af48efac2b7d97cc0b70559a0a2be8cfeae961306ed16f0c91706a3bef6d61fc

Modify Registry

Processes:

DrvInst.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\RapiMgr\Parameters\ServiceDll = "%windir%\\WindowsMobile\\rapimgr.dll"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WcesComm\Parameters\ServiceDll = "%windir%\\WindowsMobile\\wcescomm.dll"	DrvInst.exe

Checks BIOS information in registry 2 TTPs 3 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

MsiExec.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	MsiExec.exe

Executes dropped EXE 5 IoCs

Processes:

driver_setup.exesetup.exewmdcBase.exeInstallForm.exewmdc.exe

pid process

924 driver_setup.exe
4176 setup.exe
4944 wmdcBase.exe
2124 InstallForm.exe
1568 wmdc.exe

pid	process
924	driver_setup.exe
4176	setup.exe
4944	wmdcBase.exe
2124	InstallForm.exe
1568	wmdc.exe

Loads dropped DLL 35 IoCs

Processes:

MsiExec.exeMsiExec.exeMsiExec.exeDrvInst.exesvchost.exesvchost.exewmdcBase.exesvchost.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exewmdc.exe

pid	process
4984	MsiExec.exe
4424	MsiExec.exe
4424	MsiExec.exe
4868	MsiExec.exe
4868	MsiExec.exe
4868	MsiExec.exe
4868	MsiExec.exe
4424	MsiExec.exe
4980	DrvInst.exe
3300	svchost.exe
3300	svchost.exe
2208	svchost.exe
2208	svchost.exe
2208	svchost.exe
4944	wmdcBase.exe
4944	wmdcBase.exe
4944	wmdcBase.exe
3300	svchost.exe
4944	wmdcBase.exe
2136	svchost.exe
2136	svchost.exe
2136	svchost.exe
2712	MsiExec.exe
3640	MsiExec.exe
4212	MsiExec.exe
4292	MsiExec.exe
4292	MsiExec.exe
4292	MsiExec.exe
3096	MsiExec.exe
3640	MsiExec.exe
3640	MsiExec.exe
1568	wmdc.exe
1568	wmdc.exe
1568	wmdc.exe
1568	wmdc.exe

Registers COM server for autorun 1 TTPs 45 IoCs

persistence

Registry Run Keys / Startup Folder

Processes:

msiexec.exeDrvInst.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1A52C610-B080-4f7d-9277-6F89AA966620}\InprocServer32\ = "C:\\Windows\\WindowsMobile\\wmdsyncman.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{86A0B54A-5721-41b4-A3F1-81C6531B7D22}\InprocServer32\ThreadingModel = "Free"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3B5AA27A-CBF9-48C9-96F8-4ACE84FB8512}\InprocServer32\Assembly = "Microsoft.WindowsMobile.DeviceManager, Version=6.1.0.0, Culture=neutral"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3B5AA27A-CBF9-48C9-96F8-4ACE84FB8512}\InprocServer32\RuntimeVersion = "v2.0.50727"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3B5AA27A-CBF9-48C9-96F8-4ACE84FB8512}\InprocServer32\ = "mscoree.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{1A52C610-B080-4f7d-9277-6F89AA966620}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4ED4A55B-629E-4B3D-9F18-86CCE9581262}\InProcServer32\ThreadingModel = "Both"	DrvInst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{412E4330-A2EA-4A1C-B723-873E5FA1C618}\InProcServer32	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{412E4330-A2EA-4A1C-B723-873E5FA1C618}\InProcServer32\ = "%windir%\\system32\\wcescommproxy.dll"	DrvInst.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{3B5AA27A-CBF9-48C9-96F8-4ACE84FB8512}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3B5AA27A-CBF9-48C9-96F8-4ACE84FB8512}\InprocServer32\6.1.0.0\	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{122CC07F-3333-42aa-9ABC-6BAE729A4C85}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DCBEB807-14D0-4CBD-926C-B991F4FD1B91}\InprocServer32	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4ED4A55B-629E-4B3D-9F18-86CCE9581262}\InProcServer32\ = "%windir%\\system32\\WcesCommProxy.dll"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{499C0C20-A766-11CF-8011-00A0C90A8F78}\InprocServer32\ThreadingModel = "Both"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{52959703-387A-43D6-9746-75CC08DFB3F9}\InprocServer32\ = "C:\\Windows\\WindowsMobile\\wmdsyncproxy.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6B7AD2F5-32BF-4b5c-ABEA-FB123102E9AE}\LocalServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{3B5AA27A-CBF9-48C9-96F8-4ACE84FB8512}\InprocServer32\6.1.0.0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3B5AA27A-CBF9-48C9-96F8-4ACE84FB8512}\InprocServer32\6.1.0.0\Class = "Microsoft.WindowsMobile.WindowsMobileFactory"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3B5AA27A-CBF9-48C9-96F8-4ACE84FB8512}\InprocServer32\6.1.0.0\Assembly = "Microsoft.WindowsMobile.DeviceManager, Version=6.1.0.0, Culture=neutral"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{35440327-1517-4B72-865E-3FFE8E97002F}\InprocServer32\ThreadingModel = "Both"	DrvInst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{499C0C20-A766-11CF-8011-00A0C90A8F78}\InprocServer32	DrvInst.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{52959703-387A-43D6-9746-75CC08DFB3F9}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{52959703-387A-43D6-9746-75CC08DFB3F9}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6B7AD2F5-32BF-4b5c-ABEA-FB123102E9AE}\LocalServer32\ = "%windir%\\WindowsMobile\\wmdc.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3B5AA27A-CBF9-48C9-96F8-4ACE84FB8512}\InprocServer32\6.1.0.0\RuntimeVersion = "v2.0.50727"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD073990-9104-45d9-9DF8-AE6B31F7C67D}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD073990-9104-45d9-9DF8-AE6B31F7C67D}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1A52C610-B080-4f7d-9277-6F89AA966620}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DCBEB807-14D0-4CBD-926C-B991F4FD1B91}\InprocServer32\ = "%windir%\\system32\\rapiproxystub.dll"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DCBEB807-14D0-4CBD-926C-B991F4FD1B91}\InprocServer32\ThreadingModel = "Both"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{499C0C20-A766-11CF-8011-00A0C90A8F78}\InprocServer32\ = "%windir%\\system32\\rapi.dll"	DrvInst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{86A0B54A-5721-41b4-A3F1-81C6531B7D22}\InprocServer32	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{86A0B54A-5721-41b4-A3F1-81C6531B7D22}\InprocServer32\ = "%windir%\\WindowsMobile\\BthASPlugin.dll"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{122CC07F-3333-42aa-9ABC-6BAE729A4C85}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{122CC07F-3333-42aa-9ABC-6BAE729A4C85}\InprocServer32\ = "C:\\Windows\\WindowsMobile\\inplace.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{35440327-1517-4B72-865E-3FFE8E97002F}\InprocServer32	DrvInst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{52959703-387A-43D6-9746-75CC08DFB3F9}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3B5AA27A-CBF9-48C9-96F8-4ACE84FB8512}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4ED4A55B-629E-4B3D-9F18-86CCE9581262}\InProcServer32	DrvInst.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{CD073990-9104-45d9-9DF8-AE6B31F7C67D}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD073990-9104-45d9-9DF8-AE6B31F7C67D}\InprocServer32\ = "C:\\Windows\\WindowsMobile\\wmdsyncman.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{412E4330-A2EA-4A1C-B723-873E5FA1C618}\InProcServer32\ThreadingModel = "Both"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{35440327-1517-4B72-865E-3FFE8E97002F}\InprocServer32\ = "%windir%\\system32\\rapistub.dll"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3B5AA27A-CBF9-48C9-96F8-4ACE84FB8512}\InprocServer32\Class = "Microsoft.WindowsMobile.WindowsMobileFactory"	msiexec.exe

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

drvupdate-amd64.exeDrvInst.exemsiexec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	drvupdate-amd64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Mobile-based device management = "%windir%\\WindowsMobile\\wmdcBase.exe"	DrvInst.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	DrvInst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Mobile Device Center = "%windir%\\WindowsMobile\\wmdc.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	drvupdate-amd64.exe

Drops desktop.ini file(s) 1 IoCs

Processes:

msiexec.exe

description ioc process

File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini msiexec.exe

description	ioc	process
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	msiexec.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

setup.exedriver_setup.exemsiexec.exeDrvInst.exe

description	ioc	process
File opened (read-only)	\??\I:	setup.exe
File opened (read-only)	\??\N:	driver_setup.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	DrvInst.exe
File opened (read-only)	\??\B:	setup.exe
File opened (read-only)	\??\N:	setup.exe
File opened (read-only)	\??\E:	driver_setup.exe
File opened (read-only)	\??\H:	driver_setup.exe
File opened (read-only)	\??\R:	driver_setup.exe
File opened (read-only)	\??\T:	driver_setup.exe
File opened (read-only)	\??\N:	DrvInst.exe
File opened (read-only)	\??\Z:	setup.exe
File opened (read-only)	\??\Z:	driver_setup.exe
File opened (read-only)	\??\J:	DrvInst.exe
File opened (read-only)	\??\V:	DrvInst.exe
File opened (read-only)	\??\E:	setup.exe
File opened (read-only)	\??\V:	setup.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	setup.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	setup.exe
File opened (read-only)	\??\I:	driver_setup.exe
File opened (read-only)	\??\M:	driver_setup.exe
File opened (read-only)	\??\S:	driver_setup.exe
File opened (read-only)	\??\Y:	driver_setup.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	setup.exe
File opened (read-only)	\??\S:	setup.exe
File opened (read-only)	\??\G:	driver_setup.exe
File opened (read-only)	\??\W:	driver_setup.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	setup.exe
File opened (read-only)	\??\W:	DrvInst.exe
File opened (read-only)	\??\G:	setup.exe
File opened (read-only)	\??\O:	driver_setup.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\I:	DrvInst.exe
File opened (read-only)	\??\O:	DrvInst.exe
File opened (read-only)	\??\R:	DrvInst.exe
File opened (read-only)	\??\B:	DrvInst.exe
File opened (read-only)	\??\H:	DrvInst.exe
File opened (read-only)	\??\U:	DrvInst.exe
File opened (read-only)	\??\P:	setup.exe
File opened (read-only)	\??\Y:	setup.exe
File opened (read-only)	\??\Q:	driver_setup.exe
File opened (read-only)	\??\M:	DrvInst.exe
File opened (read-only)	\??\P:	DrvInst.exe
File opened (read-only)	\??\M:	setup.exe
File opened (read-only)	\??\Q:	setup.exe
File opened (read-only)	\??\A:	driver_setup.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\E:	DrvInst.exe
File opened (read-only)	\??\Y:	DrvInst.exe
File opened (read-only)	\??\Z:	DrvInst.exe
File opened (read-only)	\??\O:	setup.exe
File opened (read-only)	\??\K:	driver_setup.exe

Drops file in System32 directory 64 IoCs

Processes:

DrvInst.exeDrvInst.exeDrvInst.exeDrvInst.exeDrvInst.exe

description	ioc	process
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wceusbsh.inf_amd64_ed7e79d05f4c4512\ro-RO\ro-RO-wmdc.exe.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{edb4a530-f5d2-274e-8cc5-ae075df772d2}\da-DK\SET2842.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{c7539e53-9734-6840-a35f-0492e3fd0cf7}\SET1095.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{faa1c4a4-b131-9c4f-9d35-18e2cec87c28}\fr-FR\fr-FR-rapimgr.dll.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wcebth.inf_amd64_92cde66e1cfb521e\wmcoinst-070531-0952.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{faa1c4a4-b131-9c4f-9d35-18e2cec87c28}\tr-TR\tr-TR-rapimgr.dll.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wcebth.inf_amd64_92cde66e1cfb521e\da-DK\da-DK-wmdConn.cpl.mui	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{faa1c4a4-b131-9c4f-9d35-18e2cec87c28}\sv-SE\SETFF6B.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{edb4a530-f5d2-274e-8cc5-ae075df772d2}\tr-TR\SET2878.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{faa1c4a4-b131-9c4f-9d35-18e2cec87c28}\pt-BR\SETFE32.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{faa1c4a4-b131-9c4f-9d35-18e2cec87c28}\de-DE\SETFFF3.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{c7539e53-9734-6840-a35f-0492e3fd0cf7}\sv-SE\SET11F9.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{edb4a530-f5d2-274e-8cc5-ae075df772d2}\hu-HU\SET2747.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{edb4a530-f5d2-274e-8cc5-ae075df772d2}\sk-SK\SET277C.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wcebth.inf_amd64_92cde66e1cfb521e\wmupdate.msi	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{edb4a530-f5d2-274e-8cc5-ae075df772d2}\hu-HU\hu-HU-setup.exe.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wcebth.inf_amd64_92cde66e1cfb521e\da-DK\da-DK-wmdc.exe.mui	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{faa1c4a4-b131-9c4f-9d35-18e2cec87c28}\zh-CN\SETFC51.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{faa1c4a4-b131-9c4f-9d35-18e2cec87c28}\en-US	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c7539e53-9734-6840-a35f-0492e3fd0cf7}\fr-FR\fr-FR-wcescomm.dll.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c7539e53-9734-6840-a35f-0492e3fd0cf7}\de-DE\SET1264.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{edb4a530-f5d2-274e-8cc5-ae075df772d2}\es-ES\SET238C.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{c7539e53-9734-6840-a35f-0492e3fd0cf7}\da-DK\SET1276.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{edb4a530-f5d2-274e-8cc5-ae075df772d2}\fi-FI\fi-FI-rapimgr.dll.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{edb4a530-f5d2-274e-8cc5-ae075df772d2}\zh-TW	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wcebth.inf_amd64_92cde66e1cfb521e\zh-CN\zh-CN-wmdc.exe.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c7539e53-9734-6840-a35f-0492e3fd0cf7}\fr-FR\SETF84.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{edb4a530-f5d2-274e-8cc5-ae075df772d2}\nl-NL\SET24D2.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c7539e53-9734-6840-a35f-0492e3fd0cf7}\pt-BR\pt-BR-wmdc.exe.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wcebth.inf_amd64_92cde66e1cfb521e\de-DE\de-DE-wmdConn.cpl.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wcerndis.inf_amd64_7f46c8a40bd97188\pl-PL\pl-PL-wmdc.exe.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{faa1c4a4-b131-9c4f-9d35-18e2cec87c28}\de-DE	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{edb4a530-f5d2-274e-8cc5-ae075df772d2}\sv-SE\sv-SE-wmdConn.cpl.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{edb4a530-f5d2-274e-8cc5-ae075df772d2}\hu-HU	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{faa1c4a4-b131-9c4f-9d35-18e2cec87c28}\zh-CN\SETFC41.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{faa1c4a4-b131-9c4f-9d35-18e2cec87c28}\it-IT\SETFEAB.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{faa1c4a4-b131-9c4f-9d35-18e2cec87c28}\hu-HU\SETFECD.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wcerndis.inf_amd64_7f46c8a40bd97188\ru-RU\ru-RU-wmdConn.cpl.mui	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{edb4a530-f5d2-274e-8cc5-ae075df772d2}\pt-BR\SET269A.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c7539e53-9734-6840-a35f-0492e3fd0cf7}\setup.exe	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{edb4a530-f5d2-274e-8cc5-ae075df772d2}\nl-NL\SET2524.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wcebth.inf_amd64_92cde66e1cfb521e\da-DK\da-DK-setup.exe.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c7539e53-9734-6840-a35f-0492e3fd0cf7}\wceusbsh.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c7539e53-9734-6840-a35f-0492e3fd0cf7}\da-DK	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{edb4a530-f5d2-274e-8cc5-ae075df772d2}\ja-JP	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wcebth.inf_amd64_92cde66e1cfb521e\el-GR\el-GR-wcescomm.dll.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{faa1c4a4-b131-9c4f-9d35-18e2cec87c28}\zh-CN\zh-CN-setup.exe.mui	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{faa1c4a4-b131-9c4f-9d35-18e2cec87c28}\SETFD94.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wceusbsh.inf_amd64_ed7e79d05f4c4512\zh-CN\zh-CN-rapimgr.dll.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wceusbsh.inf_amd64_ed7e79d05f4c4512\it-IT\it-IT-wmdc.exe.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{faa1c4a4-b131-9c4f-9d35-18e2cec87c28}\ru-RU\ru-RU-setup.exe.mui	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{c7539e53-9734-6840-a35f-0492e3fd0cf7}\es-ES\SETFA6.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wcebth.inf_amd64_92cde66e1cfb521e\ru-RU\ru-RU-wcescomm.dll.mui	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{faa1c4a4-b131-9c4f-9d35-18e2cec87c28}\el-GR\SETFB62.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{faa1c4a4-b131-9c4f-9d35-18e2cec87c28}\pt-BR\pt-BR-setup.exe.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wcerndis.inf_amd64_7f46c8a40bd97188\zh-TW\zh-TW-rapimgr.dll.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wcerndis.inf_amd64_7f46c8a40bd97188\pl-PL\pl-PL-wcescomm.dll.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{edb4a530-f5d2-274e-8cc5-ae075df772d2}\SET255A.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{edb4a530-f5d2-274e-8cc5-ae075df772d2}\el-GR	DrvInst.exe
File opened for modification	C:\Windows\system32\wcescommproxy.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wcerndis.inf_amd64_7f46c8a40bd97188\zh-CN\zh-CN-rapimgr.dll.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c7539e53-9734-6840-a35f-0492e3fd0cf7}\pl-PL\SET1112.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{c7539e53-9734-6840-a35f-0492e3fd0cf7}\sk-SK\SET11A3.tmp	DrvInst.exe

Drops file in Windows directory 64 IoCs

Processes:

msiexec.exeDrvInst.exeDrvInst.exeDrvInst.exe

description	ioc	process
File created	C:\Windows\WindowsMobile\Drivers\Serial\wcescomm.dll	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\Serial\wmdConn.cpl	msiexec.exe
File created	C:\Windows\Installer\{92DBCA36-9B41-4DD1-941A-AED149DD37F0}\WindowsMobileDeviceCenter.ico	msiexec.exe
File created	C:\Windows\WindowsMobile\cs-CZ\inkres.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\fr-FR\legacysyncengine.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\RNDIS\cs-cz\cs-cz-wcescomm.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\da-DK\ceappmgr.exe.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\ru-RU\Formdll.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\Serial\fi-fi\fi-fi-wmdc.exe.mui	msiexec.exe
File opened for modification	C:\Windows\WindowsMobile\da-DK\wmdcBase.exe.mui	DrvInst.exe
File created	C:\Windows\WindowsMobile\en-US\VComCtl.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\nb-NO\BakRestr.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\ru-RU\InkProps.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\cs-CZ\eula.rtf	msiexec.exe
File created	C:\Windows\WindowsMobile\nl-NL\VoiceBar.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\RNDIS\nl-nl\nl-nl-setup.exe.mui	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\inf\oem5.inf	DrvInst.exe
File opened for modification	C:\Windows\WindowsMobile\it-IT\wmdConn.cpl.mui	DrvInst.exe
File created	C:\Windows\WindowsMobile\en-US\ceappmgr.exe.mui	msiexec.exe
File opened for modification	C:\Windows\WindowsMobile\ru-RU\wcescomm.dll.mui	DrvInst.exe
File created	C:\Windows\WindowsMobile\hu-HU\inkres.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\tr-TR\httpsys.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\nl\Microsoft.WindowsMobile.DeviceCenter.resources.dll	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\RNDIS\sk-sk\sk-sk-wmdConn.cpl.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\Serial\tr-tr\tr-tr-wmdConn.cpl.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\Bluetooth\cs-cz\cs-cz-wmdc.exe.mui	msiexec.exe
File opened for modification	C:\Windows\WindowsMobile\sv-SE\wmdcBase.exe.mui	DrvInst.exe
File created	C:\Windows\WindowsMobile\fr-FR\wmdc.exe.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\RNDIS\sk-sk\sk-sk-rapimgr.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\Bluetooth\es-es\es-es-wmdc.exe.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\riresdll.dll	msiexec.exe
File created	C:\Windows\WindowsMobile\nb-NO\inplace.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\zh-TW\Formdll.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\sk-SK\eula.rtf	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE2EF.tmp	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\RNDIS\fi-fi\fi-fi-setup.exe.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\Serial\ko-kr\ko-kr-rapimgr.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\Bluetooth\fr-fr\fr-fr-rapimgr.dll.mui	msiexec.exe
File opened for modification	C:\Windows\WindowsMobile\nb-NO\wmdcBase.exe.mui	DrvInst.exe
File created	C:\Windows\WindowsMobile\ro-RO\eula.rtf	msiexec.exe
File created	C:\Windows\WindowsMobile\sk-SK\mailsync.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\RNDIS\da-dk\da-dk-rapimgr.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\Serial\hu-hu\hu-hu-wmdc.exe.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\Bluetooth\ko-kr\ko-kr-wcescomm.dll.mui	msiexec.exe
File opened for modification	C:\Windows\WindowsMobile\nb-NO\setup.exe.mui	DrvInst.exe
File created	C:\Windows\WindowsMobile\nb-NO\outstore.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\pl-PL\wmdsyncman.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\zh-CN\outstore.dll.mui	msiexec.exe
File created	C:\Windows\Installer\SourceHash{92DBCA36-9B41-4DD1-941A-AED149DD37F0}	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\RNDIS\pl-pl\pl-pl-wmdc.exe.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\Serial\zh-cn\zh-cn-rapimgr.dll.mui	msiexec.exe
File opened for modification	C:\Windows\WindowsMobile\nl-NL\wmdConn.cpl.mui	DrvInst.exe
File created	C:\Windows\WindowsMobile\nl-NL\InkStore.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\RNDIS\nl-nl\nl-nl-wmdc.exe.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\RNDIS\zh-cn\zh-cn-wmdc.exe.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\Serial\el-gr\el-gr-wmdc.exe.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\ko-KR\INetRepl.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\zh-CN\AirSyncEngine.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\sv-SE\eula.rtf	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\Bluetooth\da-dk\da-dk-wmdc.exe.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\Bluetooth\ru-ru\ru-ru-setup.exe.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\Bluetooth\tr-tr\tr-tr-rapimgr.dll.mui	msiexec.exe
File opened for modification	C:\Windows\WindowsMobile\pl-PL\rapimgr.dll.mui	DrvInst.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

MsiExec.exeDrvInst.exeDrvInst.exedriver_setup.exesvchost.exeDrvInst.exeDrvInst.exevssvc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	driver_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	driver_setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	driver_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	driver_setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000007dd8df8e73a10d6f0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800007dd8df8e0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d012000000000000000032000000ffffffff0000000007000100006809007dd8df8e000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01232000000000020ed0d000000ffffffff0000000007000100006809197dd8df8e000000000000d0123200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000007dd8df8e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	driver_setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	driver_setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	driver_setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	driver_setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

MsiExec.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosDate MsiExec.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosDate	MsiExec.exe

Modifies Internet Explorer settings 1 TTPs 15 IoCs

adware spyware

Modify Registry

Processes:

msiexec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB1-070F-11D3-9307-00C04FAE2D4F}\Default Visible = "Yes"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB2-070F-11D3-9307-00C04FAE2D4F}\clsidExtension = "{2EAF5BB0-070F-11D3-9307-00C04FAE2D4F}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB1-070F-11D3-9307-00C04FAE2D4F}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB1-070F-11D3-9307-00C04FAE2D4F}\ButtonText = "@C:\\Windows\\WindowsMobile\\INetRepl.dll,-222"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB1-070F-11D3-9307-00C04FAE2D4F}\	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB2-070F-11D3-9307-00C04FAE2D4F}\MenuStatusBar = "@C:\\Windows\\WindowsMobile\\INetRepl.dll,-224"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB1-070F-11D3-9307-00C04FAE2D4F}\Icon = "C:\\Windows\\WindowsMobile\\INetRepl.dll,210"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB1-070F-11D3-9307-00C04FAE2D4F}\HotIcon = "C:\\Windows\\WindowsMobile\\INetRepl.dll,211"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB2-070F-11D3-9307-00C04FAE2D4F}\MenuCustomize = "Tools"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB2-070F-11D3-9307-00C04FAE2D4F}\MenuText = "@C:\\Windows\\WindowsMobile\\INetRepl.dll,-223"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB1-070F-11D3-9307-00C04FAE2D4F}\CLSID = "{1FBA04EE-3024-11D2-8F1F-0000F87ABD16}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB1-070F-11D3-9307-00C04FAE2D4F}\clsidExtension = "{2EAF5BB0-070F-11D3-9307-00C04FAE2D4F}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB2-070F-11D3-9307-00C04FAE2D4F}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB2-070F-11D3-9307-00C04FAE2D4F}\CLSID = "{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB2-070F-11D3-9307-00C04FAE2D4F}\	msiexec.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

DrvInst.exeDrvInst.exeDrvInst.exemsiexec.exeDrvInst.exeDrvInst.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe

Modifies registry class 64 IoCs

Processes:

DrvInst.exemsiexec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{77F311EA-56A7-4AB5-AB64-A5F4B7B5355E}\NumMethods\ = "60"	DrvInst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{77DCCB29-AE02-4A2B-B2FE-EA721F209864}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{41DF358B-5B20-4d4e-81CF-17FB0A121DDB}\ProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9BDE217E-C5E8-11DB-AD95-482856D89593}\NumMethods\ = "4"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DC276626FCFB9A94EAEFBAF0DEB3CFB5\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MS.WinCE.CEFStore\ = "Microsoft Windows CE Replication File Store"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2EAF5BB0-070F-11D3-9307-00C04FAE2D4F}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{35579C26-C5EF-11DB-B8D9-025356D89593}\ = "ICertificateEnroller"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF4C4832-2BEA-4472-98A3-F931BEB8F62B}\VersionIndpendentProgId\ = "Microsoft.WcesComm"	DrvInst.exe
Key created	\REGISTRY\MACHINE\Software\Classes\VoiceCtl.VoicePlay.1\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\InkProps.PropHandler\CurVer\ = "InkProps.PropHandler.1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{928F538A-195A-4CCB-B1F1-DEB8393A0469}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{17C2DE21-04E1-42b9-9414-E0973E71657F}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8A0F1632-3905-4CA4-AEA4-7E094ECBB9A7}\ = "IRAPIDevice"	DrvInst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{499C0C20-A766-11CF-8011-00A0C90A8F78}\InprocServer32	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{499C0C20-A766-11CF-8011-00A0C90A8F78}\InprocServer32\ThreadingModel = "Both"	DrvInst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9BDE217E-C5E8-11DB-AD95-482856D89593}\NumMethods	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{258A260C-95CF-46F0-ACFE-695D6463C190}\ProxyStubClsid32	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{35440327-1517-4B72-865E-3FFE8E97002F}\ProgId\ = "Microsoft.RAPIStub.1"	DrvInst.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{41DF358B-5B20-4d4e-81CF-17FB0A121DDB}\VersionIndependentProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{14601BBD-78B1-43CE-98CA-ADD8BAD63288}\NumMethods	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{23BAB749-F1B0-4AFB-9D19-E622E378F0AB}	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19a70ae6-18db-11db-9617-00e08161165f}\ = "IOutlookInfo"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1A52C610-B080-4f7d-9277-6F89AA966620}\InprocServer32\ = "C:\\Windows\\WindowsMobile\\wmdsyncman.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3B5AA27A-CBF9-48C9-96F8-4ACE84FB8512}\InprocServer32\ = "mscoree.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DCBEB807-14D0-4CBD-926C-B991F4FD1B91}\InprocServer32\ = "%windir%\\system32\\rapiproxystub.dll"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{35440327-1517-4B72-865E-3FFE8E97002F}\ = "Microsoft.RAPIStub.1"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{939763D4-D83A-4e20-BA8C-4C30EC31B82A}\ = "ISyncAppNotify"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{77DCCB29-AE02-4A2B-B2FE-EA721F209864}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6A947637-6154-4E23-B17C-B4E56936085F}\ = "IAm3xDevice"	DrvInst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DCBEB807-14D0-4CBD-926C-B991F4FD1B91}\ProxyStubClsid32	DrvInst.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{35579C26-C5EF-11DB-B8D9-025356D89593}\NumMethods	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{661a448a-1816-11db-9616-00e08161165f}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C5297E5C-0642-4D74-B0CF-04AED816AA38}\NumMethods\ = "13"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.WcesComm.1\ = "Microsoft.WcesComm.1"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.WMDC.CertEnroll.1\ = "WMDC Certificate Enroller"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F7E1C96B-781E-11D2-AAB7-00C04FAE2D4C}\InprocServer32\ = "C:\\Windows\\WindowsMobile\\INetRepl.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D6433F5C-AF10-4855-88BB-D7C607094DFF}\ = "IDccManSink2Priv"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7D7D6BB1-EC74-4DF0-A429-3AFE8BB10125}\ProxyStubClsid32\ = "{77DCCB29-AE02-4A2B-B2FE-EA721F209864}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1A15B6A1-5CE7-482B-8D65-2D5E886296F3}\InprocServer32\ = "C:\\Windows\\WindowsMobile\\legacysyncengine.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB3307E0-29BA-4d2d-95AB-98A8BF09C486}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AF843683-7A1B-4412-8D43-967F20141C3E}\NumMethods\ = "4"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{AF843683-7A1B-4412-8D43-967F20141C3E}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\VoiceCtl.VoicePlay\CurVer	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD073990-9104-45d9-9DF8-AE6B31F7C67D}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DCBEB807-14D0-4CBD-926C-B991F4FD1B91}\NumMethods	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.AirSyncStatusListener\ = "AirSync Status Listener"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{52959703-387A-43D6-9746-75CC08DFB3F9}\NumMethods	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{357A557C-B03F-4240-90D8-C6C71C659BF1}\ = "IRAPIEnumDevices"	DrvInst.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{3BC2B6A7-36A0-4e42-A518-4D49FC698099}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{122CC07F-3333-42aa-9ABC-6BAE729A4C85}\ProgID\ = "MS.WinCE.CEFStore.InplaceUI"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{4475F45B-5612-4FE0-A324-8743E8885AAE}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{35579C26-C5EF-11DB-B8D9-025356D89593}\ProxyStubClsid32\ = "{52959703-387A-43D6-9746-75CC08DFB3F9}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BF765622-C5EF-11DB-B1CD-0D5656D89593}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB3307E0-29BA-4d2d-95AB-98A8BF09C486}\NumMethods\ = "7"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8A0F1632-3905-4CA4-AEA4-7E094ECBB9A7}\ProxyStubClsid32	DrvInst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{412E4330-A2EA-4A1C-B723-873E5FA1C618}	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BF765622-C5EF-11DB-B1CD-0D5656D89593}\VersionIndependentProgID\ = "Microsoft.WMDC.CertEnroll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{2EAF5BB0-070F-11D3-9307-00C04FAE2D4F}\InprocServer32	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63ACBD2914B91DD449A1EA1D94DD730F\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MS.WinCE.CEFStore\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VoiceCtl.VoiceCtrl\ = "VoiceCtrl Class"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{5C65DC2D-78E6-11D2-9852-00C04F8ECDC8}\ProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{52959703-387A-43D6-9746-75CC08DFB3F9}\ProxyStubClsid32\ = "{52959703-387A-43D6-9746-75CC08DFB3F9}"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

msiexec.exe

pid process

636 msiexec.exe
636 msiexec.exe
636 msiexec.exe
636 msiexec.exe
636 msiexec.exe
636 msiexec.exe

pid	process
636	msiexec.exe
636	msiexec.exe
636	msiexec.exe
636	msiexec.exe
636	msiexec.exe
636	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exedriver_setup.exe

description	pid	process
Token: SeSecurityPrivilege	636	msiexec.exe
Token: SeCreateTokenPrivilege	924	driver_setup.exe
Token: SeAssignPrimaryTokenPrivilege	924	driver_setup.exe
Token: SeLockMemoryPrivilege	924	driver_setup.exe
Token: SeIncreaseQuotaPrivilege	924	driver_setup.exe
Token: SeMachineAccountPrivilege	924	driver_setup.exe
Token: SeTcbPrivilege	924	driver_setup.exe
Token: SeSecurityPrivilege	924	driver_setup.exe
Token: SeTakeOwnershipPrivilege	924	driver_setup.exe
Token: SeLoadDriverPrivilege	924	driver_setup.exe
Token: SeSystemProfilePrivilege	924	driver_setup.exe
Token: SeSystemtimePrivilege	924	driver_setup.exe
Token: SeProfSingleProcessPrivilege	924	driver_setup.exe
Token: SeIncBasePriorityPrivilege	924	driver_setup.exe
Token: SeCreatePagefilePrivilege	924	driver_setup.exe
Token: SeCreatePermanentPrivilege	924	driver_setup.exe
Token: SeBackupPrivilege	924	driver_setup.exe
Token: SeRestorePrivilege	924	driver_setup.exe
Token: SeShutdownPrivilege	924	driver_setup.exe
Token: SeDebugPrivilege	924	driver_setup.exe
Token: SeAuditPrivilege	924	driver_setup.exe
Token: SeSystemEnvironmentPrivilege	924	driver_setup.exe
Token: SeChangeNotifyPrivilege	924	driver_setup.exe
Token: SeRemoteShutdownPrivilege	924	driver_setup.exe
Token: SeUndockPrivilege	924	driver_setup.exe
Token: SeSyncAgentPrivilege	924	driver_setup.exe
Token: SeEnableDelegationPrivilege	924	driver_setup.exe
Token: SeManageVolumePrivilege	924	driver_setup.exe
Token: SeImpersonatePrivilege	924	driver_setup.exe
Token: SeCreateGlobalPrivilege	924	driver_setup.exe
Token: SeShutdownPrivilege	924	driver_setup.exe
Token: SeIncreaseQuotaPrivilege	924	driver_setup.exe
Token: SeCreateTokenPrivilege	924	driver_setup.exe
Token: SeAssignPrimaryTokenPrivilege	924	driver_setup.exe
Token: SeLockMemoryPrivilege	924	driver_setup.exe
Token: SeIncreaseQuotaPrivilege	924	driver_setup.exe
Token: SeMachineAccountPrivilege	924	driver_setup.exe
Token: SeTcbPrivilege	924	driver_setup.exe
Token: SeSecurityPrivilege	924	driver_setup.exe
Token: SeTakeOwnershipPrivilege	924	driver_setup.exe
Token: SeLoadDriverPrivilege	924	driver_setup.exe
Token: SeSystemProfilePrivilege	924	driver_setup.exe
Token: SeSystemtimePrivilege	924	driver_setup.exe
Token: SeProfSingleProcessPrivilege	924	driver_setup.exe
Token: SeIncBasePriorityPrivilege	924	driver_setup.exe
Token: SeCreatePagefilePrivilege	924	driver_setup.exe
Token: SeCreatePermanentPrivilege	924	driver_setup.exe
Token: SeBackupPrivilege	924	driver_setup.exe
Token: SeRestorePrivilege	924	driver_setup.exe
Token: SeShutdownPrivilege	924	driver_setup.exe
Token: SeDebugPrivilege	924	driver_setup.exe
Token: SeAuditPrivilege	924	driver_setup.exe
Token: SeSystemEnvironmentPrivilege	924	driver_setup.exe
Token: SeChangeNotifyPrivilege	924	driver_setup.exe
Token: SeRemoteShutdownPrivilege	924	driver_setup.exe
Token: SeUndockPrivilege	924	driver_setup.exe
Token: SeSyncAgentPrivilege	924	driver_setup.exe
Token: SeEnableDelegationPrivilege	924	driver_setup.exe
Token: SeManageVolumePrivilege	924	driver_setup.exe
Token: SeImpersonatePrivilege	924	driver_setup.exe
Token: SeCreateGlobalPrivilege	924	driver_setup.exe
Token: SeCreateTokenPrivilege	924	driver_setup.exe
Token: SeAssignPrimaryTokenPrivilege	924	driver_setup.exe
Token: SeLockMemoryPrivilege	924	driver_setup.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

driver_setup.exe

pid process

924 driver_setup.exe
924 driver_setup.exe
924 driver_setup.exe
924 driver_setup.exe

pid	process
924	driver_setup.exe
924	driver_setup.exe
924	driver_setup.exe
924	driver_setup.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

drvupdate-amd64.exemsiexec.exesvchost.exeDrvInst.exesetup.exeMsiExec.exewmdc.exe

description	pid	process	target process
PID 4780 wrote to memory of 924	4780	drvupdate-amd64.exe	driver_setup.exe
PID 4780 wrote to memory of 924	4780	drvupdate-amd64.exe	driver_setup.exe
PID 636 wrote to memory of 4984	636	msiexec.exe	MsiExec.exe
PID 636 wrote to memory of 4984	636	msiexec.exe	MsiExec.exe
PID 636 wrote to memory of 3600	636	msiexec.exe	srtasks.exe
PID 636 wrote to memory of 3600	636	msiexec.exe	srtasks.exe
PID 636 wrote to memory of 4424	636	msiexec.exe	MsiExec.exe
PID 636 wrote to memory of 4424	636	msiexec.exe	MsiExec.exe
PID 636 wrote to memory of 4868	636	msiexec.exe	MsiExec.exe
PID 636 wrote to memory of 4868	636	msiexec.exe	MsiExec.exe
PID 1040 wrote to memory of 1036	1040	svchost.exe	DrvInst.exe
PID 1040 wrote to memory of 1036	1040	svchost.exe	DrvInst.exe
PID 1040 wrote to memory of 4644	1040	svchost.exe	DrvInst.exe
PID 1040 wrote to memory of 4644	1040	svchost.exe	DrvInst.exe
PID 1040 wrote to memory of 2312	1040	svchost.exe	DrvInst.exe
PID 1040 wrote to memory of 2312	1040	svchost.exe	DrvInst.exe
PID 1040 wrote to memory of 3984	1040	svchost.exe	DrvInst.exe
PID 1040 wrote to memory of 3984	1040	svchost.exe	DrvInst.exe
PID 1040 wrote to memory of 4980	1040	svchost.exe	DrvInst.exe
PID 1040 wrote to memory of 4980	1040	svchost.exe	DrvInst.exe
PID 4980 wrote to memory of 4176	4980	DrvInst.exe	setup.exe
PID 4980 wrote to memory of 4176	4980	DrvInst.exe	setup.exe
PID 4176 wrote to memory of 4944	4176	setup.exe	wmdcBase.exe
PID 4176 wrote to memory of 4944	4176	setup.exe	wmdcBase.exe
PID 636 wrote to memory of 2712	636	msiexec.exe	MsiExec.exe
PID 636 wrote to memory of 2712	636	msiexec.exe	MsiExec.exe
PID 636 wrote to memory of 3640	636	msiexec.exe	MsiExec.exe
PID 636 wrote to memory of 3640	636	msiexec.exe	MsiExec.exe
PID 636 wrote to memory of 4212	636	msiexec.exe	MsiExec.exe
PID 636 wrote to memory of 4212	636	msiexec.exe	MsiExec.exe
PID 636 wrote to memory of 4212	636	msiexec.exe	MsiExec.exe
PID 636 wrote to memory of 4292	636	msiexec.exe	MsiExec.exe
PID 636 wrote to memory of 4292	636	msiexec.exe	MsiExec.exe
PID 636 wrote to memory of 3096	636	msiexec.exe	MsiExec.exe
PID 636 wrote to memory of 3096	636	msiexec.exe	MsiExec.exe
PID 636 wrote to memory of 3096	636	msiexec.exe	MsiExec.exe
PID 3096 wrote to memory of 2124	3096	MsiExec.exe	InstallForm.exe
PID 3096 wrote to memory of 2124	3096	MsiExec.exe	InstallForm.exe
PID 3096 wrote to memory of 2124	3096	MsiExec.exe	InstallForm.exe
PID 4176 wrote to memory of 1568	4176	setup.exe	wmdc.exe
PID 4176 wrote to memory of 1568	4176	setup.exe	wmdc.exe
PID 1568 wrote to memory of 616	1568	wmdc.exe	pcaui.exe
PID 1568 wrote to memory of 616	1568	wmdc.exe	pcaui.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\drvupdate-amd64.exe
"C:\Users\Admin\AppData\Local\Temp\drvupdate-amd64.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\driver_setup.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\driver_setup.exe /i drvupdate-amd64.msi
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:924

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Registers COM server for autorun
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:636
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 49ACBCC1EABE0DDFF1CF8993453FA9FA C
  2⤵
  - Loads dropped DLL
  PID:4984
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3600
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 329B251B2EDF73CAE679DB481B8036C6
  2⤵
  - Loads dropped DLL
  PID:4424
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 274E96482A0AD95E28D20119413682B2 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Checks SCSI registry key(s)
  PID:4868
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 4D166735CE1F345B6B33ADB7A56E50E9 C
  2⤵
  - Loads dropped DLL
  PID:2712
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 18C6DA3E9AB02E24D01B7C3B12DF7AD8
  2⤵
  - Loads dropped DLL
  PID:3640
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 564A738DD0736F8B573E921AE525DB8C
  2⤵
  - Checks BIOS information in registry
  - Loads dropped DLL
  - Enumerates system info in registry
  PID:4212
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 4AFC5B959637612017B7F98928B3691A E Global\MSI0000
  2⤵
  - Loads dropped DLL
  PID:4292
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B78D501FBDF7727876761FFA2655A16A E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3096
- - C:\Windows\WindowsMobile\InstallForm.exe
    C:\Windows\WindowsMobile\InstallForm.exe Install
    3⤵
    - Executes dropped EXE
    PID:2124

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:1040
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "1" "C:\Windows\WindowsMobile\Drivers\RNDIS\wcerndis.inf" "9" "4658cc0c3" "0000000000000138" "WinSta0\Default" "0000000000000150" "208" "C:\Windows\WindowsMobile\Drivers\RNDIS"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:1036
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "1" "C:\Windows\WindowsMobile\Drivers\Serial\wceusbsh.inf" "9" "4e3e87c83" "000000000000015C" "WinSta0\Default" "0000000000000138" "208" "C:\Windows\WindowsMobile\Drivers\Serial"
  2⤵
  - Drops file in System32 directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:4644
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "1" "C:\Windows\WindowsMobile\Drivers\WPD\wpdrapi.inf" "9" "448c3e0d7" "0000000000000170" "WinSta0\Default" "0000000000000138" "208" "C:\Windows\WindowsMobile\Drivers\WPD"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:2312
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "1" "C:\Windows\WindowsMobile\Drivers\Bluetooth\wcebth.inf" "9" "410b0571b" "000000000000016C" "WinSta0\Default" "000000000000014C" "208" "C:\Windows\WindowsMobile\Drivers\Bluetooth"
  2⤵
  - Drops file in System32 directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:3984
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "1" "0" "windowsmobiledriverinstaller\UMB\2&26a98e85&0&{5947FC2F-3FF8-4C66-8DAD-A04E47BA33D9}" "" "" "45b9f72e7" "0000000000000000"
  2⤵
  - Sets DLL path for service in the registry
  - Loads dropped DLL
  - Registers COM server for autorun
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Windows\WindowsMobile\setup.exe
    C:\Windows\WindowsMobile\setup.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Suspicious use of WriteProcessMemory
    PID:4176
  - - C:\Windows\WindowsMobile\wmdcBase.exe
      "C:\Windows\WindowsMobile\wmdcBase.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4944
  - - C:\Windows\WindowsMobile\wmdc.exe
      "C:\Windows\WindowsMobile\wmdc.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1568
    - - C:\Windows\system32\pcaui.exe
        
        "C:\Windows\system32\pcaui.exe" -g {11111111-1111-1111-1111-111111111111} -x {f58ec02d-77c3-4891-9583-49fd51990df1} -a "Windows Mobile Device Center 6.1" -v "Microsoft" -s "To work properly, this app must be reinstalled after you upgrade Windows." -n 4 -f 0 -k 0 -e "C:\Windows\WindowsMobile\wmdc.exe"
        5⤵
        
        PID:616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WindowsMobile -s RapiMgr
1⤵
- Loads dropped DLL
PID:3300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WindowsMobile -s WcesComm
1⤵
- Loads dropped DLL
PID:2208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WindowsMobile -s WcesComm
1⤵
- Loads dropped DLL
PID:2136

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery