52972a23ab12b95cd51d71741db2cf276749e56030c092e2e4f0907dcb1fbd56

Modify Registry

Processes:

explorer.exeexplorer.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Sets file execution options in registry 2 TTPs 16 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

msiexec.exeMsiExec.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe\DisableExceptionChainValidation = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe\DisableExceptionChainValidation = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe\MitigationOptions = "256"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe\MitigationOptions = "256"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe\MitigationOptions = "256"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe\MitigationOptions = "256"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe\DisableExceptionChainValidation = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe\DisableExceptionChainValidation = "0"	msiexec.exe

Executes dropped EXE 1 IoCs

Processes:

RdrServicesUpdater.exe

pid process

3580 RdrServicesUpdater.exe

pid	process
3580	RdrServicesUpdater.exe

Loads dropped DLL 42 IoCs

Processes:

MsiExec.exeMsiExec.exe

pid	process
5036	MsiExec.exe
5036	MsiExec.exe
5036	MsiExec.exe
5036	MsiExec.exe
5036	MsiExec.exe
5036	MsiExec.exe
5036	MsiExec.exe
5036	MsiExec.exe
5036	MsiExec.exe
5036	MsiExec.exe
5036	MsiExec.exe
5036	MsiExec.exe
5036	MsiExec.exe
5036	MsiExec.exe
5036	MsiExec.exe
3940	MsiExec.exe
3940	MsiExec.exe
3940	MsiExec.exe
3940	MsiExec.exe
3940	MsiExec.exe
3940	MsiExec.exe
3940	MsiExec.exe
3940	MsiExec.exe
3940	MsiExec.exe
3940	MsiExec.exe
3940	MsiExec.exe
3940	MsiExec.exe
3940	MsiExec.exe
3940	MsiExec.exe
3940	MsiExec.exe
3940	MsiExec.exe
3940	MsiExec.exe
3940	MsiExec.exe
3940	MsiExec.exe
3940	MsiExec.exe
3940	MsiExec.exe
3940	MsiExec.exe
3940	MsiExec.exe
5036	MsiExec.exe
5036	MsiExec.exe
5036	MsiExec.exe
5036	MsiExec.exe

Registers COM server for autorun 1 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

Processes:

MsiExec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\InprocServer32\ = "C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF64.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F0B4F6AD-5E09-4CB1-B763-EC390CBDE51D}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F0B4F6AD-5E09-4CB1-B763-EC390CBDE51D}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F0B4F6AD-5E09-4CB1-B763-EC390CBDE51D}\InprocServer32\ = "C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDFImpl64.dll"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\InprocServer32	MsiExec.exe

Enumerates connected drives 3 TTPs 29 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

msiexec.exeexplorer.exeexplorer.exeexplorer.exe

description	ioc	process
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\D:	explorer.exe

Drops file in System32 directory 6 IoCs

Processes:

MsiExec.exemsiexec.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Elevation.tmp	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\msvcr100.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp100.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcr110.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp110.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vccorlib110.dll	msiexec.exe

Drops file in Program Files directory 64 IoCs

Processes:

RdrServicesUpdater.exemsiexec.exe

description	ioc	process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\images\s_filter-focus_32.svg	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\images\export.svg	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\digsig\js\nls\pt-br\ui-strings.js	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\sign-services-auth\js\selector.js	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\signatures\js\nls\pt-br\ui-strings.js	RdrServicesUpdater.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\AiodLite.dll	msiexec.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\images\file_types\duplicate.svg	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\scan-files\js\nls\sk-sk\ui-strings.js	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\sample-files\assets\Sample Files\Adobe Cloud Services.pdf	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\desktop-connector-files\js\nls\zh-cn\ui-strings.js	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\fss\img\tools\themes\dark\check_2x.png	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\images\win8-scrollbar\themes\dark\arrow-up.gif	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\images\themes\dark\adc_logo.png	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\ob-preview\js\nls\zh-tw\ui-strings.js	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\reviews\js\nls\ru-ru\ui-strings.js	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\reviews\js\nls\en-ae\ui-strings.js	RdrServicesUpdater.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\ZY______.PFB	msiexec.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\add-account\js\plugin.js	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\on-boarding\images\themeless\fullscreen-exit-press.svg	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\images\themes\dark\next-arrow-disabled.svg	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\images\themes\dark\progress-indeterminate.gif	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover_2x.png	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\exportpdfupsell-app\js\nls\sv-se\ui-strings.js	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-ae\ui-strings.js	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\fss\img\tools\dot.cur	RdrServicesUpdater.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AGMGPUOptIn.ini	msiexec.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\createpdfupsell-app\js\nls\ro-ro\ui-strings.js	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\search-summary\js\nls\sl-sl\ui-strings.js	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\on-boarding\images\themeless\ru_get.svg	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\signatures\images\themes\dark\dd_arrow_small.png	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\fss\js\nls\hu-hu\ui-strings.js	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\images\file_types\s_filetype_psd.svg	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\images\s_duplicate_18.svg	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\files\dev\nls\ca-es\ui-strings.js	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\exportpdfupsell-app\js\nls\zh-tw\ui-strings.js	RdrServicesUpdater.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\UnifiedShare.aapp	msiexec.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\core\dev\nls\eu-es\ui-strings.js	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\my-computer-select\js\nls\en-gb\ui-strings.js	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\unified-share\js\nls\zh-cn\ui-strings.js	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_de_135x40.svg	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\on-boarding\images\themeless\find-text.png	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\images\file_types\editpdf.svg	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\tracked-send\js\plugins\tracked-send\js\tool\plugin.js	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\reviews\js\nls\fr-fr\ui-strings.js	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\images\themes\dark\share.svg	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\files\dev\nls\fi-fi\ui-strings.js	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\pages-app\images\themes\dark\rhp_world_icon_hover.png	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\images\themes\dark\core_icons_retina.png	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\digsig\images\s_radio_selected_18.svg	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\createpdfupsell-app\css\main-selector.css	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_pl_135x40.svg	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\my-recent-files\js\selector.js	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\my-computer\images\themes\dark\bg_pattern_RHP.png	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\app-center\js\nls\ko-kr\ui-strings.js	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\desktop-connector-files\js\nls\zh-tw\ui-strings.js	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\send-for-sign\js\nls\zh-tw\ui-strings.js	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\images\win8-scrollbar\arrow-down.gif	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\images\s_unshare_18.svg	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\createpdfupsell-app\js\nls\ko-kr\ui-strings.js	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\digsig\js\nls\nl-nl\ui-strings.js	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\on-boarding\images\themeless\theme-2x.png	RdrServicesUpdater.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\app\dev\nls\cs-cz\ui-strings.js	RdrServicesUpdater.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AXSLE.dll	msiexec.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\my-recent-files\js\nls\sk-sk\ui-strings.js	RdrServicesUpdater.exe

Drops file in Windows directory 64 IoCs

Processes:

msiexec.exemspaint.exeSearchUI.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSI48CF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e59e5c1.HDR	msiexec.exe
File created	C:\Windows\Installer\e59e5c4.HDR	msiexec.exe
File created	C:\Windows\Installer\e59e5cb.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e59e5d7.HDR	msiexec.exe
File created	C:\Windows\Installer\e59e5e2.HDR	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\e59e5b7.HDR	msiexec.exe
File created	C:\Windows\Installer\e59e5c0.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICCE8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE0A6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e59e5cc.HDR	msiexec.exe
File created	C:\Windows\Installer\e59e5d4.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e59e5d5.HDR	msiexec.exe
File created	C:\Windows\Installer\e59e5d7.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e59e5dc.HDR	msiexec.exe
File created	C:\Windows\Installer\e59e5c5.HDR	msiexec.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Installer\e59e5ba.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e59e5d2.HDR	msiexec.exe
File created	C:\Windows\Installer\e59e5d3.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI99D6.tmp	msiexec.exe
File created	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\PDXFile_8.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\PDFFile_8.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE654.tmp	msiexec.exe
File created	C:\Windows\Installer\e59e5b5.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e59e5c4.HDR	msiexec.exe
File created	C:\Windows\Installer\e59e5c6.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICBBD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICD67.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e59e5da.HDR	msiexec.exe
File created	C:\Windows\Installer\e59e5db.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7157.tmp	msiexec.exe
File created	C:\Windows\rescache\_merged\1601268389\3877292338.pri	SearchUI.exe
File opened for modification	C:\Windows\Installer\MSI469A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e59e5b6.HDR	msiexec.exe
File created	C:\Windows\Installer\e59e5c8.HDR	msiexec.exe
File created	C:\Windows\Installer\e59e5d2.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e59e5df.HDR	msiexec.exe
File created	C:\Windows\Installer\e59e5e7.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\APIFile_8.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4775.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e59e5e9.HDR	msiexec.exe
File created	C:\Windows\Installer\e59e5d8.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e59e5d1.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI98DB.tmp	msiexec.exe
File created	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\PDFFile_8.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC976.tmp	msiexec.exe
File created	C:\Windows\Installer\e59e5bf.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e59e5e8.HDR	msiexec.exe
File created	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\FDFFile_8.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB43D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e59e5be.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e59e5c0.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e59e5c5.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e59e5c8.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e59e5d4.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e59e5e5.HDR	msiexec.exe
File created	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\SecStoreFile.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\XDPFile_8.ico	msiexec.exe
File created	C:\Windows\Installer\e59e5b7.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICB9D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAD9D.tmp	msiexec.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4340 4748 WerFault.exe SearchUI.exe

pid	pid_target	process	target process
4340	4748	WerFault.exe	SearchUI.exe

Checks SCSI registry key(s) 3 TTPs 26 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	explorer.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

firefox.exefirefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

System Information Discovery

Processes:

SearchUI.exeSearchUI.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchUI.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchUI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchUI.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchUI.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

Processes:

MsiExec.exemsiexec.exeexplorer.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	MsiExec.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B723F941-52A2-4392-B500-60F3889659B4}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B723F941-52A2-4392-B500-60F3889659B4}\AppPath = "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C6A861C-B233-4994-AFB1-C158EE4FC578}\AppPath = "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B3FB63-66F4-4EFC-B717-BB283B85E79B}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C6A861C-B233-4994-AFB1-C158EE4FC578}\Policy = "3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E1F80F4-953F-41E7-8460-E64AE5BE4ED3}\Policy = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B7278BD0-7970-47D6-8954-99B2343EED88}\AppName = "RdrCEF.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B7278BD0-7970-47D6-8954-99B2343EED88}\Policy = "3"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E1F80F4-953F-41E7-8460-E64AE5BE4ED3}\AppPath = "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E1F80F4-953F-41E7-8460-E64AE5BE4ED3}\AppName = "AdobeCollabSync.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B7278BD0-7970-47D6-8954-99B2343EED88}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Low Rights	MsiExec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BD57A9B2-4E7D-4892-9107-9F4106472DA4}	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B3FB63-66F4-4EFC-B717-BB283B85E79B}\AppName = "AcroBroker.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E1F80F4-953F-41E7-8460-E64AE5BE4ED3}	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B723F941-52A2-4392-B500-60F3889659B4}\AppName = "AcroRd32.exe"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B3FB63-66F4-4EFC-B717-BB283B85E79B}\AppPath = "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BD57A9B2-4E7D-4892-9107-9F4106472DA4}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B723F941-52A2-4392-B500-60F3889659B4}\Policy = "3"	MsiExec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B3FB63-66F4-4EFC-B717-BB283B85E79B}\Policy = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C6A861C-B233-4994-AFB1-C158EE4FC578}\AppName = "AcroRd32.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B7278BD0-7970-47D6-8954-99B2343EED88}\AppPath = "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C6A861C-B233-4994-AFB1-C158EE4FC578}	msiexec.exe

Modifies data under HKEY_USERS 3 IoCs

Processes:

msiexec.exe

description	ioc	process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe

Modifies registry class 64 IoCs

Processes:

msiexec.exeMsiExec.exeexplorer.exeSearchUI.exeexplorer.exeSearchUI.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.FDFDoc\DefaultIcon\ = "C:\\Windows\\Installer\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\FDFFile_8.ico,0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{BD57A9B2-4E7D-4892-9107-9F4106472DA4}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\EnableFullPage\.xdp	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.Document.DC\Shellex\PropertySheetHandlers\ = "InfoPage"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\EnableFullPage\.xdp	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.XDPDoc\shell\Read\ = "Open with Adobe Acrobat Reader DC"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{5AAABB05-F91B-4bce-AB18-D8319DEDABA8}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PDXFileType\DefaultIcon	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.XDPDoc	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD57A9B2-4E7D-4892-9107-9F4106472DA4}\AppID = "{F2383816-917A-46CC-AD2A-5013BED3800F}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{12BA069D-0FC6-4577-97C6-5DF634CE6E84}\NumMethods\ = "6"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.api\OpenWithProgids	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.secstore\ = "AcroExch.SecStore"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MIME\Database\Content Type\application/vnd.adobe.xfdf	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.acrobatsecuritysettings.1\CLSID\ = "{B801CA65-A1FC-11D0-85AD-444553540000}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchUI.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{9B4CD3E7-4981-101B-9CA8-9240CE2738AE}\ProxyStubClsid	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B4CD3EF-4981-101B-9CA8-9240CE2738AE}\TypeLib\Version = "1.1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{08A9E040-9A9C-4F42-B5F5-2029B8F17E1D}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{3F77C747-A942-45B2-A812-097A1F5CFE6F}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5AAABB05-F91B-4bce-AB18-D8319DEDABA8}\ = "Adobe Reader Bitmap Factory Class"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\AcroRD32.exe	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B4CD3E6-4981-101B-9CA8-9240CE2738AE}\ = "CAcroApp"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{673E8454-7646-11D1-B90B-00A0C9259304}\TypeLib\ = "{7CD06992-50AA-11D1-B8F0-00A0C9259304}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{17F2E344-8227-4AA7-A25A-E89424566BBA}\ProxyStubClsid32\ = "{17F2E344-8227-4AA7-A25A-E89424566BBA}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{DC6EFB56-9CFA-464D-8880-44885D7DC193}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/vnd.adobe.xfdf\Extension = ".xfdf"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B4CD3E6-4981-101B-9CA8-9240CE2738AE}\TypeLib\Version = "1.1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{12BA069D-0FC6-4577-97C6-5DF634CE6E84}\NumMethods	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\PDFPrevHndlr.PDFPreviewHandler\CLSID	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchUI.exe
Key created	\REGISTRY\MACHINE\Software\Classes\acrobat2018	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdfxml\Content Type = "application/vnd.adobe.pdfxml"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\LocalServer32\ = "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F0B4F6AD-5E09-4CB1-B763-EC390CBDE51D}\Implemented Categories	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.pdfxml.1\shell\ = "Read"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\acrobat\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.pdfxml\CurVer\ = "AcroExch.pdfxml.1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xfdf\OpenWithProgids\AcroExch.XFDFDoc = "0"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}\	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF9A1DA0-23C0-101B-B02E-FDFDFDFDFDFD}\TreatAs\ = "{B801CA65-A1FC-11D0-85AD-444553540000}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.pdfxml.1\CLSID\ = "{B801CA65-A1FC-11D0-85AD-444553540000}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{41738EEA-442F-477F-92CF-2889BD6CD7E7}\1.0\FLAGS	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{17F2E344-8227-4AA7-A25A-E89424566BBA}\NumMethods\ = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{17F2E344-8227-4AA7-A25A-E89424566BBA}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B4CD3E9-4981-101B-9CA8-9240CE2738AE}\ = "CAcroAVPageView"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{9B4CD3ED-4981-101B-9CA8-9240CE2738AE}\ProxyStubClsid	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D3F22039-E3CF-4FC4-9A30-426A46056B8C}\TypeLib\Version = "1.0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchUI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.Document\BrowseInPlace = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.acrobatsecuritysettings.1\DefaultIcon\ = "C:\\Windows\\Installer\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\PDFFile_8.ico,0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchUI.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AcroExch.pdfxml.1\shell\Read	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7CD069A1-50AA-11D1-B8F0-00A0C9259304}\ = "AFormApp Class"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\VersionIndependentProgID\ = "AcroExch.Document"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AcroExch.Document.7\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.acrobatsecuritysettings	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\AcroRD32.exe\shell\Read	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/vnd.adobe.xfdf	msiexec.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

explorer.exe

pid process

4728 explorer.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

mspaint.exeMsiExec.exe

pid	process
4540	mspaint.exe
4540	mspaint.exe
3940	MsiExec.exe
3940	MsiExec.exe
3940	MsiExec.exe
3940	MsiExec.exe
3940	MsiExec.exe
3940	MsiExec.exe
3940	MsiExec.exe
3940	MsiExec.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

explorer.exeexplorer.exe

pid process

4728 explorer.exe
4656 explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

explorer.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	4728	explorer.exe
Token: SeCreatePagefilePrivilege	4728	explorer.exe
Token: SeShutdownPrivilege	4728	explorer.exe
Token: SeCreatePagefilePrivilege	4728	explorer.exe
Token: SeShutdownPrivilege	4728	explorer.exe
Token: SeCreatePagefilePrivilege	4728	explorer.exe
Token: SeShutdownPrivilege	4728	explorer.exe
Token: SeCreatePagefilePrivilege	4728	explorer.exe
Token: SeShutdownPrivilege	4728	explorer.exe
Token: SeCreatePagefilePrivilege	4728	explorer.exe
Token: SeShutdownPrivilege	4728	explorer.exe
Token: SeCreatePagefilePrivilege	4728	explorer.exe
Token: SeShutdownPrivilege	4728	explorer.exe
Token: SeCreatePagefilePrivilege	4728	explorer.exe
Token: SeShutdownPrivilege	4728	explorer.exe
Token: SeCreatePagefilePrivilege	4728	explorer.exe
Token: SeShutdownPrivilege	4728	explorer.exe
Token: SeCreatePagefilePrivilege	4728	explorer.exe
Token: SeShutdownPrivilege	4728	explorer.exe
Token: SeCreatePagefilePrivilege	4728	explorer.exe
Token: SeShutdownPrivilege	4728	explorer.exe
Token: SeCreatePagefilePrivilege	4728	explorer.exe
Token: SeShutdownPrivilege	4728	explorer.exe
Token: SeCreatePagefilePrivilege	4728	explorer.exe
Token: SeShutdownPrivilege	4728	explorer.exe
Token: SeCreatePagefilePrivilege	4728	explorer.exe
Token: SeShutdownPrivilege	4728	explorer.exe
Token: SeCreatePagefilePrivilege	4728	explorer.exe
Token: SeShutdownPrivilege	4728	explorer.exe
Token: SeCreatePagefilePrivilege	4728	explorer.exe
Token: SeShutdownPrivilege	4728	explorer.exe
Token: SeCreatePagefilePrivilege	4728	explorer.exe
Token: SeShutdownPrivilege	4728	explorer.exe
Token: SeCreatePagefilePrivilege	4728	explorer.exe
Token: SeShutdownPrivilege	4728	explorer.exe
Token: SeCreatePagefilePrivilege	4728	explorer.exe
Token: SeShutdownPrivilege	4728	explorer.exe
Token: SeCreatePagefilePrivilege	4728	explorer.exe
Token: SeShutdownPrivilege	4728	explorer.exe
Token: SeCreatePagefilePrivilege	4728	explorer.exe
Token: SeShutdownPrivilege	4728	explorer.exe
Token: SeCreatePagefilePrivilege	4728	explorer.exe
Token: SeShutdownPrivilege	4728	explorer.exe
Token: SeCreatePagefilePrivilege	4728	explorer.exe
Token: SeShutdownPrivilege	4728	explorer.exe
Token: SeCreatePagefilePrivilege	4728	explorer.exe
Token: SeShutdownPrivilege	4728	explorer.exe
Token: SeCreatePagefilePrivilege	4728	explorer.exe
Token: SeShutdownPrivilege	4728	explorer.exe
Token: SeCreatePagefilePrivilege	4728	explorer.exe
Token: SeShutdownPrivilege	4728	explorer.exe
Token: SeCreatePagefilePrivilege	4728	explorer.exe
Token: SeShutdownPrivilege	4728	explorer.exe
Token: SeCreatePagefilePrivilege	4728	explorer.exe
Token: SeShutdownPrivilege	4728	explorer.exe
Token: SeIncreaseQuotaPrivilege	4728	explorer.exe
Token: SeSecurityPrivilege	4796	msiexec.exe
Token: SeCreateTokenPrivilege	4728	explorer.exe
Token: SeAssignPrimaryTokenPrivilege	4728	explorer.exe
Token: SeLockMemoryPrivilege	4728	explorer.exe
Token: SeIncreaseQuotaPrivilege	4728	explorer.exe
Token: SeMachineAccountPrivilege	4728	explorer.exe
Token: SeTcbPrivilege	4728	explorer.exe
Token: SeSecurityPrivilege	4728	explorer.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

explorer.exefirefox.exeexplorer.exe

pid	process
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4064	firefox.exe
4064	firefox.exe
4728	explorer.exe
4064	firefox.exe
4064	firefox.exe
4728	explorer.exe
4064	firefox.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe
4656	explorer.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

explorer.exefirefox.exe

pid	process
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4064	firefox.exe

Suspicious use of SetWindowsHookEx 64 IoCs

Processes:

SearchUI.exeexplorer.exefirefox.exe

pid	process
4332	SearchUI.exe
4728	explorer.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe
4064	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

explorer.exefirefox.exefirefox.exe

description	pid	process	target process
PID 4728 wrote to memory of 2784	4728	explorer.exe	firefox.exe
PID 4728 wrote to memory of 2784	4728	explorer.exe	firefox.exe
PID 2784 wrote to memory of 4064	2784	firefox.exe	firefox.exe
PID 2784 wrote to memory of 4064	2784	firefox.exe	firefox.exe
PID 2784 wrote to memory of 4064	2784	firefox.exe	firefox.exe
PID 2784 wrote to memory of 4064	2784	firefox.exe	firefox.exe
PID 2784 wrote to memory of 4064	2784	firefox.exe	firefox.exe
PID 2784 wrote to memory of 4064	2784	firefox.exe	firefox.exe
PID 2784 wrote to memory of 4064	2784	firefox.exe	firefox.exe
PID 2784 wrote to memory of 4064	2784	firefox.exe	firefox.exe
PID 2784 wrote to memory of 4064	2784	firefox.exe	firefox.exe
PID 2784 wrote to memory of 4064	2784	firefox.exe	firefox.exe
PID 2784 wrote to memory of 4064	2784	firefox.exe	firefox.exe
PID 4064 wrote to memory of 4300	4064	firefox.exe	firefox.exe
PID 4064 wrote to memory of 4300	4064	firefox.exe	firefox.exe
PID 4064 wrote to memory of 3368	4064	firefox.exe	firefox.exe
PID 4064 wrote to memory of 3368	4064	firefox.exe	firefox.exe
PID 4064 wrote to memory of 3368	4064	firefox.exe	firefox.exe
PID 4064 wrote to memory of 3368	4064	firefox.exe	firefox.exe
PID 4064 wrote to memory of 3368	4064	firefox.exe	firefox.exe
PID 4064 wrote to memory of 3368	4064	firefox.exe	firefox.exe
PID 4064 wrote to memory of 3368	4064	firefox.exe	firefox.exe
PID 4064 wrote to memory of 3368	4064	firefox.exe	firefox.exe
PID 4064 wrote to memory of 3368	4064	firefox.exe	firefox.exe
PID 4064 wrote to memory of 3368	4064	firefox.exe	firefox.exe
PID 4064 wrote to memory of 3368	4064	firefox.exe	firefox.exe
PID 4064 wrote to memory of 3368	4064	firefox.exe	firefox.exe
PID 4064 wrote to memory of 3368	4064	firefox.exe	firefox.exe
PID 4064 wrote to memory of 3368	4064	firefox.exe	firefox.exe
PID 4064 wrote to memory of 3368	4064	firefox.exe	firefox.exe
PID 4064 wrote to memory of 3368	4064	firefox.exe	firefox.exe
PID 4064 wrote to memory of 3368	4064	firefox.exe	firefox.exe
PID 4064 wrote to memory of 3368	4064	firefox.exe	firefox.exe
PID 4064 wrote to memory of 3368	4064	firefox.exe	firefox.exe
PID 4064 wrote to memory of 3368	4064	firefox.exe	firefox.exe
PID 4064 wrote to memory of 3368	4064	firefox.exe	firefox.exe
PID 4064 wrote to memory of 3368	4064	firefox.exe	firefox.exe
PID 4064 wrote to memory of 3368	4064	firefox.exe	firefox.exe
PID 4064 wrote to memory of 3368	4064	firefox.exe	firefox.exe
PID 4064 wrote to memory of 3368	4064	firefox.exe	firefox.exe
PID 4064 wrote to memory of 3368	4064	firefox.exe	firefox.exe
PID 4064 wrote to memory of 3368	4064	firefox.exe	firefox.exe
PID 4064 wrote to memory of 3368	4064	firefox.exe	firefox.exe
PID 4064 wrote to memory of 3368	4064	firefox.exe	firefox.exe
PID 4064 wrote to memory of 3368	4064	firefox.exe	firefox.exe
PID 4064 wrote to memory of 3368	4064	firefox.exe	firefox.exe
PID 4064 wrote to memory of 3368	4064	firefox.exe	firefox.exe
PID 4064 wrote to memory of 3368	4064	firefox.exe	firefox.exe
PID 4064 wrote to memory of 3368	4064	firefox.exe	firefox.exe
PID 4064 wrote to memory of 3368	4064	firefox.exe	firefox.exe
PID 4064 wrote to memory of 3368	4064	firefox.exe	firefox.exe
PID 4064 wrote to memory of 3368	4064	firefox.exe	firefox.exe
PID 4064 wrote to memory of 3368	4064	firefox.exe	firefox.exe
PID 4064 wrote to memory of 3368	4064	firefox.exe	firefox.exe
PID 4064 wrote to memory of 3368	4064	firefox.exe	firefox.exe
PID 4064 wrote to memory of 3368	4064	firefox.exe	firefox.exe
PID 4064 wrote to memory of 3368	4064	firefox.exe	firefox.exe
PID 4064 wrote to memory of 3368	4064	firefox.exe	firefox.exe
PID 4064 wrote to memory of 3368	4064	firefox.exe	firefox.exe
PID 4064 wrote to memory of 3368	4064	firefox.exe	firefox.exe
PID 4064 wrote to memory of 3368	4064	firefox.exe	firefox.exe
PID 4064 wrote to memory of 3368	4064	firefox.exe	firefox.exe
PID 4064 wrote to memory of 3368	4064	firefox.exe	firefox.exe
PID 4064 wrote to memory of 2240	4064	firefox.exe	firefox.exe

C:\Users\Admin\AppData\Local\Temp\fucker script.exe
"C:\Users\Admin\AppData\Local\Temp\fucker script.exe"
1⤵
PID:4396

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s fdPHost
1⤵
PID:4264

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4376

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\287ce4bb7bb641059899c064a1dd8b5b /t 3128 /p 3124
1⤵
PID:3304

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4728

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2784

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
3⤵
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4064

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4064.0.842582923\1344488960" -parentBuildID 20221007134813 -prefsHandle 1544 -prefMapHandle 1496 -prefsLen 20936 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a7bb8365-433b-4413-b393-c901b58c122c} 4064 "\\.\pipe\gecko-crash-server-pipe.4064" 1628 25ef56ddb58 gpu
4⤵
PID:4300

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4064.1.1440879128\21369454" -parentBuildID 20221007134813 -prefsHandle 2040 -prefMapHandle 2036 -prefsLen 21017 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e796798b-dadd-4c16-a2c1-7f5594ad37df} 4064 "\\.\pipe\gecko-crash-server-pipe.4064" 2064 25ef51e1858 socket
4⤵
- Checks processor information in registry
PID:3368

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4064.2.432036349\110511722" -childID 1 -isForBrowser -prefsHandle 3316 -prefMapHandle 3312 -prefsLen 21120 -prefMapSize 232675 -jsInitHandle 904 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2618f0ad-b261-4832-88f9-bb796302db8e} 4064 "\\.\pipe\gecko-crash-server-pipe.4064" 3328 25ef9933e58 tab
4⤵
PID:2240

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4064.3.42646530\1059405357" -childID 2 -isForBrowser -prefsHandle 3524 -prefMapHandle 3528 -prefsLen 26480 -prefMapSize 232675 -jsInitHandle 904 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e70d5f46-df6d-49e9-bf96-f78bfbb9e3cb} 4064 "\\.\pipe\gecko-crash-server-pipe.4064" 3512 25eeab5e358 tab
4⤵
PID:3396

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4064.4.608463969\2011663182" -childID 3 -isForBrowser -prefsHandle 4092 -prefMapHandle 4084 -prefsLen 26559 -prefMapSize 232675 -jsInitHandle 904 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c8cc8650-56d9-475d-8d3c-87090d0f1c82} 4064 "\\.\pipe\gecko-crash-server-pipe.4064" 4108 25efb5e3c58 tab
4⤵
PID:3568

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4064.7.513776499\989173478" -childID 6 -isForBrowser -prefsHandle 3968 -prefMapHandle 3972 -prefsLen 26824 -prefMapSize 232675 -jsInitHandle 904 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {685e9417-b33f-46b2-a509-51e91f4d7728} 4064 "\\.\pipe\gecko-crash-server-pipe.4064" 4468 25ef81d7e58 tab
4⤵
PID:4956

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4064.6.183916359\1011268313" -childID 5 -isForBrowser -prefsHandle 2428 -prefMapHandle 3876 -prefsLen 26824 -prefMapSize 232675 -jsInitHandle 904 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e2d31fff-068f-4f1c-b617-566603de49a5} 4064 "\\.\pipe\gecko-crash-server-pipe.4064" 3888 25ef81d5d58 tab
4⤵
PID:3896

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4064.5.1708684998\1942866194" -childID 4 -isForBrowser -prefsHandle 3956 -prefMapHandle 2656 -prefsLen 26824 -prefMapSize 232675 -jsInitHandle 904 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8b211eb7-11db-452c-8fd9-55d803b8c4a0} 4064 "\\.\pipe\gecko-crash-server-pipe.4064" 1404 25eeab67858 tab
4⤵
PID:3620

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\DisconnectTest.jpeg"
2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:4540

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4332

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Sets file execution options in registry
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4796

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 6D96337DCD96D7998EC2EAB9C9DC44A8
2⤵
- Loads dropped DLL
- Drops file in System32 directory
PID:5036

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding F2BF94B523B5EFF0310A41367A7D16F0 E Global\MSI0000
2⤵
- Sets file execution options in registry
- Loads dropped DLL
- Registers COM server for autorun
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3940

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe" 19.010.20069 19.010.20069.0
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3580

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\a3d4820f8ac14531a7258623ee7812f3 /t 3952 /p 4728
1⤵
PID:4688

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\64018bc05eca4e598d26cec3fb901e6f /t 1776 /p 4728
1⤵
PID:3996

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService
1⤵
PID:3464

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:4656

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
1⤵
- Enumerates system info in registry
- Modifies registry class
PID:4748

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4748 -s 3528
2⤵
- Program crash
PID:4340

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\bb9b564991894c11b47084887effffb6 /t 532 /p 4656
1⤵
PID:3728

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\fa771a9dd8cc4afa8f335f72ab219e43 /t 780 /p 3616
1⤵
PID:3140

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\6e03dec1d68c4b53a60a7a12d06914de /t 532 /p 4656
1⤵
PID:4260

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
PID:4756

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
1⤵
- Drops file in Windows directory
PID:3936

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery