0c32d7613160af1241fba24f7d6a995186921703d18252dbaa857aa03c07da10

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}	ie4uinit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\IsInstalled = "1"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\Locale = "*"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\Version = "11,1081,19041,0"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\Version = "11,1081,19041,0"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}	ie4uinit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\IsInstalled = "1"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\Locale = "*"	ie4uinit.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Control Panel\International\Geo\Nation	setup_com.steam.687750_flow6mkt_44234475.exe

Executes dropped EXE 21 IoCs

pid	Process
5176	7za.exe
6008	MSI3FEC.tmp
5724	7za.exe
1300	MSIE1BA.tmp
3256	node.exe
5680	7za.exe
5956	7za.exe
4620	MSI38FF.tmp
624	setup_com.steam.687750_flow6mkt_44234475.exe
6044	setup_com.steam.687750_flow6mkt_44234475.exe
4216	sysinfo-app.exe
5248	MobiHelper.exe
5540	subinacl.exe
4300	aeg_launcher.exe
1128	subinacl.exe
2928	MobiVBoxSVC.exe
3428	SUPInstall.exe
5264	MobiVBoxSVC.exe
5932	NetLwfUninstall.exe
4312	USBUninstall.exe
3660	SUPUninstall.exe

Loads dropped DLL 64 IoCs

pid	Process
3084	MsiExec.exe
3084	MsiExec.exe
3084	MsiExec.exe
3084	MsiExec.exe
3084	MsiExec.exe
3084	MsiExec.exe
3084	MsiExec.exe
3084	MsiExec.exe
3084	MsiExec.exe
3084	MsiExec.exe
3084	MsiExec.exe
3084	MsiExec.exe
3084	MsiExec.exe
5032	MsiExec.exe
5032	MsiExec.exe
5032	MsiExec.exe
5032	MsiExec.exe
5032	MsiExec.exe
5032	MsiExec.exe
5032	MsiExec.exe
5032	MsiExec.exe
5032	MsiExec.exe
5032	MsiExec.exe
5032	MsiExec.exe
5760	MsiExec.exe
5760	MsiExec.exe
5760	MsiExec.exe
5760	MsiExec.exe
5760	MsiExec.exe
5760	MsiExec.exe
5760	MsiExec.exe
5760	MsiExec.exe
5760	MsiExec.exe
5760	MsiExec.exe
5760	MsiExec.exe
5760	MsiExec.exe
3256	node.exe
3256	node.exe
3256	node.exe
5996	MsiExec.exe
5996	MsiExec.exe
5996	MsiExec.exe
5996	MsiExec.exe
5996	MsiExec.exe
5996	MsiExec.exe
5996	MsiExec.exe
5996	MsiExec.exe
5996	MsiExec.exe
5996	MsiExec.exe
5996	MsiExec.exe
5996	MsiExec.exe
5600	MsiExec.exe
5600	MsiExec.exe
5600	MsiExec.exe
5600	MsiExec.exe
5600	MsiExec.exe
5600	MsiExec.exe
5600	MsiExec.exe
3084	MsiExec.exe
3084	MsiExec.exe
3084	MsiExec.exe
3084	MsiExec.exe
3084	MsiExec.exe
3084	MsiExec.exe

Registers COM server for autorun 1 TTPs 16 IoCs

persistence

Registry Run Keys / Startup Folder

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c5e1ec0a-f6c2-11e7-aeb4-080027376349}\LocalServer32\ = "\"C:\\Program Files\\MobiGame\\vbox\\MobiVBoxSVC.exe\""	MobiVBoxSVC.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c5e23f7a-f6c2-11e7-aeb4-080027376349}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0002DF01-0000-0000-C000-000000000046}\LocalServer32	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c5e1ec0a-f6c2-11e7-aeb4-080027376349}\LocalServer32	MobiVBoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c5e23f7a-f6c2-11e7-aeb4-080027376349}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c5e23f7a-f6c2-11e7-aeb4-080027376349}\InprocServer32\ = "C:\\Program Files\\MobiGame\\vbox\\VBoxC.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c5e220c6-f6c2-11e7-aeb4-080027376349}\InprocServer32\ = "C:\\Program Files\\MobiGame\\vbox\\VBoxC.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c5e220c6-f6c2-11e7-aeb4-080027376349}\InprocServer32\ThreadingModel = "Free"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c5e220c6-f6c2-11e7-aeb4-080027376349}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c5e23f7a-f6c2-11e7-aeb4-080027376349}\InprocServer32\ThreadingModel = "Free"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c5e23f7a-f6c2-11e7-aeb4-080027376349}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0002DF01-0000-0000-C000-000000000046}\LocalServer32	ie4uinit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c5e1ec0a-f6c2-11e7-aeb4-080027376349}\LocalServer32	MobiVBoxSVC.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c5e1ec0a-f6c2-11e7-aeb4-080027376349}\LocalServer32	MobiVBoxSVC.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c5e220c6-f6c2-11e7-aeb4-080027376349}\InprocServer32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c5e220c6-f6c2-11e7-aeb4-080027376349}\InprocServer32	regsvr32.exe

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WCUpate = "powershell.exe -WindowStyle Hidden -ExecutionPolicy bypass -c \"Start-Sleep 300\";\"& \"\"\"C:\\Users\\Admin\\AppData\\Roaming\\BBWC\\updater.exe\"\"\" /silentall -nofreqcheck\""	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WCStartup = "powershell -noninteractive -ExecutionPolicy bypass -c \"$w=\"$env:APPDATA\"+'/BBWC/';[Reflection.Assembly]::Load([System.IO.File]::ReadAllBytes($w+'Newtonsoft.Json.dll'));[Reflection.Assembly]::Load([System.IO.File]::ReadAllBytes($w+'System.Data.SQLite.dll'));[Reflection.Assembly]::Load([System.IO.File]::ReadAllBytes($w+'ICSharpCode.SharpZipLib.dll'));[Reflection.Assembly]::Load([System.IO.File]::ReadAllBytes($w+'LZ4.dll'));$f=$w+'WC.txt';$h=Get-Content -Path $f -Raw;$h=Get-Content -Path $f -Raw;[byte[]]$bytes=($h -split '(.{2})' -ne '' -replace '^','0X');[Reflection.Assembly]::Load($bytes);[WebCompanion.StartUp]::Start()\""	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BAStartup = "C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell -ExecutionPolicy bypass -c \"$env:COMPLUS_version='v4.0.30319';$w=\"$env:APPDATA\"+'\\Browser Assistant\\';cd $w;&powershell{& ./edge/x86/node.exe ./edge/startup.js}\""	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BAUpdater = "C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell -ExecutionPolicy bypass -c \"$env:COMPLUS_version='v4.0.30319';$w=\"$env:APPDATA\"+'\\Browser Assistant\\';cd $w;&powershell{& ./edge/x86/node.exe ./edge/update.js --delay=1500}\""	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WCEStartup = "powershell.exe -ExecutionPolicy bypass -c \"$f=\"$env:APPDATA\"+'/Browser Extension/BE.txt';$h=Get-Content -Path $f -Raw;[byte[]]$bytes=($h -split '(.{2})' -ne '' -replace '^', '0X');[Reflection.Assembly]::Load($bytes);[WebCompanion.BrowserExtension.S]::Start()\""	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WCEUpdater = "powershell.exe -WindowStyle Hidden -ExecutionPolicy bypass -c \"Start-Sleep 2100\";\"& \"\"\"C:\\Users\\Admin\\AppData\\Roaming\\Browser Extension\\updater.exe\"\"\" /silentall -nofreqcheck\""	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Windows\CurrentVersion\Run	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\MobiGame\playstore\System.IO.FileSystem.AccessControl.dll	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\System.IO.FileSystem.Primitives.dll	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\System.Reflection.TypeExtensions.dll	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\System.Xml.XmlDocument.dll	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\api-ms-win-core-file-l2-1-0.dll	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\api-ms-win-core-processenvironment-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\api-ms-win-crt-heap-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\Microsoft.Win32.Registry.dll	msiexec.exe
File created	C:\Program Files\MobiGame\vbox\VBoxGuestPropSvc.dll	msiexec.exe
File opened for modification	C:\Program Files\MobiGame\communicator.exe.config	rundll32.exe
File created	C:\Program Files\MobiGame\vbox\MobiVBoxDrv.sys	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\System.IO.Compression.FileSystem.dll	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\locales\ur.pak	msiexec.exe
File created	C:\Program Files\MobiGame\vbox\VBoxVMM.dll	msiexec.exe
File created	C:\Program Files\MobiGame\vbox\MobiVBoxDD2RC.rc	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\NetCoreEx.BinaryExtensions.dll	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\System.Transactions.Local.dll	msiexec.exe
File created	C:\Program Files\MobiGame\vbox\VBoxC.dll	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\api-ms-win-core-sysinfo-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\dist\static\media\fa-brands-400.70150a2b3a50f84aff70.ttf	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\dist\static\media\industry.66f0549852c68c2c3ad0.ttf	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\libcef.dll	msiexec.exe
File created	C:\Program Files\MobiGame\vbox\VBoxUSBMon.cat	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\System.Formats.Asn1.dll	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\System.Net.WebSockets.Client.dll	msiexec.exe
File created	C:\Program Files\MobiGame\vbox\drivers\VBoxNetLwf\VBoxNetLwf.sys	msiexec.exe
File created	C:\Program Files\MobiGame\vbox\VBoxOGLrenderspu.dll	msiexec.exe
File created	C:\Program Files\MobiGame\player\api-ms-win-crt-runtime-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\MobiGame\player\libEGL_angle.dll	msiexec.exe
File created	C:\Program Files\MobiGame\player\mobiadb.exe	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\locales\ru.pak	msiexec.exe
File created	C:\Program Files\MobiGame\player\api-ms-win-core-datetime-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\Microsoft.Extensions.Configuration.FileExtensions.dll	msiexec.exe
File created	C:\Program Files\MobiGame\vbox\x86\msvcp100.dll	msiexec.exe
File created	C:\Program Files\MobiGame\player\imageformats\qsvg.dll	msiexec.exe
File created	C:\Program Files\MobiGame\player\d3dcompiler_47.dll	msiexec.exe
File created	C:\Program Files\MobiGame\vbox\VBoxHostChannel.dll	msiexec.exe
File created	C:\Program Files\MobiGame\vbox\VBoxOGLhosterrorspu.dll	msiexec.exe
File created	C:\Program Files\MobiGame\vbox\drivers\VBoxUSBMon\VBoxUSBMon.sys	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\api-ms-win-core-datetime-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\api-ms-win-core-profile-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\Playstore.deps.json	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\System.Net.WebSockets.dll	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\System.ComponentModel.TypeConverter.dll	msiexec.exe
File opened for modification	C:\Program Files\MobiGame\MobiGameUpdater.exe.config	rundll32.exe
File created	C:\Program Files\MobiGame\playstore\api-ms-win-core-fibers-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\MobiGame\vbox\MobiVBoxDD2R0.r0	msiexec.exe
File created	C:\Program Files\MobiGame\Mono.Posix.dll	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\locales\sl.pak	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\System.Globalization.dll	msiexec.exe
File created	C:\Program Files\MobiGame\System.Memory.dll	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\api-ms-win-crt-locale-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\locales\hu.pak	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\Microsoft.VisualBasic.Core.dll	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\System.Diagnostics.Process.dll	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\System.ServiceProcess.dll	msiexec.exe
File created	C:\Program Files\MobiGame\player\API-MS-Win-core-xstate-l2-1-0.dll	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\dist\asset-manifest.json	msiexec.exe
File created	C:\Program Files\MobiGame\SharpAdbClient.dll	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\System.Net.Quic.dll	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\System.Diagnostics.StackTrace.dll	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\System.Runtime.Serialization.Json.dll	msiexec.exe
File created	C:\Program Files\MobiGame\vbox\drivers\VBoxNetFlt\VBoxNetFlt.inf	msiexec.exe
File created	C:\Program Files\MobiGame\playstore\api-ms-win-crt-string-l1-1-0.dll	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI391F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5C88.tmp-\WixSharp.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSICCDE.tmp-\VirtualBoxSetup.pdb	rundll32.exe
File opened for modification	C:\Windows\Installer\MSID79E.tmp-\VirtualBoxSetup.exe	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIEB9A.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIF253.tmp-\VirtualBoxSetup.pdb	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6616.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6EE1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID9C2.tmp-\WixSharp.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI2991.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2A4D.tmp-\VirtualBoxSetup.pdb	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIF253.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\Installer\SourceHash{597AF758-68F5-4419-860C-60980B2CBD76}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEE8E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2C3C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI47A7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI80B1.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI80B1.tmp-\WixSharp.UI.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIF253.tmp-\WixSharp.UI.dll	rundll32.exe
File created	C:\Windows\INF\oem1.PNF	NetLwfUninstall.exe
File opened for modification	C:\Windows\Installer\MSI150F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7791.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID52C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID9C2.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIDEC5.tmp-\VirtualBoxSetup.pdb	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIE8D9.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSICCDE.tmp-\WixSharp.UI.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSID79E.tmp-\WixSharp.dll	rundll32.exe
File created	C:\Windows\Tasks\{C7F62CED-6EB6-47D5-9ED4-6805B4DB26A1}.job	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSI7761.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5C88.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6F46.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7E7E.tmp-\VirtualBoxSetup.exe	rundll32.exe
File opened for modification	C:\Windows\Installer\MSICCDE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF253.tmp-\VirtualBoxSetup.exe	rundll32.exe
File created	C:\Windows\Installer\e57fc36.msi	msiexec.exe
File created	C:\Windows\Installer\e57fc3b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5C88.tmp-\VirtualBoxSetup.exe	rundll32.exe
File opened for modification	C:\Windows\Installer\MSID79E.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIDEC5.tmp-\WixSharp.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIEB9A.tmp-\WixSharp.dll	rundll32.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI854E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5497.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI58DE.tmp-\WixSharp.UI.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIDC24.tmp-\VirtualBoxSetup.exe	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI7E7E.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSID9C2.tmp-\VirtualBoxSetup.pdb	rundll32.exe
File created	C:\Windows\Installer\e57fc32.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2DFA.tmp	msiexec.exe
File created	C:\Windows\Installer\e57fc37.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5497.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI5497.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI58DE.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIDC24.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIDEC5.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\{0CD5AE2D-BB58-4E35-8B5C-AFE9A8E8BE1A}\app_icon.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2A4D.tmp-\CustomAction.config	rundll32.exe
File created	C:\Windows\Installer\e57fc40.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57fc41.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5497.tmp-\WixSharp.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSICCDE.tmp-\WixSharp.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIE55E.tmp-\WixSharp.UI.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIE8D9.tmp-\WixSharp.dll	rundll32.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5320	sc.exe
3920	sc.exe
3724	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000754718877b32d5760000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000754718870000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d012000000000000000032000000ffffffff00000000070001000068090075471887000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01232000000000020ed0d000000ffffffff00000000070001000068091975471887000000000000d0123200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000007547188700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
6036	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 11 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Capabilities	ie4uinit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\BrowserEmulation\CVListTTL = "0"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Capabilities	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	ie4uinit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Capabilities\Hidden = "0"	ie4uinit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\BrowserEmulation\CVListTTL = "0"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Internet Explorer\Main	ie4uinit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Capabilities\Hidden = "0"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Internet Explorer\Main	ie4uinit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\OperationalData = "12"	ie4uinit.exe

Modifies data under HKEY_USERS 24 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	InstallUtil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	InstallUtil.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4D56E7AC803733AEB63F6B8217F4BE35DFE6C42E	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4D56E7AC803733AEB63F6B8217F4BE35DFE6C42E\Blob = 0300000001000000140000004d56e7ac803733aeb63f6b8217f4be35dfe6c42e20000000010000007c0500003082057830820460a0030201020210019549f3e9c1fd841c29b1f2c2bdd013300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b446967694365727420455620436f6465205369676e696e67204341301e170d3138303230313030303030305a170d3139303132343132303030305a3081ab31133011060b2b0601040182373c02010313025647311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e3110300e0603550405130731383137383033310b30090603550406130256473112301006035504071309526f616420546f776e3120301e060355040a131749726f6e20456e7465727461696e6d656e7420496e632e3120301e0603550403131749726f6e20456e7465727461696e6d656e7420496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100a69529c8ded2a23c241b5d3223350310da8bc4c1e27e4f38de191a07c5c3e54105693aa3ecda48b1a6be745a22f6d2617e99ee326e2ee0aff2d2fb01d02a3c2aa03b0a9048d0ada52e6bce2dff81d755729ac88e1818c2665fd9007e9036b0b44a29cbfe4717c0fbbf4370768fe22f37c8be5367db93801592886db3031f7e6a67a36187480957700863fd585152c1b47c4ee0a425533fb659f96b3c826e2a3b43d83e182d06d1eaded7f282b4b375b66ec18ad6e2c2612075644ae549112d938f62647c8904720c810976bf982fb27d0b32674f36945d4515f357616429bfba6975b141c22b59ab705d063aecd315a67fd29ddef8ee550acee03e4ab3b256ff0203010001a38201db308201d7301f0603551d23041830168014ad690670fc801b16b3a918946b9402865ef7278c301d0603551d0e04160414ecafaebf1f8d1389e1c8a95226a9938391dcf69130250603551d11041e301ca01a06082b06010505070803a00e300c0c0a56472d31383137383033300e0603551d0f0101ff04040302078030130603551d25040c300a06082b0601050507030330730603551d1f046c306a3033a031a02f862d687474703a2f2f63726c332e64696769636572742e636f6d2f4556436f64655369676e696e672d67312e63726c3033a031a02f862d687474703a2f2f63726c342e64696769636572742e636f6d2f4556436f64655369676e696e672d67312e63726c304b0603551d2004443042303706096086480186fd6c0302302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f4350533007060567810c0103307906082b06010505070101046d306b302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304306082b060105050730028637687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572744556436f64655369676e696e6743412e637274300c0603551d130101ff04023000300d06092a864886f70d01010505000382010100a8590e5af448e75c68937d3c422d3edf1fe3e34f7cb11190a01bfd96c8c1b9c35a473e310ea84296fba0025a747f6247a3d87f2fdbf4a605897c4664567428eb2587b24cbcbb98e73f297bb94470e9d9332d490c5991be31835da48d9d0ff75d15107a81e1779acfc716f41d502c75527e0f2014e8af38de3f051fe2dc0e0dc0582d0f85c87d489e5608fa62044ea83503931b7016675d90f1f56e161d2ec066cd3147239c120eea6b1386f254a4d83d83f4d907652a1e9b3d36d88d21b9af7e5db8bf412e333b503d23b23144b0b0c219435182674e9d503984f820d374707031daed98ed8c44b9d540ab8cd94cab9991d72c5e6518db258236dc44eacb5305	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	InstallUtil.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	InstallUtil.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	InstallUtil.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	InstallUtil.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CTLs	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133341827211971468"	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	InstallUtil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\E74B8BC01BC843C34D710E29DE0411564BADC2F2	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\E74B8BC01BC843C34D710E29DE0411564BADC2F2\Blob = 030000000100000014000000e74b8bc01bc843c34d710e29de0411564badc2f22000000001000000900500003082058c30820474a00302010202100d7b87bf9200d82906f619b5ee6c603f300d06092a864886f70d01010b0500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b302906035504031322446967694365727420455620436f6465205369676e696e6720434120285348413229301e170d3137303731343030303030305a170d3138303731383132303030305a3081ab31133011060b2b0601040182373c02010313025647311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e3110300e0603550405130731383137383033310b30090603550406130256473112301006035504071309526f616420546f776e3120301e060355040a131749726f6e20456e7465727461696e6d656e7420496e632e3120301e0603550403131749726f6e20456e7465727461696e6d656e7420496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100adccd719ce3b4f84d425e2b3dbbf3273f8367a02e55980fb8b12d0ec202c5bbc0d40ed46059f647e65139a82317acf7f6c441043d6143f8e23097502d3c6ea25255b91fd27949261f4eac63539b1435624791be516dbf3e5d5803fd396a07c238e7c3a7e7be480b8f1e36a08d4fb7ff1ef640c7a6f00904dd3fb5f96ef5f4e7e47baeeed47bdf254fee13bf4a4e72ce5eb7451ae0cf675ad9d19dfed29621f3cc64b3bcdd7dca22b601c39ea6039603128748b1ab4acd40d3d4f53a41a862687424a55e2a56ede2909a81b695cdc2f6e16dc54864eab896765a75d10c0d156156029c91ac22daa455c8d1b853d4a330fce0de6c83b9ad632646509889134d6930203010001a38201e8308201e4301f0603551d230418301680148fe87ef06d326a000523c770976a3a90ff6bead4301d0603551d0e041604149709754f51dc8fa3bf2e4540e443dc015d8816ca30250603551d11041e301ca01a06082b06010505070803a00e300c0c0a56472d31383137383033300e0603551d0f0101ff04040302078030130603551d25040c300a06082b06010505070303307b0603551d1f047430723037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c3037a035a0338631687474703a2f2f63726c342e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c304b0603551d2004443042303706096086480186fd6c0302302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f4350533007060567810c0103307e06082b0601050507010104723070302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304806082b06010505073002863c687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572744556436f64655369676e696e6743412d534841322e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820101002f9a80a913a1d71b909c639c165ca1603d5ce7fdac7b50a4eb5d18d334d2f9d35cda3aea2e9239994a6910e122d312ad9211aebc525b54d6b480bdc1c969ff237aae64718cc06ddc194bfd735794d9d889019c1903ef81fbb1eb993aae57ef2dd9665b8a4e8265e15da21281a6526dee2c183e84c696f40a9072df9bfe5c878f3fbbc6826c780a136b05d4f97aa21c671e0a0b58f36be031a532979fbb57879b7772c50cb394ce0ea1e6688936168621ce55f9c83a7589a501d67cdd75616748aa6524f0c0867971b56b73f1e5beb3f6e4341dc6d7f4acac6f0438317b0e6d3c35116f7d9c3a2d401ff79579d791621a3500525bf068199d2ecb0c77040a9d28	rundll32.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	InstallUtil.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	InstallUtil.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	InstallUtil.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\rlogin\FriendlyTypeName = "@C:\\Windows\\system32\\ieframe.dll,-908"	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C555FED4-F6C2-11E7-AEB4-080027376349}\TypeLib\Version = "1.3"	MobiVBoxSVC.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C5E0873E-F6C2-11E7-AEB4-080027376349}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C5D228B0-F6C2-11E7-AEB4-080027376349}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MobiVBoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C5DEC84A-F6C2-11E7-AEB4-080027376349}\TypeLib\Version = "1.3"	MobiVBoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\http\DefaultIcon	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4A9DF5A-F6C2-11E7-AEB4-080027376349}\TypeLib\ = "{C39F7A20-F6C2-11E7-AEB4-080027376349}"	MobiVBoxSVC.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c5e23f7a-f6c2-11e7-aeb4-080027376349}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C4A9DF5A-F6C2-11E7-AEB4-080027376349}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C5D5C880-F6C2-11E7-AEB4-080027376349}	MobiVBoxSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.Website\EditFlags = "131074"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C5343D9E-F6C2-11E7-AEB4-080027376349}	MobiVBoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2EA5DC085BB53E4B8C5FA9E8A8EEBA1	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C52E62A2-F6C2-11E7-AEB4-080027376349}\TypeLib	MobiVBoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C459344C-F6C2-11E7-AEB4-080027376349}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MobiVBoxSVC.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C5D48E52-F6C2-11E7-AEB4-080027376349}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C5269BDA-F6C2-11E7-AEB4-080027376349}\TypeLib	MobiVBoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C59D712E-F6C2-11E7-AEB4-080027376349}\ProxyStubClsid32	MobiVBoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C5BD023C-F6C2-11E7-AEB4-080027376349}\TypeLib\Version = "1.3"	MobiVBoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C5C2F39A-F6C2-11E7-AEB4-080027376349}	MobiVBoxSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D2EA5DC085BB53E4B8C5FA9E8A8EEBA1\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mhtml\Content Type = "message/rfc822"	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C5599134-F6C2-11E7-AEB4-080027376349}\ = "IUSBController"	MobiVBoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C5C144FA-F6C2-11E7-AEB4-080027376349}\TypeLib\Version = "1.3"	MobiVBoxSVC.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C5A2AFB8-F6C2-11E7-AEB4-080027376349}\TypeLib	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4AE6912-F6C2-11E7-AEB4-080027376349}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xhtml\OpenWithProgIds	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\open\ = "Open in S&ame Window"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C5D2BFFA-F6C2-11E7-AEB4-080027376349}	MobiVBoxSVC.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C5B87F82-F6C2-11E7-AEB4-080027376349}\TypeLib	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C5B87F82-F6C2-11E7-AEB4-080027376349}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C4D91CF2-F6C2-11E7-AEB4-080027376349}	MobiVBoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C58CEC78-F6C2-11E7-AEB4-080027376349}\ = "IPerformanceCollector"	MobiVBoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C5BC3A5A-F6C2-11E7-AEB4-080027376349}\TypeLib	MobiVBoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C5C4A118-F6C2-11E7-AEB4-080027376349}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MobiVBoxSVC.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C5CBF030-F6C2-11E7-AEB4-080027376349}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C470B59A-F6C2-11E7-AEB4-080027376349}\ = "IHost"	MobiVBoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C5B87F82-F6C2-11E7-AEB4-080027376349}	MobiVBoxSVC.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C5599134-F6C2-11E7-AEB4-080027376349}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mailto\shell\open	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C59D712E-F6C2-11E7-AEB4-080027376349}\TypeLib\ = "{C39F7A20-F6C2-11E7-AEB4-080027376349}"	MobiVBoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C5C36780-F6C2-11E7-AEB4-080027376349}\ProxyStubClsid32	MobiVBoxSVC.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C5C9C79C-F6C2-11E7-AEB4-080027376349}\TypeLib	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C5CF2480-F6C2-11E7-AEB4-080027376349}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C5D786C0-F6C2-11E7-AEB4-080027376349}\ProxyStubClsid32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\shell\Open\ddeexec	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C5AFE8D6-F6C2-11E7-AEB4-080027376349}\TypeLib	MobiVBoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C59E6D04-F6C2-11E7-AEB4-080027376349}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MobiVBoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C5BA062C-F6C2-11E7-AEB4-080027376349}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MobiVBoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C5CE4AE2-F6C2-11E7-AEB4-080027376349}\TypeLib\Version = "1.3"	MobiVBoxSVC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C5CFDDBC-F6C2-11E7-AEB4-080027376349}	MobiVBoxSVC.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C59CDC78-F6C2-11E7-AEB4-080027376349}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C3F3D0A2-F6C2-11E7-AEB4-080027376349}\TypeLib	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\opennew	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C5B37C12-F6C2-11E7-AEB4-080027376349}\ProxyStubClsid32	MobiVBoxSVC.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C459344C-F6C2-11E7-AEB4-080027376349}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C5D5C880-F6C2-11E7-AEB4-080027376349}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c5e23f7a-f6c2-11e7-aeb4-080027376349}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C47CAE9A-F6C2-11E7-AEB4-080027376349}	MobiVBoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C54026FE-F6C2-11E7-AEB4-080027376349}\TypeLib\Version = "1.3"	MobiVBoxSVC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C5460592-F6C2-11E7-AEB4-080027376349}\ = "ISerialPort"	MobiVBoxSVC.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C5C08D94-F6C2-11E7-AEB4-080027376349}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\open\ = "Open in S&ame Window"	ie4uinit.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4D56E7AC803733AEB63F6B8217F4BE35DFE6C42E	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4D56E7AC803733AEB63F6B8217F4BE35DFE6C42E\Blob = 0300000001000000140000004d56e7ac803733aeb63f6b8217f4be35dfe6c42e20000000010000007c0500003082057830820460a0030201020210019549f3e9c1fd841c29b1f2c2bdd013300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b446967694365727420455620436f6465205369676e696e67204341301e170d3138303230313030303030305a170d3139303132343132303030305a3081ab31133011060b2b0601040182373c02010313025647311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e3110300e0603550405130731383137383033310b30090603550406130256473112301006035504071309526f616420546f776e3120301e060355040a131749726f6e20456e7465727461696e6d656e7420496e632e3120301e0603550403131749726f6e20456e7465727461696e6d656e7420496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100a69529c8ded2a23c241b5d3223350310da8bc4c1e27e4f38de191a07c5c3e54105693aa3ecda48b1a6be745a22f6d2617e99ee326e2ee0aff2d2fb01d02a3c2aa03b0a9048d0ada52e6bce2dff81d755729ac88e1818c2665fd9007e9036b0b44a29cbfe4717c0fbbf4370768fe22f37c8be5367db93801592886db3031f7e6a67a36187480957700863fd585152c1b47c4ee0a425533fb659f96b3c826e2a3b43d83e182d06d1eaded7f282b4b375b66ec18ad6e2c2612075644ae549112d938f62647c8904720c810976bf982fb27d0b32674f36945d4515f357616429bfba6975b141c22b59ab705d063aecd315a67fd29ddef8ee550acee03e4ab3b256ff0203010001a38201db308201d7301f0603551d23041830168014ad690670fc801b16b3a918946b9402865ef7278c301d0603551d0e04160414ecafaebf1f8d1389e1c8a95226a9938391dcf69130250603551d11041e301ca01a06082b06010505070803a00e300c0c0a56472d31383137383033300e0603551d0f0101ff04040302078030130603551d25040c300a06082b0601050507030330730603551d1f046c306a3033a031a02f862d687474703a2f2f63726c332e64696769636572742e636f6d2f4556436f64655369676e696e672d67312e63726c3033a031a02f862d687474703a2f2f63726c342e64696769636572742e636f6d2f4556436f64655369676e696e672d67312e63726c304b0603551d2004443042303706096086480186fd6c0302302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f4350533007060567810c0103307906082b06010505070101046d306b302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304306082b060105050730028637687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572744556436f64655369676e696e6743412e637274300c0603551d130101ff04023000300d06092a864886f70d01010505000382010100a8590e5af448e75c68937d3c422d3edf1fe3e34f7cb11190a01bfd96c8c1b9c35a473e310ea84296fba0025a747f6247a3d87f2fdbf4a605897c4664567428eb2587b24cbcbb98e73f297bb94470e9d9332d490c5991be31835da48d9d0ff75d15107a81e1779acfc716f41d502c75527e0f2014e8af38de3f051fe2dc0e0dc0582d0f85c87d489e5608fa62044ea83503931b7016675d90f1f56e161d2ec066cd3147239c120eea6b1386f254a4d83d83f4d907652a1e9b3d36d88d21b9af7e5db8bf412e333b503d23b23144b0b0c219435182674e9d503984f820d374707031daed98ed8c44b9d540ab8cd94cab9991d72c5e6518db258236dc44eacb5305	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\E74B8BC01BC843C34D710E29DE0411564BADC2F2	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\E74B8BC01BC843C34D710E29DE0411564BADC2F2\Blob = 030000000100000014000000e74b8bc01bc843c34d710e29de0411564badc2f22000000001000000900500003082058c30820474a00302010202100d7b87bf9200d82906f619b5ee6c603f300d06092a864886f70d01010b0500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b302906035504031322446967694365727420455620436f6465205369676e696e6720434120285348413229301e170d3137303731343030303030305a170d3138303731383132303030305a3081ab31133011060b2b0601040182373c02010313025647311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e3110300e0603550405130731383137383033310b30090603550406130256473112301006035504071309526f616420546f776e3120301e060355040a131749726f6e20456e7465727461696e6d656e7420496e632e3120301e0603550403131749726f6e20456e7465727461696e6d656e7420496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100adccd719ce3b4f84d425e2b3dbbf3273f8367a02e55980fb8b12d0ec202c5bbc0d40ed46059f647e65139a82317acf7f6c441043d6143f8e23097502d3c6ea25255b91fd27949261f4eac63539b1435624791be516dbf3e5d5803fd396a07c238e7c3a7e7be480b8f1e36a08d4fb7ff1ef640c7a6f00904dd3fb5f96ef5f4e7e47baeeed47bdf254fee13bf4a4e72ce5eb7451ae0cf675ad9d19dfed29621f3cc64b3bcdd7dca22b601c39ea6039603128748b1ab4acd40d3d4f53a41a862687424a55e2a56ede2909a81b695cdc2f6e16dc54864eab896765a75d10c0d156156029c91ac22daa455c8d1b853d4a330fce0de6c83b9ad632646509889134d6930203010001a38201e8308201e4301f0603551d230418301680148fe87ef06d326a000523c770976a3a90ff6bead4301d0603551d0e041604149709754f51dc8fa3bf2e4540e443dc015d8816ca30250603551d11041e301ca01a06082b06010505070803a00e300c0c0a56472d31383137383033300e0603551d0f0101ff04040302078030130603551d25040c300a06082b06010505070303307b0603551d1f047430723037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c3037a035a0338631687474703a2f2f63726c342e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c304b0603551d2004443042303706096086480186fd6c0302302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f4350533007060567810c0103307e06082b0601050507010104723070302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304806082b06010505073002863c687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572744556436f64655369676e696e6743412d534841322e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820101002f9a80a913a1d71b909c639c165ca1603d5ce7fdac7b50a4eb5d18d334d2f9d35cda3aea2e9239994a6910e122d312ad9211aebc525b54d6b480bdc1c969ff237aae64718cc06ddc194bfd735794d9d889019c1903ef81fbb1eb993aae57ef2dd9665b8a4e8265e15da21281a6526dee2c183e84c696f40a9072df9bfe5c878f3fbbc6826c780a136b05d4f97aa21c671e0a0b58f36be031a532979fbb57879b7772c50cb394ce0ea1e6688936168621ce55f9c83a7589a501d67cdd75616748aa6524f0c0867971b56b73f1e5beb3f6e4341dc6d7f4acac6f0438317b0e6d3c35116f7d9c3a2d401ff79579d791621a3500525bf068199d2ecb0c77040a9d28	rundll32.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
112	powershell.exe
112	powershell.exe
852	powershell.exe
852	powershell.exe
3400	powershell.exe
3400	powershell.exe
2784	msedge.exe
2784	msedge.exe
1844	msedge.exe
1844	msedge.exe
4128	powershell.exe
4128	powershell.exe
4128	powershell.exe
2216	powershell.exe
2216	powershell.exe
2216	powershell.exe
4908	msiexec.exe
4908	msiexec.exe
3316	powershell.exe
3316	powershell.exe
3316	powershell.exe
5352	powershell.exe
5352	powershell.exe
5352	powershell.exe
5700	powershell.exe
5700	powershell.exe
5700	powershell.exe
6028	powershell.exe
6028	powershell.exe
6028	powershell.exe
5156	powershell.exe
5156	powershell.exe
5156	powershell.exe
4112	powershell.exe
4112	powershell.exe
4112	powershell.exe
5156	powershell.exe
5684	powershell.exe
5684	powershell.exe
5684	powershell.exe
5180	powershell.exe
5180	powershell.exe
5180	powershell.exe
5760	MsiExec.exe
5760	MsiExec.exe
5760	MsiExec.exe
5760	MsiExec.exe
4908	msiexec.exe
4908	msiexec.exe
3424	powershell.exe
3424	powershell.exe
3424	powershell.exe
6084	powershell.exe
6084	powershell.exe
6084	powershell.exe
4300	powershell.exe
4300	powershell.exe
4300	powershell.exe
3024	powershell.exe
3024	powershell.exe
5140	powershell.exe
5140	powershell.exe
3024	powershell.exe
5140	powershell.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
668	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3956	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3956	msiexec.exe
Token: SeSecurityPrivilege	4908	msiexec.exe
Token: SeCreateTokenPrivilege	3956	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3956	msiexec.exe
Token: SeLockMemoryPrivilege	3956	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3956	msiexec.exe
Token: SeMachineAccountPrivilege	3956	msiexec.exe
Token: SeTcbPrivilege	3956	msiexec.exe
Token: SeSecurityPrivilege	3956	msiexec.exe
Token: SeTakeOwnershipPrivilege	3956	msiexec.exe
Token: SeLoadDriverPrivilege	3956	msiexec.exe
Token: SeSystemProfilePrivilege	3956	msiexec.exe
Token: SeSystemtimePrivilege	3956	msiexec.exe
Token: SeProfSingleProcessPrivilege	3956	msiexec.exe
Token: SeIncBasePriorityPrivilege	3956	msiexec.exe
Token: SeCreatePagefilePrivilege	3956	msiexec.exe
Token: SeCreatePermanentPrivilege	3956	msiexec.exe
Token: SeBackupPrivilege	3956	msiexec.exe
Token: SeRestorePrivilege	3956	msiexec.exe
Token: SeShutdownPrivilege	3956	msiexec.exe
Token: SeDebugPrivilege	3956	msiexec.exe
Token: SeAuditPrivilege	3956	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3956	msiexec.exe
Token: SeChangeNotifyPrivilege	3956	msiexec.exe
Token: SeRemoteShutdownPrivilege	3956	msiexec.exe
Token: SeUndockPrivilege	3956	msiexec.exe
Token: SeSyncAgentPrivilege	3956	msiexec.exe
Token: SeEnableDelegationPrivilege	3956	msiexec.exe
Token: SeManageVolumePrivilege	3956	msiexec.exe
Token: SeImpersonatePrivilege	3956	msiexec.exe
Token: SeCreateGlobalPrivilege	3956	msiexec.exe
Token: SeCreateTokenPrivilege	3956	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3956	msiexec.exe
Token: SeLockMemoryPrivilege	3956	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3956	msiexec.exe
Token: SeMachineAccountPrivilege	3956	msiexec.exe
Token: SeTcbPrivilege	3956	msiexec.exe
Token: SeSecurityPrivilege	3956	msiexec.exe
Token: SeTakeOwnershipPrivilege	3956	msiexec.exe
Token: SeLoadDriverPrivilege	3956	msiexec.exe
Token: SeSystemProfilePrivilege	3956	msiexec.exe
Token: SeSystemtimePrivilege	3956	msiexec.exe
Token: SeProfSingleProcessPrivilege	3956	msiexec.exe
Token: SeIncBasePriorityPrivilege	3956	msiexec.exe
Token: SeCreatePagefilePrivilege	3956	msiexec.exe
Token: SeCreatePermanentPrivilege	3956	msiexec.exe
Token: SeBackupPrivilege	3956	msiexec.exe
Token: SeRestorePrivilege	3956	msiexec.exe
Token: SeShutdownPrivilege	3956	msiexec.exe
Token: SeDebugPrivilege	3956	msiexec.exe
Token: SeAuditPrivilege	3956	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3956	msiexec.exe
Token: SeChangeNotifyPrivilege	3956	msiexec.exe
Token: SeRemoteShutdownPrivilege	3956	msiexec.exe
Token: SeUndockPrivilege	3956	msiexec.exe
Token: SeSyncAgentPrivilege	3956	msiexec.exe
Token: SeEnableDelegationPrivilege	3956	msiexec.exe
Token: SeManageVolumePrivilege	3956	msiexec.exe
Token: SeImpersonatePrivilege	3956	msiexec.exe
Token: SeCreateGlobalPrivilege	3956	msiexec.exe
Token: SeCreateTokenPrivilege	3956	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3956	msiexec.exe
Token: SeLockMemoryPrivilege	3956	msiexec.exe

Suspicious use of FindShellTrayWindow 63 IoCs

pid	Process
3956	msiexec.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
3956	msiexec.exe
6044	setup_com.steam.687750_flow6mkt_44234475.exe
1844	msedge.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe

Suspicious use of SendNotifyMessage 56 IoCs

pid	Process
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4216	sysinfo-app.exe
6044	setup_com.steam.687750_flow6mkt_44234475.exe
6044	setup_com.steam.687750_flow6mkt_44234475.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 3084	4908	msiexec.exe	87
PID 4908 wrote to memory of 3084	4908	msiexec.exe	87
PID 4908 wrote to memory of 3084	4908	msiexec.exe	87
PID 3084 wrote to memory of 112	3084	MsiExec.exe	88
PID 3084 wrote to memory of 112	3084	MsiExec.exe	88
PID 3084 wrote to memory of 112	3084	MsiExec.exe	88
PID 3084 wrote to memory of 852	3084	MsiExec.exe	95
PID 3084 wrote to memory of 852	3084	MsiExec.exe	95
PID 3084 wrote to memory of 852	3084	MsiExec.exe	95
PID 3084 wrote to memory of 3400	3084	MsiExec.exe	99
PID 3084 wrote to memory of 3400	3084	MsiExec.exe	99
PID 3084 wrote to memory of 3400	3084	MsiExec.exe	99
PID 3956 wrote to memory of 1844	3956	msiexec.exe	102
PID 3956 wrote to memory of 1844	3956	msiexec.exe	102
PID 1844 wrote to memory of 408	1844	msedge.exe	103
PID 1844 wrote to memory of 408	1844	msedge.exe	103
PID 1844 wrote to memory of 4316	1844	msedge.exe	105
PID 1844 wrote to memory of 4316	1844	msedge.exe	105
PID 1844 wrote to memory of 4316	1844	msedge.exe	105
PID 1844 wrote to memory of 4316	1844	msedge.exe	105
PID 1844 wrote to memory of 4316	1844	msedge.exe	105
PID 1844 wrote to memory of 4316	1844	msedge.exe	105
PID 1844 wrote to memory of 4316	1844	msedge.exe	105
PID 1844 wrote to memory of 4316	1844	msedge.exe	105
PID 1844 wrote to memory of 4316	1844	msedge.exe	105
PID 1844 wrote to memory of 4316	1844	msedge.exe	105
PID 1844 wrote to memory of 4316	1844	msedge.exe	105
PID 1844 wrote to memory of 4316	1844	msedge.exe	105
PID 1844 wrote to memory of 4316	1844	msedge.exe	105
PID 1844 wrote to memory of 4316	1844	msedge.exe	105
PID 1844 wrote to memory of 4316	1844	msedge.exe	105
PID 1844 wrote to memory of 4316	1844	msedge.exe	105
PID 1844 wrote to memory of 4316	1844	msedge.exe	105
PID 1844 wrote to memory of 4316	1844	msedge.exe	105
PID 1844 wrote to memory of 4316	1844	msedge.exe	105
PID 1844 wrote to memory of 4316	1844	msedge.exe	105
PID 1844 wrote to memory of 4316	1844	msedge.exe	105
PID 1844 wrote to memory of 4316	1844	msedge.exe	105
PID 1844 wrote to memory of 4316	1844	msedge.exe	105
PID 1844 wrote to memory of 4316	1844	msedge.exe	105
PID 1844 wrote to memory of 4316	1844	msedge.exe	105
PID 1844 wrote to memory of 4316	1844	msedge.exe	105
PID 1844 wrote to memory of 4316	1844	msedge.exe	105
PID 1844 wrote to memory of 4316	1844	msedge.exe	105
PID 1844 wrote to memory of 4316	1844	msedge.exe	105
PID 1844 wrote to memory of 4316	1844	msedge.exe	105
PID 1844 wrote to memory of 4316	1844	msedge.exe	105
PID 1844 wrote to memory of 4316	1844	msedge.exe	105
PID 1844 wrote to memory of 4316	1844	msedge.exe	105
PID 1844 wrote to memory of 4316	1844	msedge.exe	105
PID 1844 wrote to memory of 4316	1844	msedge.exe	105
PID 1844 wrote to memory of 4316	1844	msedge.exe	105
PID 1844 wrote to memory of 4316	1844	msedge.exe	105
PID 1844 wrote to memory of 4316	1844	msedge.exe	105
PID 1844 wrote to memory of 4316	1844	msedge.exe	105
PID 1844 wrote to memory of 4316	1844	msedge.exe	105
PID 1844 wrote to memory of 2784	1844	msedge.exe	104
PID 1844 wrote to memory of 2784	1844	msedge.exe	104
PID 1844 wrote to memory of 4248	1844	msedge.exe	106
PID 1844 wrote to memory of 4248	1844	msedge.exe	106
PID 1844 wrote to memory of 4248	1844	msedge.exe	106
PID 1844 wrote to memory of 4248	1844	msedge.exe	106
PID 1844 wrote to memory of 4248	1844	msedge.exe	106
PID 1844 wrote to memory of 4248	1844	msedge.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\com.steam.687750_installer_44234475.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://atlasox.s3.amazonaws.com/bbwc/eula.html
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb7f0f46f8,0x7ffb7f0f4708,0x7ffb7f0f4718
    3⤵
    PID:408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,18112535091826189947,479140142547191431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,18112535091826189947,479140142547191431,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
    3⤵
    PID:4316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,18112535091826189947,479140142547191431,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
    3⤵
    PID:4248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18112535091826189947,479140142547191431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
    3⤵
    PID:4708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18112535091826189947,479140142547191431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:1
    3⤵
    PID:3364
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,18112535091826189947,479140142547191431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5936 /prefetch:8
    3⤵
    PID:1776
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,18112535091826189947,479140142547191431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5936 /prefetch:8
    3⤵
    PID:744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18112535091826189947,479140142547191431,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
    3⤵
    PID:5580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18112535091826189947,479140142547191431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
    3⤵
    PID:5240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18112535091826189947,479140142547191431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
    3⤵
    PID:5768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18112535091826189947,479140142547191431,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1856 /prefetch:1
    3⤵
    PID:1492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,18112535091826189947,479140142547191431,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3920 /prefetch:2
    3⤵
    PID:5616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18112535091826189947,479140142547191431,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
    3⤵
    PID:2240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18112535091826189947,479140142547191431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4484 /prefetch:1
    3⤵
    PID:5260

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E4695C848A4A178A5D43455E244E3886 C
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:3084
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss8D5D.tmp.ps1"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:112
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssAA8E.tmp.ps1"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:852
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssBA03.tmp.ps1"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:3400
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Eclipse Media Inc\Installer Assistant\prerequisites\WCSetupv1.11.1052.27169.msi" /q
    3⤵
    PID:4232
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Eclipse Media Inc\Installer Assistant\prerequisites\BAv1411600.msi" /q
    3⤵
    PID:3556
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Eclipse Media Inc\Installer Assistant\prerequisites\BESetupv1.10.162.23111.msi" /q
    3⤵
    PID:5736
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssFD12.tmp.ps1"
    3⤵
    - Blocklisted process makes network request
    PID:3984
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssE2D.tmp.ps1"
    3⤵
    PID:4268
  - - C:\Users\Admin\AppData\Local\Temp\setup_com.steam.687750_flow6mkt_44234475.exe
      "C:\Users\Admin\AppData\Local\Temp\setup_com.steam.687750_flow6mkt_44234475.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:624
    - - C:\Users\Admin\AppData\Local\Temp\pcgame_81ECF0B3\setup_com.steam.687750_flow6mkt_44234475.exe
        
        "C:\Users\Admin\AppData\Local\Temp\pcgame_81ECF0B3\setup_com.steam.687750_flow6mkt_44234475.exe" /app "C:\Users\Admin\AppData\Local\MobiGame\\"
        5⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:6044
      - C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\pcgame_81ECF0B3\utils\sysinfo-app.exe"
        6⤵
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\pcgame_81ECF0B3\utils\sysinfo-app.exe
        
        C:\Users\Admin\AppData\Local\Temp\pcgame_81ECF0B3\utils\sysinfo-app.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4216
      - C:\Users\Admin\AppData\Local\Temp\pcgame_81ECF0B3\MobiHelper.exe
        
        "MobiHelper.exe" --install-path="C:\Program Files\MobiGame" --desktop-path="C:\Users\Admin\Desktop" --local-app-data-path="C:\Users\Admin\AppData\Local\MobiGame" --parent="C:\Users\Admin\AppData\Local\Temp\pcgame_81ECF0B3\setup_com.steam.687750_flow6mkt_44234475.exe" --playstore-json-file-path="C:\Users\Admin\AppData\Local\MobiGame\playstore.json" --google-analytics-id="44234475" --create-playstore-shortcut --api-url="https://gamestore30.emu.codes" --source="flow6mkt"
        6⤵
        Executes dropped EXE
        
        PID:5248
        
        C:\Windows\system32\ie4uinit.exe
        
        "C:\Windows\system32\ie4uinit.exe" -show
        7⤵
        Modifies Installed Components in the registry
        Registers COM server for autorun
        Modifies Internet Explorer settings
        Modifies registry class
        
        PID:5640
      - C:\Windows\system32\ie4uinit.exe
        
        "C:\Windows\system32\ie4uinit.exe" -show
        6⤵
        Modifies Installed Components in the registry
        Registers COM server for autorun
        Modifies Internet Explorer settings
        Modifies registry class
        
        PID:2352
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 0A1730B4DD9E403B28676266FBEBFC6C
  2⤵
  - Loads dropped DLL
  PID:5032
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssFF51.tmp.ps1"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:4128
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssCE2.tmp.ps1"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2216
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss1A34.tmp.ps1"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:3316
  - - C:\Users\Admin\AppData\Roaming\BBWC\7za.exe
      "C:\Users\Admin\AppData\Roaming/BBWC/7za.exe" x WC.7z -y -p1.11.1052.27169
      4⤵
      Executes dropped EXE
      PID:5176
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss2489.tmp.ps1"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:5352
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss2F3B.tmp.ps1"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:5700
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss4018.tmp.ps1"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6028
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss5692.tmp.ps1"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4112
- C:\Windows\Installer\MSI3FEC.tmp
  "C:\Windows\Installer\MSI3FEC.tmp" /DontWait /HideWindow /dir "C:\Users\Admin\AppData\Roaming\BBWC\" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -noninteractive -ExecutionPolicy bypass -c "$w="$env:APPDATA"+'/BBWC/';[Reflection.Assembly]::Load([System.IO.File]::ReadAllBytes($w+'Newtonsoft.Json.dll'));[Reflection.Assembly]::Load([System.IO.File]::ReadAllBytes($w+'System.Data.SQLite.dll'));[Reflection.Assembly]::Load([System.IO.File]::ReadAllBytes($w+'ICSharpCode.SharpZipLib.dll'));[Reflection.Assembly]::Load([System.IO.File]::ReadAllBytes($w+'LZ4.dll'));$f=$w+'WC.txt';$h=Get-Content -Path $f -Raw;$h=Get-Content -Path $f -Raw;[byte[]]$bytes=($h -split '(.{2})' -ne '' -replace '^','0X');[Reflection.Assembly]::Load($bytes);[WebCompanion.StartUp]::Start()"
  2⤵
  - Executes dropped EXE
  PID:6008
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1DF3B4C9671B9330D67A974456375DBA
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:5760
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss661A.tmp.ps1"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:5684
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss6EE8.tmp.ps1"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5180
  - - C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /F /pid
      4⤵
      Kills process with taskkill
      PID:6036
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss8581.tmp.ps1"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:3424
  - - C:\Users\Admin\AppData\Roaming\Browser Assistant\7za.exe
      "C:\Users\Admin\AppData\Roaming/Browser Assistant/7za.exe" x Data2.7z -y -p1.41.1600.26808
      4⤵
      Executes dropped EXE
      PID:5724
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssC945.tmp.ps1"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:6084
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssD5EB.tmp.ps1"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:4300
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssE1E6.tmp.ps1"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:3024
- C:\Windows\Installer\MSIE1BA.tmp
  "C:\Windows\Installer\MSIE1BA.tmp" /DontWait /HideWindow /dir "C:\Users\Admin\AppData\Roaming\Browser Assistant\" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -noninteractive -ExecutionPolicy bypass -c "& ./edge/x86/node.exe ./edge/startup.js"
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1968A363DA5E24117C54465BBB5829D2
  2⤵
  - Loads dropped DLL
  PID:5996
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssEE84.tmp.ps1"
    3⤵
    - Blocklisted process makes network request
    PID:5132
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssFA30.tmp.ps1"
    3⤵
    PID:5832
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss35C.tmp.ps1"
    3⤵
    PID:5484
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss11D7.tmp.ps1"
    3⤵
    - Blocklisted process makes network request
    PID:5980
  - - C:\Users\Admin\AppData\Roaming\Browser Extension\7za.exe
      "C:\Users\Admin\AppData\Roaming/Browser Extension/7za.exe" x Data.7z -y -p1.10.162.23111
      4⤵
      Executes dropped EXE
      PID:5956
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss218A.tmp.ps1"
    3⤵
    - Blocklisted process makes network request
    PID:3540
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss2C7B.tmp.ps1"
    3⤵
    - Blocklisted process makes network request
    PID:5096
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss3931.tmp.ps1"
    3⤵
    PID:6120
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss47CC.tmp.ps1"
    3⤵
    PID:5408
- C:\Windows\Installer\MSI38FF.tmp
  "C:\Windows\Installer\MSI38FF.tmp" /DontWait /HideWindow /dir "C:\Users\Admin\AppData\Roaming\Browser Extension\" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy bypass -c "$w="$env:APPDATA"+'/Browser Extension/BE.txt';$h=Get-Content -Path $w -Raw;[byte[]]$bytes=($h -split '(.{2})' -ne '' -replace '^','0X');[Reflection.Assembly]::Load($bytes);[WebCompanion.BrowserExtension.S]::Start()"
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:5160
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A3A05D3F12099E3C77983DA057AFC871
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:5600
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssE3A2.tmp.ps1"
    3⤵
    - Blocklisted process makes network request
    PID:6080
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding C900A6C1BC427E042D9F1878AD325BF3
  2⤵
  PID:4056
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI5497.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240866578 545 WixSharp!WixSharp.ManagedProjectActions.WixSharp_InitRuntime_Action
    3⤵
    - Drops file in Windows directory
    PID:5840
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI58DE.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240867515 554 WixSharp!WixSharp.ManagedProjectActions.WixSharp_Load_Action
    3⤵
    - Drops file in Windows directory
    PID:5172
  - - C:\Windows\system32\cmd.exe
      "cmd.exe" /c set
      4⤵
      PID:1560
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI5C88.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240868437 575 VirtualBoxSetup!VirtualBoxSetup.CustomActions.SetSessionPropertiesFromConfig
    3⤵
    - Drops file in Windows directory
    PID:5304
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1EE98702AC42E2757BD47B4A13D5A7D9
  2⤵
  PID:5800
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 0E78E88E95EB5A8ABB6FD3685C3F6EA2 E Global\MSI0000
  2⤵
  PID:2496
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI7E7E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240877171 626 VirtualBoxSetup!VirtualBoxSetup.CustomActions.CloseProcessesAndUsedFiles
    3⤵
    - Drops file in Windows directory
    PID:1840
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI80B1.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240877750 633 VirtualBoxSetup!VirtualBoxSetup.CustomActions.DeletePlayStoreAutorun
    3⤵
    - Drops file in Windows directory
    PID:2252
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSICCDE.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240897203 637 VirtualBoxSetup!VirtualBoxSetup.CustomActions.CreatePlaystore
    3⤵
    - Blocklisted process makes network request
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    PID:3940
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSID52C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240899312 656 VirtualBoxSetup!VirtualBoxSetup.CustomActions.CreateRegistryForAegLauncher
    3⤵
    PID:5872
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSID79E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240899968 660 VirtualBoxSetup!VirtualBoxSetup.CustomActions.InstallCertificate
    3⤵
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Modifies system certificate store
    PID:5676
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSID9C2.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240900500 664 VirtualBoxSetup!VirtualBoxSetup.CustomActions.SaveSessionPropertiesToConfig
    3⤵
    - Drops file in Program Files directory
    - Drops file in Windows directory
    PID:2904
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIDC24.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240901109 672 VirtualBoxSetup!VirtualBoxSetup.CustomActions.SubstitutePath
    3⤵
    - Drops file in Program Files directory
    - Drops file in Windows directory
    PID:5404
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIDEC5.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240901781 689 VirtualBoxSetup!VirtualBoxSetup.CustomActions.InstallService
    3⤵
    - Drops file in Windows directory
    PID:2460
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe" "C:\Program Files\MobiGame\MobiGameUpdater.exe"
      4⤵
      Modifies data under HKEY_USERS
      PID:5452
  - - C:\Windows\system32\sc.exe
      "sc.exe" config MobiGameUpdater start= demand
      4⤵
      Launches sc.exe
      PID:5320
  - - C:\Program Files\MobiGame\utils\subinacl.exe
      "C:\Program Files\MobiGame\utils\subinacl.exe" /service MobiGameUpdater /grant=S-1-5-21-618519468-4027732583-1827558364-1000=F
      4⤵
      Executes dropped EXE
      PID:5540
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIE55E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240903484 702 VirtualBoxSetup!VirtualBoxSetup.CustomActions.InstallAegLauncherService
    3⤵
    - Drops file in Windows directory
    PID:1488
  - - C:\Program Files\MobiGame\aeg_launcher.exe
      "C:\Program Files\MobiGame\aeg_launcher.exe" -service=install
      4⤵
      Executes dropped EXE
      PID:4300
  - - C:\Windows\system32\sc.exe
      "sc.exe" config AegLauncher start= auto
      4⤵
      Launches sc.exe
      PID:3920
  - - C:\Program Files\MobiGame\utils\subinacl.exe
      "C:\Program Files\MobiGame\utils\subinacl.exe" /service AegLauncher /grant=S-1-5-21-618519468-4027732583-1827558364-1000=F
      4⤵
      Executes dropped EXE
      PID:1128
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIE8D9.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240904375 713 VirtualBoxSetup!VirtualBoxSetup.CustomActions.UpdateUninstallData
    3⤵
    - Drops file in Windows directory
    PID:5156
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIEB9A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240905093 722 VirtualBoxSetup!VirtualBoxSetup.CustomActions.RegisterCustomProtocol
    3⤵
    - Drops file in Windows directory
    PID:1512
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIF253.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240906828 731 VirtualBoxSetup!VirtualBoxSetup.CustomActions.InstallVirtualBox
    3⤵
    - Drops file in Windows directory
    PID:5704
  - - C:\Windows\system32\cmd.exe
      "cmd.exe" /c "C:\Program Files\MobiGame\vbox\register_services.cmd"
      4⤵
      PID:1404
    - - C:\Windows\system32\net.exe
        
        NET FILE
        5⤵
        
        PID:1776
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 FILE
        6⤵
        
        PID:940
    - - C:\Windows\syswow64\regsvr32.exe
        
        C:\Windows\syswow64\regsvr32 /s /u "C:\Program Files\MobiGame\vbox\x86\VBoxClient-x86.dll"
        5⤵
        
        PID:4024
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32 /s /u "C:\Program Files\MobiGame\vbox\VBoxC.dll"
        5⤵
        
        PID:4728
    - - C:\Program Files\MobiGame\vbox\MobiVBoxSVC.exe
        
        "C:\Program Files\MobiGame\vbox\MobiVBoxSVC.exe" /RegServer
        5⤵
        Executes dropped EXE
        Registers COM server for autorun
        Modifies registry class
        
        PID:2928
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32 /s "C:\Program Files\MobiGame\vbox\VBoxC.dll"
        5⤵
        Registers COM server for autorun
        
        PID:6048
    - - C:\Windows\syswow64\regsvr32.exe
        
        C:\Windows\syswow64\regsvr32 /s "C:\Program Files\MobiGame\vbox\x86\VBoxClient-x86.dll"
        5⤵
        Modifies registry class
        
        PID:2316
    - - C:\Program Files\MobiGame\vbox\SUPInstall.exe
        
        "C:\Program Files\MobiGame\vbox\\SUPInstall.exe"
        5⤵
        Executes dropped EXE
        
        PID:3428
    - - C:\Windows\system32\net.exe
        
        NET FILE
        5⤵
        
        PID:5464
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 FILE
        6⤵
        
        PID:5740
    - - C:\Windows\syswow64\regsvr32.exe
        
        C:\Windows\syswow64\regsvr32 /s /u "C:\Program Files\MobiGame\vbox\x86\VBoxClient-x86.dll"
        5⤵
        
        PID:3020
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32 /s /u "C:\Program Files\MobiGame\vbox\VBoxC.dll"
        5⤵
        Registers COM server for autorun
        Modifies registry class
        
        PID:5832
    - - C:\Program Files\MobiGame\vbox\MobiVBoxSVC.exe
        
        "C:\Program Files\MobiGame\vbox\MobiVBoxSVC.exe" /UnregServer
        5⤵
        Executes dropped EXE
        Registers COM server for autorun
        
        PID:5264
    - - C:\Program Files\MobiGame\vbox\NetLwfUninstall.exe
        
        "C:\Program Files\MobiGame\vbox\\NetLwfUninstall.exe"
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:5932
    - - C:\Program Files\MobiGame\vbox\USBUninstall.exe
        
        "C:\Program Files\MobiGame\vbox\\USBUninstall.exe"
        5⤵
        Executes dropped EXE
        
        PID:4312
    - - C:\Program Files\MobiGame\vbox\SUPUninstall.exe
        
        "C:\Program Files\MobiGame\vbox\\SUPUninstall.exe"
        5⤵
        Executes dropped EXE
        
        PID:3660
  - - C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" stop "MobiGameUpdater"
      4⤵
      Launches sc.exe
      PID:3724
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe" /u "C:\Program Files\MobiGame\MobiGameUpdater.exe"
      4⤵
      Modifies data under HKEY_USERS
      PID:5132
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI2A4D.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240921125 745 VirtualBoxSetup!VirtualBoxSetup.CustomActions.RemoveRegistryForAegLauncher
    3⤵
    - Drops file in Windows directory
    PID:688
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5187D4AFFB4E301E7DFDC346B1739731 E Global\MSI0000
  2⤵
  PID:5840

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1148

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noninteractive -ExecutionPolicy bypass -c "$w="$env:APPDATA"+'/BBWC/';[Reflection.Assembly]::Load([System.IO.File]::ReadAllBytes($w+'Newtonsoft.Json.dll'));[Reflection.Assembly]::Load([System.IO.File]::ReadAllBytes($w+'System.Data.SQLite.dll'));[Reflection.Assembly]::Load([System.IO.File]::ReadAllBytes($w+'ICSharpCode.SharpZipLib.dll'));[Reflection.Assembly]::Load([System.IO.File]::ReadAllBytes($w+'LZ4.dll'));$f=$w+'WC.txt';$h=Get-Content -Path $f -Raw;$h=Get-Content -Path $f -Raw;[byte[]]$bytes=($h -split '(.{2})' -ne '' -replace '^','0X');[Reflection.Assembly]::Load($bytes);[WebCompanion.StartUp]::Start()"
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:5156

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noninteractive -ExecutionPolicy bypass -c "& ./edge/x86/node.exe ./edge/startup.js"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:5140
- C:\Users\Admin\AppData\Roaming\Browser Assistant\edge\x86\node.exe
  "C:\Users\Admin\AppData\Roaming\Browser Assistant\edge\x86\node.exe" ./edge/startup.js
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3256
- - C:\Users\Admin\AppData\Roaming\Browser Assistant\7za.exe
    7za.exe e -so -p1.41.1600.26808 "C:\Users\Admin\AppData\Roaming\Browser Assistant\Driver.7z" BrowserAssistant.Driver.dll
    3⤵
    - Executes dropped EXE
    PID:5680

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy bypass -c "$w="$env:APPDATA"+'/Browser Extension/BE.txt';$h=Get-Content -Path $w -Raw;[byte[]]$bytes=($h -split '(.{2})' -ne '' -replace '^','0X');[Reflection.Assembly]::Load($bytes);[WebCompanion.BrowserExtension.S]::Start()"
1⤵
- Blocklisted process makes network request
PID:1632

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4168

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c
1⤵
PID:1760

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:5328

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5532

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffb7ee59758,0x7ffb7ee59768,0x7ffb7ee59778
  2⤵
  PID:4260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1820 --field-trial-handle=1840,i,18072368326985173182,16511379063838254025,131072 /prefetch:2
  2⤵
  PID:5672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=1840,i,18072368326985173182,16511379063838254025,131072 /prefetch:8
  2⤵
  PID:1816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2264 --field-trial-handle=1840,i,18072368326985173182,16511379063838254025,131072 /prefetch:8
  2⤵
  PID:4048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3224 --field-trial-handle=1840,i,18072368326985173182,16511379063838254025,131072 /prefetch:1
  2⤵
  PID:552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3236 --field-trial-handle=1840,i,18072368326985173182,16511379063838254025,131072 /prefetch:1
  2⤵
  PID:5808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4624 --field-trial-handle=1840,i,18072368326985173182,16511379063838254025,131072 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4772 --field-trial-handle=1840,i,18072368326985173182,16511379063838254025,131072 /prefetch:8
  2⤵
  PID:4688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4916 --field-trial-handle=1840,i,18072368326985173182,16511379063838254025,131072 /prefetch:8
  2⤵
  PID:4840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 --field-trial-handle=1840,i,18072368326985173182,16511379063838254025,131072 /prefetch:8
  2⤵
  PID:644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4652 --field-trial-handle=1840,i,18072368326985173182,16511379063838254025,131072 /prefetch:8
  2⤵
  PID:5708
- C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --reenable-autoupdates --system-level
  2⤵
  PID:5832
- - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x254,0x258,0x25c,0x230,0x260,0x7ff7684d7688,0x7ff7684d7698,0x7ff7684d76a8
    3⤵
    PID:5876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 --field-trial-handle=1840,i,18072368326985173182,16511379063838254025,131072 /prefetch:8
  2⤵
  PID:2936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5192 --field-trial-handle=1840,i,18072368326985173182,16511379063838254025,131072 /prefetch:1
  2⤵
  PID:2856

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:860

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Install Root Certificate

T1130

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery