexec.exe	126
PID 2972 wrote to memory of 5032	2972	msiexec.exe	126
PID 2972 wrote to memory of 752	2972	msiexec.exe	127
PID 2972 wrote to memory of 752	2972	msiexec.exe	127
PID 2972 wrote to memory of 752	2972	msiexec.exe	127
PID 2972 wrote to memory of 5036	2972	msiexec.exe	128
PID 2972 wrote to memory of 5036	2972	msiexec.exe	128
PID 2972 wrote to memory of 5036	2972	msiexec.exe	128
PID 2972 wrote to memory of 2800	2972	msiexec.exe	129
PID 2972 wrote to memory of 2800	2972	msiexec.exe	129
PID 2972 wrote to memory of 2800	2972	msiexec.exe	129
PID 2972 wrote to memory of 1856	2972	msiexec.exe	130

C:\Users\Admin\AppData\Local\Temp\NI Circuit Design Suite 14.0\NI_Circuit_Design_Suite_14_0.exe
"C:\Users\Admin\AppData\Local\Temp\NI Circuit Design Suite 14.0\NI_Circuit_Design_Suite_14_0.exe"
1⤵
- Checks computer location settings
- Drops autorun.inf file
- Suspicious use of WriteProcessMemory
PID:2368
- C:\National Instruments Downloads\NI Circuit Design Suite\14.0.0\autorun.exe
  "C:\National Instruments Downloads\NI Circuit Design Suite\14.0.0\autorun.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4020
- - C:\National Instruments Downloads\NI Circuit Design Suite\14.0.0\setup.exe
    "C:\National Instruments Downloads\NI Circuit Design Suite\14.0.0\setup.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2228
  - - C:\Program Files (x86)\National Instruments\Circuit Design Suite 14.0\hitech\HC51-lite-9.60.exe
      "C:\Program Files (x86)\National Instruments\Circuit Design Suite 14.0\hitech\HC51-lite-9.60.exe" "--I agree to the terms of the licence" "--dir=C:\Program Files (x86)\HI-TECH Software\HC51\9.60"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      PID:4772
  - - C:\Program Files (x86)\National Instruments\Circuit Design Suite 14.0\hitech\picc-9_82-win.exe
      "C:\Program Files (x86)\National Instruments\Circuit Design Suite 14.0\hitech\picc-9_82-win.exe" "--I_agree_to_the_terms_of_the_licence" "--dir=C:\Program Files (x86)\HI-TECH Software\PICC\9.82"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      PID:4260
  - - C:\Program Files (x86)\National Instruments\Shared\License Manager\Bin\nilmMessage.exe
      "C:\Program Files (x86)\National Instruments\Shared\License Manager\Bin\nilmMessage.exe" -locale "9"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2852
  - - C:\Program Files (x86)\National Instruments\Shared\License Manager\Bin\nilmMigration.exe
      "C:\Program Files (x86)\National Instruments\Shared\License Manager\Bin\nilmMigration.exe" -files "C:\ProgramData\National Instruments\License Manager\Licenses" -servers -silent
      4⤵
      Executes dropped EXE
      PID:1748
  - - C:\Program Files (x86)\National Instruments\Shared\Update Service\NIUSScheduler.exe
      "C:\Program Files (x86)\National Instruments\Shared\Update Service\NIUSScheduler.exe" -newInstallAsk -rebootRequired 1 -alreadyPresent NO -silent -updateServiceRequested 1 -lang 9
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2484
  - - C:\Program Files (x86)\National Instruments\Shared\NI Error Reporting\nierserver.exe
      "C:\Program Files (x86)\National Instruments\Shared\NI Error Reporting\nierserver.exe"
      4⤵
      Executes dropped EXE
      PID:3700
  - - C:\Program Files (x86)\National Instruments\Shared\Update Service\NIUpdateService.exe
      "C:\Program Files (x86)\National Instruments\Shared\Update Service\NIUpdateService.exe" -newInstall -rebootRequired 1 -alreadyPresent NO -versionNumeric -silent -updateServiceRequested 1
      4⤵
      Executes dropped EXE
      Checks whether UAC is enabled
      PID:4608

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Modifies firewall policy service
- Registers COM server for autorun
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D413B685A8B1E59BDC682F1113BC346B C
  2⤵
  - Loads dropped DLL
  PID:4516
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 48A24933965A852365BFD70BC627A105
  2⤵
  - Loads dropped DLL
  PID:5068
- C:\Program Files (x86)\National Instruments\Shared\NIUninstaller\uninst.exe
  "C:\Program Files (x86)\National Instruments\Shared\NIUninstaller\uninst.exe" /NIARP Show
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4280
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 63212C3F37B101CE041DAD0A8CD3BD75
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  PID:364
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 684DA79A8C9DDC9D796245A3B323853D
  2⤵
  - Loads dropped DLL
  PID:3884
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding AE6C0B92EC89CE1F351040F3EB3DD895
  2⤵
  - Loads dropped DLL
  PID:5108
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 00A589F49B985CED6863C97FC00B4B25
  2⤵
  - Loads dropped DLL
  PID:1764
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9F4FC1A586BB196CBC305CD5B22988C4
  2⤵
  PID:2544
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6DF661903CD11F7757248466EB636E35
  2⤵
  PID:60
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 37F94A38AC317023853E236F010B3F26
  2⤵
  PID:3292
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E90681D21E982C285DEF4514E064AB7D
  2⤵
  PID:3976
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D2B35E136209C5B9335BC8191B191496
  2⤵
  PID:1536
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D197AC1E757D23BFB39EA93A2FB133BC
  2⤵
  PID:5100
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 46F412E62D60D966F9BFD29517134E74
  2⤵
  PID:3700
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 53E58F4623A4F7E96976FE2984A3161D
  2⤵
  PID:2768
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 145051633D3139D93773D8818FC3D965
  2⤵
  PID:5032
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 65CE4C3E5FB2307666957862290DC218
  2⤵
  PID:752
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D0C2A2AAAF652666C9A2B17CFC4B1753
  2⤵
  PID:5036
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B17C7BB0629AC7735E2DF9F3FD9FF3A6
  2⤵
  PID:2800
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 0802FAAE86F5FE0F4DD21FF869CE46EC
  2⤵
  PID:1856
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 736C0B7ECEAEE4DF96B3FB5A3C953D5E
  2⤵
  PID:4584
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 94A13BDFF4BCC407E7CBB3B8EEACF531
  2⤵
  PID:4212
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 051E8D04FCFB76F80CF2788CDE2DE58E
  2⤵
  PID:2984
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding BE3146D973A5A34ED09865DE6CE9510A
  2⤵
  PID:1444
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 0A6E2F597C119682EA5EB8AB8254823A
  2⤵
  PID:4108
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5FADABF84EBE59DAC3728DDD2806ED4E
  2⤵
  PID:2776
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 92E61D5104251B7AE7628AD1D7E0A300
  2⤵
  PID:1768
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 86756E8B53AF132F63EAE29B547CD796
  2⤵
  PID:740
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7E37C60FA770626AF6161296727E13F1
  2⤵
  PID:1436
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 21F63B9F21CBD3618BD71A2F73F5C6FC
  2⤵
  PID:2764
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DEAF9E607BEB4237C9F3268125726A87
  2⤵
  PID:952
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D71A36209315BC3533796791AEDD90BF
  2⤵
  PID:964
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9101A246641D1F925516035DDD3EA84C
  2⤵
  PID:4572
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding CDAED551858F543C0A0E86723C46B07D
  2⤵
  PID:5092
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E239F6F4653C8AD89129B206CF9D3318 M Global\MSI0000
  2⤵
  PID:3600
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C40E66ED5402C05B5070FADA4302214E
  2⤵
  PID:2056
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding EAC0FA29C85DD122D07A71821D69A712
  2⤵
  PID:3484
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9762205E1A28F33F58E51D7349D1B5AB
  2⤵
  PID:2800
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 33DD13A99AEE78080CF198FE0F9F4E76 M Global\MSI0000
  2⤵
  - Modifies registry class
  PID:1296
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding BCA57206053D4F1D00AF4A5A753DCC32
  2⤵
  PID:4100
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding ACF9F86AC377119D94994A7CED433658
  2⤵
  PID:1692
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3E5528A9F5E1FCE0B4CEBC836B188DD7
  2⤵
  PID:2124
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8D692FFB7AF44CB301278C4102208DA1
  2⤵
  PID:1816
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 39C3F47336978266350D4A050D545750
  2⤵
  PID:3492
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 327D9F394C72EC757E9F9E25C2C1A50D
  2⤵
  PID:1496
- C:\Program Files (x86)\National Instruments\Shared\USI\Bin\usiBoomer.exe
  "C:\Program Files (x86)\National Instruments\Shared\USI\Bin\usiBoomer.exe"
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Program Files (x86)\National Instruments\Shared\USI\Bin\usireg.exe
  "C:\Program Files (x86)\National Instruments\Shared\USI\Bin\usireg.exe" /i /o "C:\Program Files (x86)\National Instruments\Shared\USI\Bin\uspLVM_TimeChannels.uri"
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Program Files (x86)\National Instruments\Shared\USI\Bin\usireg.exe
  "C:\Program Files (x86)\National Instruments\Shared\USI\Bin\usireg.exe" /i /o "C:\Program Files (x86)\National Instruments\Shared\USI\Bin\uspTDM.uri"
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Program Files (x86)\National Instruments\Shared\USI\Bin\usireg.exe
  "C:\Program Files (x86)\National Instruments\Shared\USI\Bin\usireg.exe" /i /o "C:\Program Files (x86)\National Instruments\Shared\USI\Bin\uspLVM.uri"
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Program Files (x86)\National Instruments\Shared\USI\Bin\usireg.exe
  "C:\Program Files (x86)\National Instruments\Shared\USI\Bin\usireg.exe" /i /o "C:\Program Files (x86)\National Instruments\Shared\USI\Bin\uspDAT.uri"
  2⤵
  PID:2984
- C:\Program Files (x86)\National Instruments\Shared\USI\Bin\usireg.exe
  "C:\Program Files (x86)\National Instruments\Shared\USI\Bin\usireg.exe" /i /o "C:\Program Files (x86)\National Instruments\Shared\USI\Bin\uspNIVILogger2.uri"
  2⤵
  - Executes dropped EXE
  PID:3264
- C:\Program Files (x86)\National Instruments\Shared\USI\Bin\usireg.exe
  "C:\Program Files (x86)\National Instruments\Shared\USI\Bin\usireg.exe" /i /o "C:\Program Files (x86)\National Instruments\Shared\USI\Bin\uspATF.uri"
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Program Files (x86)\National Instruments\Shared\USI\Bin\usireg.exe
  "C:\Program Files (x86)\National Instruments\Shared\USI\Bin\usireg.exe" /i /o "C:\Program Files (x86)\National Instruments\Shared\USI\Examples\examples.uri"
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Program Files (x86)\National Instruments\Shared\USI\Bin\usireg.exe
  "C:\Program Files (x86)\National Instruments\Shared\USI\Bin\usireg.exe" /i /o "C:\Program Files (x86)\National Instruments\Shared\USI\Bin\register_icons.uri"
  2⤵
  - Executes dropped EXE
  PID:3836
- C:\Program Files (x86)\National Instruments\Shared\USI\Bin\usireg.exe
  "C:\Program Files (x86)\National Instruments\Shared\USI\Bin\usireg.exe" /i /o "C:\Program Files (x86)\National Instruments\Shared\USI\Bin\uspCSV.uri"
  2⤵
  - Executes dropped EXE
  PID:444
- C:\Program Files (x86)\National Instruments\Shared\USI\Bin\usireg.exe
  "C:\Program Files (x86)\National Instruments\Shared\USI\Bin\usireg.exe" /u "C:\Program Files (x86)\National Instruments\Shared\USI\Examples\oldExamples.uri"
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Program Files (x86)\National Instruments\Shared\USI\bin\usiReg.exe
  "C:\Program Files (x86)\National Instruments\Shared\USI\bin\usiReg.exe" /i /o "C:\Program Files (x86)\National Instruments\Shared\USI\bin\uspTdms.uri"
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9697A1F39A1E8DC3E8DD77365EC233F0
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3FDADFAC57A35F5F134B45DEA48D97FE
  2⤵
  PID:4948
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 20055732990A81171302ACC0A318B3D7
  2⤵
  PID:3720
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 58A4EE0F0934B425243828B7D4743733
  2⤵
  PID:2216
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 24145925717E3626F8C6E5F47A2700BD
  2⤵
  PID:4580
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding BE8F789BBEACA36C20CF99FCBC3F4AEB
  2⤵
  PID:936
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1EA825BFA97E98D658D4F73AE9BEB606
  2⤵
  PID:4360
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9938247D5BFE07AAE1676BAF4B9FCA70
  2⤵
  PID:1596
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 0ABDB7EABF1DB2DE042A0B592C6BC59F
  2⤵
  PID:1084
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6244DA355B8BC20AFBC8C4509F03C870
  2⤵
  PID:1748
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1AB263974343986D0DB17A46F661E225
  2⤵
  PID:3292
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 629944428297348701669C3839F51679
  2⤵
  PID:4368
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding EA966325BB93EC85AD41287E3D5D9F98
  2⤵
  PID:752
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E0016294E5A2EB567032A1A0DACB5A52
  2⤵
  PID:64
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 264FA1FE6D780801C4064034D46EF95D
  2⤵
  PID:3592
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1868633B884137DADE60FA2F5E95BCA0
  2⤵
  PID:1732
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E152BCF745E2D9EB40C86D75CD2F23AB
  2⤵
  PID:3408
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 4D48A68F87897927016B31B28123F9C2
  2⤵
  PID:3640
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6B350350A1BBEB81D635B140CE648792
  2⤵
  PID:2788
- C:\Windows\Installer\MSI1EC6.tmp
  "C:\Windows\Installer\MSI1EC6.tmp" /Q:A
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:2536
- - C:\Windows\SysWOW64\grpconv.exe
    grpconv.exe -o
    3⤵
    PID:4284
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 570F9AF5583BE5B5C5774EA6FC26CF58 M Global\MSI0000
  2⤵
  - Modifies registry class
  PID:3952
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 41153992F285526727991534CC238022
  2⤵
  PID:4352
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 10BF3B512A9535A31A6690C8C95FE6D6
  2⤵
  PID:3220
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1962103663331D684695D5131008B069
  2⤵
  PID:3752
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B7CEF9E8A01CB7CC4945A81EBEED4E67
  2⤵
  PID:2484
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 4AD4AEFA9930EC68BC1F274351E7D82D
  2⤵
  PID:4656
- C:\Windows\Installer\MSI88A9.tmp
  "C:\Windows\Installer\MSI88A9.tmp"
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding CF7CA5D24C75E505B00018A08D772A9E
  2⤵
  PID:4260
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2B95B3947EDB2A0FD8C890494EEBCB65
  2⤵
  PID:1328
- C:\Program Files (x86)\National Instruments\Shared\mDNS Responder\nimdnsNSPTool.exe
  "C:\Program Files (x86)\National Instruments\Shared\mDNS Responder\nimdnsNSPTool.exe" -install "nimdnsNSP" "981DF75B-898E-4c0c-B01C-5F181F817889" "C:\Program Files (x86)\National Instruments\Shared\mDNS Responder\nimdnsNSP.dll"
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 75F17B5078E424D899C7348F57C6F742
  2⤵
  PID:2704
- C:\Program Files\National Instruments\Shared\mDNS Responder\nimdnsNSPTool.exe
  "C:\Program Files\National Instruments\Shared\mDNS Responder\nimdnsNSPTool.exe" -install "nimdnsNSP" "981DF75B-898E-4c0c-B01C-5F181F817889" "C:\Program Files\National Instruments\Shared\mDNS Responder\nimdnsNSP.dll"
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8872A94035D3435926A05DBBFAA3D4C7
  2⤵
  PID:4276
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 4CAA4B70BF85E6393DD9A23150953ADD
  2⤵
  PID:1680
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5843A9BF5224B2FEAE596B4B8103E9B0
  2⤵
  PID:2980
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DFD0F165F7D902406EC603CB50877151
  2⤵
  PID:5056
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 99009CD8E71F5D35D7EDD5E93F744F45
  2⤵
  PID:3196
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 189A62CF4AFACCF32FFCDF4F8F7F29CB
  2⤵
  PID:4020
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 41E86A95F1D505B12A8CAA76C4F254C3
  2⤵
  PID:1096
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3A5DE3DCEBDCC2BB11798FA837D30541
  2⤵
  PID:3812
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E2F9087EE7E9916661BF0D072B13DAED
  2⤵
  PID:3752
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9BAC5AE17DFAECD2509850D27D62DDDE
  2⤵
  PID:2584
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5BBF2C466D7F2949CDF50954F0AB8A67
  2⤵
  PID:1724
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F0829E44EFB60417506B402FA96A96A0
  2⤵
  PID:1492
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DEB24B0CA109773429116D9F3508FCA3
  2⤵
  PID:3004
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 51C7B9326346C9CC43B0BADA8BBA7EB2
  2⤵
  PID:4172
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E92B04D7749D81675F8BC75B74693254
  2⤵
  PID:4344
- C:\Windows\Installer\MSI4336.tmp
  "C:\Windows\Installer\MSI4336.tmp" stop NISystemWebServer
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Windows\Installer\MSI4376.tmp
  "C:\Windows\Installer\MSI4376.tmp" delete NISystemWebServer
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\Installer\MSI4704.tmp
  "C:\Windows\Installer\MSI4704.tmp" create niSvcLoc "NI Service Locator" 16 2 1 "C:\Program Files (x86)\National Instruments\Shared\niSvcLoc\nisvcloc.exe -s" "" ""
  2⤵
  - Executes dropped EXE
  PID:652
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C47A2093CA8E2241C377663300DF30ED
  2⤵
  PID:2372
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3476D72D9FC67E3636F18FB7C16EB091
  2⤵
  PID:4612
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 71F236B58E8FE5D178BAA2B748BFA0C3
  2⤵
  PID:956
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 039E9216CB953739990CFC70460EA9EA
  2⤵
  PID:3356
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2663E9ED9DE00D354B8DB369C35ED707
  2⤵
  - Sets service image path in registry
  PID:3004
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\SysWOW64\sc.exe" config "NILM License Manager" DisplayName= "NI License Server"
    3⤵
    - Launches sc.exe
    PID:3952
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\SysWOW64\sc.exe" description "NILM License Manager" "Controls the National Instruments License Server to track volume software licenses. If this service is stopped or disabled, the volume license server will stop working, and users will not be able to check out software."
    3⤵
    - Launches sc.exe
    PID:4016
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F4EB221C1C55D793ED805B4D53048BD2
  2⤵
  PID:4432
- C:\Windows\Installer\MSI8C04.tmp
  "C:\Windows\Installer\MSI8C04.tmp" stop NiSvcLoc
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\Installer\MSI929F.tmp
  "C:\Windows\Installer\MSI929F.tmp" create niSvcLoc "NI Service Locator" 16 2 1 "C:\Program Files (x86)\National Instruments\Shared\niSvcLoc\nisvcloc.exe -s" "" ""
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 4AFE833E5E40D5C40EACAF9ACB412970
  2⤵
  PID:3904
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2928D30DC5AA92A39727B3D7D228E5A9
  2⤵
  PID:5092
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DFC3A85F347E0CBDE798DF3779CB849F
  2⤵
  PID:656
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C82C3506DC753A2F06EB91DA5538B4C7
  2⤵
  PID:1532
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding CC240584C416145BD2AC65A077E80D8C
  2⤵
  PID:3640
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3E57C36EF4B1430C6ECB7542D5EFB250
  2⤵
  PID:3848
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9A8479450EA3BF8E36F5194A0AAC80A7
  2⤵
  PID:3028
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9844351B13004BF8C9447DBADB84D341
  2⤵
  PID:220
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3683F6C5BA8D6B6FD6D1082574AFC089
  2⤵
  PID:2540
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F20DE6801635336719C4254534384187 M Global\MSI0000
  2⤵
  - Modifies registry class
  PID:336

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa38ec055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4316

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery