2d9e3ade9d362c0bea67be5bb3eafa50507723225fbe6f3f02a9d384b089f242

Modify Registry

Processes:

DrvInst.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\RapiMgr\Parameters\ServiceDll = "%windir%\\WindowsMobile\\rapimgr.dll"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WcesComm\Parameters\ServiceDll = "%windir%\\WindowsMobile\\wcescomm.dll"	DrvInst.exe

Checks BIOS information in registry 2 TTPs 3 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

MsiExec.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	MsiExec.exe

Executes dropped EXE 5 IoCs

Processes:

driver_setup.exesetup.exewmdcBase.exeInstallForm.exewmdc.exe

pid	Process
2220	driver_setup.exe
380	setup.exe
4552	wmdcBase.exe
2896	InstallForm.exe
2832	wmdc.exe

Loads dropped DLL 35 IoCs

Processes:

MsiExec.exeMsiExec.exeMsiExec.exeDrvInst.exesvchost.exesvchost.exewmdcBase.exesvchost.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exewmdc.exe

pid	Process
600	MsiExec.exe
2228	MsiExec.exe
2228	MsiExec.exe
4736	MsiExec.exe
4736	MsiExec.exe
4736	MsiExec.exe
4736	MsiExec.exe
2228	MsiExec.exe
4268	DrvInst.exe
4952	svchost.exe
4952	svchost.exe
60	svchost.exe
60	svchost.exe
60	svchost.exe
4552	wmdcBase.exe
4552	wmdcBase.exe
4552	wmdcBase.exe
4952	svchost.exe
4552	wmdcBase.exe
4368	svchost.exe
4368	svchost.exe
4368	svchost.exe
4680	MsiExec.exe
4420	MsiExec.exe
1828	MsiExec.exe
1536	MsiExec.exe
1536	MsiExec.exe
1536	MsiExec.exe
1592	MsiExec.exe
4420	MsiExec.exe
4420	MsiExec.exe
2832	wmdc.exe
2832	wmdc.exe
2832	wmdc.exe
2832	wmdc.exe

Registers COM server for autorun 1 TTPs 45 IoCs

persistence

Registry Run Keys / Startup Folder

Processes:

DrvInst.exemsiexec.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DCBEB807-14D0-4CBD-926C-B991F4FD1B91}\InprocServer32\ = "%windir%\\system32\\rapiproxystub.dll"	DrvInst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4ED4A55B-629E-4B3D-9F18-86CCE9581262}\InProcServer32	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{412E4330-A2EA-4A1C-B723-873E5FA1C618}\InProcServer32\ = "%windir%\\system32\\wcescommproxy.dll"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{499C0C20-A766-11CF-8011-00A0C90A8F78}\InprocServer32\ = "%windir%\\system32\\rapi.dll"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{52959703-387A-43D6-9746-75CC08DFB3F9}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3B5AA27A-CBF9-48C9-96F8-4ACE84FB8512}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3B5AA27A-CBF9-48C9-96F8-4ACE84FB8512}\InprocServer32\Assembly = "Microsoft.WindowsMobile.DeviceManager, Version=6.1.0.0, Culture=neutral"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3B5AA27A-CBF9-48C9-96F8-4ACE84FB8512}\InprocServer32\ = "mscoree.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{3B5AA27A-CBF9-48C9-96F8-4ACE84FB8512}\InprocServer32\6.1.0.0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD073990-9104-45d9-9DF8-AE6B31F7C67D}\InprocServer32\ = "C:\\Windows\\WindowsMobile\\wmdsyncman.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{412E4330-A2EA-4A1C-B723-873E5FA1C618}\InProcServer32	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{35440327-1517-4B72-865E-3FFE8E97002F}\InprocServer32\ThreadingModel = "Both"	DrvInst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{52959703-387A-43D6-9746-75CC08DFB3F9}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{52959703-387A-43D6-9746-75CC08DFB3F9}\InprocServer32\ = "C:\\Windows\\WindowsMobile\\wmdsyncproxy.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6B7AD2F5-32BF-4b5c-ABEA-FB123102E9AE}\LocalServer32\ = "%windir%\\WindowsMobile\\wmdc.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{3B5AA27A-CBF9-48C9-96F8-4ACE84FB8512}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3B5AA27A-CBF9-48C9-96F8-4ACE84FB8512}\InprocServer32\6.1.0.0\Class = "Microsoft.WindowsMobile.WindowsMobileFactory"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3B5AA27A-CBF9-48C9-96F8-4ACE84FB8512}\InprocServer32\6.1.0.0\Assembly = "Microsoft.WindowsMobile.DeviceManager, Version=6.1.0.0, Culture=neutral"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3B5AA27A-CBF9-48C9-96F8-4ACE84FB8512}\InprocServer32\6.1.0.0\RuntimeVersion = "v2.0.50727"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{CD073990-9104-45d9-9DF8-AE6B31F7C67D}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{122CC07F-3333-42aa-9ABC-6BAE729A4C85}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{35440327-1517-4B72-865E-3FFE8E97002F}\InprocServer32	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{86A0B54A-5721-41b4-A3F1-81C6531B7D22}\InprocServer32\ThreadingModel = "Free"	DrvInst.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{52959703-387A-43D6-9746-75CC08DFB3F9}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4ED4A55B-629E-4B3D-9F18-86CCE9581262}\InProcServer32\ThreadingModel = "Both"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3B5AA27A-CBF9-48C9-96F8-4ACE84FB8512}\InprocServer32\6.1.0.0\	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{122CC07F-3333-42aa-9ABC-6BAE729A4C85}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{122CC07F-3333-42aa-9ABC-6BAE729A4C85}\InprocServer32\ = "C:\\Windows\\WindowsMobile\\inplace.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD073990-9104-45d9-9DF8-AE6B31F7C67D}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1A52C610-B080-4f7d-9277-6F89AA966620}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{412E4330-A2EA-4A1C-B723-873E5FA1C618}\InProcServer32\ThreadingModel = "Both"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{86A0B54A-5721-41b4-A3F1-81C6531B7D22}\InprocServer32\ = "%windir%\\WindowsMobile\\BthASPlugin.dll"	DrvInst.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6B7AD2F5-32BF-4b5c-ABEA-FB123102E9AE}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3B5AA27A-CBF9-48C9-96F8-4ACE84FB8512}\InprocServer32\Class = "Microsoft.WindowsMobile.WindowsMobileFactory"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3B5AA27A-CBF9-48C9-96F8-4ACE84FB8512}\InprocServer32\RuntimeVersion = "v2.0.50727"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DCBEB807-14D0-4CBD-926C-B991F4FD1B91}\InprocServer32	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{35440327-1517-4B72-865E-3FFE8E97002F}\InprocServer32\ = "%windir%\\system32\\rapistub.dll"	DrvInst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{86A0B54A-5721-41b4-A3F1-81C6531B7D22}\InprocServer32	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DCBEB807-14D0-4CBD-926C-B991F4FD1B91}\InprocServer32\ThreadingModel = "Both"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4ED4A55B-629E-4B3D-9F18-86CCE9581262}\InProcServer32\ = "%windir%\\system32\\WcesCommProxy.dll"	DrvInst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{499C0C20-A766-11CF-8011-00A0C90A8F78}\InprocServer32	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{499C0C20-A766-11CF-8011-00A0C90A8F78}\InprocServer32\ThreadingModel = "Both"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD073990-9104-45d9-9DF8-AE6B31F7C67D}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{1A52C610-B080-4f7d-9277-6F89AA966620}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1A52C610-B080-4f7d-9277-6F89AA966620}\InprocServer32\ = "C:\\Windows\\WindowsMobile\\wmdsyncman.dll"	msiexec.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

af48efac2b7d97cc0b70559a0a2be8cfeae961306ed16f0c91706a3bef6d61fc.exeDrvInst.exemsiexec.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	af48efac2b7d97cc0b70559a0a2be8cfeae961306ed16f0c91706a3bef6d61fc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Mobile-based device management = "%windir%\\WindowsMobile\\wmdcBase.exe"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Mobile Device Center = "%windir%\\WindowsMobile\\wmdc.exe"	msiexec.exe

Drops desktop.ini file(s) 1 IoCs

Processes:

msiexec.exe

description	ioc	Process
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	msiexec.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

msiexec.exeDrvInst.exesetup.exedriver_setup.exe

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	DrvInst.exe
File opened (read-only)	\??\Y:	DrvInst.exe
File opened (read-only)	\??\Z:	DrvInst.exe
File opened (read-only)	\??\O:	setup.exe
File opened (read-only)	\??\P:	setup.exe
File opened (read-only)	\??\M:	driver_setup.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	driver_setup.exe
File opened (read-only)	\??\J:	driver_setup.exe
File opened (read-only)	\??\K:	driver_setup.exe
File opened (read-only)	\??\Y:	driver_setup.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	DrvInst.exe
File opened (read-only)	\??\P:	DrvInst.exe
File opened (read-only)	\??\A:	driver_setup.exe
File opened (read-only)	\??\Y:	setup.exe
File opened (read-only)	\??\N:	driver_setup.exe
File opened (read-only)	\??\X:	driver_setup.exe
File opened (read-only)	\??\Z:	driver_setup.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\E:	setup.exe
File opened (read-only)	\??\E:	driver_setup.exe
File opened (read-only)	\??\R:	driver_setup.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	DrvInst.exe
File opened (read-only)	\??\K:	DrvInst.exe
File opened (read-only)	\??\I:	driver_setup.exe
File opened (read-only)	\??\H:	setup.exe
File opened (read-only)	\??\B:	setup.exe
File opened (read-only)	\??\N:	setup.exe
File opened (read-only)	\??\R:	DrvInst.exe
File opened (read-only)	\??\V:	driver_setup.exe
File opened (read-only)	\??\A:	setup.exe
File opened (read-only)	\??\J:	setup.exe
File opened (read-only)	\??\H:	driver_setup.exe
File opened (read-only)	\??\X:	DrvInst.exe
File opened (read-only)	\??\G:	driver_setup.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	DrvInst.exe
File opened (read-only)	\??\S:	setup.exe
File opened (read-only)	\??\T:	setup.exe
File opened (read-only)	\??\U:	setup.exe
File opened (read-only)	\??\Q:	driver_setup.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	DrvInst.exe
File opened (read-only)	\??\O:	DrvInst.exe
File opened (read-only)	\??\Q:	DrvInst.exe
File opened (read-only)	\??\R:	setup.exe
File opened (read-only)	\??\W:	setup.exe
File opened (read-only)	\??\S:	driver_setup.exe
File opened (read-only)	\??\U:	driver_setup.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\G:	DrvInst.exe
File opened (read-only)	\??\H:	DrvInst.exe
File opened (read-only)	\??\G:	setup.exe
File opened (read-only)	\??\L:	driver_setup.exe

Drops file in System32 directory 64 IoCs

Processes:

DrvInst.exeDrvInst.exeDrvInst.exeDrvInst.exe

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wcebth.inf_amd64_92cde66e1cfb521e\sv-SE\sv-SE-wmdc.exe.mui	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{9374c13c-070c-0244-8d46-53ace6136718}\hu-HU\SET27E0.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7b7cbadc-c735-7646-9a44-e82fcba3f0ee}\zh-TW\zh-TW-setup.exe.mui	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{9374c13c-070c-0244-8d46-53ace6136718}\en-US\SET2843.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{edb4e250-e7f3-794b-9235-7ec4027e4ae4}\ko-KR\ko-KR-rapimgr.dll.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wcebth.inf_amd64_92cde66e1cfb521e\sk-SK\sk-SK-wcescomm.dll.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7b7cbadc-c735-7646-9a44-e82fcba3f0ee}\pt-BR\pt-BR-wcescomm.dll.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{edb4e250-e7f3-794b-9235-7ec4027e4ae4}\zh-CN\zh-CN-wcescomm.dll.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wcebth.inf_amd64_92cde66e1cfb521e\ro-RO\ro-RO-wmdConn.cpl.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wcerndis.inf_amd64_7f46c8a40bd97188\zh-TW\zh-TW-rapimgr.dll.mui	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{9374c13c-070c-0244-8d46-53ace6136718}\tr-TR\SET2A3D.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{edb4e250-e7f3-794b-9235-7ec4027e4ae4}\it-IT\SET3AD5.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wcebth.inf_amd64_92cde66e1cfb521e\cs-CZ\cs-CZ-setup.exe.mui	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{9374c13c-070c-0244-8d46-53ace6136718}\pt-BR\SET2688.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7b7cbadc-c735-7646-9a44-e82fcba3f0ee}\btplugin.dll	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{7b7cbadc-c735-7646-9a44-e82fcba3f0ee}\de-DE\SET1458.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{9374c13c-070c-0244-8d46-53ace6136718}\hu-HU\hu-HU-rapimgr.dll.mui	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{7b7cbadc-c735-7646-9a44-e82fcba3f0ee}\fr-FR\SET1197.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7b7cbadc-c735-7646-9a44-e82fcba3f0ee}\hu-HU	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{9374c13c-070c-0244-8d46-53ace6136718}\da-DK\SET29F8.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{9374c13c-070c-0244-8d46-53ace6136718}\pt-PT	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{edb4e250-e7f3-794b-9235-7ec4027e4ae4}\SET39B0.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{7b7cbadc-c735-7646-9a44-e82fcba3f0ee}\it-IT\SET1399.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7b7cbadc-c735-7646-9a44-e82fcba3f0ee}\zh-TW\zh-TW-rapimgr.dll.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wcerndis.inf_amd64_7f46c8a40bd97188\zh-CN\zh-CN-wmdc.exe.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{9374c13c-070c-0244-8d46-53ace6136718}\es-ES\es-ES-wmdConn.cpl.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{9374c13c-070c-0244-8d46-53ace6136718}\cs-CZ\cs-CZ-wcescomm.dll.mui	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{9374c13c-070c-0244-8d46-53ace6136718}\de-DE\SET29C5.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wceusbsh.inf_amd64_ed7e79d05f4c4512\en-US\en-US-setup.exe.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{9374c13c-070c-0244-8d46-53ace6136718}\fr-FR	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7b7cbadc-c735-7646-9a44-e82fcba3f0ee}\SET1281.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wcebth.inf_amd64_92cde66e1cfb521e\en-US\en-US-wmdc.exe.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{9374c13c-070c-0244-8d46-53ace6136718}\it-IT	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{edb4e250-e7f3-794b-9235-7ec4027e4ae4}\SET39E3.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{edb4e250-e7f3-794b-9235-7ec4027e4ae4}\SET3A05.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{edb4e250-e7f3-794b-9235-7ec4027e4ae4}\hu-HU\hu-HU-wcescomm.dll.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{edb4e250-e7f3-794b-9235-7ec4027e4ae4}\en-US\SET3B0F.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{edb4e250-e7f3-794b-9235-7ec4027e4ae4}\ro-RO\SET3BFB.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{7b7cbadc-c735-7646-9a44-e82fcba3f0ee}\de-DE\SET1457.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{edb4e250-e7f3-794b-9235-7ec4027e4ae4}\tr-TR\SET3C9B.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{edb4e250-e7f3-794b-9235-7ec4027e4ae4}\el-GR	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wcebth.inf_amd64_92cde66e1cfb521e\ko-KR\ko-KR-setup.exe.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{9374c13c-070c-0244-8d46-53ace6136718}\zh-TW\SET2A4F.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{9374c13c-070c-0244-8d46-53ace6136718}\es-ES\SET2570.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{9374c13c-070c-0244-8d46-53ace6136718}\pl-PL\SET273C.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{9374c13c-070c-0244-8d46-53ace6136718}\hu-HU\SET2811.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wcebth.inf_amd64_92cde66e1cfb521e\fi-FI\fi-FI-wcescomm.dll.mui	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{7b7cbadc-c735-7646-9a44-e82fcba3f0ee}\fi-FI\SET10F3.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wceusbsh.inf_amd64_ed7e79d05f4c4512\sk-SK\sk-SK-rapimgr.dll.mui	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{edb4e250-e7f3-794b-9235-7ec4027e4ae4}\es-ES\SET386A.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{edb4e250-e7f3-794b-9235-7ec4027e4ae4}\SET38FB.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{edb4e250-e7f3-794b-9235-7ec4027e4ae4}\SET39E1.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{edb4e250-e7f3-794b-9235-7ec4027e4ae4}\da-DK\SET3C88.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wcerndis.inf_amd64_7f46c8a40bd97188\pl-PL\pl-PL-rapimgr.dll.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wcerndis.inf_amd64_7f46c8a40bd97188\zh-TW\zh-TW-setup.exe.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{9374c13c-070c-0244-8d46-53ace6136718}\nl-NL\SET25EF.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{9374c13c-070c-0244-8d46-53ace6136718}\nl-NL\nl-NL-setup.exe.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{9374c13c-070c-0244-8d46-53ace6136718}\zh-TW\zh-TW-wcescomm.dll.mui	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{edb4e250-e7f3-794b-9235-7ec4027e4ae4}\nl-NL\SET38E7.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{7b7cbadc-c735-7646-9a44-e82fcba3f0ee}\en-US\SET13D2.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wcerndis.inf_amd64_7f46c8a40bd97188\tr-TR\tr-TR-setup.exe.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{edb4e250-e7f3-794b-9235-7ec4027e4ae4}\da-DK\da-DK-rapimgr.dll.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wcerndis.inf_amd64_7f46c8a40bd97188\rapimgr.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wcerndis.inf_amd64_7f46c8a40bd97188\fr-FR\fr-FR-rapimgr.dll.mui	DrvInst.exe

Drops file in Windows directory 64 IoCs

Processes:

msiexec.exeDrvInst.exeDrvInst.exe

description	ioc	Process
File created	C:\Windows\WindowsMobile\Drivers\Bluetooth\cs-cz\cs-cz-wmdc.exe.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\Bluetooth\ro-ro\ro-ro-rapimgr.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\Bluetooth\ru-ru\ru-ru-rapimgr.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\fi-FI\CEFStore.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\fr\Microsoft.WindowsMobile.DeviceManager.resources.dll	msiexec.exe
File created	C:\Windows\WindowsMobile\pl-PL\wmdc.exe.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\sv-SE\CEFStore.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\RNDIS\cs-cz\cs-cz-wcescomm.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\zh-CN\httpsys.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\Bluetooth\rapispxy.dll	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\Bluetooth\pt-pt\pt-pt-wmdc.exe.mui	msiexec.exe
File created	C:\Windows\Installer\SourceHash{626672CD-BFCF-49A9-AEFE-AB0FED3BFC5B}	msiexec.exe
File created	C:\Windows\WindowsMobile\pt-PT\outstore.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\Serial\de-de\de-de-setup.exe.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\Bluetooth\nl-nl\nl-nl-setup.exe.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\Bluetooth\ru-ru\ru-ru-wcescomm.dll.mui	msiexec.exe
File opened for modification	C:\Windows\WindowsMobile\ro-RO\rapimgr.dll.mui	DrvInst.exe
File created	C:\Windows\WindowsMobile\en-US\AirSyncEngine.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\el-GR\olregdll.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\es-ES\VoiceBar.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\it-IT\InkStore.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\RNDIS\pl-pl\pl-pl-rapimgr.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\ru-RU\InkStore.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Help\nb-NO\wm_devmgr.chm	msiexec.exe
File created	C:\Windows\WindowsMobile\nl-NL\httpsys.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\sv-SE\AirSyncEngine.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\sv-SE\InkProps.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\zh-TW\eula.rtf	msiexec.exe
File created	C:\Windows\Installer\SourceHash{92DBCA36-9B41-4DD1-941A-AED149DD37F0}	msiexec.exe
File opened for modification	C:\Windows\inf\oem6.inf	DrvInst.exe
File created	C:\Windows\WindowsMobile\hu-HU\VComCtl.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\Bluetooth\zh-cn\zh-cn-setup.exe.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\pt-BR\INetRepl.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\Bluetooth\el-gr\el-gr-wcescomm.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\Bluetooth\nb-no\nb-no-wcescomm.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\zh-CN\InkProps.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\RNDIS\it-it\it-it-setup.exe.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\zh-CN\AirSyncEngine.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Help\pl-PL\wm_devmgr.chm	msiexec.exe
File created	C:\Windows\WindowsMobile\ro-RO\Inkx.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\Bluetooth\nb-no\nb-no-rapimgr.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\Bluetooth\ro-ro\ro-ro-wmdConn.cpl.mui	msiexec.exe
File opened for modification	C:\Windows\WindowsMobile\cs-CZ\wmdConn.cpl.mui	DrvInst.exe
File opened for modification	C:\Windows\WindowsMobile\el-GR\setup.exe.mui	DrvInst.exe
File created	C:\Windows\WindowsMobile\en-US\mailsync.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\en-US\olregdll.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\es-ES\CEFStore.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\Serial\sk-sk\sk-sk-wcescomm.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\tr-TR\wmdsyncman.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\nl\Microsoft.WindowsMobile.DeviceCenter.resources.dll	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\Bluetooth\de-de\de-de-setup.exe.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\Bluetooth\hu-hu\hu-hu-setup.exe.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\ja-JP\mailsync.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\es-ES\eula.rtf	msiexec.exe
File created	C:\Windows\WindowsMobile\ko-KR\inkres.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\ko\Microsoft.WindowsMobile.DeviceCenter.resources.dll	msiexec.exe
File created	C:\Windows\WindowsMobile\pl-PL\outstore.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\RNDIS\pt-br\pt-br-wcescomm.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\sk-SK\INetRepl.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\Serial\sk-sk\sk-sk-rapimgr.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\ko-KR\wmdsyncman.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\Serial\pt-pt\pt-pt-rapimgr.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\Bluetooth\wmdConn.cpl	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\Serial\tr-tr\tr-tr-wmdConn.cpl.mui	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

driver_setup.exesvchost.exeDrvInst.exeDrvInst.exeDrvInst.exeDrvInst.exevssvc.exeMsiExec.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	driver_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	driver_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	driver_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	driver_setup.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000fc6bda6a7e0913030000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000fc6bda6a0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900fc6bda6a000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dfc6bda6a000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000fc6bda6a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	driver_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	driver_setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	driver_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	MsiExec.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

System Information Discovery

Processes:

MsiExec.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosDate	MsiExec.exe

Modifies Internet Explorer settings 1 TTPs 15 IoCs

adware spyware

Modify Registry

Processes:

msiexec.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB1-070F-11D3-9307-00C04FAE2D4F}\clsidExtension = "{2EAF5BB0-070F-11D3-9307-00C04FAE2D4F}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB2-070F-11D3-9307-00C04FAE2D4F}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB2-070F-11D3-9307-00C04FAE2D4F}\CLSID = "{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB2-070F-11D3-9307-00C04FAE2D4F}\MenuStatusBar = "@C:\\Windows\\WindowsMobile\\INetRepl.dll,-224"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB1-070F-11D3-9307-00C04FAE2D4F}\CLSID = "{1FBA04EE-3024-11D2-8F1F-0000F87ABD16}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB1-070F-11D3-9307-00C04FAE2D4F}\ButtonText = "@C:\\Windows\\WindowsMobile\\INetRepl.dll,-222"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB1-070F-11D3-9307-00C04FAE2D4F}\	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB2-070F-11D3-9307-00C04FAE2D4F}\MenuCustomize = "Tools"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB2-070F-11D3-9307-00C04FAE2D4F}\MenuText = "@C:\\Windows\\WindowsMobile\\INetRepl.dll,-223"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB1-070F-11D3-9307-00C04FAE2D4F}\Default Visible = "Yes"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB2-070F-11D3-9307-00C04FAE2D4F}\clsidExtension = "{2EAF5BB0-070F-11D3-9307-00C04FAE2D4F}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB2-070F-11D3-9307-00C04FAE2D4F}\	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB1-070F-11D3-9307-00C04FAE2D4F}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB1-070F-11D3-9307-00C04FAE2D4F}\Icon = "C:\\Windows\\WindowsMobile\\INetRepl.dll,210"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB1-070F-11D3-9307-00C04FAE2D4F}\HotIcon = "C:\\Windows\\WindowsMobile\\INetRepl.dll,211"	msiexec.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

DrvInst.exeDrvInst.exeDrvInst.exemsiexec.exeDrvInst.exeDrvInst.exe

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E\@%systemroot%\system32\FirewallControlPanel.dll,-12122 = "Windows Defender Firewall"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe

Modifies registry class 64 IoCs

Processes:

DrvInst.exemsiexec.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{357A557C-B03F-4240-90D8-C6C71C659BF1}\ProxyStubClsid32	DrvInst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4ED4A55B-629E-4B3D-9F18-86CCE9581262}\ProxyStubClsid32	DrvInst.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{3C4CFEBD-6B87-4909-88B9-9C39A796C2D2}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{76FD0DC0-2AF7-11D2-A502-00C04F8ECDC8}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F7E1C96B-781E-11D2-AAB7-00C04FAE2D4C}\InprocServer32\ = "C:\\Windows\\WindowsMobile\\INetRepl.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{661a448a-1816-11db-9616-00e08161165f}\NumMethods	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{431C3DE2-C39E-11DB-931E-84FA55D89593}\NumMethods	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8A0F1632-3905-4CA4-AEA4-7E094ECBB9A7}\ = "IRAPIDevice"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DCBEB807-14D0-4CBD-926C-B991F4FD1B91}\ = "PSFactoryBuffer"	DrvInst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FF4C4832-2BEA-4472-98A3-F931BEB8F62B}\ProgId	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ED081F25-6A77-4C89-B689-C6E15C582EC1}\AppID = "{AD7F04A8-CD48-48fa-B7C4-9DB7430E6A0D}"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{35440327-1517-4B72-865E-3FFE8E97002F}\VersionIndpendentProgId\ = "Microsoft.RAPIStub"	DrvInst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MS.WinCE.Outlook	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C4CFEBD-6B87-4909-88B9-9C39A796C2D2}\ProgID\ = "Microsoft.AirSyncEngine.Desktop.1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DCBEB807-14D0-4CBD-926C-B991F4FD1B91}\InprocServer32\ThreadingModel = "Both"	DrvInst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.WcesComm	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FF4C4832-2BEA-4472-98A3-F931BEB8F62B}\VersionIndpendentProgId\ = "Microsoft.WcesComm"	DrvInst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{35440327-1517-4B72-865E-3FFE8E97002F}\VersionIndpendentProgId	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.WMDC.CertEnroll\CurVer\ = "Microsoft.WMDC.CertEnroll.1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{B49696CB-1CA4-491f-972A-246EB554069B}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{14601BBD-78B1-43CE-98CA-ADD8BAD63288}\ProxyStubClsid32\ = "{52959703-387A-43D6-9746-75CC08DFB3F9}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{27114E1C-5712-4FFB-88F0-CEA0288E7CF5}\NumMethods\ = "3"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB631772-8707-456C-85D3-E1C2DB42003E}\ProxyStubClsid32\ = "{412E4330-A2EA-4A1C-B723-873E5FA1C618}"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{35440327-1517-4B72-865E-3FFE8E97002F}\InprocServer32\ = "%windir%\\system32\\rapistub.dll"	DrvInst.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MS.WinCE.Outlook\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72579CE4-3989-4D3A-AA53-9B630653C45D}\ = "LegacySyncEngine Class"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{567C5EE9-A990-4649-A029-E8A8766EDEA6}\ProxyStubClsid32\ = "{DCBEB807-14D0-4CBD-926C-B991F4FD1B91}"	DrvInst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C5297E5C-0642-4D74-B0CF-04AED816AA38}	DrvInst.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{4475F45B-5612-4FE0-A324-8743E8885AAE}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B4FD053E-4810-46DB-889B-20E638E334F0}	DrvInst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E2EDF157-338E-40F4-A79F-D70EEC32EF67}\NumMethods	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{180D7BAA-1E94-11D3-A3BE-00C04F798308}\InprocServer32\ = "C:\\Windows\\WindowsMobile\\InkStore.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B49696CB-1CA4-491f-972A-246EB554069B}\NumMethods\ = "17"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{7AC667C0-2945-11d0-A315-00A0C90F55EE}\ProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{52959703-387A-43D6-9746-75CC08DFB3F9}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{9BDE217E-C5E8-11DB-AD95-482856D89593}\NumMethods	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{258A260C-95CF-46F0-ACFE-695D6463C190}	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB631772-8707-456C-85D3-E1C2DB42003E}\ProxyStubClsid32\ = "{412E4330-A2EA-4A1C-B723-873E5FA1C618}"	DrvInst.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{661a448a-1816-11db-9616-00e08161165f}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AE2B3505-7E70-475F-86B4-782FAC03A0D1}\ProxyStubClsid32\ = "{52959703-387A-43D6-9746-75CC08DFB3F9}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AF843683-7A1B-4412-8D43-967F20141C3E}\NumMethods\ = "4"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{499C0C20-A766-11CF-8011-00A0C90A8F78}\InprocServer32	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4475F45B-5612-4FE0-A324-8743E8885AAE}\NumMethods\ = "6"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{661a448a-1816-11db-9616-00e08161165f}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7AC667C0-2945-11d0-A315-00A0C90F55EE}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{939763D4-D83A-4e20-BA8C-4C30EC31B82A}\NumMethods	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF4C4832-2BEA-4472-98A3-F931BEB8F62B}\ = "Microsoft.WcesComm.1"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{86A0B54A-5721-41b4-A3F1-81C6531B7D22}\InprocServer32\ThreadingModel = "Free"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{77DCCB29-AE02-4A2B-B2FE-EA721F209864}\ProxyStubClsid32\ = "{77DCCB29-AE02-4A2B-B2FE-EA721F209864}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63ACBD2914B91DD449A1EA1D94DD730F\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63ACBD2914B91DD449A1EA1D94DD730F\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{357A557C-B03F-4240-90D8-C6C71C659BF1}\ProxyStubClsid32\ = "{DCBEB807-14D0-4CBD-926C-B991F4FD1B91}"	DrvInst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C5297E5C-0642-4D74-B0CF-04AED816AA38}\ProxyStubClsid32	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4ED4A55B-629E-4B3D-9F18-86CCE9581262}\NumMethods\ = "14"	DrvInst.exe
Key created	\REGISTRY\MACHINE\Software\Classes\VoiceCtl.VoiceCtrl	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.RAPIMgr.1\CLSID	DrvInst.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{BF765622-C5EF-11DB-B1CD-0D5656D89593}\ProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{14601BBD-78B1-43CE-98CA-ADD8BAD63288}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9BDE217E-C5E8-11DB-AD95-482856D89593}\ = "IEnrollStatusNotifySink"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.RAPIMgr.1	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{52959703-387A-43D6-9746-75CC08DFB3F9}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1A15B6A1-5CE7-482b-8D65-2D5E886296F3}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VoiceCtl.VoicePlay.1\ = "VoiceCtrl Class"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{27114E1C-5712-4FFB-88F0-CEA0288E7CF5}	DrvInst.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

msiexec.exe

pid	Process
4788	msiexec.exe
4788	msiexec.exe
4788	msiexec.exe
4788	msiexec.exe
4788	msiexec.exe
4788	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exedriver_setup.exe

description	pid	Process
Token: SeSecurityPrivilege	4788	msiexec.exe
Token: SeCreateTokenPrivilege	2220	driver_setup.exe
Token: SeAssignPrimaryTokenPrivilege	2220	driver_setup.exe
Token: SeLockMemoryPrivilege	2220	driver_setup.exe
Token: SeIncreaseQuotaPrivilege	2220	driver_setup.exe
Token: SeMachineAccountPrivilege	2220	driver_setup.exe
Token: SeTcbPrivilege	2220	driver_setup.exe
Token: SeSecurityPrivilege	2220	driver_setup.exe
Token: SeTakeOwnershipPrivilege	2220	driver_setup.exe
Token: SeLoadDriverPrivilege	2220	driver_setup.exe
Token: SeSystemProfilePrivilege	2220	driver_setup.exe
Token: SeSystemtimePrivilege	2220	driver_setup.exe
Token: SeProfSingleProcessPrivilege	2220	driver_setup.exe
Token: SeIncBasePriorityPrivilege	2220	driver_setup.exe
Token: SeCreatePagefilePrivilege	2220	driver_setup.exe
Token: SeCreatePermanentPrivilege	2220	driver_setup.exe
Token: SeBackupPrivilege	2220	driver_setup.exe
Token: SeRestorePrivilege	2220	driver_setup.exe
Token: SeShutdownPrivilege	2220	driver_setup.exe
Token: SeDebugPrivilege	2220	driver_setup.exe
Token: SeAuditPrivilege	2220	driver_setup.exe
Token: SeSystemEnvironmentPrivilege	2220	driver_setup.exe
Token: SeChangeNotifyPrivilege	2220	driver_setup.exe
Token: SeRemoteShutdownPrivilege	2220	driver_setup.exe
Token: SeUndockPrivilege	2220	driver_setup.exe
Token: SeSyncAgentPrivilege	2220	driver_setup.exe
Token: SeEnableDelegationPrivilege	2220	driver_setup.exe
Token: SeManageVolumePrivilege	2220	driver_setup.exe
Token: SeImpersonatePrivilege	2220	driver_setup.exe
Token: SeCreateGlobalPrivilege	2220	driver_setup.exe
Token: SeShutdownPrivilege	2220	driver_setup.exe
Token: SeIncreaseQuotaPrivilege	2220	driver_setup.exe
Token: SeCreateTokenPrivilege	2220	driver_setup.exe
Token: SeAssignPrimaryTokenPrivilege	2220	driver_setup.exe
Token: SeLockMemoryPrivilege	2220	driver_setup.exe
Token: SeIncreaseQuotaPrivilege	2220	driver_setup.exe
Token: SeMachineAccountPrivilege	2220	driver_setup.exe
Token: SeTcbPrivilege	2220	driver_setup.exe
Token: SeSecurityPrivilege	2220	driver_setup.exe
Token: SeTakeOwnershipPrivilege	2220	driver_setup.exe
Token: SeLoadDriverPrivilege	2220	driver_setup.exe
Token: SeSystemProfilePrivilege	2220	driver_setup.exe
Token: SeSystemtimePrivilege	2220	driver_setup.exe
Token: SeProfSingleProcessPrivilege	2220	driver_setup.exe
Token: SeIncBasePriorityPrivilege	2220	driver_setup.exe
Token: SeCreatePagefilePrivilege	2220	driver_setup.exe
Token: SeCreatePermanentPrivilege	2220	driver_setup.exe
Token: SeBackupPrivilege	2220	driver_setup.exe
Token: SeRestorePrivilege	2220	driver_setup.exe
Token: SeShutdownPrivilege	2220	driver_setup.exe
Token: SeDebugPrivilege	2220	driver_setup.exe
Token: SeAuditPrivilege	2220	driver_setup.exe
Token: SeSystemEnvironmentPrivilege	2220	driver_setup.exe
Token: SeChangeNotifyPrivilege	2220	driver_setup.exe
Token: SeRemoteShutdownPrivilege	2220	driver_setup.exe
Token: SeUndockPrivilege	2220	driver_setup.exe
Token: SeSyncAgentPrivilege	2220	driver_setup.exe
Token: SeEnableDelegationPrivilege	2220	driver_setup.exe
Token: SeManageVolumePrivilege	2220	driver_setup.exe
Token: SeImpersonatePrivilege	2220	driver_setup.exe
Token: SeCreateGlobalPrivilege	2220	driver_setup.exe
Token: SeCreateTokenPrivilege	2220	driver_setup.exe
Token: SeAssignPrimaryTokenPrivilege	2220	driver_setup.exe
Token: SeLockMemoryPrivilege	2220	driver_setup.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

driver_setup.exe

pid	Process
2220	driver_setup.exe
2220	driver_setup.exe
2220	driver_setup.exe
2220	driver_setup.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

af48efac2b7d97cc0b70559a0a2be8cfeae961306ed16f0c91706a3bef6d61fc.exemsiexec.exesvchost.exeDrvInst.exesetup.exeMsiExec.exewmdc.exe

description	pid	Process	procid_target
PID 668 wrote to memory of 2220	668	af48efac2b7d97cc0b70559a0a2be8cfeae961306ed16f0c91706a3bef6d61fc.exe	86
PID 668 wrote to memory of 2220	668	af48efac2b7d97cc0b70559a0a2be8cfeae961306ed16f0c91706a3bef6d61fc.exe	86
PID 4788 wrote to memory of 600	4788	msiexec.exe	89
PID 4788 wrote to memory of 600	4788	msiexec.exe	89
PID 4788 wrote to memory of 4116	4788	msiexec.exe	103
PID 4788 wrote to memory of 4116	4788	msiexec.exe	103
PID 4788 wrote to memory of 2228	4788	msiexec.exe	105
PID 4788 wrote to memory of 2228	4788	msiexec.exe	105
PID 4788 wrote to memory of 4736	4788	msiexec.exe	108
PID 4788 wrote to memory of 4736	4788	msiexec.exe	108
PID 3980 wrote to memory of 2948	3980	svchost.exe	110
PID 3980 wrote to memory of 2948	3980	svchost.exe	110
PID 3980 wrote to memory of 4176	3980	svchost.exe	113
PID 3980 wrote to memory of 4176	3980	svchost.exe	113
PID 3980 wrote to memory of 4772	3980	svchost.exe	116
PID 3980 wrote to memory of 4772	3980	svchost.exe	116
PID 3980 wrote to memory of 2548	3980	svchost.exe	117
PID 3980 wrote to memory of 2548	3980	svchost.exe	117
PID 3980 wrote to memory of 4268	3980	svchost.exe	119
PID 3980 wrote to memory of 4268	3980	svchost.exe	119
PID 4268 wrote to memory of 380	4268	DrvInst.exe	122
PID 4268 wrote to memory of 380	4268	DrvInst.exe	122
PID 380 wrote to memory of 4552	380	setup.exe	123
PID 380 wrote to memory of 4552	380	setup.exe	123
PID 4788 wrote to memory of 4680	4788	msiexec.exe	125
PID 4788 wrote to memory of 4680	4788	msiexec.exe	125
PID 4788 wrote to memory of 4420	4788	msiexec.exe	126
PID 4788 wrote to memory of 4420	4788	msiexec.exe	126
PID 4788 wrote to memory of 1828	4788	msiexec.exe	127
PID 4788 wrote to memory of 1828	4788	msiexec.exe	127
PID 4788 wrote to memory of 1828	4788	msiexec.exe	127
PID 4788 wrote to memory of 1536	4788	msiexec.exe	129
PID 4788 wrote to memory of 1536	4788	msiexec.exe	129
PID 4788 wrote to memory of 1592	4788	msiexec.exe	130
PID 4788 wrote to memory of 1592	4788	msiexec.exe	130
PID 4788 wrote to memory of 1592	4788	msiexec.exe	130
PID 1592 wrote to memory of 2896	1592	MsiExec.exe	131
PID 1592 wrote to memory of 2896	1592	MsiExec.exe	131
PID 1592 wrote to memory of 2896	1592	MsiExec.exe	131
PID 380 wrote to memory of 2832	380	setup.exe	132
PID 380 wrote to memory of 2832	380	setup.exe	132
PID 2832 wrote to memory of 4244	2832	wmdc.exe	134
PID 2832 wrote to memory of 4244	2832	wmdc.exe	134

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\af48efac2b7d97cc0b70559a0a2be8cfeae961306ed16f0c91706a3bef6d61fc.exe
"C:\Users\Admin\AppData\Local\Temp\af48efac2b7d97cc0b70559a0a2be8cfeae961306ed16f0c91706a3bef6d61fc.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:668
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\driver_setup.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\driver_setup.exe /i drvupdate-amd64.msi
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2220

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Registers COM server for autorun
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 0DA1AB5E00F52D3978769984D21AC2A5 C
  2⤵
  - Loads dropped DLL
  PID:600
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4116
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 646569671531B18A60105912B56D3284
  2⤵
  - Loads dropped DLL
  PID:2228
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding E4AA2BEF1BB41925A987367C9037E20C E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Checks SCSI registry key(s)
  PID:4736
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding A951C1F96F9CD95F8FF18E3C2E5695D4 C
  2⤵
  - Loads dropped DLL
  PID:4680
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 57860475CD8334E66D40FEA22B6898C9
  2⤵
  - Loads dropped DLL
  PID:4420
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1C14B812537D2888912D7E54128CE957
  2⤵
  - Checks BIOS information in registry
  - Loads dropped DLL
  - Enumerates system info in registry
  PID:1828
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 4E5438E8FD015C0552EFE45C06FBE67B E Global\MSI0000
  2⤵
  - Loads dropped DLL
  PID:1536
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A0E3C1682EC336772858C64D06F16804 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1592
- - C:\Windows\WindowsMobile\InstallForm.exe
    C:\Windows\WindowsMobile\InstallForm.exe Install
    3⤵
    - Executes dropped EXE
    PID:2896

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:1496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "1" "C:\Windows\WindowsMobile\Drivers\RNDIS\wcerndis.inf" "9" "4658cc0c3" "0000000000000148" "WinSta0\Default" "0000000000000160" "208" "C:\Windows\WindowsMobile\Drivers\RNDIS"
  2⤵
  - Drops file in System32 directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:2948
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "1" "C:\Windows\WindowsMobile\Drivers\Serial\wceusbsh.inf" "9" "4e3e87c83" "000000000000017C" "WinSta0\Default" "0000000000000180" "208" "C:\Windows\WindowsMobile\Drivers\Serial"
  2⤵
  - Drops file in System32 directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:4176
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "1" "C:\Windows\WindowsMobile\Drivers\WPD\wpdrapi.inf" "9" "448c3e0d7" "0000000000000180" "WinSta0\Default" "0000000000000184" "208" "C:\Windows\WindowsMobile\Drivers\WPD"
  2⤵
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:4772
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "1" "C:\Windows\WindowsMobile\Drivers\Bluetooth\wcebth.inf" "9" "410b0571b" "0000000000000184" "WinSta0\Default" "0000000000000148" "208" "C:\Windows\WindowsMobile\Drivers\Bluetooth"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:2548
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "1" "0" "windowsmobiledriverinstaller\UMB\2&26a98e85&0&{AC011C27-CDDE-4DAD-A83D-714DF8D22930}" "" "" "4424e9997" "0000000000000000"
  2⤵
  - Sets DLL path for service in the registry
  - Loads dropped DLL
  - Registers COM server for autorun
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4268
- - C:\Windows\WindowsMobile\setup.exe
    C:\Windows\WindowsMobile\setup.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Suspicious use of WriteProcessMemory
    PID:380
  - - C:\Windows\WindowsMobile\wmdcBase.exe
      "C:\Windows\WindowsMobile\wmdcBase.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4552
  - - C:\Windows\WindowsMobile\wmdc.exe
      "C:\Windows\WindowsMobile\wmdc.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2832
    - - C:\Windows\system32\pcaui.exe
        
        "C:\Windows\system32\pcaui.exe" -g {11111111-1111-1111-1111-111111111111} -x {f58ec02d-77c3-4891-9583-49fd51990df1} -a "Windows Mobile Device Center 6.1" -v "Microsoft" -s "To work properly, this app must be reinstalled after you upgrade Windows." -n 4 -f 0 -k 0 -e "C:\Windows\WindowsMobile\wmdc.exe"
        5⤵
        
        PID:4244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WindowsMobile -s RapiMgr
1⤵
- Loads dropped DLL
PID:4952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WindowsMobile -s WcesComm
1⤵
- Loads dropped DLL
PID:60

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WindowsMobile -s WcesComm
1⤵
- Loads dropped DLL
PID:4368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery