redline | 5b315a54591d573feb569d2471d8291351a552d4b3f2e35987bc93bee1218989

Processes:

Bootstrapper.exeVC2005_redist_x64.exeVC2013_redist_x64.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	Bootstrapper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{9ee6a522-80ed-4b87-8615-dfd7038c76b8} = "\"C:\\ProgramData\\Package Cache\\{9ee6a522-80ed-4b87-8615-dfd7038c76b8}\\Bootstrapper.exe\" /burn.runonce"	Bootstrapper.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	VC2005_redist_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	VC2005_redist_x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	VC2013_redist_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{050d4fc8-5d48-4b8f-8972-47c82c46020f} = "\"C:\\ProgramData\\Package Cache\\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\\vcredist_x64.exe\" /burn.runonce"	VC2013_redist_x64.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe

Drops file in System32 directory 15 IoCs

Processes:

Setup.exe

description	ioc	process
File opened for modification	\??\c:\windows\system32\vcruntime140_clr0400.dll	Setup.exe
File opened for modification	\??\c:\windows\syswow64\vcruntime140_clr0400.dll	Setup.exe
File opened for modification	\??\c:\windows\syswow64\msvcr120_clr0400.dll	Setup.exe
File opened for modification	\??\c:\windows\system32\msvcr100_clr0400.dll	Setup.exe
File opened for modification	\??\c:\windows\syswow64\msvcp140_clr0400.dll	Setup.exe
File opened for modification	\??\c:\windows\syswow64\aspnet_counters.dll	Setup.exe
File opened for modification	\??\c:\windows\syswow64\msvcp120_clr0400.dll	Setup.exe
File opened for modification	\??\c:\windows\system32\ucrtbase_clr0400.dll	Setup.exe
File opened for modification	\??\c:\windows\system32\msvcp140_clr0400.dll	Setup.exe
File opened for modification	\??\c:\windows\system32\msvcr120_clr0400.dll	Setup.exe
File opened for modification	\??\c:\windows\system32\en-us\dfshim.dll.mui	Setup.exe
File opened for modification	\??\c:\windows\syswow64\ucrtbase_clr0400.dll	Setup.exe
File opened for modification	\??\c:\windows\syswow64\msvcr100_clr0400.dll	Setup.exe
File opened for modification	\??\c:\windows\system32\aspnet_counters.dll	Setup.exe
File opened for modification	\??\c:\windows\system32\msvcp120_clr0400.dll	Setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

Setup.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	Setup.exe

Drops file in Program Files directory 3 IoCs

Processes:

Setup.exemsiexec.exe

description	ioc	process
File opened for modification	\??\c:\program files (x86)\microsoft.net\redistlist\assemblylist_4_client.xml	Setup.exe
File opened for modification	\??\c:\program files (x86)\microsoft.net\redistlist\assemblylist_4_extended.xml	Setup.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VC\amd64\msdia80.dll	msiexec.exe

Drops file in Windows directory 64 IoCs

Processes:

Setup.exemsiexec.exe

description	ioc	process
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\system.runtime.extensions.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\webadminhelp_application.aspx	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\assembly\gac_msil\system.web.entity.design\v4.0_4.0.0.0__b77a5c561934e089\system.web.entity.design.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\system.web.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\app_code\wizardpage.cs	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\system.security.claims.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\system.xml.xmlserializer.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\1033\filetrackerui.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\providers\chooseprovidermanagement.aspx	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\config\legacy.web_mediumtrust.config	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\system.serviceprocess.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\system.runtime.numerics.dll	Setup.exe
File opened for modification	\??\c:\windows\inf\msdtc bridge 4.0.0.0\_transactionbridgeperfcounters.ini	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\system.enterpriseservices.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\aspnet_filter.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\permissions\app_localresources\createpermission.aspx.resx	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_regsql.exe	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\wpf\fonts\globaluserinterface.compositefont	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\dfsvc.exe.config	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\wpf\presentationframework.aerolite.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\system.messaging.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\wpf\system.windows.presentation.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\regasm.exe.config	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\system.data.services.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\sql\en\tracking_schema.sql	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\servicemodelperformancecounters.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\mof\servicemodel.mof.uninstall	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\system.identitymodel.services.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\system.componentmodel.annotations.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\assembly\gac_32\custommarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\custommarshalers.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\installprofile.sql	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\config\web.config.comments	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\wpf\presentationframework.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\wpf\presentationhost_v0400.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\default.aspx	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\system.numerics.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\system.reflection.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\assembly\gac_msil\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe.config	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\config\browsers\ucbrowser.browser	Setup.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20230610161352079.0	msiexec.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\providers\app_localresources\chooseprovidermanagement.aspx.resx	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\addinutil.exe.config	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\wpf\presentationui.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\system.web.routing.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\config\machine.config	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\system.resources.reader.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\assembly\gac_msil\system.windows.input.manipulations\v4.0_4.0.0.0__b77a5c561934e089\system.windows.input.manipulations.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\config\legacy.web_mediumtrust.config	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\system.runtime.serialization.primitives.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\dfsvc.exe	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\assembly\gac_msil\system.diagnostics.tracesource\v4.0_4.0.0.0__b03f5f7f11d50a3a\system.diagnostics.tracesource.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\assembly\gac_msil\system.windows.forms\v4.0_4.0.0.0__b77a5c561934e089\system.windows.forms.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\config\legacy.web_mediumtrust.config.default	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\appconfig\app_localresources\debugandtrace.aspx.resx	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\sql\en\dropsqlpersistenceproviderlogic.sql	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\microsoft.visualbasic.compatibility.data.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\installsqlstatetemplate.sql	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\assembly\gac_32\system.printing\v4.0_4.0.0.0__31bf3856ad364e35\system.printing.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\config\web_hightrust.config	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\app_localresources\editappsetting.aspx.resx	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\eventlogmessages.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\normnfc.nlp	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\config\browsers\ie.browser	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\system.drawing.design.dll	Setup.exe

Executes dropped EXE 10 IoCs

Processes:

rhino_en-us_7.29.23107.03001.exeBootstrapper.exeVC2005_redist_x64.exeVC2013_redist_x64.exeVC2013_redist_x64.exendp48-x86-x64-allos-enu.exeSetup.exeSetupUtility.exeSetupUtility.exedismhost.exe

pid	process
4928	rhino_en-us_7.29.23107.03001.exe
3748	Bootstrapper.exe
4780	VC2005_redist_x64.exe
1228	VC2013_redist_x64.exe
1532	VC2013_redist_x64.exe
2772	ndp48-x86-x64-allos-enu.exe
4996	Setup.exe
1812	SetupUtility.exe
4848	SetupUtility.exe
4424	dismhost.exe

Loads dropped DLL 24 IoCs

Processes:

rhino_en-us_7.29.23107.03001.exeMsiExec.exeVC2013_redist_x64.exeSetup.exedismhost.exe

pid	process
4928	rhino_en-us_7.29.23107.03001.exe
4928	rhino_en-us_7.29.23107.03001.exe
5076	MsiExec.exe
5076	MsiExec.exe
1532	VC2013_redist_x64.exe
4996	Setup.exe
4996	Setup.exe
4424	dismhost.exe
4424	dismhost.exe
4424	dismhost.exe
4424	dismhost.exe
4424	dismhost.exe
4424	dismhost.exe
4424	dismhost.exe
4424	dismhost.exe
4424	dismhost.exe
4424	dismhost.exe
4424	dismhost.exe
4424	dismhost.exe
4424	dismhost.exe
4424	dismhost.exe
4424	dismhost.exe
4424	dismhost.exe
4424	dismhost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\DeviceDesc	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Mfg	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Mfg	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Mfg	svchost.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

Setup.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Setup.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

Processes:

rhino_en-us_7.29.23107.03001.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\rhino_en-us_7.29.23107.03001.exe = "9999"	rhino_en-us_7.29.23107.03001.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	rhino_en-us_7.29.23107.03001.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	rhino_en-us_7.29.23107.03001.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

msiexec.exesvchost.exe

description	ioc	process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe

Modifies registry class 64 IoCs

Processes:

msiexec.exeVC2013_redist_x64.exeBootstrapper.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\10 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.ATL,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e005a00310021003d00520046007900460072005700650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.CRT,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e004b0039007000540041002700650026005d002900650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\ProductName = "Microsoft Visual C++ 2005 Redistributable (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\9 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Features\1af2a8da7e60d0b429d7e6453b3d0182	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{050d4fc8-5d48-4b8f-8972-47c82c46020f}	VC2013_redist_x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\Dependents	VC2013_redist_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\1 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\4 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\7 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{9ee6a522-80ed-4b87-8615-dfd7038c76b8}\Dependents	Bootstrapper.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\Assignment = "1"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFCLOC,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e00530021004900240047002e004f005f0078006800650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.OpenMP,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e007a0050005400310026006e0073004b0064007a00650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\Language = "0"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\92091D8AC5E822E408118470F0E997E6	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1af2a8da7e60d0b429d7e6453b3d0182\VC_Redist	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\DisplayName = "Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501"	VC2013_redist_x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v12	VC2013_redist_x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v12\Dependents\{050d4fc8-5d48-4b8f-8972-47c82c46020f}	VC2013_redist_x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{9ee6a522-80ed-4b87-8615-dfd7038c76b8}\Dependents	Bootstrapper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\PackageCode = "C558A51006735C645AEE5A0FC6A310C9"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\11 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\92091D8AC5E822E408118470F0E997E6	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\2 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\3 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{9ee6a522-80ed-4b87-8615-dfd7038c76b8}	Bootstrapper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{9ee6a522-80ed-4b87-8615-dfd7038c76b8}\Version = "7.29.23107.3001"	Bootstrapper.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFC,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e0069002a0048004e00530057007d0024007e005500650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\ = "{050d4fc8-5d48-4b8f-8972-47c82c46020f}"	VC2013_redist_x64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.ATL,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e007b004c0046003d0042004900620074004f002800650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\Dependents\{050d4fc8-5d48-4b8f-8972-47c82c46020f}	VC2013_redist_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\6 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1af2a8da7e60d0b429d7e6453b3d0182	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Win32Assemblies\Global	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.OpenMP,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e007e0078002d00360076007a0045007a007e003200650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\PackageName = "vcredist.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v12\Dependents\{050d4fc8-5d48-4b8f-8972-47c82c46020f}	VC2013_redist_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{9ee6a522-80ed-4b87-8615-dfd7038c76b8}\DisplayName = "Rhino 7"	Bootstrapper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\5 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\{9EE6A522-80ED-4B87-8615-DFD7038C76B8}\DEPENDENTS\{9EE6A522-80ED-4B87-8615-DFD7038C76B8}	Bootstrapper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\8 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\92091D8AC5E822E408118470F0E997E6\1af2a8da7e60d0b429d7e6453b3d0182	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{9ee6a522-80ed-4b87-8615-dfd7038c76b8}	Bootstrapper.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

Processes:

Setup.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8F43288AD272F3103B6FB1428485EA3014C0BCFE	Setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8F43288AD272F3103B6FB1428485EA3014C0BCFE\Blob = 5900000001000000160000005200530041002f005300480041003200350036000000190000000100000010000000bb048f1838395f6fc3a1f3d2b7e97654140000000100000014000000722d3a02319043b914054ee1eaa7c731d12389340300000001000000140000008f43288ad272f3103b6fb1428485ea3014c0bcfe69000000010000000e000000300c060a2b0601040182373c03020b00000001000000540000004d006900630072006f0073006f0066007400200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003100310000000f0000000100000020000000279cd652c4e252bfbe5217ac722205d7729ba409148cfa9e6d9e5b1cb94eaff1040000000100000010000000ce0490d5e56c34a5ae0be98be581185d5c0000000100000004000000001000002000000001000000f1050000308205ed308203d5a00302010202103f8bc8b5fc9fb29643b569d66c42e144300d06092a864886f70d01010b0500308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f726974792032303131301e170d3131303332323232303532385a170d3336303332323232313330345a308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f72697479203230313130820222300d06092a864886f70d01010105000382020f003082020a0282020100b28041aa35384d13723268224db8b2f1ffd552bc6cc7f5d24a8c36eed1c25c7e8c8aaeaf13286fc073e33aced025a85a3a6defa8b859ab132368cd0c2987d16f805c8f447f5d90015258ac51c55f2a87dcdcd80a1dc103b97bb056e8a3de6461c29ef8f37cb9ec0db554fe4cb6654f88f09c48990c420b097c315917790678288d893a4c0325be716a5c0be78460a49922e3d2af84a4a7fbd198ed0ca9de9489e10ea0dcc0ce993dea0852bb5679e41f84ba1eb8b4c4495c4f314b87dddd0567269980e07111a3b8a541e2a453b9f73229830c13bf365e04b34b43472f6be2911ed3984fdd4207c8e81d12fc99a96b3e927ec8d6693afc64bdb6099dcafd0c0ba29b77604b0394a4306912d6422dc1414ccadcaafd8f5b83469ad9fcb1d1e3b3c97f487acd24f0418f5c74d0acb010200649b7c72d21c857e3d086f30368fbd0ce71c189994a64016cfdec3091cf413c92c7e5ba861d6184c75f833962aeb4922f47f30bf855eba01f59d0bb749b1ed076e6f2e906d710e8fa64de69c635968802f046b83f27996fcb71892935f7481602358fd5797c4d02cf5feb8a834f457188f9a90d4e72e9c29c07cf491b4e040e63518c5ed800c1552cb6c6e0c2654ec93439f59cb3c47ee8616e135f15c45fd97eed1dceee44eccb2e86b1ec38f670edab5c13c1d90f0dc780b255ed34f7ac9be4c3dae7473ca6b58f31dfc54bafebf10203010001a351304f300b0603551d0f040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414722d3a02319043b914054ee1eaa7c731d1238934301006092b06010401823715010403020100300d06092a864886f70d01010b050003820201007f72cf0fb7c515db9bc049ca265bfe9e13e6d3f0d2db975ff24b3f4db3ae19aeedd797a0acefa93aa3c241b0e5b8919e13812403e609fd3f574039212456d1102f4b40a936864bb453579afbf17e898f11fe186c51aae8ed0995b5e571c9a1e98775a6157fc97e37545e7493c5c367cc0d4f6ba8170c6d08927e8bdd81aa2d7021c33d0614bbbf245ea784d73f0f2122bd4b0006db971cd85ed4c50b5c876e50a4e8c338a4fbcb2cc592669b855ecb7a6c937c8029585b57b54069ba0879a66462159d879645b5662320038b1c73a0d3a27933e0505986db2fe50225ea732a9f0014c836c7923be94e00ecd85609b9334912d2540b01abac47b691297d4cb475805201e8ca82f69fccac9c8f17ea2f26b0ab72ac0bfe9e511ec74355674f51b357d6b6ecee52b73ae94ee1d78188bc4f8e75bb4ba8f035aa26d4676749b2704c3b93dc1ddf78908672b238a4d1dc924dc958eb2b125cd43bae8c6bb083e5013ff80932f693353422afdd370d7709802bcd4800f18c9919470501e9d1bfd14ed0e628433799a40a4a08d99a7173d2aacd31136376a1376f92381e7d123c6632e7cb6de1fc5289ddcad666059a9661bea228c71ca3a736503c3aa4df4a6ee6873bceebf0e081379d133c528ebdb91d34c61dd50a6a3d9829708c892ad1ab8210481fdcf4efa5c5bb551a3863844eb76cad9554ec6522104917b8c01ec70fac5447	Setup.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

msiexec.exeSetup.exe

pid	process
2568	msiexec.exe
2568	msiexec.exe
4996	Setup.exe
4996	Setup.exe
4996	Setup.exe
4996	Setup.exe
4996	Setup.exe
4996	Setup.exe
4996	Setup.exe
4996	Setup.exe
4996	Setup.exe
4996	Setup.exe
4996	Setup.exe
4996	Setup.exe
4996	Setup.exe
4996	Setup.exe
4996	Setup.exe
4996	Setup.exe
4996	Setup.exe
4996	Setup.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

vssvc.exesrtasks.exemsiexec.exemsiexec.exe

description	pid	process
Token: SeBackupPrivilege	1652	vssvc.exe
Token: SeRestorePrivilege	1652	vssvc.exe
Token: SeAuditPrivilege	1652	vssvc.exe
Token: SeBackupPrivilege	2060	srtasks.exe
Token: SeRestorePrivilege	2060	srtasks.exe
Token: SeSecurityPrivilege	2060	srtasks.exe
Token: SeTakeOwnershipPrivilege	2060	srtasks.exe
Token: SeBackupPrivilege	2060	srtasks.exe
Token: SeRestorePrivilege	2060	srtasks.exe
Token: SeSecurityPrivilege	2060	srtasks.exe
Token: SeTakeOwnershipPrivilege	2060	srtasks.exe
Token: SeShutdownPrivilege	3728	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3728	msiexec.exe
Token: SeSecurityPrivilege	2568	msiexec.exe
Token: SeCreateTokenPrivilege	3728	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3728	msiexec.exe
Token: SeLockMemoryPrivilege	3728	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3728	msiexec.exe
Token: SeMachineAccountPrivilege	3728	msiexec.exe
Token: SeTcbPrivilege	3728	msiexec.exe
Token: SeSecurityPrivilege	3728	msiexec.exe
Token: SeTakeOwnershipPrivilege	3728	msiexec.exe
Token: SeLoadDriverPrivilege	3728	msiexec.exe
Token: SeSystemProfilePrivilege	3728	msiexec.exe
Token: SeSystemtimePrivilege	3728	msiexec.exe
Token: SeProfSingleProcessPrivilege	3728	msiexec.exe
Token: SeIncBasePriorityPrivilege	3728	msiexec.exe
Token: SeCreatePagefilePrivilege	3728	msiexec.exe
Token: SeCreatePermanentPrivilege	3728	msiexec.exe
Token: SeBackupPrivilege	3728	msiexec.exe
Token: SeRestorePrivilege	3728	msiexec.exe
Token: SeShutdownPrivilege	3728	msiexec.exe
Token: SeDebugPrivilege	3728	msiexec.exe
Token: SeAuditPrivilege	3728	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3728	msiexec.exe
Token: SeChangeNotifyPrivilege	3728	msiexec.exe
Token: SeRemoteShutdownPrivilege	3728	msiexec.exe
Token: SeUndockPrivilege	3728	msiexec.exe
Token: SeSyncAgentPrivilege	3728	msiexec.exe
Token: SeEnableDelegationPrivilege	3728	msiexec.exe
Token: SeManageVolumePrivilege	3728	msiexec.exe
Token: SeImpersonatePrivilege	3728	msiexec.exe
Token: SeCreateGlobalPrivilege	3728	msiexec.exe
Token: SeRestorePrivilege	2568	msiexec.exe
Token: SeTakeOwnershipPrivilege	2568	msiexec.exe
Token: SeRestorePrivilege	2568	msiexec.exe
Token: SeTakeOwnershipPrivilege	2568	msiexec.exe
Token: SeRestorePrivilege	2568	msiexec.exe
Token: SeTakeOwnershipPrivilege	2568	msiexec.exe
Token: SeRestorePrivilege	2568	msiexec.exe
Token: SeTakeOwnershipPrivilege	2568	msiexec.exe
Token: SeRestorePrivilege	2568	msiexec.exe
Token: SeTakeOwnershipPrivilege	2568	msiexec.exe
Token: SeRestorePrivilege	2568	msiexec.exe
Token: SeTakeOwnershipPrivilege	2568	msiexec.exe
Token: SeRestorePrivilege	2568	msiexec.exe
Token: SeTakeOwnershipPrivilege	2568	msiexec.exe
Token: SeRestorePrivilege	2568	msiexec.exe
Token: SeTakeOwnershipPrivilege	2568	msiexec.exe
Token: SeRestorePrivilege	2568	msiexec.exe
Token: SeTakeOwnershipPrivilege	2568	msiexec.exe
Token: SeRestorePrivilege	2568	msiexec.exe
Token: SeTakeOwnershipPrivilege	2568	msiexec.exe
Token: SeRestorePrivilege	2568	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

rhino_en-us_7.29.23107.03001.exemsiexec.exe

pid process

4928 rhino_en-us_7.29.23107.03001.exe
3728 msiexec.exe
3728 msiexec.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

rhino_en-us_7.29.23107.03001.exe

pid process

4928 rhino_en-us_7.29.23107.03001.exe
4928 rhino_en-us_7.29.23107.03001.exe
4928 rhino_en-us_7.29.23107.03001.exe

Suspicious use of WriteProcessMemory 37 IoCs

Processes:

rhino_en-us_7.29.23107.03001.exerhino_en-us_7.29.23107.03001.exeBootstrapper.exeVC2005_redist_x64.exemsiexec.exeVC2013_redist_x64.exendp48-x86-x64-allos-enu.exeSetup.exedism.exe

description	pid	process	target process
PID 4524 wrote to memory of 4928	4524	rhino_en-us_7.29.23107.03001.exe	rhino_en-us_7.29.23107.03001.exe
PID 4524 wrote to memory of 4928	4524	rhino_en-us_7.29.23107.03001.exe	rhino_en-us_7.29.23107.03001.exe
PID 4524 wrote to memory of 4928	4524	rhino_en-us_7.29.23107.03001.exe	rhino_en-us_7.29.23107.03001.exe
PID 4928 wrote to memory of 3748	4928	rhino_en-us_7.29.23107.03001.exe	Bootstrapper.exe
PID 4928 wrote to memory of 3748	4928	rhino_en-us_7.29.23107.03001.exe	Bootstrapper.exe
PID 4928 wrote to memory of 3748	4928	rhino_en-us_7.29.23107.03001.exe	Bootstrapper.exe
PID 3748 wrote to memory of 4780	3748	Bootstrapper.exe	VC2005_redist_x64.exe
PID 3748 wrote to memory of 4780	3748	Bootstrapper.exe	VC2005_redist_x64.exe
PID 3748 wrote to memory of 4780	3748	Bootstrapper.exe	VC2005_redist_x64.exe
PID 4780 wrote to memory of 3728	4780	VC2005_redist_x64.exe	msiexec.exe
PID 4780 wrote to memory of 3728	4780	VC2005_redist_x64.exe	msiexec.exe
PID 4780 wrote to memory of 3728	4780	VC2005_redist_x64.exe	msiexec.exe
PID 2568 wrote to memory of 5076	2568	msiexec.exe	MsiExec.exe
PID 2568 wrote to memory of 5076	2568	msiexec.exe	MsiExec.exe
PID 2568 wrote to memory of 5076	2568	msiexec.exe	MsiExec.exe
PID 3748 wrote to memory of 1228	3748	Bootstrapper.exe	VC2013_redist_x64.exe
PID 3748 wrote to memory of 1228	3748	Bootstrapper.exe	VC2013_redist_x64.exe
PID 3748 wrote to memory of 1228	3748	Bootstrapper.exe	VC2013_redist_x64.exe
PID 1228 wrote to memory of 1532	1228	VC2013_redist_x64.exe	VC2013_redist_x64.exe
PID 1228 wrote to memory of 1532	1228	VC2013_redist_x64.exe	VC2013_redist_x64.exe
PID 1228 wrote to memory of 1532	1228	VC2013_redist_x64.exe	VC2013_redist_x64.exe
PID 3748 wrote to memory of 2772	3748	Bootstrapper.exe	ndp48-x86-x64-allos-enu.exe
PID 3748 wrote to memory of 2772	3748	Bootstrapper.exe	ndp48-x86-x64-allos-enu.exe
PID 3748 wrote to memory of 2772	3748	Bootstrapper.exe	ndp48-x86-x64-allos-enu.exe
PID 2772 wrote to memory of 4996	2772	ndp48-x86-x64-allos-enu.exe	Setup.exe
PID 2772 wrote to memory of 4996	2772	ndp48-x86-x64-allos-enu.exe	Setup.exe
PID 2772 wrote to memory of 4996	2772	ndp48-x86-x64-allos-enu.exe	Setup.exe
PID 4996 wrote to memory of 1812	4996	Setup.exe	SetupUtility.exe
PID 4996 wrote to memory of 1812	4996	Setup.exe	SetupUtility.exe
PID 4996 wrote to memory of 1812	4996	Setup.exe	SetupUtility.exe
PID 4996 wrote to memory of 4848	4996	Setup.exe	SetupUtility.exe
PID 4996 wrote to memory of 4848	4996	Setup.exe	SetupUtility.exe
PID 4996 wrote to memory of 4848	4996	Setup.exe	SetupUtility.exe
PID 4996 wrote to memory of 4344	4996	Setup.exe	dism.exe
PID 4996 wrote to memory of 4344	4996	Setup.exe	dism.exe
PID 4344 wrote to memory of 4424	4344	dism.exe	dismhost.exe
PID 4344 wrote to memory of 4424	4344	dism.exe	dismhost.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\rhino_en-us_7.29.23107.03001.exe
"C:\Users\Admin\AppData\Local\Temp\rhino_en-us_7.29.23107.03001.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4524

C:\Windows\Temp\{7BDB8530-6FA2-41CE-83E3-594DC37A3320}\.cr\rhino_en-us_7.29.23107.03001.exe
"C:\Windows\Temp\{7BDB8530-6FA2-41CE-83E3-594DC37A3320}\.cr\rhino_en-us_7.29.23107.03001.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\rhino_en-us_7.29.23107.03001.exe" -burn.filehandle.attached=528 -burn.filehandle.self=536
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4928

C:\Windows\Temp\{893CBD47-7380-438B-B3BE-3E5B03AB7E8B}\.be\Bootstrapper.exe
"C:\Windows\Temp\{893CBD47-7380-438B-B3BE-3E5B03AB7E8B}\.be\Bootstrapper.exe" -q -burn.elevated BurnPipe.{C5E28A34-6AF3-4E6C-B0E8-55D0045EC1E9} {60878340-F202-493C-ABDA-FECCA1182286} 4928
3⤵
- Adds Run key to start application
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3748

C:\ProgramData\Package Cache\EE916012783024DAC67FC606457377932C826F05\redist\VC2005_redist_x64.exe
"C:\ProgramData\Package Cache\EE916012783024DAC67FC606457377932C826F05\redist\VC2005_redist_x64.exe" /q:a
4⤵
- Adds Run key to start application
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780

C:\Windows\SysWOW64\msiexec.exe
msiexec /i vcredist.msi
5⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3728

C:\ProgramData\Package Cache\8BF41BA9EEF02D30635A10433817DBB6886DA5A2\redist\VC2013_redist_x64.exe
"C:\ProgramData\Package Cache\8BF41BA9EEF02D30635A10433817DBB6886DA5A2\redist\VC2013_redist_x64.exe" /quiet /norestart
4⤵
- Adds Run key to start application
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1228

C:\ProgramData\Package Cache\8BF41BA9EEF02D30635A10433817DBB6886DA5A2\redist\VC2013_redist_x64.exe
"C:\ProgramData\Package Cache\8BF41BA9EEF02D30635A10433817DBB6886DA5A2\redist\VC2013_redist_x64.exe" /quiet /norestart -burn.unelevated BurnPipe.{A7F893A3-BBFD-4FC7-AA78-3E8A3682BBF3} {4880E323-AB17-4898-B6D1-86BF8CA1673B} 1228
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1532

C:\ProgramData\Package Cache\584FFD3BBB7F73CD149E4486F6465C838D847450\redist\ndp48-x86-x64-allos-enu.exe
"C:\ProgramData\Package Cache\584FFD3BBB7F73CD149E4486F6465C838D847450\redist\ndp48-x86-x64-allos-enu.exe" /q /norestart /ChainingPackage "Rhino 7" /log "C:\Users\Admin\AppData\Local\Temp\Rhino_7_20230610161207_002_NetFx48Redist.log.html" /pipe NetFxSection.{9773FC58-A365-468D-86C8-74961C55DF52}
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772

C:\5f1e66614310730602e4afb610bb69d8\Setup.exe
C:\5f1e66614310730602e4afb610bb69d8\\Setup.exe /q /norestart /ChainingPackage "Rhino 7" /log "C:\Users\Admin\AppData\Local\Temp\Rhino_7_20230610161207_002_NetFx48Redist.log.html" /pipe NetFxSection.{9773FC58-A365-468D-86C8-74961C55DF52} /x86 /x64 /redist
5⤵
- Drops file in System32 directory
- Checks system information in the registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4996

C:\5f1e66614310730602e4afb610bb69d8\SetupUtility.exe
SetupUtility.exe /aupause
6⤵
- Executes dropped EXE
PID:1812

C:\5f1e66614310730602e4afb610bb69d8\SetupUtility.exe
SetupUtility.exe /screboot
6⤵
- Executes dropped EXE
PID:4848

C:\Windows\System32\dism.exe
dism.exe /quiet /norestart /online /add-package /packagepath:"C:\5f1e66614310730602e4afb610bb69d8\x64-Windows10.0-KB4486129-x64.cab"
6⤵
- Suspicious use of WriteProcessMemory
PID:4344

C:\Users\Admin\AppData\Local\Temp\651DBDC5-97DC-4047-9034-98EE9BE47FD5\dismhost.exe
C:\Users\Admin\AppData\Local\Temp\651DBDC5-97DC-4047-9034-98EE9BE47FD5\dismhost.exe {A9718A6A-EECF-4509-9D99-F66E3FC30FB8}
7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4424

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc
1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4016

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2060

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2568

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 506D341A239AD86E9E646F8015E09AD3
2⤵
- Loads dropped DLL
PID:5076

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

Install Root Certificate

T1130

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery