cefe5eb0a731e12ef6a1657b0627246c9c04db76d5f9ad532e181ef0ca1cd4fb

System Information Discovery

Processes:

windowsdesktop-runtime-6.0.10-win-x86.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	windowsdesktop-runtime-6.0.10-win-x86.exe

Executes dropped EXE 4 IoCs

Processes:

windowsdesktop-runtime-6.0.10-win-x86.exewindowsdesktop-runtime-6.0.10-win-x86.exewindowsdesktop-runtime-6.0.10-win-x86.exehmpsched.exe

pid	process
4752	windowsdesktop-runtime-6.0.10-win-x86.exe
5580	windowsdesktop-runtime-6.0.10-win-x86.exe
6036	windowsdesktop-runtime-6.0.10-win-x86.exe
2492	hmpsched.exe

Loads dropped DLL 64 IoCs

Processes:

startup.exewindowsdesktop-runtime-6.0.10-win-x86.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exerundll32.exe

pid	process
1300	startup.exe
1300	startup.exe
1300	startup.exe
1300	startup.exe
1300	startup.exe
1300	startup.exe
1300	startup.exe
1300	startup.exe
1300	startup.exe
1300	startup.exe
1300	startup.exe
1300	startup.exe
1300	startup.exe
1300	startup.exe
1300	startup.exe
1300	startup.exe
1300	startup.exe
1300	startup.exe
1300	startup.exe
1300	startup.exe
1300	startup.exe
1300	startup.exe
1300	startup.exe
1300	startup.exe
1300	startup.exe
1300	startup.exe
1300	startup.exe
1300	startup.exe
1300	startup.exe
1300	startup.exe
1300	startup.exe
1300	startup.exe
5580	windowsdesktop-runtime-6.0.10-win-x86.exe
5844	MsiExec.exe
2896	MsiExec.exe
5400	MsiExec.exe
4052	MsiExec.exe
1300	startup.exe
1084	MsiExec.exe
1084	MsiExec.exe
1084	MsiExec.exe
1084	MsiExec.exe
1084	MsiExec.exe
1084	MsiExec.exe
1084	MsiExec.exe
1084	MsiExec.exe
1084	MsiExec.exe
1084	MsiExec.exe
1084	MsiExec.exe
1084	MsiExec.exe
1084	MsiExec.exe
1084	MsiExec.exe
1084	MsiExec.exe
1084	MsiExec.exe
1084	MsiExec.exe
1084	MsiExec.exe
5472	MsiExec.exe
5472	MsiExec.exe
3924	MsiExec.exe
3924	MsiExec.exe
5652	rundll32.exe
1300	startup.exe
1300	startup.exe
1300	startup.exe

Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 185.228.168.9

description	ioc
Destination IP	185.228.168.9

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

windowsdesktop-runtime-6.0.10-win-x86.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	windowsdesktop-runtime-6.0.10-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{9dd24b73-88e0-4f0f-882a-500e00d2bdef} = "\"C:\\ProgramData\\Package Cache\\{9dd24b73-88e0-4f0f-882a-500e00d2bdef}\\windowsdesktop-runtime-6.0.10-win-x86.exe\" /burn.runonce"	windowsdesktop-runtime-6.0.10-win-x86.exe

Checks for any installed AV software in registry 1 TTPs 1 IoCs

Security Software Discovery
T1063

Processes:

startup.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast startup.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast	startup.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

Processes:

startup.exerundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	startup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

System Information Discovery

Processes:

msiexec.exeHitmanPro_x64.exe

description	ioc	process
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\D:	HitmanPro_x64.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Maps connected drives based on registry 3 TTPs 3 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

Processes:

HitmanPro_x64.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\	HitmanPro_x64.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	HitmanPro_x64.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	HitmanPro_x64.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

startup.exe

description ioc process

File opened for modification \??\PhysicalDrive0 startup.exe
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery
T1082

Processes:

startup.exe

description ioc process

File opened (read-only) \??\VBoxMiniRdrDN startup.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	startup.exe

description	ioc	process
File opened (read-only)	\??\VBoxMiniRdrDN	startup.exe

Drops file in Program Files directory 64 IoCs

Processes:

msiexec.exewindowsdesktop-runtime-6.0.10-win-x86.exe

description	ioc	process
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.10\api-ms-win-crt-heap-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\ja\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\System.Windows.Forms.Primitives.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.10\System.Transactions.Local.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.10\System.Collections.NonGeneric.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\it\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\fr\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.10\System.Configuration.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\cs\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\Microsoft.Win32.SystemEvents.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.10\System.Runtime.InteropServices.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.10\System.Linq.Parallel.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.10\mscordaccore_x86_x86_6.0.1022.47605.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\it\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\tr\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\pt-BR\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\PresentationFramework.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\pl\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\ja\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\ko\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.10\System.ObjectModel.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.10\api-ms-win-crt-multibyte-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\PresentationFramework-SystemXml.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\System.Threading.AccessControl.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\zh-Hans\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\swidtag\Microsoft Windows Desktop Runtime - 6.0.10 (x86).swidtag	windowsdesktop-runtime-6.0.10-win-x86.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.10\System.Xml.XPath.XDocument.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.10\System.Reflection.Metadata.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\System.Diagnostics.PerformanceCounter.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\UIAutomationClientSideProviders.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\PresentationFramework.AeroLite.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\pl\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\de\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.10\System.Globalization.Extensions.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.10\api-ms-win-core-file-l2-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.10\System.IO.FileSystem.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.10\System.Reflection.Primitives.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\zh-Hant\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.10\System.Net.NetworkInformation.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\cs\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\zh-Hant\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\ko\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.10\Microsoft.Win32.Registry.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\it\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\System.Diagnostics.EventLog.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\PresentationFramework.Aero2.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.10\System.Security.Cryptography.Algorithms.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.10\System.Net.Http.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\PresentationFramework.Luna.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\tr\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\es\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\pt-BR\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.10\System.Formats.Asn1.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.10\System.Security.Cryptography.Encoding.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.10\System.Reflection.Emit.ILGeneration.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\fr\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.10\System.Runtime.Extensions.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.10\System.IO.FileSystem.Watcher.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\de\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\ru\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.10\System.Runtime.Serialization.Xml.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.10\System.Diagnostics.DiagnosticSource.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.10\System.Collections.Specialized.dll	msiexec.exe

Drops file in Windows directory 54 IoCs

Processes:

msiexec.exeMsiExec.exestartup.exe

description	ioc	process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{0F3E4057-E2BB-4114-A646-F143DB5CE4C9}	msiexec.exe
File created	C:\Windows\Installer\e598a15.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e598a16.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\e598a0a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF27E.tmp	msiexec.exe
File created	C:\Windows\Installer\e598a0d.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{3B28977C-9163-48A5-A08C-C01327E18AE2}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF210.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFE9A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI526.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF154.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI39D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB33.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1557.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e598a0e.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{08465C0A-BB15-38BE-A9CC-6A501463B4DA}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI115E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA36A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID1E3.tmp	msiexec.exe
File created	C:\Windows\Installer\e598a0a.msi	msiexec.exe
File created	C:\Windows\Installer\e598a16.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF81E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF90A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFF09.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e598a06.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF2DD.tmp	msiexec.exe
File opened for modification	C:\Windows\security\logs\scecomp.log	MsiExec.exe
File created	C:\Windows\Installer\SourceHash{98CA5A6B-4ECC-4E6D-BF18-6B20CBB6E5F4}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB945.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\e598a06.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC1F2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC658.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC88B.tmp	msiexec.exe
File created	C:\Windows\Installer\e598a09.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI98C.tmp	msiexec.exe
File created	C:\Windows\Inf\oem1.PNF	MsiExec.exe
File created	C:\Windows\Inf\oem2.PNF	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSIBFCE.tmp	msiexec.exe
File created	C:\Windows\Installer\e598a11.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF8BB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4F6.tmp	msiexec.exe
File opened for modification	C:\Windows\installer	startup.exe
File created	C:\Windows\Installer\SourceHash{EBD44C5E-F1AF-4955-AEDF-F15D06384A9C}	msiexec.exe
File created	C:\Windows\Installer\e598a0e.msi	msiexec.exe
File created	C:\Windows\Installer\e598a12.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e598a12.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE358.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFC96.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	MsiExec.exe
File created	C:\Windows\Inf\oem0.PNF	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSIE88D.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

Processes:

HitmanPro_x64.exetaskmgr.exe

description	ioc	process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	HitmanPro_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\	HitmanPro_x64.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Device Parameters	HitmanPro_x64.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Device Parameters	HitmanPro_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	HitmanPro_x64.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Device Parameters	HitmanPro_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Storport\	HitmanPro_x64.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	HitmanPro_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Device Parameters\	HitmanPro_x64.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Device Parameters	HitmanPro_x64.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Device Parameters	HitmanPro_x64.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Device Parameters\Storport	HitmanPro_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\	HitmanPro_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\	HitmanPro_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\	HitmanPro_x64.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Device Parameters\Storport	HitmanPro_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\	HitmanPro_x64.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Device Parameters	HitmanPro_x64.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Device Parameters\Storport	HitmanPro_x64.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM	HitmanPro_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\	HitmanPro_x64.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Storport	HitmanPro_x64.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	HitmanPro_x64.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Device Parameters	HitmanPro_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\	HitmanPro_x64.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Device Parameters\Storport	HitmanPro_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Device Parameters\Storport\	HitmanPro_x64.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK	HitmanPro_x64.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Device Parameters	HitmanPro_x64.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Storport	HitmanPro_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\	HitmanPro_x64.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	HitmanPro_x64.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	HitmanPro_x64.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK	HitmanPro_x64.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	HitmanPro_x64.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	HitmanPro_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Device Parameters\	HitmanPro_x64.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Device Parameters\Storport	HitmanPro_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	HitmanPro_x64.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM	HitmanPro_x64.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Device Parameters\Storport	HitmanPro_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Device Parameters\	HitmanPro_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Device Parameters\Storport\	HitmanPro_x64.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	HitmanPro_x64.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	HitmanPro_x64.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	HitmanPro_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\	HitmanPro_x64.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM	HitmanPro_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\	HitmanPro_x64.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	HitmanPro_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\	HitmanPro_x64.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	HitmanPro_x64.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	HitmanPro_x64.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	HitmanPro_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\	HitmanPro_x64.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	HitmanPro_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\	HitmanPro_x64.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM	HitmanPro_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Device Parameters\Storport\	HitmanPro_x64.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	HitmanPro_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\	HitmanPro_x64.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

taskmgr.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

chrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 13 IoCs

Processes:

msiexec.exechrome.exe

description	ioc	process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\21	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\22	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133241751945367429"	chrome.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\20	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\21	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe

Modifies registry class 64 IoCs

Processes:

msiexec.exechrome.exewindowsdesktop-runtime-6.0.10-win-x86.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E5C44DBEFA1F5594EAFD1FD56083A4C9\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E5C44DBEFA1F5594EAFD1FD56083A4C9\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7504E3F0BB2E41146A641F34BDC54E9C\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7504E3F0BB2E41146A641F34BDC54E9C	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7504E3F0BB2E41146A641F34BDC54E9C\SourceList	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6A5AC89CCE4D6E4FB81B602BC6B5E4F\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C77982B336195A840AC80C31721EA82E\Provider	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E5C44DBEFA1F5594EAFD1FD56083A4C9\SourceList\PackageName = "dotnet-hostfxr-6.0.10-win-x86.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C77982B336195A840AC80C31721EA82E\ProductName = "Microsoft .NET Host - 6.0.10 (x86)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7504E3F0BB2E41146A641F34BDC54E9C\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3244FD6F2C1580A7BEA778D09630AAF4\7504E3F0BB2E41146A641F34BDC54E9C	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E5C44DBEFA1F5594EAFD1FD56083A4C9\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7504E3F0BB2E41146A641F34BDC54E9C\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3244FD6F2C1580A7BEA778D09630AAF4	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E5C44DBEFA1F5594EAFD1FD56083A4C9\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{9dd24b73-88e0-4f0f-882a-500e00d2bdef}\Version = "6.0.10.31726"	windowsdesktop-runtime-6.0.10-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_48.43.48869_x86\DisplayName = "Microsoft .NET Runtime - 6.0.10 (x86)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6A5AC89CCE4D6E4FB81B602BC6B5E4F\SourceList\PackageName = "dotnet-runtime-6.0.10-win-x86.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6A5AC89CCE4D6E4FB81B602BC6B5E4F\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{98CA5A6B-4ECC-4E6D-BF18-6B20CBB6E5F4}v48.43.48869\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E5C44DBEFA1F5594EAFD1FD56083A4C9\Version = "808173285"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C77982B336195A840AC80C31721EA82E	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{9dd24b73-88e0-4f0f-882a-500e00d2bdef}\ = "{9dd24b73-88e0-4f0f-882a-500e00d2bdef}"	windowsdesktop-runtime-6.0.10-win-x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_48.43.48870_x86\Dependents\{9dd24b73-88e0-4f0f-882a-500e00d2bdef}	windowsdesktop-runtime-6.0.10-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7504E3F0BB2E41146A641F34BDC54E9C\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{0F3E4057-E2BB-4114-A646-F143DB5CE4C9}v48.43.48870\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B6A5AC89CCE4D6E4FB81B602BC6B5E4F\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6A5AC89CCE4D6E4FB81B602BC6B5E4F\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E5C44DBEFA1F5594EAFD1FD56083A4C9\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.43.48869_x86	windowsdesktop-runtime-6.0.10-win-x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.43.48869_x86\Dependents	windowsdesktop-runtime-6.0.10-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_48.43.48869_x86\Version = "48.43.48869"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C77982B336195A840AC80C31721EA82E\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{3B28977C-9163-48A5-A08C-C01327E18AE2}v48.43.48869\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7504E3F0BB2E41146A641F34BDC54E9C\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7504E3F0BB2E41146A641F34BDC54E9C\SourceList\PackageName = "windowsdesktop-runtime-6.0.10-win-x86.msi"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E5C44DBEFA1F5594EAFD1FD56083A4C9\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C77982B336195A840AC80C31721EA82E	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_48.43.48870_x86	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7504E3F0BB2E41146A641F34BDC54E9C\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B6A5AC89CCE4D6E4FB81B602BC6B5E4F\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_48.43.48870_x86	windowsdesktop-runtime-6.0.10-win-x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6A5AC89CCE4D6E4FB81B602BC6B5E4F\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E5C44DBEFA1F5594EAFD1FD56083A4C9\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.43.48869_x86\Dependents\{9dd24b73-88e0-4f0f-882a-500e00d2bdef}	windowsdesktop-runtime-6.0.10-win-x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C77982B336195A840AC80C31721EA82E\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7504E3F0BB2E41146A641F34BDC54E9C\Version = "808173286"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7504E3F0BB2E41146A641F34BDC54E9C\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\7B6B3B3BDB85C274615B1EE3672D8E69	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.43.48869_x86\DisplayName = "Microsoft .NET Host FX Resolver - 6.0.10 (x86)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E5C44DBEFA1F5594EAFD1FD56083A4C9\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_48.43.48870_x86\Dependents	windowsdesktop-runtime-6.0.10-win-x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6A5AC89CCE4D6E4FB81B602BC6B5E4F\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_48.3.31210_x86\Dependents\{9dd24b73-88e0-4f0f-882a-500e00d2bdef}	windowsdesktop-runtime-6.0.10-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_48.43.48870_x86\ = "{0F3E4057-E2BB-4114-A646-F143DB5CE4C9}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_48.3.31210_x86\DisplayName = "Microsoft .NET Host - 6.0.10 (x86)"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6A5AC89CCE4D6E4FB81B602BC6B5E4F\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E5C44DBEFA1F5594EAFD1FD56083A4C9	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C77982B336195A840AC80C31721EA82E\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5A036181AE3507D45E36606F9464ED83	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{9dd24b73-88e0-4f0f-882a-500e00d2bdef}\Dependents	windowsdesktop-runtime-6.0.10-win-x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6A5AC89CCE4D6E4FB81B602BC6B5E4F\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C77982B336195A840AC80C31721EA82E\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5A036181AE3507D45E36606F9464ED83\C77982B336195A840AC80C31721EA82E	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6A5AC89CCE4D6E4FB81B602BC6B5E4F\PackageCode = "0F3235AA744CCE147A368B22C44B7831"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\7B6B3B3BDB85C274615B1EE3672D8E69\B6A5AC89CCE4D6E4FB81B602BC6B5E4F	msiexec.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

startup.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	startup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d4304000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	startup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c00000001000000040000000008000004000000010000001000000087ce0b7b2a0e4900e158719b37a893720300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	startup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	startup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	startup.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

vlc.exe

pid process

4792 vlc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

taskmgr.exestartup.exe

pid	process
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
1300	startup.exe
1300	startup.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

vlc.exetaskmgr.exe

pid process

4792 vlc.exe
5248 taskmgr.exe
Suspicious behavior: LoadsDriver 10 IoCs

Processes:

pid process

652
652
652
652
652
652
652
652
652
652

pid	process
652
652
652
652
652
652
652
652
652
652

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

Processes:

chrome.exe

pid	process
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

taskmgr.exewindowsdesktop-runtime-6.0.10-win-x86.exemsiexec.exe

description	pid	process
Token: SeDebugPrivilege	5248	taskmgr.exe
Token: SeSystemProfilePrivilege	5248	taskmgr.exe
Token: SeCreateGlobalPrivilege	5248	taskmgr.exe
Token: SeShutdownPrivilege	6036	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeIncreaseQuotaPrivilege	6036	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeSecurityPrivilege	1908	msiexec.exe
Token: SeCreateTokenPrivilege	6036	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeAssignPrimaryTokenPrivilege	6036	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeLockMemoryPrivilege	6036	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeIncreaseQuotaPrivilege	6036	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeMachineAccountPrivilege	6036	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeTcbPrivilege	6036	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeSecurityPrivilege	6036	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeTakeOwnershipPrivilege	6036	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeLoadDriverPrivilege	6036	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeSystemProfilePrivilege	6036	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeSystemtimePrivilege	6036	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeProfSingleProcessPrivilege	6036	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeIncBasePriorityPrivilege	6036	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeCreatePagefilePrivilege	6036	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeCreatePermanentPrivilege	6036	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeBackupPrivilege	6036	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeRestorePrivilege	6036	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeShutdownPrivilege	6036	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeDebugPrivilege	6036	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeAuditPrivilege	6036	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeSystemEnvironmentPrivilege	6036	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeChangeNotifyPrivilege	6036	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeRemoteShutdownPrivilege	6036	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeUndockPrivilege	6036	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeSyncAgentPrivilege	6036	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeEnableDelegationPrivilege	6036	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeManageVolumePrivilege	6036	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeImpersonatePrivilege	6036	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeCreateGlobalPrivilege	6036	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeRestorePrivilege	1908	msiexec.exe
Token: SeTakeOwnershipPrivilege	1908	msiexec.exe
Token: SeRestorePrivilege	1908	msiexec.exe
Token: SeTakeOwnershipPrivilege	1908	msiexec.exe
Token: SeRestorePrivilege	1908	msiexec.exe
Token: SeTakeOwnershipPrivilege	1908	msiexec.exe
Token: SeRestorePrivilege	1908	msiexec.exe
Token: SeTakeOwnershipPrivilege	1908	msiexec.exe
Token: SeRestorePrivilege	1908	msiexec.exe
Token: SeTakeOwnershipPrivilege	1908	msiexec.exe
Token: SeRestorePrivilege	1908	msiexec.exe
Token: SeTakeOwnershipPrivilege	1908	msiexec.exe
Token: SeRestorePrivilege	1908	msiexec.exe
Token: SeTakeOwnershipPrivilege	1908	msiexec.exe
Token: SeRestorePrivilege	1908	msiexec.exe
Token: SeTakeOwnershipPrivilege	1908	msiexec.exe
Token: SeRestorePrivilege	1908	msiexec.exe
Token: SeTakeOwnershipPrivilege	1908	msiexec.exe
Token: SeRestorePrivilege	1908	msiexec.exe
Token: SeTakeOwnershipPrivilege	1908	msiexec.exe
Token: SeRestorePrivilege	1908	msiexec.exe
Token: SeTakeOwnershipPrivilege	1908	msiexec.exe
Token: SeRestorePrivilege	1908	msiexec.exe
Token: SeTakeOwnershipPrivilege	1908	msiexec.exe
Token: SeRestorePrivilege	1908	msiexec.exe
Token: SeTakeOwnershipPrivilege	1908	msiexec.exe
Token: SeRestorePrivilege	1908	msiexec.exe
Token: SeTakeOwnershipPrivilege	1908	msiexec.exe
Token: SeRestorePrivilege	1908	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

vlc.exetaskmgr.exe

pid	process
4792	vlc.exe
4792	vlc.exe
4792	vlc.exe
4792	vlc.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

vlc.exetaskmgr.exe

pid	process
4792	vlc.exe
4792	vlc.exe
4792	vlc.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe
5248	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

vlc.exe

pid process

4792 vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

startup.exewindowsdesktop-runtime-6.0.10-win-x86.exewindowsdesktop-runtime-6.0.10-win-x86.exemsiexec.exechrome.exe

description	pid	process	target process
PID 1300 wrote to memory of 4752	1300	startup.exe	windowsdesktop-runtime-6.0.10-win-x86.exe
PID 1300 wrote to memory of 4752	1300	startup.exe	windowsdesktop-runtime-6.0.10-win-x86.exe
PID 1300 wrote to memory of 4752	1300	startup.exe	windowsdesktop-runtime-6.0.10-win-x86.exe
PID 4752 wrote to memory of 5580	4752	windowsdesktop-runtime-6.0.10-win-x86.exe	windowsdesktop-runtime-6.0.10-win-x86.exe
PID 4752 wrote to memory of 5580	4752	windowsdesktop-runtime-6.0.10-win-x86.exe	windowsdesktop-runtime-6.0.10-win-x86.exe
PID 4752 wrote to memory of 5580	4752	windowsdesktop-runtime-6.0.10-win-x86.exe	windowsdesktop-runtime-6.0.10-win-x86.exe
PID 5580 wrote to memory of 6036	5580	windowsdesktop-runtime-6.0.10-win-x86.exe	windowsdesktop-runtime-6.0.10-win-x86.exe
PID 5580 wrote to memory of 6036	5580	windowsdesktop-runtime-6.0.10-win-x86.exe	windowsdesktop-runtime-6.0.10-win-x86.exe
PID 5580 wrote to memory of 6036	5580	windowsdesktop-runtime-6.0.10-win-x86.exe	windowsdesktop-runtime-6.0.10-win-x86.exe
PID 1908 wrote to memory of 5844	1908	msiexec.exe	MsiExec.exe
PID 1908 wrote to memory of 5844	1908	msiexec.exe	MsiExec.exe
PID 1908 wrote to memory of 5844	1908	msiexec.exe	MsiExec.exe
PID 1908 wrote to memory of 2896	1908	msiexec.exe	MsiExec.exe
PID 1908 wrote to memory of 2896	1908	msiexec.exe	MsiExec.exe
PID 1908 wrote to memory of 2896	1908	msiexec.exe	MsiExec.exe
PID 1908 wrote to memory of 5400	1908	msiexec.exe	MsiExec.exe
PID 1908 wrote to memory of 5400	1908	msiexec.exe	MsiExec.exe
PID 1908 wrote to memory of 5400	1908	msiexec.exe	MsiExec.exe
PID 1908 wrote to memory of 4052	1908	msiexec.exe	MsiExec.exe
PID 1908 wrote to memory of 4052	1908	msiexec.exe	MsiExec.exe
PID 1908 wrote to memory of 4052	1908	msiexec.exe	MsiExec.exe
PID 1908 wrote to memory of 1084	1908	msiexec.exe	MsiExec.exe
PID 1908 wrote to memory of 1084	1908	msiexec.exe	MsiExec.exe
PID 1908 wrote to memory of 1084	1908	msiexec.exe	MsiExec.exe
PID 1908 wrote to memory of 5472	1908	msiexec.exe	MsiExec.exe
PID 1908 wrote to memory of 5472	1908	msiexec.exe	MsiExec.exe
PID 1908 wrote to memory of 5472	1908	msiexec.exe	MsiExec.exe
PID 1908 wrote to memory of 3924	1908	msiexec.exe	MsiExec.exe
PID 1908 wrote to memory of 3924	1908	msiexec.exe	MsiExec.exe
PID 1300 wrote to memory of 5652	1300	startup.exe	rundll32.exe
PID 1300 wrote to memory of 5652	1300	startup.exe	rundll32.exe
PID 1300 wrote to memory of 5652	1300	startup.exe	rundll32.exe
PID 4640 wrote to memory of 4736	4640	chrome.exe	chrome.exe
PID 4640 wrote to memory of 4736	4640	chrome.exe	chrome.exe
PID 4640 wrote to memory of 3728	4640	chrome.exe	chrome.exe
PID 4640 wrote to memory of 3728	4640	chrome.exe	chrome.exe
PID 4640 wrote to memory of 3728	4640	chrome.exe	chrome.exe
PID 4640 wrote to memory of 3728	4640	chrome.exe	chrome.exe
PID 4640 wrote to memory of 3728	4640	chrome.exe	chrome.exe
PID 4640 wrote to memory of 3728	4640	chrome.exe	chrome.exe
PID 4640 wrote to memory of 3728	4640	chrome.exe	chrome.exe
PID 4640 wrote to memory of 3728	4640	chrome.exe	chrome.exe
PID 4640 wrote to memory of 3728	4640	chrome.exe	chrome.exe
PID 4640 wrote to memory of 3728	4640	chrome.exe	chrome.exe
PID 4640 wrote to memory of 3728	4640	chrome.exe	chrome.exe
PID 4640 wrote to memory of 3728	4640	chrome.exe	chrome.exe
PID 4640 wrote to memory of 3728	4640	chrome.exe	chrome.exe
PID 4640 wrote to memory of 3728	4640	chrome.exe	chrome.exe
PID 4640 wrote to memory of 3728	4640	chrome.exe	chrome.exe
PID 4640 wrote to memory of 3728	4640	chrome.exe	chrome.exe
PID 4640 wrote to memory of 3728	4640	chrome.exe	chrome.exe
PID 4640 wrote to memory of 3728	4640	chrome.exe	chrome.exe
PID 4640 wrote to memory of 3728	4640	chrome.exe	chrome.exe
PID 4640 wrote to memory of 3728	4640	chrome.exe	chrome.exe
PID 4640 wrote to memory of 3728	4640	chrome.exe	chrome.exe
PID 4640 wrote to memory of 3728	4640	chrome.exe	chrome.exe
PID 4640 wrote to memory of 3728	4640	chrome.exe	chrome.exe
PID 4640 wrote to memory of 3728	4640	chrome.exe	chrome.exe
PID 4640 wrote to memory of 3728	4640	chrome.exe	chrome.exe
PID 4640 wrote to memory of 3728	4640	chrome.exe	chrome.exe
PID 4640 wrote to memory of 3728	4640	chrome.exe	chrome.exe
PID 4640 wrote to memory of 3728	4640	chrome.exe	chrome.exe
PID 4640 wrote to memory of 3728	4640	chrome.exe	chrome.exe
PID 4640 wrote to memory of 3728	4640	chrome.exe	chrome.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\startup.exe
"C:\Users\Admin\AppData\Local\Temp\startup.exe"
1⤵
- Loads dropped DLL
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1300

C:\Users\Admin\AppData\Local\Temp\8A60BC74-CA9B-11ED-ABF7-C2E0088FA829\windowsdesktop-runtime-6.0.10-win-x86.exe
"C:\Users\Admin\AppData\Local\Temp\8A60BC74-CA9B-11ED-ABF7-C2E0088FA829\windowsdesktop-runtime-6.0.10-win-x86.exe" /q /norestart
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752

C:\Windows\Temp\{ADB54890-3D9D-489E-A953-BCB3AE456147}\.cr\windowsdesktop-runtime-6.0.10-win-x86.exe
"C:\Windows\Temp\{ADB54890-3D9D-489E-A953-BCB3AE456147}\.cr\windowsdesktop-runtime-6.0.10-win-x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\8A60BC74-CA9B-11ED-ABF7-C2E0088FA829\windowsdesktop-runtime-6.0.10-win-x86.exe" -burn.filehandle.attached=540 -burn.filehandle.self=548 /q /norestart
3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:5580

C:\Windows\Temp\{804B2C12-D826-4507-96CD-6DC494C32210}\.be\windowsdesktop-runtime-6.0.10-win-x86.exe
"C:\Windows\Temp\{804B2C12-D826-4507-96CD-6DC494C32210}\.be\windowsdesktop-runtime-6.0.10-win-x86.exe" -q -burn.elevated BurnPipe.{B876CD8C-5A91-4CBF-856A-2E87B1D72C13} {D1F5D825-A5B7-43BF-BEC5-45B50E9AB030} 5580
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:6036

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\15E3D884-CA9E-11ED-ABF7-C2E0088FA829\GetSI.dll",SaveReportRunDllEntry "C:\Users\Admin\AppData\Local\Temp\15E3D884-CA9E-11ED-ABF7-C2E0088FA829\15E3D885-CA9E-11ED-ABF7-C2E0088FA829"
2⤵
- Loads dropped DLL
- Checks whether UAC is enabled
PID:5652

C:\Users\Admin\AppData\Local\Temp\startup.exe
"C:\Users\Admin\AppData\Local\Temp\startup.exe" -cleanup="C:\Users\Admin\AppData\Local\Temp\2F6C35F1B9ACDE11BA7F2C0E80F88A92;1300"
2⤵
PID:5232

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\ResetPing.wvx"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4792

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:444

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5248

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1908

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding A8AE04871B37199A70E7605ACB07961B
2⤵
- Loads dropped DLL
PID:5844

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 323792C97570858E8A2BA87B85149219
2⤵
- Loads dropped DLL
PID:2896

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 2AADEC20043D0C1D05BB2909199B998D
2⤵
- Loads dropped DLL
PID:5400

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 304526EFAC539354385E5735C456971D
2⤵
- Loads dropped DLL
PID:4052

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding ACBEEEB8796BDFFAC8C6715F91DB097D
2⤵
- Loads dropped DLL
PID:1084

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 2968A8DEBC7DECCD60B1F4D6BB0B2FCD E Global\MSI0000
2⤵
- Loads dropped DLL
PID:5472

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding FA87D86C2AD2CF91B6F75616410815EC E Global\MSI0000
2⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in Windows directory
PID:3924

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:4640

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa32509758,0x7ffa32509768,0x7ffa32509778
2⤵
PID:4736

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1800 --field-trial-handle=1824,i,9053650679018859805,3691909478834834394,131072 /prefetch:2
2⤵
PID:3728

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1824,i,9053650679018859805,3691909478834834394,131072 /prefetch:8
2⤵
PID:5124

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2180 --field-trial-handle=1824,i,9053650679018859805,3691909478834834394,131072 /prefetch:8
2⤵
PID:5936

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3216 --field-trial-handle=1824,i,9053650679018859805,3691909478834834394,131072 /prefetch:1
2⤵
PID:5816

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3340 --field-trial-handle=1824,i,9053650679018859805,3691909478834834394,131072 /prefetch:1
2⤵
PID:2084

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4516 --field-trial-handle=1824,i,9053650679018859805,3691909478834834394,131072 /prefetch:1
2⤵
PID:5444

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4704 --field-trial-handle=1824,i,9053650679018859805,3691909478834834394,131072 /prefetch:8
2⤵
PID:5060

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4736 --field-trial-handle=1824,i,9053650679018859805,3691909478834834394,131072 /prefetch:8
2⤵
PID:1492

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4532 --field-trial-handle=1824,i,9053650679018859805,3691909478834834394,131072 /prefetch:8
2⤵
PID:5636

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5168 --field-trial-handle=1824,i,9053650679018859805,3691909478834834394,131072 /prefetch:8
2⤵
PID:4684

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5224 --field-trial-handle=1824,i,9053650679018859805,3691909478834834394,131072 /prefetch:8
2⤵
PID:4112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4548 --field-trial-handle=1824,i,9053650679018859805,3691909478834834394,131072 /prefetch:8
2⤵
PID:3576

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4724 --field-trial-handle=1824,i,9053650679018859805,3691909478834834394,131072 /prefetch:8
2⤵
PID:5764

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4736 --field-trial-handle=1824,i,9053650679018859805,3691909478834834394,131072 /prefetch:1
2⤵
PID:2540

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5296 --field-trial-handle=1824,i,9053650679018859805,3691909478834834394,131072 /prefetch:1
2⤵
PID:5160

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=5144 --field-trial-handle=1824,i,9053650679018859805,3691909478834834394,131072 /prefetch:1
2⤵
PID:2212

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=3488 --field-trial-handle=1824,i,9053650679018859805,3691909478834834394,131072 /prefetch:1
2⤵
PID:5476

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=5532 --field-trial-handle=1824,i,9053650679018859805,3691909478834834394,131072 /prefetch:1
2⤵
PID:5052

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2828 --field-trial-handle=1824,i,9053650679018859805,3691909478834834394,131072 /prefetch:2
2⤵
PID:2520

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=5592 --field-trial-handle=1824,i,9053650679018859805,3691909478834834394,131072 /prefetch:1
2⤵
PID:1164

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=5740 --field-trial-handle=1824,i,9053650679018859805,3691909478834834394,131072 /prefetch:1
2⤵
PID:1920

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 --field-trial-handle=1824,i,9053650679018859805,3691909478834834394,131072 /prefetch:8
2⤵
PID:2656

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1536 --field-trial-handle=1824,i,9053650679018859805,3691909478834834394,131072 /prefetch:8
2⤵
PID:4668

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2996

C:\Users\Admin\AppData\Local\Temp\Temp1_Antivirus just in case-20230324T224933Z-001.zip\Antivirus just in case\HitmanPro_x64.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Antivirus just in case-20230324T224933Z-001.zip\Antivirus just in case\HitmanPro_x64.exe"
1⤵
- Drops file in Drivers directory
- Enumerates connected drives
- Maps connected drives based on registry
- Checks SCSI registry key(s)
PID:5012

C:\Program Files\HitmanPro\hmpsched.exe
"C:\Program Files\HitmanPro\hmpsched.exe"
1⤵
- Executes dropped EXE
PID:2492

C:\Users\Admin\AppData\Local\Temp\Temp1_Antivirus just in case-20230324T224933Z-001.zip\Antivirus just in case\NPE.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Antivirus just in case-20230324T224933Z-001.zip\Antivirus just in case\NPE.exe"
1⤵
PID:4408

C:\Users\Admin\AppData\Local\Temp\Temp1_Antivirus just in case-20230324T224933Z-001.zip\Antivirus just in case\startup.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Antivirus just in case-20230324T224933Z-001.zip\Antivirus just in case\startup.exe"
1⤵
PID:1212

C:\Users\Admin\AppData\Local\Temp\Temp1_Antivirus just in case-20230324T224933Z-001.zip\Antivirus just in case\startup.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Antivirus just in case-20230324T224933Z-001.zip\Antivirus just in case\startup.exe" -cleanup="C:\Users\Admin\AppData\Local\Temp\EFACE3EFE9ACDE11BA7F2C0E80F88A92;1212"
2⤵
PID:5940

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3843855 /state1:0x41c64e6d
1⤵
PID:5380

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:4424

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Bootkit

T1067

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Install Root Certificate

T1130

Credential Access

Discovery

Query Registry

System Information Discovery

Security Software Discovery

T1063

Peripheral Device Discovery