Analysis
-
max time kernel
72s -
max time network
80s -
platform
windows7_x64 -
resource
win7-20230621-en -
resource tags
arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system -
submitted
27-06-2023 04:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
PE-DESIGN 10.exe
Resource
win7-20230621-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
PE-DESIGN 10.exe
Resource
win10v2004-20230621-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
PE-DESIGN 10.exe
-
Size
133.2MB
-
MD5
1eab43b9863a9e3203b8fb415294f7ae
-
SHA1
3f0921b2a8616420839b029d6cbb0544a0bbfe88
-
SHA256
4f0e2487db334d423312079607320b303bf2bd502b6a1a8b78d5744601fee7a6
-
SHA512
4cf29ad9d6c7f5f4cf3ac4a51d7682bc6404457df10be0406ddc57ea6f53b1c6bf69d2f27b210d6a2e853c4b95364534927ec5de9e36d096b8ab2f3f64d3e8c2
-
SSDEEP
3145728:jVfN29HxfR8Okgh02VcKk/CzGwNWkj1hcajz08//7:VN29RfR8ORfcKfXNWu1hFz0y/7
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 6 IoCs
pid Process 1384 MsiExec.exe 1384 MsiExec.exe 1384 MsiExec.exe 1468 MsiExec.exe 1468 MsiExec.exe 1468 MsiExec.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\H: PE-DESIGN 10.exe File opened (read-only) \??\P: PE-DESIGN 10.exe File opened (read-only) \??\R: PE-DESIGN 10.exe File opened (read-only) \??\L: PE-DESIGN 10.exe File opened (read-only) \??\N: PE-DESIGN 10.exe File opened (read-only) \??\P: PE-DESIGN 10.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\N: PE-DESIGN 10.exe File opened (read-only) \??\J: PE-DESIGN 10.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\F: PE-DESIGN 10.exe File opened (read-only) \??\G: PE-DESIGN 10.exe File opened (read-only) \??\F: PE-DESIGN 10.exe File opened (read-only) \??\W: PE-DESIGN 10.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: PE-DESIGN 10.exe File opened (read-only) \??\K: PE-DESIGN 10.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: PE-DESIGN 10.exe File opened (read-only) \??\L: PE-DESIGN 10.exe File opened (read-only) \??\Q: PE-DESIGN 10.exe File opened (read-only) \??\B: PE-DESIGN 10.exe File opened (read-only) \??\I: PE-DESIGN 10.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\J: PE-DESIGN 10.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Z: PE-DESIGN 10.exe File opened (read-only) \??\T: PE-DESIGN 10.exe File opened (read-only) \??\U: PE-DESIGN 10.exe File opened (read-only) \??\V: PE-DESIGN 10.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\M: PE-DESIGN 10.exe File opened (read-only) \??\G: PE-DESIGN 10.exe File opened (read-only) \??\R: PE-DESIGN 10.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\E: PE-DESIGN 10.exe File opened (read-only) \??\I: PE-DESIGN 10.exe File opened (read-only) \??\S: PE-DESIGN 10.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: PE-DESIGN 10.exe File opened (read-only) \??\M: PE-DESIGN 10.exe File opened (read-only) \??\Z: PE-DESIGN 10.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: PE-DESIGN 10.exe File opened (read-only) \??\X: PE-DESIGN 10.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\S: PE-DESIGN 10.exe File opened (read-only) \??\T: PE-DESIGN 10.exe File opened (read-only) \??\X: PE-DESIGN 10.exe File opened (read-only) \??\O: PE-DESIGN 10.exe File opened (read-only) \??\U: PE-DESIGN 10.exe File opened (read-only) \??\V: PE-DESIGN 10.exe File opened (read-only) \??\E: PE-DESIGN 10.exe File opened (read-only) \??\H: PE-DESIGN 10.exe -
Drops file in System32 directory 14 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\mfc110u.dll PE-DESIGN 10.exe File opened for modification C:\Windows\SysWOW64\msvcp110.dll PE-DESIGN 10.exe File opened for modification C:\Windows\SysWOW64\msvcr110.dll PE-DESIGN 10.exe File opened for modification C:\Windows\SysWOW64\vccorlib110.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc110u.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfcm110u.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfcm110.dll PE-DESIGN 10.exe File opened for modification C:\Windows\SysWOW64\mfc110.dll PE-DESIGN 10.exe File opened for modification C:\Windows\SysWOW64\msvcr110.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\vccorlib110.dll PE-DESIGN 10.exe File opened for modification C:\Windows\SysWOW64\mfcm110u.dll PE-DESIGN 10.exe File opened for modification C:\Windows\SysWOW64\mfcm110.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc110.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\msvcp110.dll msiexec.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\BIL\PE-DESIGN 10\Sample\Font Creator\Font Template\Small_x.bmp msiexec.exe File created C:\Program Files (x86)\Common Files\BIL\LEADTOOLS\LTAUT13n.dll msiexec.exe File created C:\Program Files (x86)\Brother\PE-DESIGN 10\ClipArt\Celebrations\Shell2.bmp msiexec.exe File created C:\Program Files (x86)\Brother\PE-DESIGN 10\Font\Pefnt083.hoj msiexec.exe File created C:\Program Files (x86)\Brother\PE-DESIGN 10\Font\Pefnt106.hoj msiexec.exe File created C:\Program Files (x86)\Brother\PE-DESIGN 10\Color\bimnd.bml msiexec.exe File created C:\Program Files (x86)\Brother\PE-DESIGN 10\Library\Design Library\Children\33101709.pes msiexec.exe File created C:\Program Files (x86)\Brother\PE-DESIGN 10\Library\Template Library\Towels\towels01B.pes msiexec.exe File created C:\Program Files (x86)\Common Files\BIL\LEADTOOLS\ltdlg13n.ocx msiexec.exe File created C:\Program Files (x86)\Brother\PE-DESIGN 10\Library\Outline Shapes\Fashion\OL_key01.pes msiexec.exe File created C:\Program Files (x86)\Brother\PE-DESIGN 10\Library\Design Library\Lace & Ribbon\33100411.pes msiexec.exe File created C:\Program Files (x86)\Brother\PE-DESIGN 10\Library\Outline Shapes\Basic Shapes\MP_straight01.pes msiexec.exe File created C:\Program Files (x86)\Brother\PE-DESIGN 10\Library\Text\Serif Fonts\TN_069.pes msiexec.exe File created C:\Program Files (x86)\Brother\PE-DESIGN 10\Pattern\motif012.pmf msiexec.exe File created C:\Program Files (x86)\Brother\PE-DESIGN 10\Font\Pefnt023.pf1 msiexec.exe File created C:\Program Files (x86)\Brother\PE-DESIGN 10\ClipArt\Celebrations\Bottle.bmp msiexec.exe File created C:\Program Files (x86)\Brother\PE-DESIGN 10\Library\Template Library\Towels\towels01A.pes msiexec.exe File created C:\Program Files (x86)\Brother\PE-DESIGN 10\Library\Template Library\Jackets\jackets02A.pes msiexec.exe File created C:\Program Files (x86)\Brother\PE-DESIGN 10\Font\Pefnt045.hoj msiexec.exe File created C:\Program Files (x86)\Brother\PE-DESIGN 10\Pattern\stamp7_.pas msiexec.exe File created C:\Program Files (x86)\Brother\PE-DESIGN 10\Library\Design Library\Lace & Ribbon\no78_11.pes msiexec.exe File created C:\Program Files (x86)\Brother\PE-DESIGN 10\Library\Template Library\Jackets\jackets03A.pes msiexec.exe File created C:\Program Files (x86)\Brother\PE-DESIGN 10\Font\Pefnt105.hoj msiexec.exe File created C:\Program Files (x86)\Brother\PE-DESIGN 10\Pattern\motif003.pmf msiexec.exe File created C:\Program Files (x86)\Brother\PE-DESIGN 10\Library\Design Library\Floral4\SP_floral_bar03.pes msiexec.exe File created C:\Program Files (x86)\Brother\PE-DESIGN 10\ClipArt\Christmas\Rdeer_lg.bmp msiexec.exe File created C:\Program Files (x86)\Brother\PE-DESIGN 10\ClipArt\horse.bmp msiexec.exe File created C:\Program Files (x86)\Brother\PE-DESIGN 10\Library\Outline Shapes\Misc\OL_tower01.pes msiexec.exe File created C:\Program Files (x86)\Brother\PE-DESIGN 10\Library\Outline Shapes\Basic Shapes\OP_arc03.pes msiexec.exe File created C:\Program Files (x86)\Common Files\BIL\PE-DESIGN 10\Sample\Layout & Editing\Photo Stitch\temple.jpg msiexec.exe File created C:\Program Files (x86)\Brother\PE-DESIGN 10\Library\Design Library\Aquatic\33101630.pes msiexec.exe File created C:\Program Files (x86)\Brother\PE-DESIGN 10\Library\Template Library\Sheets\sheets05A.pes msiexec.exe File created C:\Program Files (x86)\Brother\PE-DESIGN 10\Library\Design Library\Monogram Decoration\Deco09.pes msiexec.exe File created C:\Program Files (x86)\Brother\PE-DESIGN 10\Library\Outline Shapes\Borders\OL_heart_bar01.pes msiexec.exe File created C:\Program Files (x86)\Brother\PE-DESIGN 10\Library\Outline Shapes\Emblems\OL_flourish03.pes msiexec.exe File created C:\Program Files (x86)\Common Files\BIL\PE-DESIGN 10\Sample\Font Creator\Font Template\Capital_G.bmp msiexec.exe File created C:\Program Files (x86)\Common Files\BIL\PE-DESIGN 10\Sample\Layout & Editing\Various Sew types\FloralLine1.pes msiexec.exe File created C:\Program Files (x86)\Brother\PE-DESIGN 10\ClipArt\Quilt\Run_rab.bmp msiexec.exe File created C:\Program Files (x86)\Brother\PE-DESIGN 10\Library\Design Library\Button Hole L\BH12_L.pes msiexec.exe File created C:\Program Files (x86)\Brother\PE-DESIGN 10\Library\Template Library\Aprons\aprons02A.pes msiexec.exe File created C:\Program Files (x86)\Brother\PE-DESIGN 10\Pattern\stamp3_.pas msiexec.exe File created C:\Program Files (x86)\Brother\PE-DESIGN 10\Library\Design Library\Quilt\no58_5.pes msiexec.exe File created C:\Program Files (x86)\Common Files\BIL\PE-DESIGN 10\Sample\Font Creator\Font Template\Capital_E.bmp msiexec.exe File created C:\Program Files (x86)\Brother\PE-DESIGN 10\Font\Pefnt073.pf1 msiexec.exe File created C:\Program Files (x86)\Brother\PE-DESIGN 10\Library\Design Library\Floral3\Birthday9S.pes msiexec.exe File created C:\Program Files (x86)\Brother\PE-DESIGN 10\Font\Pefnt093.hoj msiexec.exe File created C:\Program Files (x86)\Brother\PE-DESIGN 10\ClipArt\snake.bmp msiexec.exe File created C:\Program Files (x86)\Brother\PE-DESIGN 10\ClipArt\Southwest\Lizard.bmp msiexec.exe File created C:\Program Files (x86)\Brother\PE-DESIGN 10\Library\Design Library\Lace & Ribbon\33101828.pes msiexec.exe File created C:\Program Files (x86)\Brother\PE-DESIGN 10\Library\Design Library\Floral3\Birthday10S.pes msiexec.exe File created C:\Program Files (x86)\Brother\PE-DESIGN 10\Library\Design Library\Holidays\no74_2.pes msiexec.exe File created C:\Program Files (x86)\Brother\PE-DESIGN 10\Pattern\motif081.pmf msiexec.exe File created C:\Program Files (x86)\Brother\PE-DESIGN 10\Library\Design Library\Quilt\no58_10.pes msiexec.exe File created C:\Program Files (x86)\Brother\PE-DESIGN 10\Font\Pefnt005.hoj msiexec.exe File created C:\Program Files (x86)\Brother\PE-DESIGN 10\Library\Text\Transformed\TT_004.pes msiexec.exe File created C:\Program Files (x86)\Brother\PE-DESIGN 10\Library\Template Library\Caps\caps09A.pes msiexec.exe File created C:\Program Files (x86)\Common Files\BIL\PE-DESIGN 10\Sample\Layout & Editing\Photo Stitch\celebration.jpg msiexec.exe File created C:\Program Files (x86)\Brother\PE-DESIGN 10\ClipArt\candy.bmp msiexec.exe File created C:\Program Files (x86)\Brother\PE-DESIGN 10\Color\bim09.bml msiexec.exe File created C:\Program Files (x86)\Brother\PE-DESIGN 10\Library\Design Library\Floral4\SP_leaf01.pes msiexec.exe File created C:\Program Files (x86)\Common Files\BIL\PE-DESIGN 10\Sample\Layout & Editing\Various Sew types\VS_rudolph01.pes msiexec.exe File created C:\Program Files (x86)\Brother\PE-DESIGN 10\Library\Outline Shapes\Misc\OL_arrow04.pes msiexec.exe File created C:\Program Files (x86)\Brother\PE-DESIGN 10\Library\Text\Decorative Fonts\TN_016.pes msiexec.exe File created C:\Program Files (x86)\Common Files\BIL\PE-DESIGN 10\Sample\Layout & Editing\Various Sew types\Stamp_Sample.pes msiexec.exe -
Drops file in Windows directory 27 IoCs
description ioc Process File created C:\Windows\Installer\6cbac8.msi msiexec.exe File opened for modification C:\Windows\Installer\{8BDB2C9D-C678-46C5-A87D-713634DB6487}\Embedit.exe msiexec.exe File opened for modification C:\Windows\Installer\{8BDB2C9D-C678-46C5-A87D-713634DB6487}\Embfont.exe msiexec.exe File created C:\Windows\Installer\6cbac9.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIC1DB.tmp msiexec.exe File opened for modification C:\Windows\Installer\{8BDB2C9D-C678-46C5-A87D-713634DB6487}\EmbProgs.exe msiexec.exe File created C:\Windows\Installer\{8BDB2C9D-C678-46C5-A87D-713634DB6487}\Embedit.exe msiexec.exe File opened for modification C:\Windows\Installer\{8BDB2C9D-C678-46C5-A87D-713634DB6487}\Embmake.exe msiexec.exe File created C:\Windows\Installer\6cbacb.msi msiexec.exe File created C:\Windows\Installer\{8BDB2C9D-C678-46C5-A87D-713634DB6487}\Embfont.exe msiexec.exe File created C:\Windows\Installer\{8BDB2C9D-C678-46C5-A87D-713634DB6487}\Embmake.exe msiexec.exe File opened for modification C:\Windows\Installer\{8BDB2C9D-C678-46C5-A87D-713634DB6487}\Embedit_2.exe msiexec.exe File created C:\Windows\Installer\{8BDB2C9D-C678-46C5-A87D-713634DB6487}\Embedit_1.exe msiexec.exe File opened for modification C:\Windows\Installer\6cbac9.ipi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\Installer\MSIBB93.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\{8BDB2C9D-C678-46C5-A87D-713634DB6487}\EmbDB.exe msiexec.exe File opened for modification C:\Windows\Installer\6cbac8.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIC278.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSICDCF.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\{8BDB2C9D-C678-46C5-A87D-713634DB6487}\EmbProgs.exe msiexec.exe File created C:\Windows\Installer\{8BDB2C9D-C678-46C5-A87D-713634DB6487}\EmbDB.exe msiexec.exe File created C:\Windows\Installer\{8BDB2C9D-C678-46C5-A87D-713634DB6487}\Embedit_2.exe msiexec.exe File opened for modification C:\Windows\Installer\{8BDB2C9D-C678-46C5-A87D-713634DB6487}\Embedit_1.exe msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 46 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D msiexec.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E msiexec.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6780CE08-F782-4458-88A4-DB5FF38AA892}\ProxyStubClsid msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D9C2BDB8876C5C648AD7176343BD4678\SourceList\PackageName = "PE-DESIGN 10.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ProgrammableStitchCreator.pasfile\shell\Open\command\ = "\"C:\\Program Files (x86)\\Brother\\PE-DESIGN 10\\EmbProgs.exe\" \"%1\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.pem\ = "DesignCenter.pemfile" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00130005-B1BA-11CE-ABC6-F5B2E79D9E3F}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00130006-B1BA-11CE-ABC6-F5B2E79D9E3F}\ProxyStubClsid\ = "{00020420-0000-0000-C000-000000000046}" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00130000-B1BA-11CE-ABC6-F5B2E79D9E3F}\MiscStatus msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00130002-B1BA-11CE-ABC6-F5B2E79D9E3F}\ProxyStubClsid msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2EB42375-0D00-444B-A022-09B15CB1261A} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2EB42375-0D00-444B-A022-09B15CB1261A}\InprocServer32\ = "C:\\Program Files (x86)\\Common Files\\BIL\\embedit\\G7EmbTools.ocx" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9BCEF050-A9C8-44B6-AFEC-C4C890CAE381}\1.0\ = "G7EmbTools ActiveX Control module" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9BCEF050-A9C8-44B6-AFEC-C4C890CAE381}\1.0\0\win32\ = "C:\\Program Files (x86)\\Common Files\\BIL\\embedit\\G7EmbTools.ocx" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00130007-B1BA-11CE-ABC6-F5B2E79D9E3F} msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00130801-B1BA-11CE-ABC6-F5B2E79D9E3F}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2EB42375-0D00-444B-A022-09B15CB1261A}\MiscStatus\1\ = "132241" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6780CE08-F782-4458-88A4-DB5FF38AA892}\ProxyStubClsid32 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DesignCenter.pemfile msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00130800-B1BA-11CE-ABC6-F5B2E79D9E3F} msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9BCEF050-A9C8-44B6-AFEC-C4C890CAE381}\1.0\0 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D9C2BDB8876C5C648AD7176343BD4678\MainFeature msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PE-DESIGN10\ProductVersion = "10.20.0000" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00130003-B1BA-11CE-ABC6-F5B2E79D9E3F}\1.0\0 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00130000-B1BA-11CE-ABC6-F5B2E79D9E3F}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D9C2BDB8876C5C648AD7176343BD4678 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00130003-B1BA-11CE-ABC6-F5B2E79D9E3F}\1.0 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6780CE08-F782-4458-88A4-DB5FF38AA892}\TypeLib msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00130800-B1BA-11CE-ABC6-F5B2E79D9E3F}\TypeLib msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00130000-B1BA-11CE-ABC6-F5B2E79D9E3F}\Implemented Categories msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00130005-B1BA-11CE-ABC6-F5B2E79D9E3F}\ProgID msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\LayoutEditing.pesfile\shell\Open\command\ = "\"C:\\Program Files (x86)\\Brother\\PE-DESIGN 10\\Embedit.exe\" \"%1\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00130003-B1BA-11CE-ABC6-F5B2E79D9E3F}\1.0\ = "LEAD Main Control (13.0)" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00130004-B1BA-11CE-ABC6-F5B2E79D9E3F}\ = "IAnnToolbar" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{45C4F113-B646-44CF-BF61-29B0DD05A52E}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6780CE08-F782-4458-88A4-DB5FF38AA892}\ProxyStubClsid\ = "{00020420-0000-0000-C000-000000000046}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ProgrammableStitchCreator.pasfile\ = "PE-DESIGN Pattern File" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PE-DESIGN10\ProductLanguage = "1033" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00130006-B1BA-11CE-ABC6-F5B2E79D9E3F}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00130000-B1BA-11CE-ABC6-F5B2E79D9E3F} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.pas\ = "ProgrammableStitchCreator.pasfile" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00130801-B1BA-11CE-ABC6-F5B2E79D9E3F}\InprocServer32\ = "C:\\Program Files (x86)\\Common Files\\BIL\\LEADTOOLS\\ltocx13n.ocx" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2EB42375-0D00-444B-A022-09B15CB1261A}\ProgID\ = "G7EMBTOOLS.G7FileConvertCtrl.1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LayoutEditing.pesfile msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FontCreator.peffile\ = "PE-DESIGN UserFont File" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00130007-B1BA-11CE-ABC6-F5B2E79D9E3F}\ProgID msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00130000-B1BA-11CE-ABC6-F5B2E79D9E3F}\Control\ msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\LEAD.AnnMenu.130\CLSID\ = "{00130007-B1BA-11CE-ABC6-F5B2E79D9E3F}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2EB42375-0D00-444B-A022-09B15CB1261A}\ToolboxBitmap32\ = "C:\\Program Files (x86)\\Common Files\\BIL\\embedit\\G7EMBT~1.OCX, 1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00130003-B1BA-11CE-ABC6-F5B2E79D9E3F} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00130001-B1BA-11CE-ABC6-F5B2E79D9E3F}\ProxyStubClsid\ = "{00020420-0000-0000-C000-000000000046}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00130800-B1BA-11CE-ABC6-F5B2E79D9E3F}\TypeLib\Version = "1.0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00130801-B1BA-11CE-ABC6-F5B2E79D9E3F}\ = "LEAD.ScrollInfo.130" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6780CE08-F782-4458-88A4-DB5FF38AA892}\ = "_DG7FileConvert" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{45C4F113-B646-44CF-BF61-29B0DD05A52E}\ProxyStubClsid32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D9C2BDB8876C5C648AD7176343BD4678\PackageCode = "32A9DEEDA1AD5FB459563705BB7AFBEC" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DesignCenter.pemfile\shell\Open\command\ = "\"C:\\Program Files (x86)\\Brother\\PE-DESIGN 10\\Embmake.exe\" \"%1\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DesignCenter.pemfile\shell\ = "Open" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DesignCenter.pemfile\ = "PE-DESIGN Design File" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00130007-B1BA-11CE-ABC6-F5B2E79D9E3F}\ProgID\ = "LEAD.AnnMenu.130" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00130000-B1BA-11CE-ABC6-F5B2E79D9E3F}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4} msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00130001-B1BA-11CE-ABC6-F5B2E79D9E3F}\TypeLib msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00130006-B1BA-11CE-ABC6-F5B2E79D9E3F} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B6402E51-F7A0-4346-B1E8-2091CA4DF787}\InprocServer32\ = "C:\\Program Files (x86)\\Common Files\\BIL\\embedit\\G7EmbTools.ocx" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{00130003-B1BA-11CE-ABC6-F5B2E79D9E3F}\1.0\FLAGS\ = "2" msiexec.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1928 msiexec.exe 1928 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 1928 msiexec.exe Token: SeTakeOwnershipPrivilege 1928 msiexec.exe Token: SeSecurityPrivilege 1928 msiexec.exe Token: SeCreateTokenPrivilege 944 PE-DESIGN 10.exe Token: SeAssignPrimaryTokenPrivilege 944 PE-DESIGN 10.exe Token: SeLockMemoryPrivilege 944 PE-DESIGN 10.exe Token: SeIncreaseQuotaPrivilege 944 PE-DESIGN 10.exe Token: SeMachineAccountPrivilege 944 PE-DESIGN 10.exe Token: SeTcbPrivilege 944 PE-DESIGN 10.exe Token: SeSecurityPrivilege 944 PE-DESIGN 10.exe Token: SeTakeOwnershipPrivilege 944 PE-DESIGN 10.exe Token: SeLoadDriverPrivilege 944 PE-DESIGN 10.exe Token: SeSystemProfilePrivilege 944 PE-DESIGN 10.exe Token: SeSystemtimePrivilege 944 PE-DESIGN 10.exe Token: SeProfSingleProcessPrivilege 944 PE-DESIGN 10.exe Token: SeIncBasePriorityPrivilege 944 PE-DESIGN 10.exe Token: SeCreatePagefilePrivilege 944 PE-DESIGN 10.exe Token: SeCreatePermanentPrivilege 944 PE-DESIGN 10.exe Token: SeBackupPrivilege 944 PE-DESIGN 10.exe Token: SeRestorePrivilege 944 PE-DESIGN 10.exe Token: SeShutdownPrivilege 944 PE-DESIGN 10.exe Token: SeDebugPrivilege 944 PE-DESIGN 10.exe Token: SeAuditPrivilege 944 PE-DESIGN 10.exe Token: SeSystemEnvironmentPrivilege 944 PE-DESIGN 10.exe Token: SeChangeNotifyPrivilege 944 PE-DESIGN 10.exe Token: SeRemoteShutdownPrivilege 944 PE-DESIGN 10.exe Token: SeUndockPrivilege 944 PE-DESIGN 10.exe Token: SeSyncAgentPrivilege 944 PE-DESIGN 10.exe Token: SeEnableDelegationPrivilege 944 PE-DESIGN 10.exe Token: SeManageVolumePrivilege 944 PE-DESIGN 10.exe Token: SeImpersonatePrivilege 944 PE-DESIGN 10.exe Token: SeCreateGlobalPrivilege 944 PE-DESIGN 10.exe Token: SeCreateTokenPrivilege 944 PE-DESIGN 10.exe Token: SeAssignPrimaryTokenPrivilege 944 PE-DESIGN 10.exe Token: SeLockMemoryPrivilege 944 PE-DESIGN 10.exe Token: SeIncreaseQuotaPrivilege 944 PE-DESIGN 10.exe Token: SeMachineAccountPrivilege 944 PE-DESIGN 10.exe Token: SeTcbPrivilege 944 PE-DESIGN 10.exe Token: SeSecurityPrivilege 944 PE-DESIGN 10.exe Token: SeTakeOwnershipPrivilege 944 PE-DESIGN 10.exe Token: SeLoadDriverPrivilege 944 PE-DESIGN 10.exe Token: SeSystemProfilePrivilege 944 PE-DESIGN 10.exe Token: SeSystemtimePrivilege 944 PE-DESIGN 10.exe Token: SeProfSingleProcessPrivilege 944 PE-DESIGN 10.exe Token: SeIncBasePriorityPrivilege 944 PE-DESIGN 10.exe Token: SeCreatePagefilePrivilege 944 PE-DESIGN 10.exe Token: SeCreatePermanentPrivilege 944 PE-DESIGN 10.exe Token: SeBackupPrivilege 944 PE-DESIGN 10.exe Token: SeRestorePrivilege 944 PE-DESIGN 10.exe Token: SeShutdownPrivilege 944 PE-DESIGN 10.exe Token: SeDebugPrivilege 944 PE-DESIGN 10.exe Token: SeAuditPrivilege 944 PE-DESIGN 10.exe Token: SeSystemEnvironmentPrivilege 944 PE-DESIGN 10.exe Token: SeChangeNotifyPrivilege 944 PE-DESIGN 10.exe Token: SeRemoteShutdownPrivilege 944 PE-DESIGN 10.exe Token: SeUndockPrivilege 944 PE-DESIGN 10.exe Token: SeSyncAgentPrivilege 944 PE-DESIGN 10.exe Token: SeEnableDelegationPrivilege 944 PE-DESIGN 10.exe Token: SeManageVolumePrivilege 944 PE-DESIGN 10.exe Token: SeImpersonatePrivilege 944 PE-DESIGN 10.exe Token: SeCreateGlobalPrivilege 944 PE-DESIGN 10.exe Token: SeCreateTokenPrivilege 944 PE-DESIGN 10.exe Token: SeAssignPrimaryTokenPrivilege 944 PE-DESIGN 10.exe Token: SeLockMemoryPrivilege 944 PE-DESIGN 10.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 944 PE-DESIGN 10.exe 944 PE-DESIGN 10.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1928 wrote to memory of 1384 1928 msiexec.exe 29 PID 1928 wrote to memory of 1384 1928 msiexec.exe 29 PID 1928 wrote to memory of 1384 1928 msiexec.exe 29 PID 1928 wrote to memory of 1384 1928 msiexec.exe 29 PID 1928 wrote to memory of 1384 1928 msiexec.exe 29 PID 1928 wrote to memory of 1384 1928 msiexec.exe 29 PID 1928 wrote to memory of 1384 1928 msiexec.exe 29 PID 944 wrote to memory of 1656 944 PE-DESIGN 10.exe 30 PID 944 wrote to memory of 1656 944 PE-DESIGN 10.exe 30 PID 944 wrote to memory of 1656 944 PE-DESIGN 10.exe 30 PID 944 wrote to memory of 1656 944 PE-DESIGN 10.exe 30 PID 944 wrote to memory of 1656 944 PE-DESIGN 10.exe 30 PID 944 wrote to memory of 1656 944 PE-DESIGN 10.exe 30 PID 944 wrote to memory of 1656 944 PE-DESIGN 10.exe 30 PID 1928 wrote to memory of 1468 1928 msiexec.exe 34 PID 1928 wrote to memory of 1468 1928 msiexec.exe 34 PID 1928 wrote to memory of 1468 1928 msiexec.exe 34 PID 1928 wrote to memory of 1468 1928 msiexec.exe 34 PID 1928 wrote to memory of 1468 1928 msiexec.exe 34 PID 1928 wrote to memory of 1468 1928 msiexec.exe 34 PID 1928 wrote to memory of 1468 1928 msiexec.exe 34 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\PE-DESIGN 10.exe"C:\Users\Admin\AppData\Local\Temp\PE-DESIGN 10.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Users\Admin\AppData\Local\Temp\PE-DESIGN 10.exe"C:\Users\Admin\AppData\Local\Temp\PE-DESIGN 10.exe" /i "C:\Users\Admin\AppData\Roaming\Brother Industries, Ltd\PE-DESIGN 10 10.20.0.0\install\PE-DESIGN 10.msi" CLIENTPROCESSID="944" SECONDSEQUENCE="1" CHAINERUIPROCESSID="944Chainer" ACTION="INSTALL" EXECUTEACTION="INSTALL" CLIENTUILEVEL="0" ADDLOCAL="MainFeature" PRIMARYFOLDER="APPDIR" ROOTDRIVE="C:\" AI_SETUPEXEPATH="C:\Users\Admin\AppData\Local\Temp\PE-DESIGN 10.exe" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp\" EXE_CMD_LINE="/exenoupdates /exelang 0 /noprereqs " TARGETDIR="C:\" APPDIR="C:\Program Files (x86)\Brother\PE-DESIGN 10\" AI_SETUPEXEPATH_ORIGINAL="C:\Users\Admin\AppData\Local\Temp\PE-DESIGN 10.exe" AI_INSTALL="1" SHORTCUTDIR="C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PE-DESIGN 10"2⤵
- Enumerates connected drives
PID:1656
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 47B251E97451C1B65E17A5C233497D24 C2⤵
- Loads dropped DLL
PID:1384
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D4DDB7869F0310C103DFD1F8F58606102⤵
- Loads dropped DLL
PID:1468
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:2024
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005B0" "00000000000003A8"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1936
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
433KB
MD539b8181d303b1ce7743a4984157b0141
SHA1ca51676b6f529c264a5435541f0736099a59a480
SHA25670664ab34e2e784538abb14b8503abd9e352577688b71ddb1df7f634599072a4
SHA512e9b926d01e3adf9b833dc18f93c6578a35633c8bc510d9508bbe6e66dce0d8ce007aab7f7d02a9e3584832a05dfe274b07584d92d21d824329d0bcd5627a2a27
-
Filesize
26KB
MD5a91a62c1650fbcf22b3cbbb299a91b0f
SHA1746c521c77512631bc8576cc3fac9cb4f93c3b1c
SHA2564d7dc81040e3343e5d01eea3e16a66f9efdfdb5183e1d00ea2abf889fecd676b
SHA512d98b09905fa43f04c1f6bbbdb2056744b9ebdc787e57f16c860aecd10d0f5bb5bd4a7ad5d437ec346e57cfd518895f5d0471bddd8333caff169ce0f8a6460be4
-
Filesize
86KB
MD5616d33d84937a1edde1bb431b8cd8fc0
SHA14a690e056a7808d10d0667351697fa43640aecb3
SHA256494939263cb5535d464a8cf49616e1fa69bc8de099aae4638b1609e32827bede
SHA512daabdd78946d2c12124c680a31e8e7afd9184ceffdf2fd59d0c8067fe46ee80f53a843b93fd3be203a0fa74424e95d1509d8f1a75db3ea6239b19b3b78e720f6
-
Filesize
29KB
MD534363136d896a1de743489e2aff7d849
SHA12678a41eec6d6d7f3267347f5ea2f7ca770323bb
SHA256ae4355bc29fc0b409605faf5c69664a97a44c914e855b474b24281d17b7dcb15
SHA5122711c50013f9b763e2eb7eed136f120dbe71b45ed0669655b07393e75f4e704877e7af473133469a012fd13d6bc50f2f715e8244395061a0067a480778759448
-
Filesize
27KB
MD524103f71a86c20089528c96c0dbe1445
SHA1007d7a930dcae7684477347f4f2bd58d4ee5d184
SHA2568542e195ef15dfd3ed9b246d3539295f266a19f3bde524c3f41b99adb6719c11
SHA51294267aa20fb17e2db9ac31bb20b17e108f99c17f181c8f1612d9ecc9ac1375703b2ec7af3795b7c4ab379723c4c764a137025fb21df3e60859d0480ca546eb10
-
Filesize
86KB
MD5616d33d84937a1edde1bb431b8cd8fc0
SHA14a690e056a7808d10d0667351697fa43640aecb3
SHA256494939263cb5535d464a8cf49616e1fa69bc8de099aae4638b1609e32827bede
SHA512daabdd78946d2c12124c680a31e8e7afd9184ceffdf2fd59d0c8067fe46ee80f53a843b93fd3be203a0fa74424e95d1509d8f1a75db3ea6239b19b3b78e720f6
-
Filesize
86KB
MD5616d33d84937a1edde1bb431b8cd8fc0
SHA14a690e056a7808d10d0667351697fa43640aecb3
SHA256494939263cb5535d464a8cf49616e1fa69bc8de099aae4638b1609e32827bede
SHA512daabdd78946d2c12124c680a31e8e7afd9184ceffdf2fd59d0c8067fe46ee80f53a843b93fd3be203a0fa74424e95d1509d8f1a75db3ea6239b19b3b78e720f6
-
Filesize
86KB
MD5616d33d84937a1edde1bb431b8cd8fc0
SHA14a690e056a7808d10d0667351697fa43640aecb3
SHA256494939263cb5535d464a8cf49616e1fa69bc8de099aae4638b1609e32827bede
SHA512daabdd78946d2c12124c680a31e8e7afd9184ceffdf2fd59d0c8067fe46ee80f53a843b93fd3be203a0fa74424e95d1509d8f1a75db3ea6239b19b3b78e720f6
-
C:\Users\Admin\AppData\Roaming\Brother Industries, Ltd\PE-DESIGN 10 10.20.0.0\install\PE-DESIGN 10.msi
Filesize3.0MB
MD559120041a44e2bea892d231122f01286
SHA18a2a33b9091b375d9f21e1340584edbc5c58b144
SHA2568b44c2d5bd17ef7b7c3664c64a5c869ff96a1db591d582ee3ebca7cbd4d4b5a6
SHA5129f0223c5f0124afb98b801733f6160b0035168fa21b6f469ab5c12f15a5b5d05b3b47e76d2e6d4fc8cdb24e1dda48411acf64702d9d58af337de339cc47ab1e2
-
C:\Users\Admin\AppData\Roaming\Brother Industries, Ltd\PE-DESIGN 10 10.20.0.0\install\PE-DESIGN 10.msi
Filesize3.0MB
MD559120041a44e2bea892d231122f01286
SHA18a2a33b9091b375d9f21e1340584edbc5c58b144
SHA2568b44c2d5bd17ef7b7c3664c64a5c869ff96a1db591d582ee3ebca7cbd4d4b5a6
SHA5129f0223c5f0124afb98b801733f6160b0035168fa21b6f469ab5c12f15a5b5d05b3b47e76d2e6d4fc8cdb24e1dda48411acf64702d9d58af337de339cc47ab1e2
-
Filesize
128.4MB
MD53765f4d0212ba2adea52b21a1a5f861a
SHA1c8a73f91aa2f096e01c8ecc30eb291deb1a3eb2b
SHA256d3bbd5d6d304db29812c7527d63ea1a1ddfb3147a54ec59b393b96194ab0907a
SHA5123d9b3fab4f4d9bb7793e1797e2e0ec1408d339d046fa5b30fd6b99d9e5a66912b26bc8397e3e9efaac0c9f81301c715bcd9d72658d1e87ea927ed176b3162b85
-
Filesize
86KB
MD5616d33d84937a1edde1bb431b8cd8fc0
SHA14a690e056a7808d10d0667351697fa43640aecb3
SHA256494939263cb5535d464a8cf49616e1fa69bc8de099aae4638b1609e32827bede
SHA512daabdd78946d2c12124c680a31e8e7afd9184ceffdf2fd59d0c8067fe46ee80f53a843b93fd3be203a0fa74424e95d1509d8f1a75db3ea6239b19b3b78e720f6
-
Filesize
309KB
MD56509b4aa5d8561d61dd7699088bede3b
SHA1126ccbd1db3ce2fcd412d4f2b9afe1e7c62a3ae6
SHA2563b7ceecd08d77d0795144793ec9ef9be7fbe91f9242d0ff0b5521fa0bbf8d152
SHA512085b3328581c774a5187f66bba38479474fbf8d6b2c6f83ea4c869d0addf9eeccbbd28d063fbfd741ac45dc113cb0646eff91653cea21825fa56e9968e349370
-
Filesize
309KB
MD56509b4aa5d8561d61dd7699088bede3b
SHA1126ccbd1db3ce2fcd412d4f2b9afe1e7c62a3ae6
SHA2563b7ceecd08d77d0795144793ec9ef9be7fbe91f9242d0ff0b5521fa0bbf8d152
SHA512085b3328581c774a5187f66bba38479474fbf8d6b2c6f83ea4c869d0addf9eeccbbd28d063fbfd741ac45dc113cb0646eff91653cea21825fa56e9968e349370
-
Filesize
309KB
MD56509b4aa5d8561d61dd7699088bede3b
SHA1126ccbd1db3ce2fcd412d4f2b9afe1e7c62a3ae6
SHA2563b7ceecd08d77d0795144793ec9ef9be7fbe91f9242d0ff0b5521fa0bbf8d152
SHA512085b3328581c774a5187f66bba38479474fbf8d6b2c6f83ea4c869d0addf9eeccbbd28d063fbfd741ac45dc113cb0646eff91653cea21825fa56e9968e349370
-
Filesize
278KB
MD5e0af4c81b1b8e5dce06754f19b20515d
SHA1e76c0cb36a538b7e650da327093c3f8d3f5a115f
SHA256f58f3d3b51b33e9b41093b4e823927009b80cdd1489079b4637e1b1df2a79452
SHA512bafaff59755ef639180b3536c17df963e05bfecec0a4d4fe52557b46c72f61b4a46a7dc9739c9b2f6c96ab2f477661e9f1a3be372f0fed21023839cda3b8c9da
-
Filesize
86KB
MD5616d33d84937a1edde1bb431b8cd8fc0
SHA14a690e056a7808d10d0667351697fa43640aecb3
SHA256494939263cb5535d464a8cf49616e1fa69bc8de099aae4638b1609e32827bede
SHA512daabdd78946d2c12124c680a31e8e7afd9184ceffdf2fd59d0c8067fe46ee80f53a843b93fd3be203a0fa74424e95d1509d8f1a75db3ea6239b19b3b78e720f6
-
Filesize
86KB
MD5616d33d84937a1edde1bb431b8cd8fc0
SHA14a690e056a7808d10d0667351697fa43640aecb3
SHA256494939263cb5535d464a8cf49616e1fa69bc8de099aae4638b1609e32827bede
SHA512daabdd78946d2c12124c680a31e8e7afd9184ceffdf2fd59d0c8067fe46ee80f53a843b93fd3be203a0fa74424e95d1509d8f1a75db3ea6239b19b3b78e720f6
-
Filesize
86KB
MD5616d33d84937a1edde1bb431b8cd8fc0
SHA14a690e056a7808d10d0667351697fa43640aecb3
SHA256494939263cb5535d464a8cf49616e1fa69bc8de099aae4638b1609e32827bede
SHA512daabdd78946d2c12124c680a31e8e7afd9184ceffdf2fd59d0c8067fe46ee80f53a843b93fd3be203a0fa74424e95d1509d8f1a75db3ea6239b19b3b78e720f6
-
Filesize
86KB
MD5616d33d84937a1edde1bb431b8cd8fc0
SHA14a690e056a7808d10d0667351697fa43640aecb3
SHA256494939263cb5535d464a8cf49616e1fa69bc8de099aae4638b1609e32827bede
SHA512daabdd78946d2c12124c680a31e8e7afd9184ceffdf2fd59d0c8067fe46ee80f53a843b93fd3be203a0fa74424e95d1509d8f1a75db3ea6239b19b3b78e720f6
-
Filesize
309KB
MD56509b4aa5d8561d61dd7699088bede3b
SHA1126ccbd1db3ce2fcd412d4f2b9afe1e7c62a3ae6
SHA2563b7ceecd08d77d0795144793ec9ef9be7fbe91f9242d0ff0b5521fa0bbf8d152
SHA512085b3328581c774a5187f66bba38479474fbf8d6b2c6f83ea4c869d0addf9eeccbbd28d063fbfd741ac45dc113cb0646eff91653cea21825fa56e9968e349370
-
Filesize
309KB
MD56509b4aa5d8561d61dd7699088bede3b
SHA1126ccbd1db3ce2fcd412d4f2b9afe1e7c62a3ae6
SHA2563b7ceecd08d77d0795144793ec9ef9be7fbe91f9242d0ff0b5521fa0bbf8d152
SHA512085b3328581c774a5187f66bba38479474fbf8d6b2c6f83ea4c869d0addf9eeccbbd28d063fbfd741ac45dc113cb0646eff91653cea21825fa56e9968e349370
