pid	Process
380	MsiExec.exe
4740	KeyScramblerLogon.exe
4740	KeyScramblerLogon.exe

flow	pid	Process
26	3560	msiexec.exe
27	3560	msiexec.exe
29	3560	msiexec.exe
31	3560	msiexec.exe

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

description	ioc	Process
File created	C:\Windows\Installer\SourceHash{DDF6203D-8744-4725-BE80-0CC782D3696F}	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	EXPAND.EXE
File opened for modification	C:\Windows\Installer\e59f795.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF94A.tmp	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	EXPAND.EXE
File created	C:\Windows\Installer\e59f795.msi	msiexec.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000001d6f92995d065bd40000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800001d6f92990000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809001d6f9299000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d1d6f9299000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000001d6f929900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Autoit3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Autoit3.exe

description	pid	Process
Token: SeShutdownPrivilege	3560	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3560	msiexec.exe
Token: SeSecurityPrivilege	792	msiexec.exe
Token: SeCreateTokenPrivilege	3560	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3560	msiexec.exe
Token: SeLockMemoryPrivilege	3560	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3560	msiexec.exe
Token: SeMachineAccountPrivilege	3560	msiexec.exe
Token: SeTcbPrivilege	3560	msiexec.exe
Token: SeSecurityPrivilege	3560	msiexec.exe
Token: SeTakeOwnershipPrivilege	3560	msiexec.exe
Token: SeLoadDriverPrivilege	3560	msiexec.exe
Token: SeSystemProfilePrivilege	3560	msiexec.exe
Token: SeSystemtimePrivilege	3560	msiexec.exe
Token: SeProfSingleProcessPrivilege	3560	msiexec.exe
Token: SeIncBasePriorityPrivilege	3560	msiexec.exe
Token: SeCreatePagefilePrivilege	3560	msiexec.exe
Token: SeCreatePermanentPrivilege	3560	msiexec.exe
Token: SeBackupPrivilege	3560	msiexec.exe
Token: SeRestorePrivilege	3560	msiexec.exe
Token: SeShutdownPrivilege	3560	msiexec.exe
Token: SeDebugPrivilege	3560	msiexec.exe
Token: SeAuditPrivilege	3560	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3560	msiexec.exe
Token: SeChangeNotifyPrivilege	3560	msiexec.exe
Token: SeRemoteShutdownPrivilege	3560	msiexec.exe
Token: SeUndockPrivilege	3560	msiexec.exe
Token: SeSyncAgentPrivilege	3560	msiexec.exe
Token: SeEnableDelegationPrivilege	3560	msiexec.exe
Token: SeManageVolumePrivilege	3560	msiexec.exe
Token: SeImpersonatePrivilege	3560	msiexec.exe
Token: SeCreateGlobalPrivilege	3560	msiexec.exe
Token: SeBackupPrivilege	1028	vssvc.exe
Token: SeRestorePrivilege	1028	vssvc.exe
Token: SeAuditPrivilege	1028	vssvc.exe
Token: SeBackupPrivilege	792	msiexec.exe
Token: SeRestorePrivilege	792	msiexec.exe
Token: SeRestorePrivilege	792	msiexec.exe
Token: SeTakeOwnershipPrivilege	792	msiexec.exe
Token: SeRestorePrivilege	792	msiexec.exe
Token: SeTakeOwnershipPrivilege	792	msiexec.exe
Token: SeBackupPrivilege	3028	srtasks.exe
Token: SeRestorePrivilege	3028	srtasks.exe
Token: SeSecurityPrivilege	3028	srtasks.exe
Token: SeTakeOwnershipPrivilege	3028	srtasks.exe
Token: SeBackupPrivilege	3028	srtasks.exe
Token: SeRestorePrivilege	3028	srtasks.exe
Token: SeSecurityPrivilege	3028	srtasks.exe
Token: SeTakeOwnershipPrivilege	3028	srtasks.exe

description	pid	Process	procid_target
PID 792 wrote to memory of 3028	792	msiexec.exe	102
PID 792 wrote to memory of 3028	792	msiexec.exe	102
PID 792 wrote to memory of 380	792	msiexec.exe	104
PID 792 wrote to memory of 380	792	msiexec.exe	104
PID 792 wrote to memory of 380	792	msiexec.exe	104
PID 380 wrote to memory of 2156	380	MsiExec.exe	105
PID 380 wrote to memory of 2156	380	MsiExec.exe	105
PID 380 wrote to memory of 2156	380	MsiExec.exe	105
PID 380 wrote to memory of 4108	380	MsiExec.exe	107
PID 380 wrote to memory of 4108	380	MsiExec.exe	107
PID 380 wrote to memory of 4108	380	MsiExec.exe	107
PID 380 wrote to memory of 4740	380	MsiExec.exe	109
PID 380 wrote to memory of 4740	380	MsiExec.exe	109
PID 380 wrote to memory of 4740	380	MsiExec.exe	109
PID 4740 wrote to memory of 1916	4740	KeyScramblerLogon.exe	110
PID 4740 wrote to memory of 1916	4740	KeyScramblerLogon.exe	110
PID 4740 wrote to memory of 1916	4740	KeyScramblerLogon.exe	110
PID 1916 wrote to memory of 892	1916	cmd.exe	113
PID 1916 wrote to memory of 892	1916	cmd.exe	113
PID 1916 wrote to memory of 892	1916	cmd.exe	113
PID 1916 wrote to memory of 472	1916	cmd.exe	115
PID 1916 wrote to memory of 472	1916	cmd.exe	115
PID 1916 wrote to memory of 472	1916	cmd.exe	115
PID 1916 wrote to memory of 3564	1916	cmd.exe	116
PID 1916 wrote to memory of 3564	1916	cmd.exe	116
PID 1916 wrote to memory of 3564	1916	cmd.exe	116
PID 380 wrote to memory of 2532	380	MsiExec.exe	118
PID 380 wrote to memory of 2532	380	MsiExec.exe	118
PID 380 wrote to memory of 2532	380	MsiExec.exe	118
PID 380 wrote to memory of 224	380	MsiExec.exe	119
PID 380 wrote to memory of 224	380	MsiExec.exe	119
PID 380 wrote to memory of 224	380	MsiExec.exe	119

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads