ad9f5d3476184acfc2fc585f0cc1a54995319c0f56215668e9aa93c0b248a7f4

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	VisualCppRedist_AIO_x86_x64.exe

Executes dropped EXE 4 IoCs

pid	Process
1916	VisualCppRedist_AIO_x86_x64.exe
5140	SetTimerResolutionService.exe
4656	SetTimerResolutionService.exe
2916	Devmanview.exe

Loads dropped DLL 17 IoCs

pid	Process
1568	vcredist_x86.exe
776	vcredist_x64.exe
4260	vcredist_x86.exe
3460	vcredist_x64.exe
3772	MsiExec.exe
3772	MsiExec.exe
3772	MsiExec.exe
3772	MsiExec.exe
3772	MsiExec.exe
3772	MsiExec.exe
3772	MsiExec.exe
3772	MsiExec.exe
3772	MsiExec.exe
3772	MsiExec.exe
3772	MsiExec.exe
3772	MsiExec.exe
3772	MsiExec.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{61087a79-ac85-455c-934d-1fa22cc64f36} = "\"C:\\ProgramData\\Package Cache\\{61087a79-ac85-455c-934d-1fa22cc64f36}\\vcredist_x86.exe\" /burn.runonce"	vcredist_x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	vcredist_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{ef6b00ec-13e1-4c25-9064-b2f383cb8412} = "\"C:\\ProgramData\\Package Cache\\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\\vcredist_x64.exe\" /burn.runonce"	vcredist_x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	vcredist_x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f} = "\"C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe\" /burn.log.append \"C:\\Users\\Admin\\AppData\\Local\\Temp\\dd_vcredist_x86_20230322103950.log\" /uninstall /passive /norestart ignored /burn.runonce"	vcredist_x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	vcredist_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6} = "\"C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe\" /burn.log.append \"C:\\Users\\Admin\\AppData\\Local\\Temp\\dd_vcredist_amd64_20230322104016.log\" /uninstall /passive /norestart ignored /burn.runonce"	vcredist_x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	vcredist_x86.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\D:	Devmanview.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Maps connected drives based on registry 3 TTPs 4 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	Devmanview.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	Devmanview.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	Devmanview.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count	Devmanview.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Windows\SysWOW64\mfc100esn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110jpn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110ita.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm120u.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100chs.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120cht.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100cht.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110enu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib110.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcr110.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110ita.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcamp110.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120chs.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120esn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120ita.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120kor.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcamp120.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp110.dll	msiexec.exe
File opened for modification	C:\Windows\system32\atl110.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120fra.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120rus.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib120.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100fra.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110jpn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110kor.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm120.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\vcomp100.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110rus.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcomp110.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110kor.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm110u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110esn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcr120.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100deu.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100ita.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110fra.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcamp110.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm120u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120ita.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcamp120.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfcm100.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\atl110.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm110.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110rus.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120fra.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120jpn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp120.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\atl100.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110esn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110enu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp110.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100u.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100enu.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100rus.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcomp120.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110chs.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110u.dll	msiexec.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia100.dll	msiexec.exe

Drops file in Windows directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI85CA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8936.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICD2F.tmp	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100chs_x86	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100ita_x86	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID67E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICBC4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID062.tmp	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100enu_x86	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100esn_x86	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100_x86	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID620.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9424.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAF50.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICF18.tmp	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100deu_x86	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\CacheSize.txt	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\11b1d.msp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICCBF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICD0F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICD6F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICF19.tmp	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100fra_x86	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100u_x86	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID68F.tmp	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100jpn_x86	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfcm100_x86	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9D0E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICE89.tmp	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_atl100_x86	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfcm100u_x86	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_vcomp100_x86	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICCFF.tmp	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100kor_x86	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100rus_x86	msiexec.exe
File created	\??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\CacheSize.txt	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA879.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB888.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBDC9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICEB9.tmp	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100cht_x86	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_msvcp100_x86	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_msvcr100_x86	msiexec.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5188	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Devmanview.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	Devmanview.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	Devmanview.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceDesc	Devmanview.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0066\	Devmanview.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ClassGuid	Devmanview.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\ClassGUID	Devmanview.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\ConfigFlags	Devmanview.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\ContainerID	Devmanview.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064	Devmanview.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc	Devmanview.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\00000065\00000000	Devmanview.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0065\	Devmanview.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Device Parameters	Devmanview.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	Devmanview.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0067\	Devmanview.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\LocationInformation	Devmanview.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ClassGUID	Devmanview.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	Devmanview.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	Devmanview.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Driver	Devmanview.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	Devmanview.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Control	Devmanview.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0067	Devmanview.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	Devmanview.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Control	Devmanview.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ContainerID	Devmanview.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\00000066\00000000	Devmanview.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM	Devmanview.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	Devmanview.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Driver	Devmanview.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ClassGuid	Devmanview.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\00000065\00000000	Devmanview.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0065\	Devmanview.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Device Parameters	Devmanview.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Service	Devmanview.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK	Devmanview.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK	Devmanview.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\00000064\00000000	Devmanview.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM	Devmanview.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064	Devmanview.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	Devmanview.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Control	Devmanview.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\00000067\00000000	Devmanview.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	Devmanview.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ContainerID	Devmanview.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ClassGUID	Devmanview.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	Devmanview.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}	Devmanview.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	Devmanview.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0066	Devmanview.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\00000064\00000000	Devmanview.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	Devmanview.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Device Parameters	Devmanview.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Mfg	Devmanview.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\00000065\00000000	Devmanview.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\00000067\00000000	Devmanview.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0066	Devmanview.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0065	Devmanview.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\00000067\00000000	Devmanview.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM	Devmanview.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}	Devmanview.exe

Delays execution with timeout.exe 6 IoCs

evasion

pid	Process
5164	timeout.exe
1516	timeout.exe
3476	timeout.exe
5252	timeout.exe
2304	timeout.exe
376	timeout.exe

Modifies data under HKEY_USERS 19 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\20	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\22	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\21	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\24	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1F	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\23	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\24	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\25	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\21	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEMINIMUMVSU_X86,V11\DEPENDENTS\{33D1FD90-4274-48A1-9BC1-97E33D9C2D6F}	vcredist_x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12B8D03ED28D112328CCF0A0D541598E	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{61087a79-ac85-455c-934d-1fa22cc64f36}	vcredist_x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\44DB0475D85BA123FA0CD6D35465DDC6	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v11	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\85DE12149DB4B7E38A5BF9B8AA0E547B	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\{61087A79-AC85-455C-934D-1FA22CC64F36}\DEPENDENTS\{61087A79-AC85-455C-934D-1FA22CC64F36}	vcredist_x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8520DAD7C5154DD39846DB1714990E7F	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEMINIMUMVSU_AMD64,V12\DEPENDENTS\{EF6B00EC-13E1-4C25-9064-B2F383CB8412}	vcredist_x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Patches\2D0058F6F08A743309184BE1178C95B2\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C025571B2A687A53689168CD7369889B\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1D5E3C0FEDA1E123187686FED06E995A	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v12	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A\Patches	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v11	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7C9F8B73BF303523781852719CD9C700	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v11	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimum_amd64,v11	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v11	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8520DAD7C5154DD39846DB1714990E7F\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8520DAD7C5154DD39846DB1714990E7F\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEMINIMUM_X86,V11\DEPENDENTS\{33D1FD90-4274-48A1-9BC1-97E33D9C2D6F}	vcredist_x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DC8A59DBF9D1DA5389A1E3975220E6BB\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DC8A59DBF9D1DA5389A1E3975220E6BB\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7C9F8B73BF303523781852719CD9C700	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3AEB2FCAE628F23AAB933F1E743AB79\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3AEB2FCAE628F23AAB933F1E743AB79\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEMINIMUMVSU_X86,V12\DEPENDENTS\{61087A79-AC85-455C-934D-1FA22CC64F36}	vcredist_x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\Dependents	vcredist_x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEADDITIONALVSU_AMD64,V12\DEPENDENTS\{EF6B00EC-13E1-4C25-9064-B2F383CB8412}	vcredist_x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B696E639D8C084A389FD43F4AEE41193	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v12	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditional_x86,v11\Dependents	vcredist_x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v11\Dependents	vcredist_x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DC8A59DBF9D1DA5389A1E3975220E6BB	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7C9F8B73BF303523781852719CD9C700\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditional_amd64,v11	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimum_amd64,v11\Dependents	vcredist_x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12B8D03ED28D112328CCF0A0D541598E\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}	vcredist_x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Patches\2D0058F6F08A743309184BE1178C95B2\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DC8A59DBF9D1DA5389A1E3975220E6BB	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7C9F8B73BF303523781852719CD9C700\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3AEB2FCAE628F23AAB933F1E743AB79	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\44DB0475D85BA123FA0CD6D35465DDC6\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\44DB0475D85BA123FA0CD6D35465DDC6	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CE6380BC270BD863282B3D74B09F7570\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C025571B2A687A53689168CD7369889B\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEMINIMUMVSU_AMD64,V11\DEPENDENTS\{CA67548A-5EBE-413A-B50C-4B9CEB6D66C6}	vcredist_x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\{CA67548A-5EBE-413A-B50C-4B9CEB6D66C6}	vcredist_x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CE6380BC270BD863282B3D74B09F7570	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DC8A59DBF9D1DA5389A1E3975220E6BB\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditional_amd64,v11\Dependents	vcredist_x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\{EF6B00EC-13E1-4C25-9064-B2F383CB8412}\DEPENDENTS\{EF6B00EC-13E1-4C25-9064-B2F383CB8412}	vcredist_x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v12\Dependents	vcredist_x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0FC00402C7EDE723A94E0F3FD809588F	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEADDITIONAL_X86,V11\DEPENDENTS\{33D1FD90-4274-48A1-9BC1-97E33D9C2D6F}	vcredist_x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimum_x86,v11	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEADDITIONAL_AMD64,V11\DEPENDENTS\{CA67548A-5EBE-413A-B50C-4B9CEB6D66C6}	vcredist_x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\06C4C5BE27A0CEF3DB628D4F75236241	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEADDITIONALVSU_X86,V12\DEPENDENTS\{61087A79-AC85-455C-934D-1FA22CC64F36}	vcredist_x86.exe

Modifies registry key 1 TTPs 39 IoCs

Modify Registry

T1112

pid	Process
2840	reg.exe
1796	reg.exe
4080	reg.exe
4200	reg.exe
5064	reg.exe
3376	reg.exe
2828	reg.exe
3564	reg.exe
4784	reg.exe
2392	reg.exe
5100	reg.exe
4592	reg.exe
60	reg.exe
3160	reg.exe
1244	reg.exe
3412	reg.exe
2016	reg.exe
2740	reg.exe
4404	reg.exe
3324	reg.exe
1808	reg.exe
1600	reg.exe
4452	reg.exe
1304	reg.exe
3328	reg.exe
2180	reg.exe
4396	reg.exe
4604	reg.exe
3412	reg.exe
3172	reg.exe
2656	reg.exe
632	reg.exe
2996	reg.exe
776	reg.exe
3488	reg.exe
2528	reg.exe
3624	reg.exe
4988	reg.exe
4012	reg.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
3700	powershell.exe
3700	powershell.exe
4600	msiexec.exe
4600	msiexec.exe
4600	msiexec.exe
4600	msiexec.exe
4600	msiexec.exe
4600	msiexec.exe
4600	msiexec.exe
4600	msiexec.exe
4600	msiexec.exe
4600	msiexec.exe
4600	msiexec.exe
4600	msiexec.exe
4600	msiexec.exe
4600	msiexec.exe
4600	msiexec.exe
4600	msiexec.exe
4600	msiexec.exe
4600	msiexec.exe
2356	powershell.exe
2356	powershell.exe
2356	powershell.exe
2916	Devmanview.exe
2916	Devmanview.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3700	powershell.exe
Token: SeBackupPrivilege	4100	vssvc.exe
Token: SeRestorePrivilege	4100	vssvc.exe
Token: SeAuditPrivilege	4100	vssvc.exe
Token: SeShutdownPrivilege	4624	vcredist_x86.exe
Token: SeIncreaseQuotaPrivilege	4624	vcredist_x86.exe
Token: SeSecurityPrivilege	4600	msiexec.exe
Token: SeCreateTokenPrivilege	4624	vcredist_x86.exe
Token: SeAssignPrimaryTokenPrivilege	4624	vcredist_x86.exe
Token: SeLockMemoryPrivilege	4624	vcredist_x86.exe
Token: SeIncreaseQuotaPrivilege	4624	vcredist_x86.exe
Token: SeMachineAccountPrivilege	4624	vcredist_x86.exe
Token: SeTcbPrivilege	4624	vcredist_x86.exe
Token: SeSecurityPrivilege	4624	vcredist_x86.exe
Token: SeTakeOwnershipPrivilege	4624	vcredist_x86.exe
Token: SeLoadDriverPrivilege	4624	vcredist_x86.exe
Token: SeSystemProfilePrivilege	4624	vcredist_x86.exe
Token: SeSystemtimePrivilege	4624	vcredist_x86.exe
Token: SeProfSingleProcessPrivilege	4624	vcredist_x86.exe
Token: SeIncBasePriorityPrivilege	4624	vcredist_x86.exe
Token: SeCreatePagefilePrivilege	4624	vcredist_x86.exe
Token: SeCreatePermanentPrivilege	4624	vcredist_x86.exe
Token: SeBackupPrivilege	4624	vcredist_x86.exe
Token: SeRestorePrivilege	4624	vcredist_x86.exe
Token: SeShutdownPrivilege	4624	vcredist_x86.exe
Token: SeDebugPrivilege	4624	vcredist_x86.exe
Token: SeAuditPrivilege	4624	vcredist_x86.exe
Token: SeSystemEnvironmentPrivilege	4624	vcredist_x86.exe
Token: SeChangeNotifyPrivilege	4624	vcredist_x86.exe
Token: SeRemoteShutdownPrivilege	4624	vcredist_x86.exe
Token: SeUndockPrivilege	4624	vcredist_x86.exe
Token: SeSyncAgentPrivilege	4624	vcredist_x86.exe
Token: SeEnableDelegationPrivilege	4624	vcredist_x86.exe
Token: SeManageVolumePrivilege	4624	vcredist_x86.exe
Token: SeImpersonatePrivilege	4624	vcredist_x86.exe
Token: SeCreateGlobalPrivilege	4624	vcredist_x86.exe
Token: SeRestorePrivilege	4600	msiexec.exe
Token: SeTakeOwnershipPrivilege	4600	msiexec.exe
Token: SeRestorePrivilege	4600	msiexec.exe
Token: SeTakeOwnershipPrivilege	4600	msiexec.exe
Token: SeRestorePrivilege	4600	msiexec.exe
Token: SeTakeOwnershipPrivilege	4600	msiexec.exe
Token: SeRestorePrivilege	4600	msiexec.exe
Token: SeTakeOwnershipPrivilege	4600	msiexec.exe
Token: SeRestorePrivilege	4600	msiexec.exe
Token: SeTakeOwnershipPrivilege	4600	msiexec.exe
Token: SeRestorePrivilege	4600	msiexec.exe
Token: SeTakeOwnershipPrivilege	4600	msiexec.exe
Token: SeRestorePrivilege	4600	msiexec.exe
Token: SeTakeOwnershipPrivilege	4600	msiexec.exe
Token: SeRestorePrivilege	4600	msiexec.exe
Token: SeTakeOwnershipPrivilege	4600	msiexec.exe
Token: SeRestorePrivilege	4600	msiexec.exe
Token: SeTakeOwnershipPrivilege	4600	msiexec.exe
Token: SeRestorePrivilege	4600	msiexec.exe
Token: SeTakeOwnershipPrivilege	4600	msiexec.exe
Token: SeRestorePrivilege	4600	msiexec.exe
Token: SeTakeOwnershipPrivilege	4600	msiexec.exe
Token: SeRestorePrivilege	4600	msiexec.exe
Token: SeTakeOwnershipPrivilege	4600	msiexec.exe
Token: SeRestorePrivilege	4600	msiexec.exe
Token: SeTakeOwnershipPrivilege	4600	msiexec.exe
Token: SeRestorePrivilege	4600	msiexec.exe
Token: SeTakeOwnershipPrivilege	4600	msiexec.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
1916	VisualCppRedist_AIO_x86_x64.exe
1568	vcredist_x86.exe
776	vcredist_x64.exe
4260	vcredist_x86.exe
3460	vcredist_x64.exe
2744	msiexec.exe
2744	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 2304	1820	cmd.exe	86
PID 1820 wrote to memory of 2304	1820	cmd.exe	86
PID 1820 wrote to memory of 376	1820	cmd.exe	87
PID 1820 wrote to memory of 376	1820	cmd.exe	87
PID 1820 wrote to memory of 3700	1820	cmd.exe	88
PID 1820 wrote to memory of 3700	1820	cmd.exe	88
PID 1820 wrote to memory of 1916	1820	cmd.exe	97
PID 1820 wrote to memory of 1916	1820	cmd.exe	97
PID 1820 wrote to memory of 1916	1820	cmd.exe	97
PID 1916 wrote to memory of 1392	1916	VisualCppRedist_AIO_x86_x64.exe	101
PID 1916 wrote to memory of 1392	1916	VisualCppRedist_AIO_x86_x64.exe	101
PID 1916 wrote to memory of 1392	1916	VisualCppRedist_AIO_x86_x64.exe	101
PID 1392 wrote to memory of 4696	1392	cmd.exe	103
PID 1392 wrote to memory of 4696	1392	cmd.exe	103
PID 1392 wrote to memory of 4696	1392	cmd.exe	103
PID 4696 wrote to memory of 4100	4696	cmd.exe	105
PID 4696 wrote to memory of 4100	4696	cmd.exe	105
PID 1392 wrote to memory of 5108	1392	cmd.exe	106
PID 1392 wrote to memory of 5108	1392	cmd.exe	106
PID 1392 wrote to memory of 5108	1392	cmd.exe	106
PID 1392 wrote to memory of 1640	1392	cmd.exe	107
PID 1392 wrote to memory of 1640	1392	cmd.exe	107
PID 1392 wrote to memory of 2420	1392	cmd.exe	108
PID 1392 wrote to memory of 2420	1392	cmd.exe	108
PID 1392 wrote to memory of 1800	1392	cmd.exe	109
PID 1392 wrote to memory of 1800	1392	cmd.exe	109
PID 1392 wrote to memory of 1800	1392	cmd.exe	109
PID 1392 wrote to memory of 3468	1392	cmd.exe	110
PID 1392 wrote to memory of 3468	1392	cmd.exe	110
PID 1392 wrote to memory of 3468	1392	cmd.exe	110
PID 3468 wrote to memory of 336	3468	cmd.exe	111
PID 3468 wrote to memory of 336	3468	cmd.exe	111
PID 1392 wrote to memory of 2676	1392	cmd.exe	112
PID 1392 wrote to memory of 2676	1392	cmd.exe	112
PID 1392 wrote to memory of 2676	1392	cmd.exe	112
PID 2676 wrote to memory of 3804	2676	cmd.exe	113
PID 2676 wrote to memory of 3804	2676	cmd.exe	113
PID 1392 wrote to memory of 3564	1392	cmd.exe	114
PID 1392 wrote to memory of 3564	1392	cmd.exe	114
PID 1392 wrote to memory of 3564	1392	cmd.exe	114
PID 3564 wrote to memory of 3160	3564	cmd.exe	115
PID 3564 wrote to memory of 3160	3564	cmd.exe	115
PID 1392 wrote to memory of 4868	1392	cmd.exe	116
PID 1392 wrote to memory of 4868	1392	cmd.exe	116
PID 1392 wrote to memory of 3940	1392	cmd.exe	117
PID 1392 wrote to memory of 3940	1392	cmd.exe	117
PID 1392 wrote to memory of 1552	1392	cmd.exe	118
PID 1392 wrote to memory of 1552	1392	cmd.exe	118
PID 1392 wrote to memory of 572	1392	cmd.exe	119
PID 1392 wrote to memory of 572	1392	cmd.exe	119
PID 1392 wrote to memory of 4592	1392	cmd.exe	120
PID 1392 wrote to memory of 4592	1392	cmd.exe	120
PID 1392 wrote to memory of 396	1392	cmd.exe	121
PID 1392 wrote to memory of 396	1392	cmd.exe	121
PID 1392 wrote to memory of 2528	1392	cmd.exe	122
PID 1392 wrote to memory of 2528	1392	cmd.exe	122
PID 1392 wrote to memory of 4700	1392	cmd.exe	123
PID 1392 wrote to memory of 4700	1392	cmd.exe	123
PID 1392 wrote to memory of 60	1392	cmd.exe	124
PID 1392 wrote to memory of 60	1392	cmd.exe	124
PID 1392 wrote to memory of 4480	1392	cmd.exe	125
PID 1392 wrote to memory of 4480	1392	cmd.exe	125
PID 1392 wrote to memory of 3624	1392	cmd.exe	127
PID 1392 wrote to memory of 3624	1392	cmd.exe	127

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Performance V2\{2} Timer Res.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Windows\system32\timeout.exe
  timeout 2
  2⤵
  - Delays execution with timeout.exe
  PID:2304
- C:\Windows\system32\timeout.exe
  timeout 2
  2⤵
  - Delays execution with timeout.exe
  PID:376
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell Invoke-WebRequest "https://cdn.discordapp.com/attachments/911089630051454977/911091888931635200/VisualCppRedist_AIO_x86_x64.exe" -OutFile "C:\Users\Admin\AppData\Local\Temp\VisualCppRedist_AIO_x86_x64.exe"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3700
- C:\Users\Admin\AppData\Local\Temp\VisualCppRedist_AIO_x86_x64.exe
  C:\Users\Admin\AppData\Local\Temp\VisualCppRedist_AIO_x86_x64.exe /y
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1916
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Installer.cmd" /auto"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1392
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4696
    - - C:\Windows\system32\reg.exe
        
        reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
        5⤵
        
        PID:4100
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" ver"
      4⤵
      PID:5108
  - - C:\Windows\system32\findstr.exe
      findstr /c:" 5."
      4⤵
      PID:1640
  - - C:\Windows\system32\reg.exe
      reg query "HKU\S-1-5-19"
      4⤵
      PID:2420
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:1800
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "reg query "hklm\software\microsoft\Windows NT\currentversion" /v productname" 2>nul
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3468
    - - C:\Windows\system32\reg.exe
        
        reg query "hklm\software\microsoft\Windows NT\currentversion" /v productname
        5⤵
        
        PID:336
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "reg query "hklm\software\microsoft\Windows NT\currentversion" /v UBR" 2>nul
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2676
    - - C:\Windows\system32\reg.exe
        
        reg query "hklm\software\microsoft\Windows NT\currentversion" /v UBR
        5⤵
        
        PID:3804
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg query "hklm\software\microsoft\Windows NT\currentversion" /v buildlabex
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3564
    - - C:\Windows\system32\reg.exe
        
        reg query "hklm\software\microsoft\Windows NT\currentversion" /v buildlabex
        5⤵
        
        PID:3160
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled
      4⤵
      PID:4868
  - - C:\Windows\system32\find.exe
      find /i "0x0"
      4⤵
      PID:3940
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled
      4⤵
      PID:1552
  - - C:\Windows\system32\find.exe
      find /i "0x0"
      4⤵
      PID:572
  - - C:\Windows\system32\reg.exe
      reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2012 Redistributable" /s
      4⤵
      Modifies registry key
      PID:4592
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:396
  - - C:\Windows\system32\reg.exe
      reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2013 Preview Redistributable" /s
      4⤵
      Modifies registry key
      PID:2528
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4700
  - - C:\Windows\system32\reg.exe
      reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2013 RC Redistributable" /s
      4⤵
      Modifies registry key
      PID:60
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4480
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4928
  - - C:\Windows\system32\reg.exe
      reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2013 Redistributable" /s
      4⤵
      Modifies registry key
      PID:3624
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:2668
  - - C:\Windows\system32\reg.exe
      reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 14 CTP Redistributable" /s
      4⤵
      Modifies registry key
      PID:3412
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4720
  - - C:\Windows\system32\reg.exe
      reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2015 Preview Redistributable" /s
      4⤵
      Modifies registry key
      PID:3376
  - - C:\Windows\system32\reg.exe
      reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2015 CTP Redistributable" /s
      4⤵
      Modifies registry key
      PID:4988
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:444
  - - C:\Windows\system32\reg.exe
      reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2015 RC Redistributable" /s
      4⤵
      Modifies registry key
      PID:2016
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4916
  - - C:\Windows\system32\reg.exe
      reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2015 Redistributable" /s
      4⤵
      Modifies registry key
      PID:2828
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4872
  - - C:\Windows\system32\reg.exe
      reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2017 RC Redistributable" /s
      4⤵
      Modifies registry key
      PID:2740
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:3704
  - - C:\Windows\system32\reg.exe
      reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2017 Redistributable" /s
      4⤵
      Modifies registry key
      PID:2840
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:3864
  - - C:\Windows\system32\reg.exe
      reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2019 Redistributable" /s
      4⤵
      Modifies registry key
      PID:2392
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:524
  - - C:\Windows\system32\reg.exe
      reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2015-2019 Redistributable" /s
      4⤵
      Modifies registry key
      PID:4404
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:3196
  - - C:\Windows\system32\findstr.exe
      findstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\wix.txt"
      4⤵
      PID:5072
  - - C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /uninstall /passive /norestart
      4⤵
      Adds Run key to start application
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      PID:4624
    - - C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
        
        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{74F66014-6700-4450-A702-285B85ED6C76} {FFC13693-6FE0-4349-B8C5-264FBA39D68E} 4624
        5⤵
        Loads dropped DLL
        Suspicious use of FindShellTrayWindow
        
        PID:1568
  - - C:\Windows\system32\reg.exe
      reg delete hklm\software\wow6432node\microsoft\windows\currentversion\uninstall\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f} /f
      4⤵
      Modifies registry key
      PID:1600
  - - C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
      "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /uninstall /passive /norestart
      4⤵
      Adds Run key to start application
      Modifies registry class
      PID:3312
    - - C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
        
        "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{5F6BF9B4-C287-4125-BADB-4EBB41E50F4A} {1D31CCA3-E396-43F7-8924-BFB53B01827C} 3312
        5⤵
        Loads dropped DLL
        Suspicious use of FindShellTrayWindow
        
        PID:776
  - - C:\Windows\system32\reg.exe
      reg delete hklm\software\wow6432node\microsoft\windows\currentversion\uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6} /f
      4⤵
      Modifies registry key
      PID:3160
  - - C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
      "C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /uninstall /passive /norestart
      4⤵
      Adds Run key to start application
      Modifies registry class
      PID:4844
    - - C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
        
        "C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{8CBB3170-63EC-4A5C-BA01-EBB2685CF4B0} {85CDBDD5-0CCF-4156-92D0-5BA1BBE3E15C} 4844
        5⤵
        Loads dropped DLL
        Suspicious use of FindShellTrayWindow
        
        PID:4260
  - - C:\Windows\system32\reg.exe
      reg delete hklm\software\wow6432node\microsoft\windows\currentversion\uninstall\{61087a79-ac85-455c-934d-1fa22cc64f36} /f
      4⤵
      Modifies registry key
      PID:4012
  - - C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
      "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /uninstall /passive /norestart
      4⤵
      Adds Run key to start application
      Modifies registry class
      PID:4148
    - - C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
        
        "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{030BA80C-EBD1-491F-944F-63F41E99526A} {D420135C-0D84-44D4-9309-193EE8497213} 4148
        5⤵
        Loads dropped DLL
        Suspicious use of FindShellTrayWindow
        
        PID:3460
  - - C:\Windows\system32\reg.exe
      reg delete hklm\software\wow6432node\microsoft\windows\currentversion\uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412} /f
      4⤵
      Modifies registry key
      PID:632
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c cscript //nologo filever.vbs "C:\Windows\SysWOW64\mfcm100.dll"
      4⤵
      PID:2652
    - - C:\Windows\system32\cscript.exe
        
        cscript //nologo filever.vbs "C:\Windows\SysWOW64\mfcm100.dll"
        5⤵
        
        PID:4520
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c cscript //nologo filever.vbs "C:\Windows\SysWOW64\mfcm140.dll"
      4⤵
      PID:1760
    - - C:\Windows\system32\cscript.exe
        
        cscript //nologo filever.vbs "C:\Windows\SysWOW64\mfcm140.dll"
        5⤵
        
        PID:3660
  - - C:\Windows\system32\reg.exe
      reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall\{00DC6825-CBC7-4179-AA10-829FA349A6B9} /v UninstallString
      4⤵
      Modifies registry key
      PID:2996
  - - C:\Windows\system32\reg.exe
      reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall\{09A8B65F-2B67-4C5C-8FD8-D3EB60F4121D} /v UninstallString
      4⤵
      Modifies registry key
      PID:1796
  - - C:\Windows\system32\findstr.exe
      findstr /i /v {710f4c1c-cc18-4c49-8cbf-51240c89a1a2}
      4⤵
      PID:4676
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4920
  - - C:\Windows\system32\reg.exe
      reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2005 Redistributable" /s
      4⤵
      Modifies registry key
      PID:776
  - - C:\Windows\system32\reg.exe
      reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2008 Redistributable" /s
      4⤵
      Modifies registry key
      PID:4604
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:2800
  - - C:\Windows\system32\findstr.exe
      findstr /i /v {9BE518E6-ECC6-35A9-88E4-87755C07200F}
      4⤵
      PID:412
  - - C:\Windows\system32\reg.exe
      reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2010 x86 Redistributable" /s
      4⤵
      Modifies registry key
      PID:4452
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4996
  - - C:\Windows\system32\findstr.exe
      findstr /i /v {F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}
      4⤵
      PID:2260
  - - C:\Windows\system32\reg.exe
      reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2010 x86 Redistributable" /s
      4⤵
      Modifies registry key
      PID:1244
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:2528
  - - C:\Windows\system32\reg.exe
      reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2012 x86 Additional Runtime" /s
      4⤵
      Modifies registry key
      PID:3412
  - - C:\Windows\system32\findstr.exe
      findstr /i /v {B175520C-86A2-35A7-8619-86DC379688B9}
      4⤵
      PID:3180
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4720
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:780
  - - C:\Windows\system32\findstr.exe
      findstr /i /v {BD95A8CD-1D9F-35AD-981A-3E7925026EBB}
      4⤵
      PID:3516
  - - C:\Windows\system32\reg.exe
      reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2012 x86 Minimum Runtime" /s
      4⤵
      Modifies registry key
      PID:1304
  - - C:\Windows\system32\reg.exe
      reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2013 x86 Additional Runtime" /s
      4⤵
      Modifies registry key
      PID:3172
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:732
  - - C:\Windows\system32\findstr.exe
      findstr /i /v {D401961D-3A20-3AC7-943B-6139D5BD490A}
      4⤵
      PID:2004
  - - C:\Windows\system32\reg.exe
      reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2013 x86 Minimum Runtime" /s
      4⤵
      Modifies registry key
      PID:2656
  - - C:\Windows\system32\findstr.exe
      findstr /i /v {8122DAB1-ED4D-3676-BB0A-CA368196543E}
      4⤵
      PID:1628
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5068
  - - C:\Windows\system32\reg.exe
      reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2019 x86 Additional Runtime" /s
      4⤵
      Modifies registry key
      PID:3328
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:3696
  - - C:\Windows\system32\findstr.exe
      findstr /i /v {09A8B65F-2B67-4C5C-8FD8-D3EB60F4121D}
      4⤵
      PID:316
  - - C:\Windows\system32\reg.exe
      reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2019 x86 Minimum Runtime" /s
      4⤵
      Modifies registry key
      PID:3324
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:1700
  - - C:\Windows\system32\findstr.exe
      findstr /i /v {00DC6825-CBC7-4179-AA10-829FA349A6B9}
      4⤵
      PID:3972
  - - C:\Windows\system32\reg.exe
      reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 14 x86 Additional Runtime" /s
      4⤵
      Modifies registry key
      PID:4080
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4624
  - - C:\Windows\system32\reg.exe
      reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 14 x86 Minimum Runtime" /s
      4⤵
      Modifies registry key
      PID:2180
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5112
  - - C:\Windows\system32\reg.exe
      reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2015 x86 Additional Runtime" /s
      4⤵
      Modifies registry key
      PID:4396
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4456
  - - C:\Windows\system32\reg.exe
      reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2015 x86 Minimum Runtime" /s
      4⤵
      Modifies registry key
      PID:3564
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4040
  - - C:\Windows\system32\reg.exe
      reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2017 x86 Additional Runtime" /s
      4⤵
      Modifies registry key
      PID:4784
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4728
  - - C:\Windows\system32\reg.exe
      reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2017 x86 Minimum Runtime" /s
      4⤵
      Modifies registry key
      PID:4200
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:2660
  - - C:\Windows\system32\findstr.exe
      findstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\msi.txt"
      4⤵
      PID:5012
  - - C:\Windows\system32\msiexec.exe
      msiexec /X{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /passive /norestart
      4⤵
      Suspicious use of FindShellTrayWindow
      PID:2744
  - - C:\Windows\system32\reg.exe
      reg delete hklm\software\wow6432node\microsoft\windows\currentversion\uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /f
      4⤵
      Modifies registry key
      PID:3488
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c cscript //nologo filever.vbs "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\vstoee.dll"
      4⤵
      PID:4944
    - - C:\Windows\system32\cscript.exe
        
        cscript //nologo filever.vbs "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\vstoee.dll"
        5⤵
        
        PID:1304
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c cscript //nologo filever.vbs "C:\Windows\System32\mfcm100.dll"
      4⤵
      PID:3692
    - - C:\Windows\system32\cscript.exe
        
        cscript //nologo filever.vbs "C:\Windows\System32\mfcm100.dll"
        5⤵
        
        PID:732
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c cscript //nologo filever.vbs "C:\Windows\System32\mfcm140.dll"
      4⤵
      PID:4976
    - - C:\Windows\system32\cscript.exe
        
        cscript //nologo filever.vbs "C:\Windows\System32\mfcm140.dll"
        5⤵
        
        PID:2696
  - - C:\Windows\system32\reg.exe
      reg query hklm\software\microsoft\windows\currentversion\uninstall\{50FF98A9-6C60-4DF2-AE02-C48AED35B59B} /v UninstallString
      4⤵
      Modifies registry key
      PID:1808
  - - C:\Windows\system32\reg.exe
      reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2005 Redistributable" /s
      4⤵
      Modifies registry key
      PID:5100
  - - C:\Windows\system32\reg.exe
      reg query hklm\software\microsoft\windows\currentversion\uninstall\{29A1747B-007E-4BB0-A4BE-D6B855C2C56D} /v UninstallString
      4⤵
      Modifies registry key
      PID:5064
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell Invoke-WebRequest "https://cdn.discordapp.com/attachments/911089630051454977/911092583596425216/SetTimerResolutionService.exe" -OutFile "C:\Users\Admin\AppData\Local\Temp\SetTimerResolutionService.exe"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:2356
- C:\SetTimerResolutionService.exe
  "C:\SetTimerResolutionService.exe" -install
  2⤵
  - Executes dropped EXE
  PID:5140
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:5164
- C:\Windows\system32\sc.exe
  sc config "STR" start=auto
  2⤵
  - Launches sc.exe
  PID:5188
- C:\Windows\system32\net.exe
  net start STR
  2⤵
  PID:5200
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start STR
    3⤵
    PID:5216
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:1516
- C:\Windows\system32\timeout.exe
  timeout 3
  2⤵
  - Delays execution with timeout.exe
  PID:3476
- C:\Windows\system32\bcdedit.exe
  bcdedit /set useplatformtick true
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4740
- C:\Windows\system32\bcdedit.exe
  bcdedit /set disabledynamictick yes
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4896
- C:\Windows\system32\curl.exe
  curl -L https://cdn.discordapp.com/attachments/911089630051454977/1004840385580912701/DevManView.exe -o Devmanview.exe
  2⤵
  PID:4604
- C:\Users\Admin\AppData\Local\Temp\Devmanview.exe
  devmanview /disable "High Precision Event Timer"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Maps connected drives based on registry
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:2916
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  - Delays execution with timeout.exe
  PID:5252

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4100

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:2296

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4600
- \??\c:\Windows\syswow64\MsiExec.exe
  c:\Windows\syswow64\MsiExec.exe -Embedding DDAEAB1A4254BCAAA2F0C751B80793A6
  2⤵
  - Loads dropped DLL
  PID:3772

C:\SetTimerResolutionService.exe
C:\SetTimerResolutionService.exe
1⤵
- Executes dropped EXE
PID:4656

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery