631ab8138d473aa7201e031566169ca6b7bbe964bf059158a5cc7a81b75c4343

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	notepad.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	regsvr32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	notepad.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 10 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	notepad.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	notepad.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	notepad.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	notepad.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rundll32.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	systeminformer-3.0.7333-setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	SystemInformer.exe

Executes dropped EXE 63 IoCs

pid	Process
5196	systeminformer-3.0.7333-setup.exe
5688	SystemInformer.exe
3284	dxwebsetup.exe
5640	dxwsetup.exe
5948	infinst.exe
4820	infinst.exe
5164	infinst.exe
1788	regsvr32.exe
5872	infinst.exe
6196	infinst.exe
6808	infinst.exe
6976	infinst.exe
6364	infinst.exe
2696	infinst.exe
5660	infinst.exe
7136	infinst.exe
4316	infinst.exe
2952	infinst.exe
1096	infinst.exe
6332	infinst.exe
6432	infinst.exe
6900	infinst.exe
5828	infinst.exe
5576	infinst.exe
2904	infinst.exe
6392	infinst.exe
6808	infinst.exe
6816	infinst.exe
5436	infinst.exe
540	infinst.exe
4760	infinst.exe
2864	infinst.exe
5480	infinst.exe
6832	infinst.exe
5916	infinst.exe
4124	infinst.exe
3888	infinst.exe
3088	infinst.exe
4184	infinst.exe
6348	infinst.exe
6868	infinst.exe
6920	infinst.exe
1096	infinst.exe
5576	infinst.exe
5300	infinst.exe
1204	infinst.exe
4464	infinst.exe
5656	infinst.exe
5680	infinst.exe
4620	infinst.exe
5972	infinst.exe
2124	infinst.exe
3976	infinst.exe
6768	infinst.exe
6564	infinst.exe
5852	infinst.exe
6864	infinst.exe
4984	infinst.exe
2456	infinst.exe
3376	infinst.exe
5080	infinst.exe
3212	infinst.exe
972	ProcessHacker.exe

Loads dropped DLL 64 IoCs

pid	Process
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5640	dxwsetup.exe
5640	dxwsetup.exe
5640	dxwsetup.exe
5640	dxwsetup.exe
5640	dxwsetup.exe
5640	dxwsetup.exe
5640	dxwsetup.exe
5640	dxwsetup.exe
5640	dxwsetup.exe
5640	dxwsetup.exe
5640	dxwsetup.exe
5640	dxwsetup.exe
5640	dxwsetup.exe
5640	dxwsetup.exe
5640	dxwsetup.exe
5640	dxwsetup.exe
5640	dxwsetup.exe
5640	dxwsetup.exe
5640	dxwsetup.exe
5640	dxwsetup.exe
5640	dxwsetup.exe
5640	dxwsetup.exe
5640	dxwsetup.exe
5640	dxwsetup.exe
5640	dxwsetup.exe
5640	dxwsetup.exe
5640	dxwsetup.exe
5080	infinst.exe
5640	dxwsetup.exe
5640	dxwsetup.exe
5640	dxwsetup.exe
5640	dxwsetup.exe
5640	dxwsetup.exe
5640	dxwsetup.exe
5640	dxwsetup.exe
5640	dxwsetup.exe
5640	dxwsetup.exe
5640	dxwsetup.exe
5640	dxwsetup.exe
5640	dxwsetup.exe
5640	dxwsetup.exe
5640	dxwsetup.exe
5640	dxwsetup.exe
5640	dxwsetup.exe
5640	dxwsetup.exe
5640	dxwsetup.exe
5640	dxwsetup.exe
6224	regsvr32.exe
5640	dxwsetup.exe
6872	regsvr32.exe
5640	dxwsetup.exe
2764	regsvr32.exe
5640	dxwsetup.exe

Registers COM server for autorun 1 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77c56bf4-18a1-42b0-88af-5072ce814949}\InProcServer32\ = "C:\\Windows\\system32\\xactengine2_8.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{343e68e6-8f82-4a8d-a2da-6e9a944b378c}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e21a7345-eb21-468e-be50-804db97cf708}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_1.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e180344b-ac83-4483-959e-18a5c56a5e19}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_3.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1138472b-d187-44e9-81f2-ae1b0e7785f1}\InProcServer32\ = "C:\\Windows\\system32\\xactengine2_3.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{54b68bc7-3a45-416b-a8c9-19bf19ec1df5}\InProcServer32\ = "C:\\Windows\\system32\\xactengine2_5.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cd0d66ec-8057-43f5-acbd-66dfb36fd78c}\InProcServer32\ = "C:\\Windows\\system32\\xactengine2_7.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3b80ee2a-b0f5-4780-9e30-90cb39685b03}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cd0d66ec-8057-43f5-acbd-66dfb36fd78c}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0977d092-2d95-4e43-8d42-9ddcc2545ed5}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8bb7778b-645b-4475-9a73-1de3170bd3af}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8bb7778b-645b-4475-9a73-1de3170bd3af}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0aa000aa-f404-11d9-bd7a-0010dc4f8f81}\InProcServer32	infinst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c60fae90-4183-4a3f-b2f7-ac1dc49b0e5c}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1138472b-d187-44e9-81f2-ae1b0e7785f1}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c1e3f122-a2ea-442c-854f-20d98f8357a1}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f1b577e-5e5a-4e8a-ba73-c657ea8e8598}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c60fae90-4183-4a3f-b2f7-ac1dc49b0e5c}\InProcServer32\ = "C:\\Windows\\system32\\xactengine2_2.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{bc3e0fc6-2e0d-4c45-bc61-d9c328319bd8}\InProcServer32\ = "C:\\Windows\\system32\\xactengine2_4.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{54b68bc7-3a45-416b-a8c9-19bf19ec1df5}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3a2495ce-31d0-435b-8ccf-e9f0843fd960}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3b80ee2a-b0f5-4780-9e30-90cb39685b03}\InProcServer32\ = "C:\\Windows\\system32\\xactengine3_0.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e21a7345-eb21-468e-be50-804db97cf708}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f4769300-b949-4df9-b333-00d33932e9a6}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_1.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4c5e637a-16c7-4de3-9c46-5ed22181962d}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03219e78-5bc3-44d1-b92e-f63d89cc6526}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77c56bf4-18a1-42b0-88af-5072ce814949}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{fac23f48-31f5-45a8-b49b-5225d61401aa}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{b802058a-464a-42db-bc10-b650d6f2586a}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_2.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{94c1affa-66e7-4961-9521-cfdef3128d4f}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{94c1affa-66e7-4961-9521-cfdef3128d4f}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c7338b95-52b8-4542-aa79-42eb016c8c1c}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77c56bf4-18a1-42b0-88af-5072ce814949}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{65d822a4-4799-42c6-9b18-d26cf66dd320}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6f6ea3a9-2cf5-41cf-91c1-2170b1540063}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9cab402c-1d37-44b4-886d-fa4f36170a4c}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c7338b95-52b8-4542-aa79-42eb016c8c1c}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_4.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c60fae90-4183-4a3f-b2f7-ac1dc49b0e5c}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1138472b-d187-44e9-81f2-ae1b0e7785f1}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e21a7345-eb21-468e-be50-804db97cf708}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c1e3f122-a2ea-442c-854f-20d98f8357a1}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3332f02-3dd0-4de9-9aec-20d85c4111b6}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0977d092-2d95-4e43-8d42-9ddcc2545ed5}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f1b577e-5e5a-4e8a-ba73-c657ea8e8598}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3a2495ce-31d0-435b-8ccf-e9f0843fd960}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{fac23f48-31f5-45a8-b49b-5225d61401aa}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_0.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{b802058a-464a-42db-bc10-b650d6f2586a}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e180344b-ac83-4483-959e-18a5c56a5e19}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03219e78-5bc3-44d1-b92e-f63d89cc6526}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{bc3e0fc6-2e0d-4c45-bc61-d9c328319bd8}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3b80ee2a-b0f5-4780-9e30-90cb39685b03}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c0c56f46-29b1-44e9-9939-a32ce86867e2}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0aa000aa-f404-11d9-bd7a-0010dc4f8f81}\InProcServer32\ = "C:\\Windows\\system32\\xactengine2_0.dll"	infinst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f1b577e-5e5a-4e8a-ba73-c657ea8e8598}\InProcServer32\ = "C:\\Windows\\system32\\xactengine2_1.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{343e68e6-8f82-4a8d-a2da-6e9a944b378c}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4c5e637a-16c7-4de3-9c46-5ed22181962d}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9cab402c-1d37-44b4-886d-fa4f36170a4c}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_3.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{65d822a4-4799-42c6-9b18-d26cf66dd320}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6f6ea3a9-2cf5-41cf-91c1-2170b1540063}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_0.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6f6ea3a9-2cf5-41cf-91c1-2170b1540063}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3332f02-3dd0-4de9-9aec-20d85c4111b6}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f5ca7b34-8055-42c0-b836-216129eb7e30}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_2.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{629cf0de-3ecc-41e7-9926-f7e43eebec51}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4c5e637a-16c7-4de3-9c46-5ed22181962d}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_3.dll"	regsvr32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	dxwebsetup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	dxwsetup.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	dxwsetup.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\I:	dxwsetup.exe
File opened (read-only)	\??\N:	dxwsetup.exe
File opened (read-only)	\??\P:	dxwsetup.exe
File opened (read-only)	\??\Q:	dxwsetup.exe
File opened (read-only)	\??\R:	dxwsetup.exe
File opened (read-only)	\??\S:	dxwsetup.exe
File opened (read-only)	\??\Y:	dxwsetup.exe
File opened (read-only)	\??\B:	dxwsetup.exe
File opened (read-only)	\??\E:	dxwsetup.exe
File opened (read-only)	\??\M:	dxwsetup.exe
File opened (read-only)	\??\O:	dxwsetup.exe
File opened (read-only)	\??\T:	dxwsetup.exe
File opened (read-only)	\??\A:	dxwsetup.exe
File opened (read-only)	\??\G:	dxwsetup.exe
File opened (read-only)	\??\J:	dxwsetup.exe
File opened (read-only)	\??\K:	dxwsetup.exe
File opened (read-only)	\??\L:	dxwsetup.exe
File opened (read-only)	\??\H:	dxwsetup.exe
File opened (read-only)	\??\U:	dxwsetup.exe
File opened (read-only)	\??\V:	dxwsetup.exe
File opened (read-only)	\??\W:	dxwsetup.exe
File opened (read-only)	\??\X:	dxwsetup.exe
File opened (read-only)	\??\Z:	dxwsetup.exe

Writes to the Master Boot Record (MBR) 1 TTPs 5 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	rundll32.exe
File opened for modification	\??\PhysicalDrive0	rundll32.exe
File opened for modification	\??\PhysicalDrive0	notepad.exe
File opened for modification	\??\PhysicalDrive0	regsvr32.exe
File opened for modification	\??\PhysicalDrive0	notepad.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Nov2008_d3dx10_40_x64.cab	dxwsetup.exe
File created	C:\Windows\system32\SET57AE.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\X3DAudio1_5.dll	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Jun2010_xaudio_x86.cab	dxwsetup.exe
File created	C:\Windows\system32\SET791F.tmp	infinst.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Dec2006_d3dx9_32_x64.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\SET5530.tmp	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Mar2008_d3dx10_37_x64.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Nov2008_d3dx9_40_x64.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\SET4847.tmp	dxwsetup.exe
File opened for modification	C:\Windows\system32\D3DCompiler_38.dll	infinst.exe
File opened for modification	C:\Windows\system32\xactengine3_1.dll	infinst.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Aug2007_d3dx10_35_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Jun2010_d3dx10_43_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Apr2006_d3dx9_30_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\SET7833.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\SET84A8.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\SET63C6.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\d3dx10_37.dll	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\SET798E.tmp	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Jun2010_d3dcsx_43_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Nov2008_x3daudio_x86.cab	dxwsetup.exe
File created	C:\Windows\system32\SET4B97.tmp	infinst.exe
File created	C:\Windows\system32\SET62F7.tmp	infinst.exe
File created	C:\Windows\SysWOW64\SET7B85.tmp	dxwsetup.exe
File opened for modification	C:\Windows\system32\XAudio2_4.dll	infinst.exe
File opened for modification	C:\Windows\SysWOW64\SET33FA.tmp	dxwsetup.exe
File opened for modification	C:\Windows\system32\d3dx9_27.dll	regsvr32.exe
File created	C:\Windows\SysWOW64\SET3AF2.tmp	dxwsetup.exe
File opened for modification	C:\Windows\system32\xactengine2_7.dll	infinst.exe
File opened for modification	C:\Windows\system32\SET6087.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\SET74D4.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\directx\websetup\dsetup32.dll	dxwsetup.exe
File created	C:\Windows\system32\SET3C45.tmp	infinst.exe
File created	C:\Windows\SysWOW64\SET5C2C.tmp	dxwsetup.exe
File created	C:\Windows\SysWOW64\SET5AD2.tmp	dxwsetup.exe
File opened for modification	C:\Windows\system32\d3dx10_40.dll	infinst.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Jun2006_xact_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\d3dx10_42.dll	dxwsetup.exe
File created	C:\Windows\system32\SET73E0.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\SET38DE.tmp	dxwsetup.exe
File opened for modification	C:\Windows\system32\x3daudio1_1.dll	infinst.exe
File opened for modification	C:\Windows\system32\D3DX9_38.dll	infinst.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Nov2007_x3daudio_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\xinput1_3.dll	dxwsetup.exe
File opened for modification	C:\Windows\system32\SET3C45.tmp	infinst.exe
File opened for modification	C:\Windows\system32\x3daudio1_0.dll	infinst.exe
File opened for modification	C:\Windows\system32\SET48D8.tmp	infinst.exe
File opened for modification	C:\Windows\system32\SET7566.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\D3DCompiler_40.dll	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\directx\websetup\dsetup.dll	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Aug2009_d3dcsx_42_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Aug2009_D3DCompiler_42_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\system32\xactengine3_4.dll	infinst.exe
File opened for modification	C:\Windows\system32\SET6559.tmp	infinst.exe
File created	C:\Windows\SysWOW64\SET72BE.tmp	dxwsetup.exe
File created	C:\Windows\system32\SET73F0.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\X3DAudio1_6.dll	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\MDX_1.0.2909.0_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\SET595A.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\d3dx10_33.dll	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\d3dx9_31.dll	dxwsetup.exe
File opened for modification	C:\Windows\system32\D3DCompiler_40.dll	infinst.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Mar2009_d3dx10_41_x64.cab	dxwsetup.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
1360	rundll32.exe
2684	rundll32.exe
5412	notepad.exe
6880	regsvr32.exe
1916	notepad.exe

Drops file in Program Files directory 41 IoCs

description	ioc	Process
File created	C:\Program Files\SystemInformer\peview.exe	systeminformer-3.0.7333-setup.exe
File created	C:\Program Files\SystemInformer\plugins\ExtendedNotifications.sig	systeminformer-3.0.7333-setup.exe
File created	C:\Program Files\SystemInformer\plugins\ExtendedTools.sig	systeminformer-3.0.7333-setup.exe
File created	C:\Program Files\SystemInformer\plugins\ToolStatus.dll	systeminformer-3.0.7333-setup.exe
File created	C:\Program Files\SystemInformer\plugins\ToolStatus.sig	systeminformer-3.0.7333-setup.exe
File created	C:\Program Files\SystemInformer\x86\SystemInformer.exe	systeminformer-3.0.7333-setup.exe
File created	C:\Program Files\SystemInformer\plugins\Updater.dll	systeminformer-3.0.7333-setup.exe
File created	C:\Program Files\SystemInformer\plugins\Updater.sig	systeminformer-3.0.7333-setup.exe
File created	C:\Program Files\SystemInformer\LICENSE.txt	systeminformer-3.0.7333-setup.exe
File created	C:\Program Files\SystemInformer\SystemInformer.sig	systeminformer-3.0.7333-setup.exe
File created	C:\Program Files\SystemInformer\SystemInformer.sys	systeminformer-3.0.7333-setup.exe
File created	C:\Program Files\SystemInformer\plugins\ExtendedNotifications.dll	systeminformer-3.0.7333-setup.exe
File created	C:\Program Files\SystemInformer\plugins\NetworkTools.sig	systeminformer-3.0.7333-setup.exe
File created	C:\Program Files\SystemInformer\plugins\OnlineChecks.sig	systeminformer-3.0.7333-setup.exe
File created	C:\Program Files\SystemInformer\plugins\UserNotes.sig	systeminformer-3.0.7333-setup.exe
File created	C:\Program Files\SystemInformer\plugins\WindowExplorer.dll	systeminformer-3.0.7333-setup.exe
File created	C:\Program Files\SystemInformer\etwguids.txt	systeminformer-3.0.7333-setup.exe
File created	C:\Program Files\SystemInformer\plugins\DotNetTools.sig	systeminformer-3.0.7333-setup.exe
File created	C:\Program Files\SystemInformer\plugins\ExtendedServices.sig	systeminformer-3.0.7333-setup.exe
File created	C:\Program Files\SystemInformer\plugins\ExtendedTools.dll	systeminformer-3.0.7333-setup.exe
File opened for modification	C:\Program Files\SystemInformer\ntdll.pdb	SystemInformer.exe
File created	C:\Program Files\SystemInformer\SystemInformer.exe	systeminformer-3.0.7333-setup.exe
File created	C:\Program Files\SystemInformer\plugins\HardwareDevices.sig	systeminformer-3.0.7333-setup.exe
File created	C:\Program Files\SystemInformer\plugins\OnlineChecks.dll	systeminformer-3.0.7333-setup.exe
File created	C:\Program Files\SystemInformer\COPYRIGHT.txt	systeminformer-3.0.7333-setup.exe
File created	C:\Program Files\SystemInformer\capslist.txt	systeminformer-3.0.7333-setup.exe
File created	C:\Program Files\SystemInformer\plugins\ExtendedServices.dll	systeminformer-3.0.7333-setup.exe
File created	C:\Program Files\SystemInformer\plugins\HardwareDevices.dll	systeminformer-3.0.7333-setup.exe
File created	C:\Program Files\SystemInformer\x86\plugins\DotNetTools.dll	systeminformer-3.0.7333-setup.exe
File created	C:\Program Files\SystemInformer\x86\plugins\ExtendedTools.dll	systeminformer-3.0.7333-setup.exe
File created	C:\Program Files\SystemInformer\README.txt	systeminformer-3.0.7333-setup.exe
File created	C:\Program Files\SystemInformer\plugins\NetworkTools.dll	systeminformer-3.0.7333-setup.exe
File created	C:\Program Files\SystemInformer\x86\SystemInformer.sig	systeminformer-3.0.7333-setup.exe
File created	C:\Program Files\SystemInformer\x86\plugins\ExtendedTools.sig	systeminformer-3.0.7333-setup.exe
File created	C:\Program Files\SystemInformer\icon.png	systeminformer-3.0.7333-setup.exe
File created	C:\Program Files\SystemInformer\ksi.dll	systeminformer-3.0.7333-setup.exe
File created	C:\Program Files\SystemInformer\plugins\DotNetTools.dll	systeminformer-3.0.7333-setup.exe
File created	C:\Program Files\SystemInformer\plugins\UserNotes.dll	systeminformer-3.0.7333-setup.exe
File created	C:\Program Files\SystemInformer\peview.sig	systeminformer-3.0.7333-setup.exe
File created	C:\Program Files\SystemInformer\plugins\WindowExplorer.sig	systeminformer-3.0.7333-setup.exe
File created	C:\Program Files\SystemInformer\x86\plugins\DotNetTools.sig	systeminformer-3.0.7333-setup.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\assembly\ngenlock.dat	dxwsetup.exe
File created	C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2910.0\Microsoft.DirectX.Direct3DX.xml	dxwsetup.exe
File created	C:\Windows\assembly\tmp\CHK3J92E\Microsoft.DirectX.dll	dxwsetup.exe
File opened for modification	C:\Windows\DirectX.log	infinst.exe
File opened for modification	C:\Windows\assembly\tmp\5ZY4HSUI\__AssemblyInfo__.ini	dxwsetup.exe
File created	C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2908.0\Microsoft.DirectX.Direct3DX.dll	dxwsetup.exe
File created	C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.AudioVideoPlayback.xml	dxwsetup.exe
File opened for modification	C:\Windows\DirectX.log	infinst.exe
File opened for modification	C:\Windows\DirectX.log	infinst.exe
File opened for modification	C:\Windows\DirectX.log	infinst.exe
File created	C:\Windows\assembly\GACLock.dat	dxwsetup.exe
File created	C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.dll	dxwsetup.exe
File created	C:\Windows\assembly\tmp\1IHJU2O8\Microsoft.DirectX.AudioVideoPlayback.dll	dxwsetup.exe
File opened for modification	C:\Windows\DirectX.log	infinst.exe
File opened for modification	C:\Windows\DirectX.log	infinst.exe
File created	C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2909.0\Microsoft.DirectX.Direct3DX.dll	dxwsetup.exe
File created	C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectSound.xml	dxwsetup.exe
File opened for modification	C:\Windows\DirectX.log	infinst.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File opened for modification	C:\Windows\assembly	dxwsetup.exe
File created	C:\Windows\assembly\tmp\ZJ7UBF2L\Microsoft.DirectX.Direct3DX.dll	dxwsetup.exe
File created	C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2904.0\Microsoft.DirectX.Direct3DX.dll	dxwsetup.exe
File opened for modification	C:\Windows\assembly\tmp\1DO6YGQN\__AssemblyInfo__.ini	dxwsetup.exe
File created	C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectInput.dll	dxwsetup.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File opened for modification	C:\Windows\Logs\DXError.log	dxwsetup.exe
File created	C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.Direct3D.dll	dxwsetup.exe
File created	C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.Direct3D.xml	dxwsetup.exe
File opened for modification	C:\Windows\assembly\tmp\83O2AQBT\__AssemblyInfo__.ini	dxwsetup.exe
File created	C:\Windows\assembly\tmp\EPP8DOA9\Microsoft.DirectX.DirectSound.dll	dxwsetup.exe
File opened for modification	C:\Windows\DirectX.log	infinst.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File created	C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2903.0\Microsoft.DirectX.Direct3DX.xml	dxwsetup.exe
File opened for modification	C:\Windows\assembly\tmp\L7BLPM4B\__AssemblyInfo__.ini	dxwsetup.exe
File created	C:\Windows\assembly\tmp\TUHHWS6X\Microsoft.DirectX.Direct3DX.dll	dxwsetup.exe
File opened for modification	C:\Windows\DirectX.log	infinst.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File created	C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2904.0\Microsoft.DirectX.Direct3DX.xml	dxwsetup.exe
File opened for modification	C:\Windows\assembly\tmp\R1XFV3AZ\__AssemblyInfo__.ini	dxwsetup.exe
File opened for modification	C:\Windows\DirectX.log	infinst.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File created	C:\Windows\assembly\tmp\PAHKZR8T\Microsoft.DirectX.Diagnostics.dll	dxwsetup.exe
File created	C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectInput.xml	dxwsetup.exe
File opened for modification	C:\Windows\DirectX.log	infinst.exe
File opened for modification	C:\Windows\DirectX.log	infinst.exe
File opened for modification	C:\Windows\DirectX.log	infinst.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File created	C:\Windows\assembly\tmp\5HP2TCEY\Microsoft.DirectX.Direct3DX.dll	dxwsetup.exe
File opened for modification	C:\Windows\DirectX.log	infinst.exe
File opened for modification	C:\Windows\assembly\tmp\TUHHWS6X\__AssemblyInfo__.ini	dxwsetup.exe
File opened for modification	C:\Windows\DirectX.log	regsvr32.exe
File created	C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.Direct3DX.xml	dxwsetup.exe
File created	C:\Windows\assembly\tmp\83O2AQBT\Microsoft.DirectX.DirectDraw.dll	dxwsetup.exe
File opened for modification	C:\Windows\DirectX.log	infinst.exe
File opened for modification	C:\Windows\DirectX.log	infinst.exe
File opened for modification	C:\Windows\DirectX.log	infinst.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File created	C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.Direct3DX.dll	dxwsetup.exe
File opened for modification	C:\Windows\assembly\tmp\5HP2TCEY\__AssemblyInfo__.ini	dxwsetup.exe
File opened for modification	C:\Windows\DirectX.log	infinst.exe
File opened for modification	C:\Windows\assembly\tmp\QPGYXX48\__AssemblyInfo__.ini	dxwsetup.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 9 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ProcessHacker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ProcessHacker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SystemInformer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SystemInformer.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Software\Microsoft\Internet Explorer\TypedURLs	ProcessHacker.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\0\0\0\NodeSlot = "2"	SystemInformer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3b80ee2a-b0f5-4780-9e30-90cb39685b03}\InProcServer32\ = "C:\\Windows\\SysWow64\\xactengine3_0.dll"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{962f5027-99be-4692-a468-85802cf8de61}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f5ca7b34-8055-42c0-b836-216129eb7e30}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_2.dll"	dxwsetup.exe
Key created	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	ProcessHacker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	ProcessHacker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{65d822a4-4799-42c6-9b18-d26cf66dd320}	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{fac23f48-31f5-45a8-b49b-5225d61401aa}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4c5e637a-16c7-4de3-9c46-5ed22181962d}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{65d822a4-4799-42c6-9b18-d26cf66dd320}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3332f02-3dd0-4de9-9aec-20d85c4111b6}\ = "XACT Engine"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0977d092-2d95-4e43-8d42-9ddcc2545ed5}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8bb7778b-645b-4475-9a73-1de3170bd3af}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_4.dll"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	SystemInformer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	SystemInformer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cd0d66ec-8057-43f5-acbd-66dfb36fd78c}\ = "XACT Engine"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0977d092-2d95-4e43-8d42-9ddcc2545ed5}\ = "XACT Engine"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c7338b95-52b8-4542-aa79-42eb016c8c1c}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_4.dll"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f1b577e-5e5a-4e8a-ba73-c657ea8e8598}	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{54b68bc7-3a45-416b-a8c9-19bf19ec1df5}\ = "XACT Engine"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3a2495ce-31d0-435b-8ccf-e9f0843fd960}\InProcServer32\ThreadingModel = "Both"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03219e78-5bc3-44d1-b92e-f63d89cc6526}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{962f5027-99be-4692-a468-85802cf8de61}\InProcServer32\ThreadingModel = "Both"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4c5e637a-16c7-4de3-9c46-5ed22181962d}\ = "XAudio2"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c7338b95-52b8-4542-aa79-42eb016c8c1c}\InProcServer32	dxwsetup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2 = 14002e80922b16d365937a46956b92703aca08af0000	ProcessHacker.exe
Key created	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	SystemInformer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{bc3e0fc6-2e0d-4c45-bc61-d9c328319bd8}	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{bc3e0fc6-2e0d-4c45-bc61-d9c328319bd8}\InProcServer32\ = "C:\\Windows\\SysWow64\\xactengine2_4.dll"	dxwsetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	ProcessHacker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cd0d66ec-8057-43f5-acbd-66dfb36fd78c}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77c56bf4-18a1-42b0-88af-5072ce814949}\InProcServer32	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4c5e637a-16c7-4de3-9c46-5ed22181962d}\InProcServer32\ThreadingModel = "Both"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8bb7778b-645b-4475-9a73-1de3170bd3af}\InProcServer32\ThreadingModel = "Both"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c7338b95-52b8-4542-aa79-42eb016c8c1c}\ = "AudioVolumeMeter"	regsvr32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	SystemInformer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{629cf0de-3ecc-41e7-9926-f7e43eebec51}\ = "AudioReverb"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1138472b-d187-44e9-81f2-ae1b0e7785f1}\InProcServer32\ = "C:\\Windows\\system32\\xactengine2_3.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c7338b95-52b8-4542-aa79-42eb016c8c1c}\InProcServer32\ThreadingModel = "Both"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3a2495ce-31d0-435b-8ccf-e9f0843fd960}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e21a7345-eb21-468e-be50-804db97cf708}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_1.dll"	dxwsetup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\0\0\0 = 4e003100000000007b57e76d100054656d7000003a0009000400efbe5757415f7b57e76d2e00000097e10100000001000000000000000000000000000000950e2001540065006d007000000014000000	SystemInformer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{629cf0de-3ecc-41e7-9926-f7e43eebec51}\ = "AudioReverb"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03219e78-5bc3-44d1-b92e-f63d89cc6526}\ = "XAudio2"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8bb7778b-645b-4475-9a73-1de3170bd3af}\InProcServer32	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c7338b95-52b8-4542-aa79-42eb016c8c1c}\InProcServer32	regsvr32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	ProcessHacker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{bc3e0fc6-2e0d-4c45-bc61-d9c328319bd8}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{65d822a4-4799-42c6-9b18-d26cf66dd320}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{fac23f48-31f5-45a8-b49b-5225d61401aa}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03219e78-5bc3-44d1-b92e-f63d89cc6526}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_4.dll"	dxwsetup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\0\0 = 50003100000000005757b36210004c6f63616c003c0009000400efbe5757415f7b57e86d2e00000096e10100000001000000000000000000000000000000128601004c006f00630061006c00000014000000	SystemInformer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0aa000aa-f404-11d9-bd7a-0010dc4f8f81}\ = "XACT Engine"	infinst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c0c56f46-29b1-44e9-9939-a32ce86867e2}\ = "AudioVolumeMeter"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94c1affa-66e7-4961-9521-cfdef3128d4f}	dxwsetup.exe
Key created	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7	ProcessHacker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	SystemInformer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{65d822a4-4799-42c6-9b18-d26cf66dd320}\InProcServer32\ = "C:\\Windows\\system32\\xactengine2_10.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{962f5027-99be-4692-a468-85802cf8de61}\ = "XACT Engine"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3332f02-3dd0-4de9-9aec-20d85c4111b6}\InProcServer32\ = "C:\\Windows\\system32\\xactengine3_2.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c7338b95-52b8-4542-aa79-42eb016c8c1c}	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3a2495ce-31d0-435b-8ccf-e9f0843fd960}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0977d092-2d95-4e43-8d42-9ddcc2545ed5}\InProcServer32\ThreadingModel = "Both"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c7338b95-52b8-4542-aa79-42eb016c8c1c}\ = "AudioVolumeMeter"	dxwsetup.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	ProcessHacker.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	ProcessHacker.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	ProcessHacker.exe

NTFS ADS 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\systeminformer-3.0.7333-setup.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\dxwebsetup.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\processhacker-2.39-bin.zip:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5688	SystemInformer.exe
972	ProcessHacker.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
684	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3420	firefox.exe
Token: SeDebugPrivilege	3420	firefox.exe
Token: SeDebugPrivilege	5196	systeminformer-3.0.7333-setup.exe
Token: SeDebugPrivilege	5196	systeminformer-3.0.7333-setup.exe
Token: SeDebugPrivilege	5196	systeminformer-3.0.7333-setup.exe
Token: SeDebugPrivilege	5196	systeminformer-3.0.7333-setup.exe
Token: SeDebugPrivilege	5196	systeminformer-3.0.7333-setup.exe
Token: SeDebugPrivilege	5196	systeminformer-3.0.7333-setup.exe
Token: SeDebugPrivilege	5196	systeminformer-3.0.7333-setup.exe
Token: SeDebugPrivilege	5196	systeminformer-3.0.7333-setup.exe
Token: SeDebugPrivilege	5196	systeminformer-3.0.7333-setup.exe
Token: SeDebugPrivilege	5196	systeminformer-3.0.7333-setup.exe
Token: SeDebugPrivilege	5196	systeminformer-3.0.7333-setup.exe
Token: SeDebugPrivilege	5196	systeminformer-3.0.7333-setup.exe
Token: SeDebugPrivilege	5196	systeminformer-3.0.7333-setup.exe
Token: SeDebugPrivilege	5688	SystemInformer.exe
Token: SeIncBasePriorityPrivilege	5688	SystemInformer.exe
Token: 33	5688	SystemInformer.exe
Token: SeLoadDriverPrivilege	5688	SystemInformer.exe
Token: SeProfSingleProcessPrivilege	5688	SystemInformer.exe
Token: SeBackupPrivilege	5688	SystemInformer.exe
Token: SeRestorePrivilege	5688	SystemInformer.exe
Token: SeShutdownPrivilege	5688	SystemInformer.exe
Token: SeTakeOwnershipPrivilege	5688	SystemInformer.exe
Token: SeSecurityPrivilege	5688	SystemInformer.exe
Token: SeDebugPrivilege	5688	SystemInformer.exe
Token: SeDebugPrivilege	5688	SystemInformer.exe
Token: SeDebugPrivilege	5688	SystemInformer.exe
Token: SeDebugPrivilege	5688	SystemInformer.exe
Token: SeDebugPrivilege	5688	SystemInformer.exe
Token: SeDebugPrivilege	5688	SystemInformer.exe
Token: SeDebugPrivilege	5688	SystemInformer.exe
Token: SeDebugPrivilege	5688	SystemInformer.exe
Token: SeDebugPrivilege	5688	SystemInformer.exe
Token: SeDebugPrivilege	5688	SystemInformer.exe
Token: SeDebugPrivilege	5688	SystemInformer.exe
Token: SeDebugPrivilege	5688	SystemInformer.exe
Token: SeDebugPrivilege	5688	SystemInformer.exe
Token: SeDebugPrivilege	5688	SystemInformer.exe
Token: SeDebugPrivilege	5688	SystemInformer.exe
Token: SeDebugPrivilege	5688	SystemInformer.exe
Token: SeDebugPrivilege	5688	SystemInformer.exe
Token: SeDebugPrivilege	5688	SystemInformer.exe
Token: SeDebugPrivilege	5688	SystemInformer.exe
Token: SeDebugPrivilege	3420	firefox.exe
Token: SeDebugPrivilege	3420	firefox.exe
Token: SeDebugPrivilege	3420	firefox.exe
Token: SeDebugPrivilege	3420	firefox.exe
Token: SeBackupPrivilege	6032	vssvc.exe
Token: SeRestorePrivilege	6032	vssvc.exe
Token: SeAuditPrivilege	6032	vssvc.exe
Token: SeDebugPrivilege	5640	dxwsetup.exe
Token: SeDebugPrivilege	5640	dxwsetup.exe
Token: SeDebugPrivilege	5640	dxwsetup.exe
Token: SeDebugPrivilege	5640	dxwsetup.exe
Token: SeDebugPrivilege	5640	dxwsetup.exe
Token: SeDebugPrivilege	5640	dxwsetup.exe
Token: SeDebugPrivilege	5640	dxwsetup.exe
Token: SeDebugPrivilege	5640	dxwsetup.exe
Token: SeDebugPrivilege	5640	dxwsetup.exe
Token: SeDebugPrivilege	5640	dxwsetup.exe
Token: SeDebugPrivilege	5640	dxwsetup.exe
Token: SeDebugPrivilege	5640	dxwsetup.exe
Token: SeDebugPrivilege	5640	dxwsetup.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3420	firefox.exe
3420	firefox.exe
3420	firefox.exe
3420	firefox.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3420	firefox.exe
3420	firefox.exe
3420	firefox.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
5688	SystemInformer.exe

Suspicious use of SetWindowsHookEx 29 IoCs

pid	Process
3420	firefox.exe
3420	firefox.exe
3420	firefox.exe
3420	firefox.exe
5688	SystemInformer.exe
5688	SystemInformer.exe
3420	firefox.exe
3420	firefox.exe
3420	firefox.exe
3420	firefox.exe
3420	firefox.exe
3420	firefox.exe
3420	firefox.exe
3420	firefox.exe
3420	firefox.exe
3420	firefox.exe
3420	firefox.exe
3420	firefox.exe
3420	firefox.exe
3420	firefox.exe
3420	firefox.exe
972	ProcessHacker.exe
972	ProcessHacker.exe
972	ProcessHacker.exe
972	ProcessHacker.exe
972	ProcessHacker.exe
972	ProcessHacker.exe
972	ProcessHacker.exe
972	ProcessHacker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4172 wrote to memory of 3420	4172	firefox.exe	92
PID 4172 wrote to memory of 3420	4172	firefox.exe	92
PID 4172 wrote to memory of 3420	4172	firefox.exe	92
PID 4172 wrote to memory of 3420	4172	firefox.exe	92
PID 4172 wrote to memory of 3420	4172	firefox.exe	92
PID 4172 wrote to memory of 3420	4172	firefox.exe	92
PID 4172 wrote to memory of 3420	4172	firefox.exe	92
PID 4172 wrote to memory of 3420	4172	firefox.exe	92
PID 4172 wrote to memory of 3420	4172	firefox.exe	92
PID 4172 wrote to memory of 3420	4172	firefox.exe	92
PID 4172 wrote to memory of 3420	4172	firefox.exe	92
PID 3420 wrote to memory of 5004	3420	firefox.exe	93
PID 3420 wrote to memory of 5004	3420	firefox.exe	93
PID 3420 wrote to memory of 4944	3420	firefox.exe	95
PID 3420 wrote to memory of 4944	3420	firefox.exe	95
PID 3420 wrote to memory of 4944	3420	firefox.exe	95
PID 3420 wrote to memory of 4944	3420	firefox.exe	95
PID 3420 wrote to memory of 4944	3420	firefox.exe	95
PID 3420 wrote to memory of 4944	3420	firefox.exe	95
PID 3420 wrote to memory of 4944	3420	firefox.exe	95
PID 3420 wrote to memory of 4944	3420	firefox.exe	95
PID 3420 wrote to memory of 4944	3420	firefox.exe	95
PID 3420 wrote to memory of 4944	3420	firefox.exe	95
PID 3420 wrote to memory of 4944	3420	firefox.exe	95
PID 3420 wrote to memory of 4944	3420	firefox.exe	95
PID 3420 wrote to memory of 4944	3420	firefox.exe	95
PID 3420 wrote to memory of 4944	3420	firefox.exe	95
PID 3420 wrote to memory of 4944	3420	firefox.exe	95
PID 3420 wrote to memory of 4944	3420	firefox.exe	95
PID 3420 wrote to memory of 4944	3420	firefox.exe	95
PID 3420 wrote to memory of 4944	3420	firefox.exe	95
PID 3420 wrote to memory of 4944	3420	firefox.exe	95
PID 3420 wrote to memory of 4944	3420	firefox.exe	95
PID 3420 wrote to memory of 4944	3420	firefox.exe	95
PID 3420 wrote to memory of 4944	3420	firefox.exe	95
PID 3420 wrote to memory of 4944	3420	firefox.exe	95
PID 3420 wrote to memory of 4944	3420	firefox.exe	95
PID 3420 wrote to memory of 4944	3420	firefox.exe	95
PID 3420 wrote to memory of 4944	3420	firefox.exe	95
PID 3420 wrote to memory of 4944	3420	firefox.exe	95
PID 3420 wrote to memory of 4944	3420	firefox.exe	95
PID 3420 wrote to memory of 4944	3420	firefox.exe	95
PID 3420 wrote to memory of 4944	3420	firefox.exe	95
PID 3420 wrote to memory of 4944	3420	firefox.exe	95
PID 3420 wrote to memory of 4944	3420	firefox.exe	95
PID 3420 wrote to memory of 4944	3420	firefox.exe	95
PID 3420 wrote to memory of 4944	3420	firefox.exe	95
PID 3420 wrote to memory of 4944	3420	firefox.exe	95
PID 3420 wrote to memory of 4944	3420	firefox.exe	95
PID 3420 wrote to memory of 4944	3420	firefox.exe	95
PID 3420 wrote to memory of 4944	3420	firefox.exe	95
PID 3420 wrote to memory of 4944	3420	firefox.exe	95
PID 3420 wrote to memory of 4944	3420	firefox.exe	95
PID 3420 wrote to memory of 4944	3420	firefox.exe	95
PID 3420 wrote to memory of 4944	3420	firefox.exe	95
PID 3420 wrote to memory of 4944	3420	firefox.exe	95
PID 3420 wrote to memory of 4944	3420	firefox.exe	95
PID 3420 wrote to memory of 4944	3420	firefox.exe	95
PID 3420 wrote to memory of 4944	3420	firefox.exe	95
PID 3420 wrote to memory of 4944	3420	firefox.exe	95
PID 3420 wrote to memory of 4944	3420	firefox.exe	95
PID 3420 wrote to memory of 2760	3420	firefox.exe	96
PID 3420 wrote to memory of 2760	3420	firefox.exe	96
PID 3420 wrote to memory of 2760	3420	firefox.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\install1.dll,#1
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1360

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4172
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3420
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3420.0.1544752079\1602772747" -parentBuildID 20221007134813 -prefsHandle 1900 -prefMapHandle 1892 -prefsLen 20938 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {acd425e1-a977-46e0-89f4-4a6946a0b10c} 3420 "\\.\pipe\gecko-crash-server-pipe.3420" 1980 1fff40bd458 gpu
    3⤵
    PID:5004
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3420.1.223297581\1633528244" -parentBuildID 20221007134813 -prefsHandle 2368 -prefMapHandle 2364 -prefsLen 20974 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7bb43b0a-a764-48c0-bb13-d5d6f5beca4a} 3420 "\\.\pipe\gecko-crash-server-pipe.3420" 2380 1ffe7572858 socket
    3⤵
    PID:4944
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3420.2.635140647\1014650987" -childID 1 -isForBrowser -prefsHandle 3000 -prefMapHandle 3076 -prefsLen 21077 -prefMapSize 232675 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7c72474e-956f-47e4-b5a1-d882c0e90208} 3420 "\\.\pipe\gecko-crash-server-pipe.3420" 3112 1fff7ebbb58 tab
    3⤵
    PID:2760
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3420.3.1472308246\1003358533" -childID 2 -isForBrowser -prefsHandle 3556 -prefMapHandle 3552 -prefsLen 26437 -prefMapSize 232675 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a3eca311-ac99-4fb2-8fda-0a34953a822f} 3420 "\\.\pipe\gecko-crash-server-pipe.3420" 3568 1ffe7562b58 tab
    3⤵
    PID:4552
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3420.4.1775341544\1263842463" -childID 3 -isForBrowser -prefsHandle 4240 -prefMapHandle 4224 -prefsLen 26496 -prefMapSize 232675 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a54e1392-d8b2-486e-a265-23409dc3538a} 3420 "\\.\pipe\gecko-crash-server-pipe.3420" 4248 1fff9519b58 tab
    3⤵
    PID:4856
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3420.5.553864044\1522663346" -childID 4 -isForBrowser -prefsHandle 5020 -prefMapHandle 5016 -prefsLen 26577 -prefMapSize 232675 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4bc0ff1b-0f15-4c4d-87e9-c445bc966791} 3420 "\\.\pipe\gecko-crash-server-pipe.3420" 5136 1ffe7560758 tab
    3⤵
    PID:2116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3420.7.1494573480\1036067680" -childID 6 -isForBrowser -prefsHandle 5460 -prefMapHandle 5464 -prefsLen 26577 -prefMapSize 232675 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {854860cd-3102-480d-95bb-0cfa7c9c3f23} 3420 "\\.\pipe\gecko-crash-server-pipe.3420" 5452 1fffa4a4058 tab
    3⤵
    PID:3296
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3420.6.739007414\725085723" -childID 5 -isForBrowser -prefsHandle 5272 -prefMapHandle 5276 -prefsLen 26577 -prefMapSize 232675 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3176a603-cd71-4b1e-9a47-f7b9d70f2664} 3420 "\\.\pipe\gecko-crash-server-pipe.3420" 5264 1fffa4a3758 tab
    3⤵
    PID:3336
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3420.8.384625431\865126938" -childID 7 -isForBrowser -prefsHandle 2736 -prefMapHandle 1700 -prefsLen 26831 -prefMapSize 232675 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e23feb53-7c99-4cc7-8d3b-bfeabfcd4863} 3420 "\\.\pipe\gecko-crash-server-pipe.3420" 1704 1fff67ddd58 tab
    3⤵
    PID:2408
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3420.9.421241670\634668824" -childID 8 -isForBrowser -prefsHandle 6032 -prefMapHandle 6020 -prefsLen 26831 -prefMapSize 232675 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {50889bab-f75b-4eb7-8969-8942a668bdc2} 3420 "\\.\pipe\gecko-crash-server-pipe.3420" 6016 1fffb8c9258 tab
    3⤵
    PID:5204
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3420.10.558014333\1703101706" -parentBuildID 20221007134813 -prefsHandle 6200 -prefMapHandle 6204 -prefsLen 26831 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4961ad8d-889c-4cfb-ae6a-2fa1f29c9318} 3420 "\\.\pipe\gecko-crash-server-pipe.3420" 6188 1fffbc35f58 rdd
    3⤵
    PID:5268
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3420.11.1453792318\517621588" -childID 9 -isForBrowser -prefsHandle 5420 -prefMapHandle 5416 -prefsLen 26831 -prefMapSize 232675 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a04847f6-b643-4873-ba10-85bc530d4679} 3420 "\\.\pipe\gecko-crash-server-pipe.3420" 4280 1fffa4a3d58 tab
    3⤵
    PID:5736
- - C:\Users\Admin\Downloads\systeminformer-3.0.7333-setup.exe
    "C:\Users\Admin\Downloads\systeminformer-3.0.7333-setup.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious use of AdjustPrivilegeToken
    PID:5196
  - - C:\Program Files\SystemInformer\SystemInformer.exe
      "C:\Program Files\SystemInformer\SystemInformer.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      Checks processor information in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      PID:5688
    - - C:\Windows\SYSTEM32\cmd.exe
        
        "C:\Windows\SYSTEM32\cmd.exe"
        5⤵
        
        PID:2360
      - C:\Windows\system32\rundll32.exe
        
        rundll32.exe install1.dll,hola
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Writes to the Master Boot Record (MBR)
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2684
      - C:\Windows\system32\rundll32.exe
        
        rundll32.exe install1.dll,hola
        6⤵
        
        PID:5836
      - C:\Windows\system32\regsvr32.exe
        
        regsvr32 install1.dll a
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Writes to the Master Boot Record (MBR)
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:6880
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3420.12.879438685\1991362988" -childID 10 -isForBrowser -prefsHandle 4452 -prefMapHandle 5940 -prefsLen 27272 -prefMapSize 232675 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8d176bef-76f6-4c50-89f9-5b507ed119dd} 3420 "\\.\pipe\gecko-crash-server-pipe.3420" 7068 1ffe7560d58 tab
    3⤵
    PID:6104
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3420.13.1320238661\1293664969" -childID 11 -isForBrowser -prefsHandle 5504 -prefMapHandle 5912 -prefsLen 27272 -prefMapSize 232675 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {365b2fc9-9ac6-41b2-92d3-17226b4e857d} 3420 "\\.\pipe\gecko-crash-server-pipe.3420" 5676 1fffb8f0158 tab
    3⤵
    PID:5900
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3420.14.1096416570\1217924897" -childID 12 -isForBrowser -prefsHandle 7096 -prefMapHandle 5044 -prefsLen 27272 -prefMapSize 232675 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ce56f700-83d7-4a36-a5da-62b0e2023be6} 3420 "\\.\pipe\gecko-crash-server-pipe.3420" 7108 1ffe7560d58 tab
    3⤵
    PID:5180
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3420.15.253583845\1618039680" -childID 13 -isForBrowser -prefsHandle 5496 -prefMapHandle 5736 -prefsLen 27272 -prefMapSize 232675 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8bc3b779-48bf-4edd-b630-4e1e7b43efb2} 3420 "\\.\pipe\gecko-crash-server-pipe.3420" 7064 1fffa4a3d58 tab
    3⤵
    PID:5188
- - C:\Users\Admin\Downloads\dxwebsetup.exe
    "C:\Users\Admin\Downloads\dxwebsetup.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    PID:3284
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops desktop.ini file(s)
      Enumerates connected drives
      Drops file in System32 directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      PID:5640
    - - C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe d3dx9_24_x64.inf
        5⤵
        Executes dropped EXE
        
        PID:5948
    - - C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe d3dx9_25_x64.inf
        5⤵
        Executes dropped EXE
        
        PID:4820
    - - C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe d3dx9_26_x64.inf
        5⤵
        Executes dropped EXE
        
        PID:5164
    - - C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe d3dx9_27_x64.inf
        5⤵
        
        PID:1788
    - - C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe d3dx9_28_x64.inf
        5⤵
        Executes dropped EXE
        
        PID:5872
    - - C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe d3dx9_29_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:6196
    - - C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe XACT_x64.inf
        5⤵
        
        PID:6808
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_0.dll
        5⤵
        
        PID:5080
    - - C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe d3dx9_30_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:6976
    - - C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe XACT2_1_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:6364
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_1.dll
        5⤵
        Loads dropped DLL
        Registers COM server for autorun
        
        PID:6224
    - - C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe xinput1_1_x64.inf, Install_Driver
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2696
    - - C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe XACT2_2_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5660
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_2.dll
        5⤵
        Loads dropped DLL
        Registers COM server for autorun
        
        PID:6872
    - - C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe xinput1_2_x64.inf, Install_Driver
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:7136
    - - C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe XACT2_3_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4316
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_3.dll
        5⤵
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:2764
    - - C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe d3dx9_31_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2952
    - - C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe XACT2_4_x64.inf
        5⤵
        
        PID:1096
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_4.dll
        5⤵
        Registers COM server for autorun
        Modifies registry class
        
        PID:2944
    - - C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe d3dx9_32_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:6332
    - - C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe d3dx10_00_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:6432
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_5.dll
        5⤵
        Registers COM server for autorun
        
        PID:5008
    - - C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe XACT2_6_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5828
    - - C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe XACT2_5_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:6900
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_6.dll
        5⤵
        Registers COM server for autorun
        Modifies registry class
        
        PID:580
    - - C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe d3dx9_33_x64.inf
        5⤵
        
        PID:5576
    - - C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe d3dx10_33_x64.inf
        5⤵
        Executes dropped EXE
        
        PID:2904
    - - C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe XACT2_7_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:6392
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_7.dll
        5⤵
        Registers COM server for autorun
        Modifies registry class
        
        PID:3996
    - - C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe xinput1_3_x64.inf, Install_Driver
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:6808
    - - C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe d3dx9_34_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:6816
    - - C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe d3dx10_34_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:5436
    - - C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe XACT2_8_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:540
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_8.dll
        5⤵
        Registers COM server for autorun
        
        PID:4560
    - - C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe d3dx9_35_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4760
    - - C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe d3dx10_35_x64.inf
        5⤵
        Executes dropped EXE
        
        PID:2864
    - - C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe XACT2_9_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5480
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_9.dll
        5⤵
        Registers COM server for autorun
        
        PID:6580
    - - C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe d3dx9_36_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:6832
    - - C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe d3dx10_36_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:5916
    - - C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe X3DAudio1_2_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4124
    - - C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe XACT2_10_x64.inf
        5⤵
        Executes dropped EXE
        
        PID:3888
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_10.dll
        5⤵
        Registers COM server for autorun
        Modifies registry class
        
        PID:5524
    - - C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe D3DX9_37_x64.inf
        5⤵
        Executes dropped EXE
        
        PID:3088
    - - C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe d3dx10_37_x64.inf
        5⤵
        Executes dropped EXE
        
        PID:4184
    - - C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe X3DAudio1_3_x64.inf
        5⤵
        Executes dropped EXE
        
        PID:6348
    - - C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe XACT3_0_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:6868
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_0.dll
        5⤵
        Registers COM server for autorun
        
        PID:5108
    - - C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe XAudio2_0_x64.inf
        5⤵
        Executes dropped EXE
        
        PID:6920
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_0.dll
        5⤵
        Registers COM server for autorun
        Modifies registry class
        
        PID:2536
    - - C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe D3DX9_38_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:1096
    - - C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe d3dx10_38_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:5576
    - - C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe X3DAudio1_4_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:5300
    - - C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe XACT3_1_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1204
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_1.dll
        5⤵
        Modifies registry class
        
        PID:6240
    - - C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe XAudio2_1_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4464
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_1.dll
        5⤵
        Registers COM server for autorun
        
        PID:6488
    - - C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe D3DX9_39_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:5656
    - - C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe d3dx10_39_x64.inf
        5⤵
        Executes dropped EXE
        
        PID:5680
    - - C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe XACT3_2_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4620
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_2.dll
        5⤵
        Registers COM server for autorun
        Modifies registry class
        
        PID:1212
    - - C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe XAudio2_2_x64.inf
        5⤵
        Executes dropped EXE
        
        PID:5972
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_2.dll
        5⤵
        Registers COM server for autorun
        Modifies registry class
        
        PID:5032
    - - C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe X3DAudio1_5_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:2124
    - - C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe XACT3_3_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3976
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_3.dll
        5⤵
        Registers COM server for autorun
        
        PID:4188
    - - C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe XAudio2_3_x64.inf
        5⤵
        Executes dropped EXE
        
        PID:6768
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_3.dll
        5⤵
        Registers COM server for autorun
        Modifies registry class
        
        PID:6784
    - - C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe D3DX9_40_x64.inf
        5⤵
        Executes dropped EXE
        
        PID:6564
    - - C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe d3dx10_40_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5852
    - - C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe X3DAudio1_6_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:6864
    - - C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe XACT3_4_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:4984
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_4.dll
        5⤵
        Executes dropped EXE
        Registers COM server for autorun
        Drops file in System32 directory
        Drops file in Windows directory
        Modifies registry class
        
        PID:1788
    - - C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe XAudio2_4_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2456
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_4.dll
        5⤵
        Registers COM server for autorun
        Modifies registry class
        
        PID:1308
    - - C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe D3DX9_41_x64.inf
        5⤵
        Executes dropped EXE
        
        PID:3376
    - - C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe d3dx10_41_x64.inf
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Drops file in Windows directory
        Modifies registry class
        
        PID:5080
    - - C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX1035.tmp\infinst.exe D3DX9_42_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3212
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3420.16.1522673784\1385661124" -childID 14 -isForBrowser -prefsHandle 7584 -prefMapHandle 5700 -prefsLen 30336 -prefMapSize 232675 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e7464206-6b1a-47ec-a525-d78302e83982} 3420 "\\.\pipe\gecko-crash-server-pipe.3420" 6116 1fffc42eb58 tab
    3⤵
    PID:6000
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3420.17.562895833\1242378283" -childID 15 -isForBrowser -prefsHandle 4992 -prefMapHandle 5580 -prefsLen 30336 -prefMapSize 232675 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9c49ddc0-d088-41c6-afb7-bbc3ab3ce594} 3420 "\\.\pipe\gecko-crash-server-pipe.3420" 6156 1fff56d0e58 tab
    3⤵
    PID:5124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3420.18.1767759875\115561126" -childID 16 -isForBrowser -prefsHandle 4812 -prefMapHandle 5028 -prefsLen 30345 -prefMapSize 232675 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {78af0bd9-be1e-449b-b182-1fcc0f014ba2} 3420 "\\.\pipe\gecko-crash-server-pipe.3420" 1696 1fffb16f658 tab
    3⤵
    PID:6116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3420.19.1802309903\187652445" -childID 17 -isForBrowser -prefsHandle 8160 -prefMapHandle 8024 -prefsLen 30345 -prefMapSize 232675 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b3609361-3d7d-459d-b793-f1eec6e51a18} 3420 "\\.\pipe\gecko-crash-server-pipe.3420" 8104 1fffb16ff58 tab
    3⤵
    PID:5592
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3420.20.1630401791\1885067510" -childID 18 -isForBrowser -prefsHandle 9196 -prefMapHandle 11592 -prefsLen 30345 -prefMapSize 232675 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {145845dc-29fc-407b-88d6-ad4e7efbe05e} 3420 "\\.\pipe\gecko-crash-server-pipe.3420" 9208 2000383d158 tab
    3⤵
    PID:1540
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3420.21.941286019\643690133" -childID 19 -isForBrowser -prefsHandle 11444 -prefMapHandle 11440 -prefsLen 30345 -prefMapSize 232675 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d8603548-b51e-48b8-a8c6-7e24c90eccaa} 3420 "\\.\pipe\gecko-crash-server-pipe.3420" 11452 2000383dd58 tab
    3⤵
    PID:2232
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3420.22.351974982\63720806" -childID 20 -isForBrowser -prefsHandle 7952 -prefMapHandle 9144 -prefsLen 30345 -prefMapSize 232675 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {032e0a16-f475-4990-9c6b-1cf17ba8a806} 3420 "\\.\pipe\gecko-crash-server-pipe.3420" 11200 20004844058 tab
    3⤵
    PID:4316
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3420.23.360342278\1682664482" -childID 21 -isForBrowser -prefsHandle 7932 -prefMapHandle 8108 -prefsLen 30345 -prefMapSize 232675 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4a74e0eb-4a34-4b49-abe8-9105d7234074} 3420 "\\.\pipe\gecko-crash-server-pipe.3420" 7988 1fffe52be58 tab
    3⤵
    PID:5824
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3420.24.282220822\1327083940" -childID 22 -isForBrowser -prefsHandle 5688 -prefMapHandle 1676 -prefsLen 30345 -prefMapSize 232675 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f16277bc-c6fd-4c73-a57f-93001a0d6621} 3420 "\\.\pipe\gecko-crash-server-pipe.3420" 6048 200027cf958 tab
    3⤵
    PID:5000
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3420.25.945804298\342603435" -childID 23 -isForBrowser -prefsHandle 8916 -prefMapHandle 8912 -prefsLen 30345 -prefMapSize 232675 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {47124d8e-0325-495e-94bf-f34c9316aa2f} 3420 "\\.\pipe\gecko-crash-server-pipe.3420" 8924 20005aa1d58 tab
    3⤵
    PID:5216
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3420.26.1639125920\195051187" -childID 24 -isForBrowser -prefsHandle 6048 -prefMapHandle 7256 -prefsLen 30345 -prefMapSize 232675 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3f66a56b-653d-4f9d-a43b-2eabe74f5772} 3420 "\\.\pipe\gecko-crash-server-pipe.3420" 5688 1fff95d7358 tab
    3⤵
    PID:6008
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3420.27.1943341093\42222187" -childID 25 -isForBrowser -prefsHandle 9144 -prefMapHandle 9064 -prefsLen 30345 -prefMapSize 232675 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {132e92b9-39d4-4302-96b0-9e7b60bebd28} 3420 "\\.\pipe\gecko-crash-server-pipe.3420" 11224 20004842e58 tab
    3⤵
    PID:1944
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3420.28.773742071\2136950779" -childID 26 -isForBrowser -prefsHandle 11300 -prefMapHandle 11284 -prefsLen 30345 -prefMapSize 232675 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7e9b8c0b-9c49-44e2-ad67-e77e4032bfc0} 3420 "\\.\pipe\gecko-crash-server-pipe.3420" 11324 20004d28b58 tab
    3⤵
    PID:6584
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3420.29.41166130\1968478336" -childID 27 -isForBrowser -prefsHandle 11336 -prefMapHandle 5464 -prefsLen 30345 -prefMapSize 232675 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bc93b875-2f68-4b13-a2c8-d3c0c51250ea} 3420 "\\.\pipe\gecko-crash-server-pipe.3420" 11440 2000265d258 tab
    3⤵
    PID:6704
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3420.30.1506257709\733924116" -childID 28 -isForBrowser -prefsHandle 6008 -prefMapHandle 5712 -prefsLen 30345 -prefMapSize 232675 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0ba7edb1-4887-40a4-abd0-cf69a941be25} 3420 "\\.\pipe\gecko-crash-server-pipe.3420" 4576 1ffe7560d58 tab
    3⤵
    PID:6512

C:\Windows\system32\notepad.exe
"C:\Windows\system32\notepad.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5412

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6032

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6792

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\processhacker-2.39-bin\" -spe -an -ai#7zMap14595:106:7zEvent14208
1⤵
PID:5220

C:\Users\Admin\Downloads\processhacker-2.39-bin\x64\ProcessHacker.exe
"C:\Users\Admin\Downloads\processhacker-2.39-bin\x64\ProcessHacker.exe"
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:972

C:\Windows\system32\notepad.exe
"C:\Windows\system32\notepad.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery