hxxps://oxy[.]cloud/d/Bdqc

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E9526F9B-B449-4171-810F-E710946CA1FA}\LocalServer32	DiscSoftBusServicePro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A5415364-784A-41A5-B47A-D452909CA8FF}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2C7DDECF-7A8E-48A5-A744-8F45D20FB1A9}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2C7DDECF-7A8E-48A5-A744-8F45D20FB1A9}\InprocServer32\ = "C:\\Program Files\\DAEMON Tools Pro\\DTShl64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E9526F9B-B449-4171-810F-E710946CA1FA}\LocalServer32\ = "\"C:\\Program Files\\DAEMON Tools Pro\\DiscSoftBusServicePro.exe\""	DiscSoftBusServicePro.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E9526F9B-B449-4171-810F-E710946CA1FA}\LocalServer32\ServerExecutable = "C:\\Program Files\\DAEMON Tools Pro\\DiscSoftBusServicePro.exe"	DiscSoftBusServicePro.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A5415364-784A-41A5-B47A-D452909CA8FF}\InprocServer32\ = "C:\\Program Files\\DAEMON Tools Pro\\DTShl64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A5415364-784A-41A5-B47A-D452909CA8FF}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{40966797-8FFE-46C8-9EF8-7003F33CCF0F}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{40966797-8FFE-46C8-9EF8-7003F33CCF0F}\InprocServer32\ = "C:\\Program Files\\DAEMON Tools Pro\\DTShl64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{40966797-8FFE-46C8-9EF8-7003F33CCF0F}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2C7DDECF-7A8E-48A5-A744-8F45D20FB1A9}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DAEMON Tools Pro Agent = "\"C:\\Program Files\\DAEMON Tools Pro\\DTAgent.exe\" -autorun"	DTPro830-0749.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\U:	DTPro.exe
File opened (read-only)	\??\M:	DTPro.exe
File opened (read-only)	\??\P:	DTPro.exe
File opened (read-only)	\??\R:	DTPro.exe
File opened (read-only)	\??\O:	DTPro.exe
File opened (read-only)	\??\S:	DTPro.exe
File opened (read-only)	\??\T:	DTPro.exe
File opened (read-only)	\??\W:	DTPro.exe
File opened (read-only)	\??\X:	DTPro.exe
File opened (read-only)	\??\H:	DTPro.exe
File opened (read-only)	\??\J:	DTPro.exe
File opened (read-only)	\??\L:	DTPro.exe
File opened (read-only)	\??\Z:	DTPro.exe
File opened (read-only)	\??\V:	DTPro.exe
File opened (read-only)	\??\I:	DTPro.exe
File opened (read-only)	\??\K:	DTPro.exe
File opened (read-only)	\??\N:	DTPro.exe
File opened (read-only)	\??\Q:	DTPro.exe
File opened (read-only)	\??\Y:	DTPro.exe
File opened (read-only)	\??\D:	DTPro.exe
File opened (read-only)	\??\E:	DTPro.exe
File opened (read-only)	\??\G:	DTPro.exe

Drops file in System32 directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{d7c3847a-5416-e542-838b-27732b5eb776}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{d7c3847a-5416-e542-838b-27732b5eb776}\dtproscsibus.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{d7c3847a-5416-e542-838b-27732b5eb776}\SET6C7E.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{d7c3847a-5416-e542-838b-27732b5eb776}\SET6C7D.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{d7c3847a-5416-e542-838b-27732b5eb776}\SET6C7E.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\dtproscsibus.inf_amd64_4ee68020f2de7537\dtproscsibus.PNF	DiscSoftBusServicePro.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{d7c3847a-5416-e542-838b-27732b5eb776}\SET6C5C.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{d7c3847a-5416-e542-838b-27732b5eb776}\dtproscsibus.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\dtproscsibus.inf_amd64_4ee68020f2de7537\dtproscsibus.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{d7c3847a-5416-e542-838b-27732b5eb776}\dtproscsibus.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\dtproscsibus.inf_amd64_4ee68020f2de7537\dtproscsibus.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\dtproscsibus.inf_amd64_4ee68020f2de7537\dtproscsibus.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{d7c3847a-5416-e542-838b-27732b5eb776}\SET6C5C.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{d7c3847a-5416-e542-838b-27732b5eb776}\SET6C7D.tmp	DrvInst.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\DAEMON Tools Pro\Lang\ARA.dll	DTPro830-0749.exe
File opened for modification	C:\Program Files\DAEMON Tools Pro\Lang\CHT.dll	DTPro830-0749.exe
File opened for modification	C:\Program Files\DAEMON Tools Pro\Lang\HUN.dll	DTPro830-0749.exe
File opened for modification	C:\Program Files\DAEMON Tools Pro\Lang\HEB.dll	DTPro830-0749.exe
File opened for modification	C:\Program Files\DAEMON Tools Pro\Lang\JPN.dll	DTPro830-0749.exe
File created	C:\Program Files\DAEMON Tools Pro\Extractor.exe	DTPro830-0749.exe
File opened for modification	C:\Program Files\DAEMON Tools Pro\Lang\FIN.dll	DTPro830-0749.exe
File created	C:\Program Files\DAEMON Tools Pro\Lang\HEB.dll	DTPro830-0749.exe
File created	C:\Program Files\DAEMON Tools Pro\Lang\BIH.dll	DTPro830-0749.exe
File opened for modification	C:\Program Files\DAEMON Tools Pro\Lang\BIH.dll	DTPro830-0749.exe
File created	C:\Program Files\DAEMON Tools Pro\Lang\PTB.dll	DTPro830-0749.exe
File opened for modification	C:\Program Files\DAEMON Tools Pro\imgengine.dll	DTPro830-0749.exe
File opened for modification	C:\Program Files\DAEMON Tools Pro\DTPro.gadget	DTPro830-0749.exe
File created	C:\Program Files\DAEMON Tools Pro\DTShl.propdesc	DTPro830-0749.exe
File created	C:\Program Files\DAEMON Tools Pro\DTShl64.dll	DTPro830-0749.exe
File created	C:\Program Files\DAEMON Tools Pro\Lang\PLK.dll	DTPro830-0749.exe
File created	C:\Program Files\DAEMON Tools Pro\Lang\PTP.dll	DTPro830-0749.exe
File opened for modification	C:\Program Files\DAEMON Tools Pro\Extractor.exe	DTPro830-0749.exe
File opened for modification	C:\Program Files\DAEMON Tools Pro\Plugins\Grabbers\SafeDisc.dll	DTPro830-0749.exe
File opened for modification	C:\Program Files\DAEMON Tools Pro\InstallGadget.exe	DTPro830-0749.exe
File opened for modification	C:\Program Files\DAEMON Tools Pro\Lang\RUS.dll	DTPro830-0749.exe
File opened for modification	C:\Program Files\DAEMON Tools Pro\DTHelper.exe	DTPro830-0749.exe
File created	C:\Program Files\DAEMON Tools Pro\Lang\BGR.dll	DTPro830-0749.exe
File created	C:\Program Files\DAEMON Tools Pro\Lang\HUN.dll	DTPro830-0749.exe
File created	C:\Program Files\DAEMON Tools Pro\tmp	RegGen.exe
File created	C:\Program Files\DAEMON Tools Pro\sptdintf.dll	DTPro830-0749.exe
File opened for modification	C:\Program Files\DAEMON Tools Pro\Lang\KOR.dll	DTPro830-0749.exe
File created	C:\Program Files\DAEMON Tools Pro\Lang\RUS.dll	DTPro830-0749.exe
File opened for modification	C:\Program Files\DAEMON Tools Pro\Lang\UKR.dll	DTPro830-0749.exe
File created	C:\Program Files\DAEMON Tools Pro\DTAgent.exe	DTPro830-0749.exe
File opened for modification	C:\Program Files\DAEMON Tools Pro\Engine.dll	DTPro830-0749.exe
File opened for modification	C:\Program Files\DAEMON Tools Pro\Lang\SVE.dll	DTPro830-0749.exe
File created	C:\Program Files\DAEMON Tools Pro\Lang\ROM.dll	DTPro830-0749.exe
File created	C:\Program Files\DAEMON Tools Pro\InstallGadget.exe	DTPro830-0749.exe
File created	C:\Program Files\DAEMON Tools Pro\Lang\CHS.dll	DTPro830-0749.exe
File created	C:\Program Files\DAEMON Tools Pro\Lang\FRA.dll	DTPro830-0749.exe
File created	C:\Program Files\DAEMON Tools Pro\Lang\JPN.dll	DTPro830-0749.exe
File opened for modification	C:\Program Files\DAEMON Tools Pro\DTShellHlp.exe	DTPro830-0749.exe
File opened for modification	C:\Program Files\DAEMON Tools Pro\DTShl32.dll	DTPro830-0749.exe
File created	C:\Program Files\DAEMON Tools Pro\Lang\HYE.dll	DTPro830-0749.exe
File opened for modification	C:\Program Files\DAEMON Tools Pro\Lang\ESN.dll	DTPro830-0749.exe
File opened for modification	C:\Program Files\DAEMON Tools Pro\DTAgent.exe	DTPro830-0749.exe
File created	C:\Program Files\DAEMON Tools Pro\uninst.exe	DTPro830-0749.exe
File created	C:\Program Files\DAEMON Tools Pro\Lang\ARA.dll	DTPro830-0749.exe
File opened for modification	C:\Program Files\DAEMON Tools Pro\Plugins\Grabbers\GenDisc.dll	DTPro830-0749.exe
File created	C:\Program Files\DAEMON Tools Pro\Lang\ITA.dll	DTPro830-0749.exe
File created	C:\Program Files\DAEMON Tools Pro\Lang\CSY.dll	DTPro830-0749.exe
File created	C:\Program Files\DAEMON Tools Pro\Lang\KOR.dll	DTPro830-0749.exe
File created	C:\Program Files\DAEMON Tools Pro\Lang\SVE.dll	DTPro830-0749.exe
File opened for modification	C:\Program Files\DAEMON Tools Pro\DTPro.exe	DTPro830-0749.exe
File created	C:\Program Files\DAEMON Tools Pro\SPTDinst-x64.exe	DTPro830-0749.exe
File opened for modification	C:\Program Files\DAEMON Tools Pro\Lang\TRK.dll	DTPro830-0749.exe
File created	C:\Program Files\DAEMON Tools Pro\Plugins\Grabbers\GenDPM.dll	DTPro830-0749.exe
File created	C:\Program Files\DAEMON Tools Pro\Lang\LVI.dll	DTPro830-0749.exe
File created	C:\Program Files\DAEMON Tools Pro\Lang\UKR.dll	DTPro830-0749.exe
File created	C:\Program Files\DAEMON Tools Pro\dtproscsibus.cat	DiscSoftBusServicePro.exe
File created	C:\Program Files\DAEMON Tools Pro\DiscSoftBusServicePro.exe	DTPro830-0749.exe
File created	C:\Program Files\DAEMON Tools Pro\Plugins\Grabbers\GenDisc.dll	DTPro830-0749.exe
File created	C:\Program Files\DAEMON Tools Pro\DTShl32.dll	DTPro830-0749.exe
File opened for modification	C:\Program Files\DAEMON Tools Pro\DTGadget64.dll	DTPro830-0749.exe
File opened for modification	C:\Program Files\DAEMON Tools Pro\Lang\ENU.dll	DTPro830-0749.exe
File created	C:\Program Files\DAEMON Tools Pro\Lang\FIN.dll	DTPro830-0749.exe
File created	C:\Program Files\DAEMON Tools Pro\DTPro.exe	DTPro830-0749.exe
File created	C:\Program Files\DAEMON Tools Pro\Plugins\Grabbers\GenSub.dll	DTPro830-0749.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DiscSoftBusServicePro.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	DiscSoftBusServicePro.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DiscSoftBusServicePro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\UpperFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\UpperFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DiscSoftBusServicePro.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DiscSoftBusServicePro.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DiscSoftBusServicePro.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DiscSoftBusServicePro.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DiscSoftBusServicePro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DiscSoftBusServicePro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	DiscSoftBusServicePro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DiscSoftBusServicePro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DiscSoftBusServicePro.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DiscSoftBusServicePro.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DiscSoftBusServicePro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	DiscSoftBusServicePro.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DiscSoftBusServicePro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters	DrvInst.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133394560083299366"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7625197B-1FFF-43E9-BF22-689B4A295877}\ = "IDSDeviceManagerEvents"	DiscSoftBusServicePro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8F113755-AFF6-48DF-B46A-48ADCE570CFF}\ProxyStubClsid32	DiscSoftBusServicePro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E6B45A0F-66FD-4BC6-BBA0-D0C5E6333CFC}\ProxyStubClsid32	DiscSoftBusServicePro.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C7DDECF-7A8E-48A5-A744-8F45D20FB1A9}\ShellFolder\PinToNameSpaceTree	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2C7DDECF-7A8E-48A5-A744-8F45D20FB1A9}\DefaultIcon	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2C7DDECF-7A8E-48A5-A744-8F45D20FB1A9}\ShellFolder	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{905C4BC6-A817-42CD-88D7-2EC36A5F6DF8}\TypeLib\Version = "1.0"	DiscSoftBusServicePro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{965F7A80-B670-436C-A7C4-FD9402A97DB7}\ProxyStubClsid32	DiscSoftBusServicePro.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6B45A0F-66FD-4BC6-BBA0-D0C5E6333CFC}\TypeLib\Version = "1.0"	DiscSoftBusServicePro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wim	DTPro830-0749.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C7DDECF-7A8E-48A5-A744-8F45D20FB1A9}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{965F7A80-B670-436C-A7C4-FD9402A97DB7}\TypeLib\ = "{D6C1423A-4E00-482F-89CE-5B4457D74E6E}"	DiscSoftBusServicePro.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E6B45A0F-66FD-4BC6-BBA0-D0C5E6333CFC}\ = "IDSBusService"	DiscSoftBusServicePro.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E6B45A0F-66FD-4BC6-BBA0-D0C5E6333CFC}\TypeLib\Version = "1.0"	DiscSoftBusServicePro.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2DE20037-951D-4C5A-ADAE-9BB482E9C8BE}\TypeLib\ = "{D6C1423A-4E00-482F-89CE-5B4457D74E6E}"	DiscSoftBusServicePro.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\DTShl32.dll\AppID = "{F9B84490-4C45-4737-82E5-0EA0B1CF5307}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2C7DDECF-7A8E-48A5-A744-8F45D20FB1A9}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\DiscSoftBusServicePro.exe	DiscSoftBusServicePro.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7625197B-1FFF-43E9-BF22-689B4A295877}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	DiscSoftBusServicePro.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DB39A774-090B-4469-882C-BC402F9999EA}\ = "IDSiSCSIDiscoveryTargets"	DiscSoftBusServicePro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{965F7A80-B670-436C-A7C4-FD9402A97DB7}\TypeLib	DiscSoftBusServicePro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8F113755-AFF6-48DF-B46A-48ADCE570CFF}\TypeLib	DiscSoftBusServicePro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.7z	DTPro.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.daa\ = "DAEMON.Tools.Pro"	DTPro830-0749.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{905C4BC6-A817-42CD-88D7-2EC36A5F6DF8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	DiscSoftBusServicePro.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{98976E15-9EC0-4B6F-BBEA-FE19A10B5030}\TypeLib\Version = "1.0"	DiscSoftBusServicePro.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{89A42CC7-BBA4-40D0-BDE4-21D86DA06F11}\ = "IDSMailManagerEvents"	DiscSoftBusServicePro.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB632AED-2106-427D-9E8C-D18BE9B46060}\TypeLib\Version = "1.0"	DiscSoftBusServicePro.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mdx\ = "DAEMON.Tools.Pro"	DTPro830-0749.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mdf\ = "DAEMON.Tools.Pro"	DTPro830-0749.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bwt	DTPro830-0749.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.nrg	DTPro830-0749.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E9526F9B-B449-4171-810F-E710946CA1FA}\AppID = "{1E9D16CB-FF03-481F-ABE2-F406C2808FE2}"	DiscSoftBusServicePro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{965F7A80-B670-436C-A7C4-FD9402A97DB7}	DiscSoftBusServicePro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{98976E15-9EC0-4B6F-BBEA-FE19A10B5030}\ProxyStubClsid32	DiscSoftBusServicePro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB632AED-2106-427D-9E8C-D18BE9B46060}	DiscSoftBusServicePro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DAEMON.Tools.Pro\shell	DTPro830-0749.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\DaemonShellExtDrive	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D6C1423A-4E00-482F-89CE-5B4457D74E6E}	DiscSoftBusServicePro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tc	DTPro830-0749.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C7DDECF-7A8E-48A5-A744-8F45D20FB1A9}\AppID = "{F9B84490-4C45-4737-82E5-0EA0B1CF5307}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C7DDECF-7A8E-48A5-A744-8F45D20FB1A9}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E9526F9B-B449-4171-810F-E710946CA1FA}\Programmable	DiscSoftBusServicePro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{98976E15-9EC0-4B6F-BBEA-FE19A10B5030}\ProxyStubClsid32	DiscSoftBusServicePro.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6B45A0F-66FD-4BC6-BBA0-D0C5E6333CFC}\ = "IDSBusService"	DiscSoftBusServicePro.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vhd\ = "DAEMON.Tools.Pro"	DTPro830-0749.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{40966797-8FFE-46C8-9EF8-7003F33CCF0F}\ = "DaemonShellExtImage Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2C7DDECF-7A8E-48A5-A744-8F45D20FB1A9}\DefaultIcon\ = "C:\\Program Files\\DAEMON Tools Pro\\DTShl64.dll,-109"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{965F7A80-B670-436C-A7C4-FD9402A97DB7}\ = "IDSAsyncDiscoverTargetsResultHandler"	DiscSoftBusServicePro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6B45A0F-66FD-4BC6-BBA0-D0C5E6333CFC}\TypeLib	DiscSoftBusServicePro.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{40966797-8FFE-46C8-9EF8-7003F33CCF0F}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ImageCatalogNSExt.ICShellFolder.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C7DDECF-7A8E-48A5-A744-8F45D20FB1A9}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{905C4BC6-A817-42CD-88D7-2EC36A5F6DF8}	DiscSoftBusServicePro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ccd	DTPro830-0749.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\DaemonShellExtDrive	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{965F7A80-B670-436C-A7C4-FD9402A97DB7}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	DiscSoftBusServicePro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{98976E15-9EC0-4B6F-BBEA-FE19A10B5030}	DiscSoftBusServicePro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.hc	DTPro830-0749.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{905C4BC6-A817-42CD-88D7-2EC36A5F6DF8}\TypeLib\ = "{D6C1423A-4E00-482F-89CE-5B4457D74E6E}"	DiscSoftBusServicePro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7625197B-1FFF-43E9-BF22-689B4A295877}	DiscSoftBusServicePro.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6AC175F8-B1C6-4256-91FA-DCC932E07CB8}\TypeLib\ = "{D6C1423A-4E00-482F-89CE-5B4457D74E6E}"	DiscSoftBusServicePro.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{76352D25-94A1-4DF9-9D1E-C64CB8C4AC39}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	DiscSoftBusServicePro.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{76352D25-94A1-4DF9-9D1E-C64CB8C4AC39}\TypeLib\ = "{D6C1423A-4E00-482F-89CE-5B4457D74E6E}"	DiscSoftBusServicePro.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2028	chrome.exe
2028	chrome.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4292	7zFM.exe
3984	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe
Token: SeShutdownPrivilege	2028	chrome.exe
Token: SeCreatePagefilePrivilege	2028	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
4292	7zFM.exe
2028	chrome.exe
4292	7zFM.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
2028	chrome.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe
3984	taskmgr.exe

Suspicious use of SetWindowsHookEx 40 IoCs

pid	Process
2904	DTPro830-0749.exe
3616	DiscSoftBusServicePro.exe
2604	DTPro.exe
2604	DTPro.exe
1524	DTPro.exe
1524	DTPro.exe
1524	DTPro.exe
1524	DTPro.exe
1524	DTPro.exe
1524	DTPro.exe
1524	DTPro.exe
1524	DTPro.exe
1524	DTPro.exe
1524	DTPro.exe
1524	DTPro.exe
1524	DTPro.exe
1524	DTPro.exe
1524	DTPro.exe
1524	DTPro.exe
1524	DTPro.exe
1524	DTPro.exe
1524	DTPro.exe
1524	DTPro.exe
1524	DTPro.exe
1524	DTPro.exe
1524	DTPro.exe
1524	DTPro.exe
1524	DTPro.exe
1524	DTPro.exe
1524	DTPro.exe
1524	DTPro.exe
1524	DTPro.exe
1524	DTPro.exe
1524	DTPro.exe
1524	DTPro.exe
1524	DTPro.exe
1524	DTPro.exe
1524	DTPro.exe
1524	DTPro.exe
1524	DTPro.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 3596	2028	chrome.exe	45
PID 2028 wrote to memory of 3596	2028	chrome.exe	45
PID 2028 wrote to memory of 2164	2028	chrome.exe	87
PID 2028 wrote to memory of 2164	2028	chrome.exe	87
PID 2028 wrote to memory of 2164	2028	chrome.exe	87
PID 2028 wrote to memory of 2164	2028	chrome.exe	87
PID 2028 wrote to memory of 2164	2028	chrome.exe	87
PID 2028 wrote to memory of 2164	2028	chrome.exe	87
PID 2028 wrote to memory of 2164	2028	chrome.exe	87
PID 2028 wrote to memory of 2164	2028	chrome.exe	87
PID 2028 wrote to memory of 2164	2028	chrome.exe	87
PID 2028 wrote to memory of 2164	2028	chrome.exe	87
PID 2028 wrote to memory of 2164	2028	chrome.exe	87
PID 2028 wrote to memory of 2164	2028	chrome.exe	87
PID 2028 wrote to memory of 2164	2028	chrome.exe	87
PID 2028 wrote to memory of 2164	2028	chrome.exe	87
PID 2028 wrote to memory of 2164	2028	chrome.exe	87
PID 2028 wrote to memory of 2164	2028	chrome.exe	87
PID 2028 wrote to memory of 2164	2028	chrome.exe	87
PID 2028 wrote to memory of 2164	2028	chrome.exe	87
PID 2028 wrote to memory of 2164	2028	chrome.exe	87
PID 2028 wrote to memory of 2164	2028	chrome.exe	87
PID 2028 wrote to memory of 2164	2028	chrome.exe	87
PID 2028 wrote to memory of 2164	2028	chrome.exe	87
PID 2028 wrote to memory of 2164	2028	chrome.exe	87
PID 2028 wrote to memory of 2164	2028	chrome.exe	87
PID 2028 wrote to memory of 2164	2028	chrome.exe	87
PID 2028 wrote to memory of 2164	2028	chrome.exe	87
PID 2028 wrote to memory of 2164	2028	chrome.exe	87
PID 2028 wrote to memory of 2164	2028	chrome.exe	87
PID 2028 wrote to memory of 2164	2028	chrome.exe	87
PID 2028 wrote to memory of 2164	2028	chrome.exe	87
PID 2028 wrote to memory of 2164	2028	chrome.exe	87
PID 2028 wrote to memory of 2164	2028	chrome.exe	87
PID 2028 wrote to memory of 2164	2028	chrome.exe	87
PID 2028 wrote to memory of 2164	2028	chrome.exe	87
PID 2028 wrote to memory of 2164	2028	chrome.exe	87
PID 2028 wrote to memory of 2164	2028	chrome.exe	87
PID 2028 wrote to memory of 2164	2028	chrome.exe	87
PID 2028 wrote to memory of 2164	2028	chrome.exe	87
PID 2028 wrote to memory of 2376	2028	chrome.exe	88
PID 2028 wrote to memory of 2376	2028	chrome.exe	88
PID 2028 wrote to memory of 760	2028	chrome.exe	89
PID 2028 wrote to memory of 760	2028	chrome.exe	89
PID 2028 wrote to memory of 760	2028	chrome.exe	89
PID 2028 wrote to memory of 760	2028	chrome.exe	89
PID 2028 wrote to memory of 760	2028	chrome.exe	89
PID 2028 wrote to memory of 760	2028	chrome.exe	89
PID 2028 wrote to memory of 760	2028	chrome.exe	89
PID 2028 wrote to memory of 760	2028	chrome.exe	89
PID 2028 wrote to memory of 760	2028	chrome.exe	89
PID 2028 wrote to memory of 760	2028	chrome.exe	89
PID 2028 wrote to memory of 760	2028	chrome.exe	89
PID 2028 wrote to memory of 760	2028	chrome.exe	89
PID 2028 wrote to memory of 760	2028	chrome.exe	89
PID 2028 wrote to memory of 760	2028	chrome.exe	89
PID 2028 wrote to memory of 760	2028	chrome.exe	89
PID 2028 wrote to memory of 760	2028	chrome.exe	89
PID 2028 wrote to memory of 760	2028	chrome.exe	89
PID 2028 wrote to memory of 760	2028	chrome.exe	89
PID 2028 wrote to memory of 760	2028	chrome.exe	89
PID 2028 wrote to memory of 760	2028	chrome.exe	89
PID 2028 wrote to memory of 760	2028	chrome.exe	89
PID 2028 wrote to memory of 760	2028	chrome.exe	89

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://oxy.cloud/d/Bdqc
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa622b9758,0x7ffa622b9768,0x7ffa622b9778
  2⤵
  PID:3596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1792 --field-trial-handle=1884,i,7877985796516755674,9585066712620487760,131072 /prefetch:2
  2⤵
  PID:2164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1884,i,7877985796516755674,9585066712620487760,131072 /prefetch:8
  2⤵
  PID:2376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2196 --field-trial-handle=1884,i,7877985796516755674,9585066712620487760,131072 /prefetch:8
  2⤵
  PID:760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2980 --field-trial-handle=1884,i,7877985796516755674,9585066712620487760,131072 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2988 --field-trial-handle=1884,i,7877985796516755674,9585066712620487760,131072 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4868 --field-trial-handle=1884,i,7877985796516755674,9585066712620487760,131072 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4968 --field-trial-handle=1884,i,7877985796516755674,9585066712620487760,131072 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4680 --field-trial-handle=1884,i,7877985796516755674,9585066712620487760,131072 /prefetch:1
  2⤵
  PID:2004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5032 --field-trial-handle=1884,i,7877985796516755674,9585066712620487760,131072 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5928 --field-trial-handle=1884,i,7877985796516755674,9585066712620487760,131072 /prefetch:8
  2⤵
  PID:644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5620 --field-trial-handle=1884,i,7877985796516755674,9585066712620487760,131072 /prefetch:8
  2⤵
  PID:4312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3320 --field-trial-handle=1884,i,7877985796516755674,9585066712620487760,131072 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5116 --field-trial-handle=1884,i,7877985796516755674,9585066712620487760,131072 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4912 --field-trial-handle=1884,i,7877985796516755674,9585066712620487760,131072 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4824 --field-trial-handle=1884,i,7877985796516755674,9585066712620487760,131072 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4764 --field-trial-handle=1884,i,7877985796516755674,9585066712620487760,131072 /prefetch:8
  2⤵
  PID:408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4760 --field-trial-handle=1884,i,7877985796516755674,9585066712620487760,131072 /prefetch:8
  2⤵
  PID:4788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=5572 --field-trial-handle=1884,i,7877985796516755674,9585066712620487760,131072 /prefetch:1
  2⤵
  PID:4280

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3604

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4896

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\DAEMON Tools Pro 8.3.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:4292

C:\Users\Admin\Desktop\DTPro830-0749.exe
"C:\Users\Admin\Desktop\DTPro830-0749.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2904
- C:\Program Files\DAEMON Tools Pro\DiscSoftBusServicePro.exe
  "C:\Program Files\DAEMON Tools Pro\DiscSoftBusServicePro.exe" /Service
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Registers COM server for autorun
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:3616
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32.exe /s "C:\Program Files\DAEMON Tools Pro\DTShl32.dll"
  2⤵
  - Modifies registry class
  PID:2032
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32.exe /s "C:\Program Files\DAEMON Tools Pro\DTShl64.dll"
  2⤵
  PID:2556
- - C:\Windows\system32\regsvr32.exe
    /s "C:\Program Files\DAEMON Tools Pro\DTShl64.dll"
    3⤵
    - Registers COM server for autorun
    - Modifies registry class
    PID:456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:1160
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{b21713ea-7dbe-d74f-ba30-f8923e5d848e}\dtproscsibus.inf" "9" "4ade3b53b" "0000000000000148" "WinSta0\Default" "0000000000000140" "208" "c:\program files\daemon tools pro"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:3656
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "2" "211" "ROOT\SCSIADAPTER\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:f5fe8c81ebc2f07d:Install:5.29.0.0:root\dtproscsibus," "4ade3b53b" "0000000000000148"
  2⤵
  - Drops file in Drivers directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  PID:564

C:\Program Files\DAEMON Tools Pro\DTShellHlp.exe
"C:\Program Files\DAEMON Tools Pro\DTShellHlp.exe"
1⤵
- Executes dropped EXE
PID:4292

C:\Program Files\DAEMON Tools Pro\DiscSoftBusServicePro.exe
"C:\Program Files\DAEMON Tools Pro\DiscSoftBusServicePro.exe"
1⤵
- Executes dropped EXE
PID:4844

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3984

C:\Program Files\DAEMON Tools Pro\RegGen.exe
"C:\Program Files\DAEMON Tools Pro\RegGen.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4672
- C:\Program Files\DAEMON Tools Pro\DTPro.exe
  "DTPro.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2604

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x468 0x4c4
1⤵
PID:2696

C:\Program Files\DAEMON Tools Pro\DTPro.exe
"C:\Program Files\DAEMON Tools Pro\DTPro.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery