32d091a86c5a0323dd8d2ccc195427f8e798f88fae9bbb814fbbadcadfe26ba7

Modify Registry

Processes:

DrvInst.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\RapiMgr\Parameters\ServiceDll = "%windir%\\WindowsMobile\\rapimgr.dll"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WcesComm\Parameters\ServiceDll = "%windir%\\WindowsMobile\\wcescomm.dll"	DrvInst.exe

Checks BIOS information in registry 2 TTPs 3 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

MsiExec.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	MsiExec.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

InstallForm.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Control Panel\International\Geo\Nation	InstallForm.exe

Executes dropped EXE 6 IoCs

Processes:

driver_setup.exesetup.exewmdcBase.exeInstallForm.exewmdc.exe

pid	Process
1692	driver_setup.exe
1384
1636	setup.exe
2148	wmdcBase.exe
2808	InstallForm.exe
1484	wmdc.exe

Loads dropped DLL 49 IoCs

Processes:

af48efac2b7d97cc0b70559a0a2be8cfeae961306ed16f0c91706a3bef6d61fc.exeMsiExec.exeMsiExec.exeMsiExec.exeDrvInst.exesvchost.exesetup.exewmdcBase.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exewmdc.exe

pid	Process
1768	af48efac2b7d97cc0b70559a0a2be8cfeae961306ed16f0c91706a3bef6d61fc.exe
1384
2308	MsiExec.exe
2976	MsiExec.exe
2976	MsiExec.exe
380	MsiExec.exe
380	MsiExec.exe
380	MsiExec.exe
380	MsiExec.exe
2976	MsiExec.exe
2456	DrvInst.exe
2456	DrvInst.exe
468
468
468
468
2772	svchost.exe
2772	svchost.exe
2772	svchost.exe
2772	svchost.exe
2772	svchost.exe
2772	svchost.exe
2772	svchost.exe
2456	DrvInst.exe
1636	setup.exe
2148	wmdcBase.exe
2148	wmdcBase.exe
2148	wmdcBase.exe
2148	wmdcBase.exe
2772	svchost.exe
2148	wmdcBase.exe
380	MsiExec.exe
1384
1572	MsiExec.exe
592	MsiExec.exe
2040	MsiExec.exe
2040	MsiExec.exe
2040	MsiExec.exe
2888	MsiExec.exe
2888	MsiExec.exe
1572	MsiExec.exe
1572	MsiExec.exe
1384
1636	setup.exe
1484	wmdc.exe
1484	wmdc.exe
1484	wmdc.exe
1484	wmdc.exe
1484	wmdc.exe

Registers COM server for autorun 1 TTPs 45 IoCs

persistence

Registry Run Keys / Startup Folder

Processes:

DrvInst.exemsiexec.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4ED4A55B-629E-4B3D-9F18-86CCE9581262}\InProcServer32\ = "%windir%\\system32\\WcesCommProxy.dll"	DrvInst.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{3B5AA27A-CBF9-48C9-96F8-4ACE84FB8512}\InprocServer32\6.1.0.0	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD073990-9104-45d9-9DF8-AE6B31F7C67D}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{35440327-1517-4B72-865E-3FFE8E97002F}\InprocServer32	DrvInst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{499C0C20-A766-11CF-8011-00A0C90A8F78}\InprocServer32	DrvInst.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{52959703-387A-43D6-9746-75CC08DFB3F9}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{52959703-387A-43D6-9746-75CC08DFB3F9}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6B7AD2F5-32BF-4b5c-ABEA-FB123102E9AE}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1A52C610-B080-4f7d-9277-6F89AA966620}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4ED4A55B-629E-4B3D-9F18-86CCE9581262}\InProcServer32	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{86A0B54A-5721-41b4-A3F1-81C6531B7D22}\InprocServer32\ = "%windir%\\WindowsMobile\\BthASPlugin.dll"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{86A0B54A-5721-41b4-A3F1-81C6531B7D22}\InprocServer32\ThreadingModel = "Free"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6B7AD2F5-32BF-4b5c-ABEA-FB123102E9AE}\LocalServer32\ = "%windir%\\WindowsMobile\\wmdc.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3B5AA27A-CBF9-48C9-96F8-4ACE84FB8512}\InprocServer32\Assembly = "Microsoft.WindowsMobile.DeviceManager, Version=6.1.0.0, Culture=neutral"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3B5AA27A-CBF9-48C9-96F8-4ACE84FB8512}\InprocServer32\6.1.0.0\RuntimeVersion = "v2.0.50727"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{CD073990-9104-45d9-9DF8-AE6B31F7C67D}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DCBEB807-14D0-4CBD-926C-B991F4FD1B91}\InprocServer32\ = "%windir%\\system32\\rapiproxystub.dll"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{499C0C20-A766-11CF-8011-00A0C90A8F78}\InprocServer32\ThreadingModel = "Both"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3B5AA27A-CBF9-48C9-96F8-4ACE84FB8512}\InprocServer32\6.1.0.0\Class = "Microsoft.WindowsMobile.WindowsMobileFactory"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DCBEB807-14D0-4CBD-926C-B991F4FD1B91}\InprocServer32\ThreadingModel = "Both"	DrvInst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{412E4330-A2EA-4A1C-B723-873E5FA1C618}\InProcServer32	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{35440327-1517-4B72-865E-3FFE8E97002F}\InprocServer32\ = "%windir%\\system32\\rapistub.dll"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{499C0C20-A766-11CF-8011-00A0C90A8F78}\InprocServer32\ = "%windir%\\system32\\rapi.dll"	DrvInst.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{3B5AA27A-CBF9-48C9-96F8-4ACE84FB8512}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{1A52C610-B080-4f7d-9277-6F89AA966620}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DCBEB807-14D0-4CBD-926C-B991F4FD1B91}\InprocServer32	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{52959703-387A-43D6-9746-75CC08DFB3F9}\InprocServer32\ = "C:\\Windows\\WindowsMobile\\wmdsyncproxy.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3B5AA27A-CBF9-48C9-96F8-4ACE84FB8512}\InprocServer32\Class = "Microsoft.WindowsMobile.WindowsMobileFactory"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD073990-9104-45d9-9DF8-AE6B31F7C67D}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1A52C610-B080-4f7d-9277-6F89AA966620}\InprocServer32\ = "C:\\Windows\\WindowsMobile\\wmdsyncman.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{122CC07F-3333-42aa-9ABC-6BAE729A4C85}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4ED4A55B-629E-4B3D-9F18-86CCE9581262}\InProcServer32\ThreadingModel = "Both"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{412E4330-A2EA-4A1C-B723-873E5FA1C618}\InProcServer32\ = "%windir%\\system32\\wcescommproxy.dll"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{35440327-1517-4B72-865E-3FFE8E97002F}\InprocServer32\ThreadingModel = "Both"	DrvInst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{86A0B54A-5721-41b4-A3F1-81C6531B7D22}\InprocServer32	DrvInst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{52959703-387A-43D6-9746-75CC08DFB3F9}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3B5AA27A-CBF9-48C9-96F8-4ACE84FB8512}\InprocServer32\6.1.0.0\Assembly = "Microsoft.WindowsMobile.DeviceManager, Version=6.1.0.0, Culture=neutral"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{122CC07F-3333-42aa-9ABC-6BAE729A4C85}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{412E4330-A2EA-4A1C-B723-873E5FA1C618}\InProcServer32\ThreadingModel = "Both"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3B5AA27A-CBF9-48C9-96F8-4ACE84FB8512}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3B5AA27A-CBF9-48C9-96F8-4ACE84FB8512}\InprocServer32\RuntimeVersion = "v2.0.50727"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3B5AA27A-CBF9-48C9-96F8-4ACE84FB8512}\InprocServer32\ = "mscoree.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3B5AA27A-CBF9-48C9-96F8-4ACE84FB8512}\InprocServer32\6.1.0.0\	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD073990-9104-45d9-9DF8-AE6B31F7C67D}\InprocServer32\ = "C:\\Windows\\WindowsMobile\\wmdsyncman.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{122CC07F-3333-42aa-9ABC-6BAE729A4C85}\InprocServer32\ = "C:\\Windows\\WindowsMobile\\inplace.dll"	msiexec.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

af48efac2b7d97cc0b70559a0a2be8cfeae961306ed16f0c91706a3bef6d61fc.exeDrvInst.exemsiexec.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	af48efac2b7d97cc0b70559a0a2be8cfeae961306ed16f0c91706a3bef6d61fc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Mobile-based device management = "%windir%\\WindowsMobile\\wmdcBase.exe"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Mobile Device Center = "%windir%\\WindowsMobile\\wmdc.exe"	msiexec.exe

Drops desktop.ini file(s) 1 IoCs

Processes:

msiexec.exe

description	ioc	Process
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	msiexec.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

msiexec.exesetup.exedriver_setup.exeDrvInst.exe

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	setup.exe
File opened (read-only)	\??\G:	setup.exe
File opened (read-only)	\??\H:	setup.exe
File opened (read-only)	\??\H:	driver_setup.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	DrvInst.exe
File opened (read-only)	\??\S:	DrvInst.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\U:	DrvInst.exe
File opened (read-only)	\??\I:	DrvInst.exe
File opened (read-only)	\??\O:	DrvInst.exe
File opened (read-only)	\??\I:	setup.exe
File opened (read-only)	\??\L:	setup.exe
File opened (read-only)	\??\K:	driver_setup.exe
File opened (read-only)	\??\X:	driver_setup.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\A:	DrvInst.exe
File opened (read-only)	\??\U:	setup.exe
File opened (read-only)	\??\Y:	setup.exe
File opened (read-only)	\??\X:	setup.exe
File opened (read-only)	\??\M:	DrvInst.exe
File opened (read-only)	\??\Q:	DrvInst.exe
File opened (read-only)	\??\X:	DrvInst.exe
File opened (read-only)	\??\Y:	DrvInst.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\W:	DrvInst.exe
File opened (read-only)	\??\A:	setup.exe
File opened (read-only)	\??\J:	setup.exe
File opened (read-only)	\??\M:	driver_setup.exe
File opened (read-only)	\??\U:	driver_setup.exe
File opened (read-only)	\??\V:	driver_setup.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	setup.exe
File opened (read-only)	\??\R:	setup.exe
File opened (read-only)	\??\I:	driver_setup.exe
File opened (read-only)	\??\P:	driver_setup.exe
File opened (read-only)	\??\Z:	driver_setup.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\B:	DrvInst.exe
File opened (read-only)	\??\W:	setup.exe
File opened (read-only)	\??\Z:	setup.exe
File opened (read-only)	\??\W:	driver_setup.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\N:	setup.exe
File opened (read-only)	\??\T:	driver_setup.exe
File opened (read-only)	\??\L:	DrvInst.exe
File opened (read-only)	\??\P:	DrvInst.exe
File opened (read-only)	\??\T:	DrvInst.exe
File opened (read-only)	\??\P:	setup.exe
File opened (read-only)	\??\S:	driver_setup.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\G:	DrvInst.exe
File opened (read-only)	\??\J:	DrvInst.exe
File opened (read-only)	\??\N:	DrvInst.exe
File opened (read-only)	\??\O:	setup.exe

Drops file in System32 directory 64 IoCs

Processes:

DrvInst.exeDrvInst.exeDrvInst.exeDrvInst.exe

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\Temp\{514bbee2-02e8-0c31-0ec5-190712784a08}\pt-BR\pt-BR-wmdConn.cpl.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4e1eded1-1154-1be6-0b4f-1b1b6b6b2831}\SET8218.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{0606cf0d-5247-658a-fbbf-cf1bd9261003}\nb-NO\SETA804.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wcebth.inf_amd64_neutral_92cde66e1cfb521e\wcebth.PNF	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{514bbee2-02e8-0c31-0ec5-190712784a08}\nb-NO\nb-NO-setup.exe.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4e1eded1-1154-1be6-0b4f-1b1b6b6b2831}\pl-PL\SET84D1.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4e1eded1-1154-1be6-0b4f-1b1b6b6b2831}\ja-JP	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0606cf0d-5247-658a-fbbf-cf1bd9261003}\SETA585.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{0606cf0d-5247-658a-fbbf-cf1bd9261003}\fi-FI\SETA67E.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0606cf0d-5247-658a-fbbf-cf1bd9261003}\nl-NL\SETA8C7.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{514bbee2-02e8-0c31-0ec5-190712784a08}\ru-RU\ru-RU-wcescomm.dll.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4e1eded1-1154-1be6-0b4f-1b1b6b6b2831}\zh-TW\zh-TW-setup.exe.mui	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{4e1eded1-1154-1be6-0b4f-1b1b6b6b2831}\SET8218.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{4e1eded1-1154-1be6-0b4f-1b1b6b6b2831}\da-DK\SET8294.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0606cf0d-5247-658a-fbbf-cf1bd9261003}\it-IT\SETA97C.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0606cf0d-5247-658a-fbbf-cf1bd9261003}\it-IT\it-IT-setup.exe.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0606cf0d-5247-658a-fbbf-cf1bd9261003}\pt-PT\pt-PT-wcescomm.dll.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{514bbee2-02e8-0c31-0ec5-190712784a08}\ro-RO\SET5720.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{514bbee2-02e8-0c31-0ec5-190712784a08}\zh-CN\SET54EC.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4e1eded1-1154-1be6-0b4f-1b1b6b6b2831}\de-DE\de-DE-wcescomm.dll.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4e1eded1-1154-1be6-0b4f-1b1b6b6b2831}\pt-BR\pt-BR-wmdConn.cpl.mui	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{0606cf0d-5247-658a-fbbf-cf1bd9261003}\fi-FI\SETA67F.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{0606cf0d-5247-658a-fbbf-cf1bd9261003}\pt-PT\SETAA73.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{514bbee2-02e8-0c31-0ec5-190712784a08}\fr-FR\fr-FR-wcescomm.dll.mui	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{4e1eded1-1154-1be6-0b4f-1b1b6b6b2831}\zh-TW\SET8118.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{0606cf0d-5247-658a-fbbf-cf1bd9261003}\es-ES\SETA849.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{514bbee2-02e8-0c31-0ec5-190712784a08}\zh-TW\zh-TW-wmdConn.cpl.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4e1eded1-1154-1be6-0b4f-1b1b6b6b2831}\ru-RU\ru-RU-wcescomm.dll.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4e1eded1-1154-1be6-0b4f-1b1b6b6b2831}\de-DE	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{0606cf0d-5247-658a-fbbf-cf1bd9261003}\ru-RU\SETA54E.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0606cf0d-5247-658a-fbbf-cf1bd9261003}\wmcoinst-070531-0952.dll	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\SETC9CC.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{514bbee2-02e8-0c31-0ec5-190712784a08}\wow64-rapispxy.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{514bbee2-02e8-0c31-0ec5-190712784a08}\pt-PT\SET5764.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{4e1eded1-1154-1be6-0b4f-1b1b6b6b2831}\SET81E7.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4e1eded1-1154-1be6-0b4f-1b1b6b6b2831}\sk-SK\SET8583.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{514bbee2-02e8-0c31-0ec5-190712784a08}\ro-RO\ro-RO-wmdc.exe.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4e1eded1-1154-1be6-0b4f-1b1b6b6b2831}\SET822A.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{0606cf0d-5247-658a-fbbf-cf1bd9261003}\SETA5AA.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0606cf0d-5247-658a-fbbf-cf1bd9261003}\nb-NO	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{514bbee2-02e8-0c31-0ec5-190712784a08}\sv-SE\sv-SE-setup.exe.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{514bbee2-02e8-0c31-0ec5-190712784a08}\ru-RU\SET5168.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{514bbee2-02e8-0c31-0ec5-190712784a08}\it-IT\SET5661.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{4e1eded1-1154-1be6-0b4f-1b1b6b6b2831}\sv-SE\SET8614.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{0606cf0d-5247-658a-fbbf-cf1bd9261003}\pt-BR\SETA927.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{514bbee2-02e8-0c31-0ec5-190712784a08}\zh-TW\zh-TW-wcescomm.dll.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{514bbee2-02e8-0c31-0ec5-190712784a08}\cs-CZ\SET54B8.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{0606cf0d-5247-658a-fbbf-cf1bd9261003}\sv-SE\SETA9FB.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{514bbee2-02e8-0c31-0ec5-190712784a08}\SET5179.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4e1eded1-1154-1be6-0b4f-1b1b6b6b2831}\zh-TW\zh-TW-wcescomm.dll.mui	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{0606cf0d-5247-658a-fbbf-cf1bd9261003}\SETA598.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0606cf0d-5247-658a-fbbf-cf1bd9261003}\zh-CN\zh-CN-wcescomm.dll.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0606cf0d-5247-658a-fbbf-cf1bd9261003}\ko-KR\ko-KR-wcescomm.dll.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{514bbee2-02e8-0c31-0ec5-190712784a08}\sk-SK	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4e1eded1-1154-1be6-0b4f-1b1b6b6b2831}\fr-FR\SET83FC.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4e1eded1-1154-1be6-0b4f-1b1b6b6b2831}\it-IT\it-IT-setup.exe.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0606cf0d-5247-658a-fbbf-cf1bd9261003}\zh-TW\SETA52B.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0606cf0d-5247-658a-fbbf-cf1bd9261003}\zh-TW\SETA54D.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0606cf0d-5247-658a-fbbf-cf1bd9261003}\wmupdate.msi	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{0606cf0d-5247-658a-fbbf-cf1bd9261003}\nb-NO\SETA806.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{514bbee2-02e8-0c31-0ec5-190712784a08}\hu-HU\hu-HU-rapimgr.dll.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{514bbee2-02e8-0c31-0ec5-190712784a08}\ja-JP\SET5396.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{514bbee2-02e8-0c31-0ec5-190712784a08}\nb-NO\nb-NO-wmdc.exe.mui	DrvInst.exe
File created	C:\Windows\System32\DriverStore\INFCACHE.0	DrvInst.exe

Drops file in Windows directory 64 IoCs

Processes:

DrvInst.exemsiexec.exe

description	ioc	Process
File opened for modification	C:\Windows\WindowsMobile\ro-RO\setup.exe.mui	DrvInst.exe
File opened for modification	C:\Windows\WindowsMobile\tr-TR\SETEC65.tmp	DrvInst.exe
File created	C:\Windows\WindowsMobile\cs-CZ\eula.rtf	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\RNDIS\it-it\it-it-setup.exe.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\RNDIS\ro-ro\ro-ro-wmdConn.cpl.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\Serial\fi-fi\fi-fi-wmdc.exe.mui	msiexec.exe
File opened for modification	C:\Windows\WindowsMobile\ko-KR\wmdConn.cpl.mui	DrvInst.exe
File created	C:\Windows\WindowsMobile\pl-PL\SETE168.tmp	DrvInst.exe
File created	C:\Windows\WindowsMobile\ru-RU\Inkx.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\ru-RU\riresdll.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\RNDIS\pt-br\pt-br-wmdConn.cpl.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\Bluetooth\pt-pt\pt-pt-wcescomm.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\it-IT\olregdll.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\it\Microsoft.WindowsMobile.DeviceCenter.resources.dll	msiexec.exe
File created	C:\Windows\WindowsMobile\ru-RU\InkProps.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\fr-FR\inplace.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\nb-NO\INetRepl.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\pl-PL\ceappmgr.exe.mui	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1CE4.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File created	C:\Windows\WindowsMobile\Microsoft.WindowsMobile.DeviceManager.dll	msiexec.exe
File created	C:\Windows\WindowsMobile\es-ES\wmdc.exe.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\fr-FR\BakRestr.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\RNDIS\nl-nl\nl-nl-wmdConn.cpl.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\Serial\es-es\es-es-wmdConn.cpl.mui	msiexec.exe
File opened for modification	C:\Windows\WindowsMobile\zh-CN\SETED91.tmp	DrvInst.exe
File created	C:\Windows\WindowsMobile\en-US\mailsync.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\cs-CZ\wmdc.exe.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Help\sv-SE\wm_devmgr.chm	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\Bluetooth\wcescomm.dll	msiexec.exe
File opened for modification	C:\Windows\WindowsMobile\fi-FI\wmdConn.cpl.mui	DrvInst.exe
File created	C:\Windows\WindowsMobile\it-IT\SETDC93.tmp	DrvInst.exe
File opened for modification	C:\Windows\WindowsMobile\pl-PL\SETE198.tmp	DrvInst.exe
File opened for modification	C:\Windows\WindowsMobile\ru-RU\SETE763.tmp	DrvInst.exe
File created	C:\Windows\Installer\f7718df.ipi	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\RNDIS\btplugin.dll	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\Bluetooth\el-gr\el-gr-setup.exe.mui	msiexec.exe
File opened for modification	C:\Windows\WindowsMobile\nl-NL\SETDF1F.tmp	DrvInst.exe
File created	C:\Windows\WindowsMobile\es-ES\httpsys.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\Bluetooth\ja-jp\ja-jp-wcescomm.dll.mui	msiexec.exe
File opened for modification	C:\Windows\WindowsMobile\en-US\wmdConn.cpl.mui	DrvInst.exe
File opened for modification	C:\Windows\WindowsMobile\hu-HU\rapimgr.dll.mui	DrvInst.exe
File created	C:\Windows\WindowsMobile\ru-RU\SETE7A3.tmp	DrvInst.exe
File created	C:\Windows\WindowsMobile\fr\Microsoft.WindowsMobile.DeviceManager.resources.dll	msiexec.exe
File opened for modification	C:\Windows\WindowsMobile\de-DE\setup.exe.mui	DrvInst.exe
File created	C:\Windows\WindowsMobile\zh-TW\SETEEDE.tmp	DrvInst.exe
File created	C:\Windows\Installer\f7718e2.msi	msiexec.exe
File created	C:\Windows\WindowsMobile\fi-FI\VComCtl.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\tr-TR\httpsys.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\RNDIS\cs-cz\cs-cz-setup.exe.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\nb-NO\riresdll.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\zh-TW\riresdll.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\ro\Microsoft.WindowsMobile.DeviceManager.resources.dll	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\RNDIS\sk-sk\sk-sk-setup.exe.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\Serial\hu-hu\hu-hu-wcescomm.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\ko-KR\Inkx.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\nl-NL\outstore.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\pl-PL\VComCtl.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\fr-FR\VComCtl.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\ko-KR\AirSyncEngine.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\pt-PT\CEFStore.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\Serial\wow64-rapispxy.dll	msiexec.exe
File opened for modification	C:\Windows\WindowsMobile\de-DE\SETCF39.tmp	DrvInst.exe
File opened for modification	C:\Windows\WindowsMobile\ja-JP\SETD1C2.tmp	DrvInst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

System Information Discovery

Processes:

MsiExec.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosDate	MsiExec.exe

Modifies Internet Explorer settings 1 TTPs 15 IoCs

adware spyware

Modify Registry

Processes:

msiexec.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB1-070F-11D3-9307-00C04FAE2D4F}\CLSID = "{1FBA04EE-3024-11D2-8F1F-0000F87ABD16}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB1-070F-11D3-9307-00C04FAE2D4F}\Icon = "C:\\Windows\\WindowsMobile\\INetRepl.dll,210"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB1-070F-11D3-9307-00C04FAE2D4F}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB1-070F-11D3-9307-00C04FAE2D4F}\ButtonText = "@C:\\Windows\\WindowsMobile\\INetRepl.dll,-222"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB2-070F-11D3-9307-00C04FAE2D4F}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB2-070F-11D3-9307-00C04FAE2D4F}\MenuCustomize = "Tools"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB1-070F-11D3-9307-00C04FAE2D4F}\clsidExtension = "{2EAF5BB0-070F-11D3-9307-00C04FAE2D4F}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB1-070F-11D3-9307-00C04FAE2D4F}\	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB2-070F-11D3-9307-00C04FAE2D4F}\	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB1-070F-11D3-9307-00C04FAE2D4F}\Default Visible = "Yes"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB1-070F-11D3-9307-00C04FAE2D4F}\HotIcon = "C:\\Windows\\WindowsMobile\\INetRepl.dll,211"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB2-070F-11D3-9307-00C04FAE2D4F}\CLSID = "{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB2-070F-11D3-9307-00C04FAE2D4F}\clsidExtension = "{2EAF5BB0-070F-11D3-9307-00C04FAE2D4F}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB2-070F-11D3-9307-00C04FAE2D4F}\MenuText = "@C:\\Windows\\WindowsMobile\\INetRepl.dll,-223"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB2-070F-11D3-9307-00C04FAE2D4F}\MenuStatusBar = "@C:\\Windows\\WindowsMobile\\INetRepl.dll,-224"	msiexec.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

DrvInst.exeDrvInst.exeDrvInst.exeDrvInst.exeDrvInst.exeDrvInst.exeDrvInst.exemsiexec.exeDrvInst.exeDrvInst.exeMsiExec.exe

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2f\52C64B7E	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2F\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\system32\qagentrt.dll,-10 = "System Health Authentication"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2F\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe

Modifies registry class 64 IoCs

Processes:

msiexec.exeDrvInst.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\63ACBD2914B91DD449A1EA1D94DD730F\WPDDriver = "WindowsMobileDeviceCenter"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\INetRepl.ReplInet\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F7E1C96B-781E-11D2-AAB7-00C04FAE2D4C}\ProgID\ = "INetRepl.ReplInet.1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{52959703-387A-43D6-9746-75CC08DFB3F9}\ProxyStubClsid32\ = "{52959703-387A-43D6-9746-75CC08DFB3F9}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DCBEB807-14D0-4CBD-926C-B991F4FD1B91}\ProxyStubClsid32\ = "{DCBEB807-14D0-4CBD-926C-B991F4FD1B91}"	DrvInst.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{BF765622-C5EF-11DB-B1CD-0D5656D89593}\ProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{122CC07F-3333-42aa-9ABC-6BAE729A4C85}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{23BAB749-F1B0-4AFB-9D19-E622E378F0AB}\NumMethods\ = "8"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{258A260C-95CF-46F0-ACFE-695D6463C190}\ProxyStubClsid32\ = "{DCBEB807-14D0-4CBD-926C-B991F4FD1B91}"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BF765622-C5EF-11DB-B1CD-0D5656D89593}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{5C65DC2A-78E6-11D2-9852-00C04F8ECDC8}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{27114E1C-5712-4FFB-88F0-CEA0288E7CF5}\ProxyStubClsid32\ = "{DCBEB807-14D0-4CBD-926C-B991F4FD1B91}"	DrvInst.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{661a448a-1816-11db-9616-00e08161165f}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1A52C610-B080-4f7d-9277-6F89AA966620}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63ACBD2914B91DD449A1EA1D94DD730F\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E24E3CC0-192C-4F1D-BC5F-C14349F1D418}\NumMethods\ = "12"	DrvInst.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{9D6B4DF1-5197-4167-B8D5-6BD71561BE87}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B49696CB-1CA4-491f-972A-246EB554069B}\ProxyStubClsid32\ = "{52959703-387A-43D6-9746-75CC08DFB3F9}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{60C456FC-26CC-410d-85A3-E949C7F51534}\NumMethods	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Microsoft.AirSyncEngine.Desktop\CLSID	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{928F538A-195A-4CCB-B1F1-DEB8393A0469}\NumMethods	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.WcesShared\ = "Microsoft.WcesShared.1"	DrvInst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9BDE217E-C5E8-11DB-AD95-482856D89593}\NumMethods	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9BDE217E-C5E8-11DB-AD95-482856D89593}\NumMethods\ = "4"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{14601BBD-78B1-43CE-98CA-ADD8BAD63288}\ProxyStubClsid32\ = "{52959703-387A-43D6-9746-75CC08DFB3F9}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2C46EC31-15F2-11d2-8CE7-0000F80275D9}\AppID = "{21607919-AC56-4282-B2B3-C9B03972887B}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED081F25-6A77-4C89-B689-C6E15C582EC1}\ProgId\ = "Microsoft.RAPIMgr.1"	DrvInst.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{431C3DE2-C39E-11DB-931E-84FA55D89593}\NumMethods	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{35579C26-C5EF-11DB-B8D9-025356D89593}\ProxyStubClsid32\ = "{52959703-387A-43D6-9746-75CC08DFB3F9}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MS.WinCE.InkStore\ = "Microsoft Notes Synchronization"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3C4CFEBD-6B87-4909-88B9-9C39A796C2D2}\InprocServer32\ = "C:\\Windows\\WindowsMobile\\ASDsktpEng.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{EB3307E0-29BA-4d2d-95AB-98A8BF09C486}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{17C2DE21-04E1-42b9-9414-E0973E71657F}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{122CC07F-3333-42aa-9ABC-6BAE729A4C85}\ProgID\ = "MS.WinCE.CEFStore.InplaceUI"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\63ACBD2914B91DD449A1EA1D94DD730F\BluetoothDriver = "WindowsMobileDeviceCenter"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FF4C4832-2BEA-4472-98A3-F931BEB8F62B}\VersionIndpendentProgId	DrvInst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED081F25-6A77-4C89-B689-C6E15C582EC1}	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.WMDC.CertEnroll\CLSID\ = "{BF765622-C5EF-11DB-B1CD-0D5656D89593}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{BC73A398-3B96-43f5-8EEB-0EBB43B0791B}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{52959703-387A-43D6-9746-75CC08DFB3F9}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WMDC.AutoplayHandler\ = "Windows Mobile Device Center Autoplay"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MS.WinCE.CEFStore.InplaceUI	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{23BAB749-F1B0-4AFB-9D19-E622E378F0AB}\ProxyStubClsid32\ = "{DCBEB807-14D0-4CBD-926C-B991F4FD1B91}"	DrvInst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4475F45B-5612-4FE0-A324-8743E8885AAE}\NumMethods	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3BC2B6A7-36A0-4e42-A518-4D49FC698099}\NumMethods\ = "7"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{19a70ae6-18db-11db-9617-00e08161165f}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{357A557C-B03F-4240-90D8-C6C71C659BF1}\NumMethods\ = "8"	DrvInst.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{122CC07F-3333-42aa-9ABC-6BAE729A4C85}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63ACBD2914B91DD449A1EA1D94DD730F\ProductName = "Windows Mobile Device Center Driver Update"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{449FE623-24B0-454B-A889-129BB05DDBED}\NumMethods	DrvInst.exe
Key created	\REGISTRY\MACHINE\Software\Classes\VoiceCtl.VoiceCtrl.1\CLSID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{E2EDF157-338E-40F4-A79F-D70EEC32EF67}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{35440327-1517-4B72-865E-3FFE8E97002F}\InprocServer32	DrvInst.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{BF765622-C5EF-11DB-B1CD-0D5656D89593}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.AirSyncEngine.Desktop\ = "AirSync Desktop Engine"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3B5AA27A-CBF9-48C9-96F8-4ACE84FB8512}\InprocServer32\6.1.0.0\RuntimeVersion = "v2.0.50727"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D6433F5C-AF10-4855-88BB-D7C607094DFF}\NumMethods	DrvInst.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{76FD0DC0-2AF7-11D2-A502-00C04F8ECDC8}\ProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{BC73A398-3B96-43f5-8EEB-0EBB43B0791B}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{1A15B6A1-5CE7-482b-8D65-2D5E886296F3}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{77DCCB29-AE02-4A2B-B2FE-EA721F209864}\ProxyStubClsid32\ = "{77DCCB29-AE02-4A2B-B2FE-EA721F209864}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{AE2B3505-7E70-475F-86B4-782FAC03A0D1}\NumMethods	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C5297E5C-0642-4D74-B0CF-04AED816AA38}\NumMethods\ = "13"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4ED4A55B-629E-4B3D-9F18-86CCE9581262}\ = "IDccManPriv"	DrvInst.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

msiexec.exe

pid	Process
624	msiexec.exe
624	msiexec.exe
624	msiexec.exe
624	msiexec.exe
624	msiexec.exe
624	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exedriver_setup.exe

description	pid	Process
Token: SeRestorePrivilege	624	msiexec.exe
Token: SeTakeOwnershipPrivilege	624	msiexec.exe
Token: SeSecurityPrivilege	624	msiexec.exe
Token: SeCreateTokenPrivilege	1692	driver_setup.exe
Token: SeAssignPrimaryTokenPrivilege	1692	driver_setup.exe
Token: SeLockMemoryPrivilege	1692	driver_setup.exe
Token: SeIncreaseQuotaPrivilege	1692	driver_setup.exe
Token: SeMachineAccountPrivilege	1692	driver_setup.exe
Token: SeTcbPrivilege	1692	driver_setup.exe
Token: SeSecurityPrivilege	1692	driver_setup.exe
Token: SeTakeOwnershipPrivilege	1692	driver_setup.exe
Token: SeLoadDriverPrivilege	1692	driver_setup.exe
Token: SeSystemProfilePrivilege	1692	driver_setup.exe
Token: SeSystemtimePrivilege	1692	driver_setup.exe
Token: SeProfSingleProcessPrivilege	1692	driver_setup.exe
Token: SeIncBasePriorityPrivilege	1692	driver_setup.exe
Token: SeCreatePagefilePrivilege	1692	driver_setup.exe
Token: SeCreatePermanentPrivilege	1692	driver_setup.exe
Token: SeBackupPrivilege	1692	driver_setup.exe
Token: SeRestorePrivilege	1692	driver_setup.exe
Token: SeShutdownPrivilege	1692	driver_setup.exe
Token: SeDebugPrivilege	1692	driver_setup.exe
Token: SeAuditPrivilege	1692	driver_setup.exe
Token: SeSystemEnvironmentPrivilege	1692	driver_setup.exe
Token: SeChangeNotifyPrivilege	1692	driver_setup.exe
Token: SeRemoteShutdownPrivilege	1692	driver_setup.exe
Token: SeUndockPrivilege	1692	driver_setup.exe
Token: SeSyncAgentPrivilege	1692	driver_setup.exe
Token: SeEnableDelegationPrivilege	1692	driver_setup.exe
Token: SeManageVolumePrivilege	1692	driver_setup.exe
Token: SeImpersonatePrivilege	1692	driver_setup.exe
Token: SeCreateGlobalPrivilege	1692	driver_setup.exe
Token: SeShutdownPrivilege	1692	driver_setup.exe
Token: SeIncreaseQuotaPrivilege	1692	driver_setup.exe
Token: SeCreateTokenPrivilege	1692	driver_setup.exe
Token: SeAssignPrimaryTokenPrivilege	1692	driver_setup.exe
Token: SeLockMemoryPrivilege	1692	driver_setup.exe
Token: SeIncreaseQuotaPrivilege	1692	driver_setup.exe
Token: SeMachineAccountPrivilege	1692	driver_setup.exe
Token: SeTcbPrivilege	1692	driver_setup.exe
Token: SeSecurityPrivilege	1692	driver_setup.exe
Token: SeTakeOwnershipPrivilege	1692	driver_setup.exe
Token: SeLoadDriverPrivilege	1692	driver_setup.exe
Token: SeSystemProfilePrivilege	1692	driver_setup.exe
Token: SeSystemtimePrivilege	1692	driver_setup.exe
Token: SeProfSingleProcessPrivilege	1692	driver_setup.exe
Token: SeIncBasePriorityPrivilege	1692	driver_setup.exe
Token: SeCreatePagefilePrivilege	1692	driver_setup.exe
Token: SeCreatePermanentPrivilege	1692	driver_setup.exe
Token: SeBackupPrivilege	1692	driver_setup.exe
Token: SeRestorePrivilege	1692	driver_setup.exe
Token: SeShutdownPrivilege	1692	driver_setup.exe
Token: SeDebugPrivilege	1692	driver_setup.exe
Token: SeAuditPrivilege	1692	driver_setup.exe
Token: SeSystemEnvironmentPrivilege	1692	driver_setup.exe
Token: SeChangeNotifyPrivilege	1692	driver_setup.exe
Token: SeRemoteShutdownPrivilege	1692	driver_setup.exe
Token: SeUndockPrivilege	1692	driver_setup.exe
Token: SeSyncAgentPrivilege	1692	driver_setup.exe
Token: SeEnableDelegationPrivilege	1692	driver_setup.exe
Token: SeManageVolumePrivilege	1692	driver_setup.exe
Token: SeImpersonatePrivilege	1692	driver_setup.exe
Token: SeCreateGlobalPrivilege	1692	driver_setup.exe
Token: SeCreateTokenPrivilege	1692	driver_setup.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

driver_setup.exedinotify.exe

pid	Process
1692	driver_setup.exe
1692	driver_setup.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

dinotify.exe

pid	Process
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe
2436	dinotify.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

af48efac2b7d97cc0b70559a0a2be8cfeae961306ed16f0c91706a3bef6d61fc.exemsiexec.exerundll32.exeDrvInst.exesetup.exeMsiExec.exe

description	pid	Process	procid_target
PID 1768 wrote to memory of 1692	1768	af48efac2b7d97cc0b70559a0a2be8cfeae961306ed16f0c91706a3bef6d61fc.exe	28
PID 1768 wrote to memory of 1692	1768	af48efac2b7d97cc0b70559a0a2be8cfeae961306ed16f0c91706a3bef6d61fc.exe	28
PID 1768 wrote to memory of 1692	1768	af48efac2b7d97cc0b70559a0a2be8cfeae961306ed16f0c91706a3bef6d61fc.exe	28
PID 624 wrote to memory of 2308	624	msiexec.exe	30
PID 624 wrote to memory of 2308	624	msiexec.exe	30
PID 624 wrote to memory of 2308	624	msiexec.exe	30
PID 624 wrote to memory of 2308	624	msiexec.exe	30
PID 624 wrote to memory of 2308	624	msiexec.exe	30
PID 624 wrote to memory of 2976	624	msiexec.exe	36
PID 624 wrote to memory of 2976	624	msiexec.exe	36
PID 624 wrote to memory of 2976	624	msiexec.exe	36
PID 624 wrote to memory of 2976	624	msiexec.exe	36
PID 624 wrote to memory of 2976	624	msiexec.exe	36
PID 624 wrote to memory of 380	624	msiexec.exe	37
PID 624 wrote to memory of 380	624	msiexec.exe	37
PID 624 wrote to memory of 380	624	msiexec.exe	37
PID 624 wrote to memory of 380	624	msiexec.exe	37
PID 624 wrote to memory of 380	624	msiexec.exe	37
PID 2952 wrote to memory of 2436	2952	rundll32.exe	45
PID 2952 wrote to memory of 2436	2952	rundll32.exe	45
PID 2952 wrote to memory of 2436	2952	rundll32.exe	45
PID 2456 wrote to memory of 1636	2456	DrvInst.exe	48
PID 2456 wrote to memory of 1636	2456	DrvInst.exe	48
PID 2456 wrote to memory of 1636	2456	DrvInst.exe	48
PID 1636 wrote to memory of 2148	1636	setup.exe	49
PID 1636 wrote to memory of 2148	1636	setup.exe	49
PID 1636 wrote to memory of 2148	1636	setup.exe	49
PID 624 wrote to memory of 380	624	msiexec.exe	51
PID 624 wrote to memory of 380	624	msiexec.exe	51
PID 624 wrote to memory of 380	624	msiexec.exe	51
PID 624 wrote to memory of 380	624	msiexec.exe	51
PID 624 wrote to memory of 380	624	msiexec.exe	51
PID 624 wrote to memory of 1572	624	msiexec.exe	53
PID 624 wrote to memory of 1572	624	msiexec.exe	53
PID 624 wrote to memory of 1572	624	msiexec.exe	53
PID 624 wrote to memory of 1572	624	msiexec.exe	53
PID 624 wrote to memory of 1572	624	msiexec.exe	53
PID 624 wrote to memory of 592	624	msiexec.exe	54
PID 624 wrote to memory of 592	624	msiexec.exe	54
PID 624 wrote to memory of 592	624	msiexec.exe	54
PID 624 wrote to memory of 592	624	msiexec.exe	54
PID 624 wrote to memory of 592	624	msiexec.exe	54
PID 624 wrote to memory of 592	624	msiexec.exe	54
PID 624 wrote to memory of 592	624	msiexec.exe	54
PID 624 wrote to memory of 2040	624	msiexec.exe	55
PID 624 wrote to memory of 2040	624	msiexec.exe	55
PID 624 wrote to memory of 2040	624	msiexec.exe	55
PID 624 wrote to memory of 2040	624	msiexec.exe	55
PID 624 wrote to memory of 2040	624	msiexec.exe	55
PID 624 wrote to memory of 2888	624	msiexec.exe	56
PID 624 wrote to memory of 2888	624	msiexec.exe	56
PID 624 wrote to memory of 2888	624	msiexec.exe	56
PID 624 wrote to memory of 2888	624	msiexec.exe	56
PID 624 wrote to memory of 2888	624	msiexec.exe	56
PID 624 wrote to memory of 2888	624	msiexec.exe	56
PID 624 wrote to memory of 2888	624	msiexec.exe	56
PID 2888 wrote to memory of 2808	2888	MsiExec.exe	57
PID 2888 wrote to memory of 2808	2888	MsiExec.exe	57
PID 2888 wrote to memory of 2808	2888	MsiExec.exe	57
PID 2888 wrote to memory of 2808	2888	MsiExec.exe	57
PID 2888 wrote to memory of 2808	2888	MsiExec.exe	57
PID 2888 wrote to memory of 2808	2888	MsiExec.exe	57
PID 2888 wrote to memory of 2808	2888	MsiExec.exe	57
PID 1636 wrote to memory of 1484	1636	setup.exe	59

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\af48efac2b7d97cc0b70559a0a2be8cfeae961306ed16f0c91706a3bef6d61fc.exe
"C:\Users\Admin\AppData\Local\Temp\af48efac2b7d97cc0b70559a0a2be8cfeae961306ed16f0c91706a3bef6d61fc.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\driver_setup.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\driver_setup.exe /i drvupdate-amd64.msi
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:1692

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Registers COM server for autorun
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:624
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding C7C0AD76291252DBF35C9617D0B2B6D0 C
  2⤵
  - Loads dropped DLL
  PID:2308
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding E999DEF8256E8E81518600D471810E15
  2⤵
  - Loads dropped DLL
  PID:2976
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding 33DBD06399B12491C1F12B32170CCF22 M Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Modifies data under HKEY_USERS
  PID:380
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding 900F7E097D88001843DCD9E88615DF4B C
  2⤵
  - Loads dropped DLL
  PID:380
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding 78093F8B7457A18AE9E8386CA83281D9
  2⤵
  - Loads dropped DLL
  PID:1572
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 31AB50FC2EEE150421E0DD53758CA04B
  2⤵
  - Checks BIOS information in registry
  - Loads dropped DLL
  - Enumerates system info in registry
  PID:592
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding A7A59630E1238205C6AD27ABE7A5B6FB M Global\MSI0000
  2⤵
  - Loads dropped DLL
  PID:2040
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1CA3A9AE31BF2B625642FBAAC1642F85 M Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2888
- - C:\Windows\WindowsMobile\InstallForm.exe
    C:\Windows\WindowsMobile\InstallForm.exe Install
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:2808

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2988

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005A8" "00000000000005C0"
1⤵
- Modifies data under HKEY_USERS
PID:2664

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{3298c94c-558d-01dc-40a1-087dbbc2c705}\wcerndis.inf" "9" "656b799f7" "00000000000005C0" "WinSta0\Default" "00000000000005A8" "208" "C:\Windows\WindowsMobile\Drivers\RNDIS"
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2604

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{5e81fbd9-3df2-34b6-9019-05162ad35636}\wceusbsh.inf" "9" "608b27587" "00000000000005A8" "WinSta0\Default" "00000000000005BC" "208" "C:\Windows\WindowsMobile\Drivers\Serial"
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2844

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{2ba682ab-b4da-5030-1961-4a0d52708823}\wpdrapi.inf" "9" "6c93161fb" "00000000000005A8" "WinSta0\Default" "00000000000005BC" "208" "C:\Windows\WindowsMobile\Drivers\WPD"
1⤵
- Modifies data under HKEY_USERS
PID:1524

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{5bd15ba0-5ce2-6630-242d-fb7c9cf30a0d}\wcebth.inf" "9" "695ee40cf" "00000000000005BC" "WinSta0\Default" "00000000000003C4" "208" "C:\Windows\WindowsMobile\Drivers\Bluetooth"
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2220

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "UMB\UMB\1&841921d&0&windowsmobiledriverinstaller" "" "" "6ef5b215f" "0000000000000000" "0000000000000528" "00000000000005B0"
1⤵
- Modifies data under HKEY_USERS
PID:2288

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Windows\system32\newdev.dll,pDiDeviceInstallNotification \\.\pipe\PNP_Device_Install_Pipe_1.{20059981-c435-4da1-b950-a514f430b04f} "(null)"
1⤵
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Windows\System32\dinotify.exe
  "C:\Windows\System32\dinotify.exe" pnpui.dll,SimplifiedDINotification
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2436

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "windowsmobiledriverinstaller\UMB\2&26a98e85&0&{7E8DC16A-D872-4FC8-8F57-FA297C48649A}" "" "" "675968977" "0000000000000000" "00000000000003C4" "00000000000005C0"
1⤵
- Sets DLL path for service in the registry
- Loads dropped DLL
- Registers COM server for autorun
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Windows\WindowsMobile\setup.exe
  C:\Windows\WindowsMobile\setup.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Windows\WindowsMobile\wmdcBase.exe
    "C:\Windows\WindowsMobile\wmdcBase.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2148
- - C:\Windows\WindowsMobile\wmdc.exe
    "C:\Windows\WindowsMobile\wmdc.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WindowsMobile
1⤵
- Loads dropped DLL
PID:2772

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "UMB\UMB\1&841921d&0&ActiveSyncWPDEnumerator" "" "" "6ebc820a3" "0000000000000000" "00000000000005FC" "000000000000060C"
1⤵
- Modifies data under HKEY_USERS
PID:1256

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7} -Embedding
1⤵
PID:2324

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot20" "" "" "65dbac317" "0000000000000000" "00000000000005B0" "00000000000005FC"
1⤵
- Modifies data under HKEY_USERS
PID:2140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery