e6aa9026e4327eeaa2cf116634b4c4fc6e12db2dc05c89afa3ab32a802b83018

Modify Registry

Processes:

DrvInst.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\RapiMgr\Parameters\ServiceDll = "%windir%\\WindowsMobile\\rapimgr.dll"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WcesComm\Parameters\ServiceDll = "%windir%\\WindowsMobile\\wcescomm.dll"	DrvInst.exe

Checks BIOS information in registry 2 TTPs 3 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

MsiExec.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	MsiExec.exe

Executes dropped EXE 5 IoCs

Processes:

driver_setup.exesetup.exewmdcBase.exeInstallForm.exewmdc.exe

pid process

2296 driver_setup.exe
2012 setup.exe
1588 wmdcBase.exe
1568 InstallForm.exe
4616 wmdc.exe

pid	process
2296	driver_setup.exe
2012	setup.exe
1588	wmdcBase.exe
1568	InstallForm.exe
4616	wmdc.exe

Loads dropped DLL 35 IoCs

Processes:

MsiExec.exeMsiExec.exeMsiExec.exeDrvInst.exesvchost.exesvchost.exewmdcBase.exesvchost.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exewmdc.exe

pid	process
3200	MsiExec.exe
2420	MsiExec.exe
2420	MsiExec.exe
1988	MsiExec.exe
1988	MsiExec.exe
1988	MsiExec.exe
1988	MsiExec.exe
2420	MsiExec.exe
1648	DrvInst.exe
776	svchost.exe
776	svchost.exe
1116	svchost.exe
1116	svchost.exe
1116	svchost.exe
1588	wmdcBase.exe
1588	wmdcBase.exe
1588	wmdcBase.exe
776	svchost.exe
1588	wmdcBase.exe
2400	svchost.exe
2400	svchost.exe
2400	svchost.exe
1904	MsiExec.exe
1596	MsiExec.exe
660	MsiExec.exe
1804	MsiExec.exe
1804	MsiExec.exe
1804	MsiExec.exe
4728	MsiExec.exe
1596	MsiExec.exe
1596	MsiExec.exe
4616	wmdc.exe
4616	wmdc.exe
4616	wmdc.exe
4616	wmdc.exe

Registers COM server for autorun 1 TTPs 45 IoCs

persistence

Registry Run Keys / Startup Folder

Processes:

msiexec.exeDrvInst.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3B5AA27A-CBF9-48C9-96F8-4ACE84FB8512}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3B5AA27A-CBF9-48C9-96F8-4ACE84FB8512}\InprocServer32\Class = "Microsoft.WindowsMobile.WindowsMobileFactory"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3B5AA27A-CBF9-48C9-96F8-4ACE84FB8512}\InprocServer32\ = "mscoree.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3B5AA27A-CBF9-48C9-96F8-4ACE84FB8512}\InprocServer32\6.1.0.0\Assembly = "Microsoft.WindowsMobile.DeviceManager, Version=6.1.0.0, Culture=neutral"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD073990-9104-45d9-9DF8-AE6B31F7C67D}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{122CC07F-3333-42aa-9ABC-6BAE729A4C85}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{412E4330-A2EA-4A1C-B723-873E5FA1C618}\InProcServer32\ThreadingModel = "Both"	DrvInst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{52959703-387A-43D6-9746-75CC08DFB3F9}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3B5AA27A-CBF9-48C9-96F8-4ACE84FB8512}\InprocServer32\6.1.0.0\RuntimeVersion = "v2.0.50727"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD073990-9104-45d9-9DF8-AE6B31F7C67D}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{122CC07F-3333-42aa-9ABC-6BAE729A4C85}\InprocServer32\ = "C:\\Windows\\WindowsMobile\\inplace.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{86A0B54A-5721-41b4-A3F1-81C6531B7D22}\InprocServer32\ThreadingModel = "Free"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3B5AA27A-CBF9-48C9-96F8-4ACE84FB8512}\InprocServer32\RuntimeVersion = "v2.0.50727"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{52959703-387A-43D6-9746-75CC08DFB3F9}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3B5AA27A-CBF9-48C9-96F8-4ACE84FB8512}\InprocServer32\6.1.0.0\	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{1A52C610-B080-4f7d-9277-6F89AA966620}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1A52C610-B080-4f7d-9277-6F89AA966620}\InprocServer32\ = "C:\\Windows\\WindowsMobile\\wmdsyncman.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4ED4A55B-629E-4B3D-9F18-86CCE9581262}\InProcServer32	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{35440327-1517-4B72-865E-3FFE8E97002F}\InprocServer32\ThreadingModel = "Both"	DrvInst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{86A0B54A-5721-41b4-A3F1-81C6531B7D22}\InprocServer32	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DCBEB807-14D0-4CBD-926C-B991F4FD1B91}\InprocServer32\ThreadingModel = "Both"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{499C0C20-A766-11CF-8011-00A0C90A8F78}\InprocServer32\ThreadingModel = "Both"	DrvInst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{35440327-1517-4B72-865E-3FFE8E97002F}\InprocServer32	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{86A0B54A-5721-41b4-A3F1-81C6531B7D22}\InprocServer32\ = "%windir%\\WindowsMobile\\BthASPlugin.dll"	DrvInst.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{52959703-387A-43D6-9746-75CC08DFB3F9}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6B7AD2F5-32BF-4b5c-ABEA-FB123102E9AE}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4ED4A55B-629E-4B3D-9F18-86CCE9581262}\InProcServer32\ = "%windir%\\system32\\WcesCommProxy.dll"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{412E4330-A2EA-4A1C-B723-873E5FA1C618}\InProcServer32\ = "%windir%\\system32\\wcescommproxy.dll"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{499C0C20-A766-11CF-8011-00A0C90A8F78}\InprocServer32\ = "%windir%\\system32\\rapi.dll"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6B7AD2F5-32BF-4b5c-ABEA-FB123102E9AE}\LocalServer32\ = "%windir%\\WindowsMobile\\wmdc.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3B5AA27A-CBF9-48C9-96F8-4ACE84FB8512}\InprocServer32\Assembly = "Microsoft.WindowsMobile.DeviceManager, Version=6.1.0.0, Culture=neutral"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{3B5AA27A-CBF9-48C9-96F8-4ACE84FB8512}\InprocServer32\6.1.0.0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3B5AA27A-CBF9-48C9-96F8-4ACE84FB8512}\InprocServer32\6.1.0.0\Class = "Microsoft.WindowsMobile.WindowsMobileFactory"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4ED4A55B-629E-4B3D-9F18-86CCE9581262}\InProcServer32\ThreadingModel = "Both"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{35440327-1517-4B72-865E-3FFE8E97002F}\InprocServer32\ = "%windir%\\system32\\rapistub.dll"	DrvInst.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{CD073990-9104-45d9-9DF8-AE6B31F7C67D}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1A52C610-B080-4f7d-9277-6F89AA966620}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DCBEB807-14D0-4CBD-926C-B991F4FD1B91}\InprocServer32\ = "%windir%\\system32\\rapiproxystub.dll"	DrvInst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{412E4330-A2EA-4A1C-B723-873E5FA1C618}\InProcServer32	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{52959703-387A-43D6-9746-75CC08DFB3F9}\InprocServer32\ = "C:\\Windows\\WindowsMobile\\wmdsyncproxy.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{3B5AA27A-CBF9-48C9-96F8-4ACE84FB8512}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD073990-9104-45d9-9DF8-AE6B31F7C67D}\InprocServer32\ = "C:\\Windows\\WindowsMobile\\wmdsyncman.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{122CC07F-3333-42aa-9ABC-6BAE729A4C85}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DCBEB807-14D0-4CBD-926C-B991F4FD1B91}\InprocServer32	DrvInst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{499C0C20-A766-11CF-8011-00A0C90A8F78}\InprocServer32	DrvInst.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

af48efac2b7d97cc0b70559a0a2be8cfeae961306ed16f0c91706a3bef6d61fc.exeDrvInst.exemsiexec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	af48efac2b7d97cc0b70559a0a2be8cfeae961306ed16f0c91706a3bef6d61fc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Mobile-based device management = "%windir%\\WindowsMobile\\wmdcBase.exe"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Mobile Device Center = "%windir%\\WindowsMobile\\wmdc.exe"	msiexec.exe

Drops desktop.ini file(s) 1 IoCs

Processes:

msiexec.exe

description ioc process

File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini msiexec.exe

description	ioc	process
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	msiexec.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

driver_setup.exemsiexec.exeDrvInst.exesetup.exe

description	ioc	process
File opened (read-only)	\??\J:	driver_setup.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	DrvInst.exe
File opened (read-only)	\??\L:	DrvInst.exe
File opened (read-only)	\??\R:	DrvInst.exe
File opened (read-only)	\??\K:	setup.exe
File opened (read-only)	\??\G:	driver_setup.exe
File opened (read-only)	\??\M:	driver_setup.exe
File opened (read-only)	\??\R:	driver_setup.exe
File opened (read-only)	\??\Y:	driver_setup.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	DrvInst.exe
File opened (read-only)	\??\Z:	DrvInst.exe
File opened (read-only)	\??\R:	setup.exe
File opened (read-only)	\??\S:	setup.exe
File opened (read-only)	\??\I:	driver_setup.exe
File opened (read-only)	\??\L:	driver_setup.exe
File opened (read-only)	\??\N:	DrvInst.exe
File opened (read-only)	\??\B:	DrvInst.exe
File opened (read-only)	\??\S:	DrvInst.exe
File opened (read-only)	\??\L:	setup.exe
File opened (read-only)	\??\T:	setup.exe
File opened (read-only)	\??\Q:	driver_setup.exe
File opened (read-only)	\??\T:	driver_setup.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	DrvInst.exe
File opened (read-only)	\??\E:	DrvInst.exe
File opened (read-only)	\??\U:	DrvInst.exe
File opened (read-only)	\??\X:	DrvInst.exe
File opened (read-only)	\??\B:	setup.exe
File opened (read-only)	\??\G:	setup.exe
File opened (read-only)	\??\X:	setup.exe
File opened (read-only)	\??\J:	setup.exe
File opened (read-only)	\??\K:	driver_setup.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	DrvInst.exe
File opened (read-only)	\??\O:	DrvInst.exe
File opened (read-only)	\??\Q:	DrvInst.exe
File opened (read-only)	\??\H:	driver_setup.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\I:	setup.exe
File opened (read-only)	\??\Y:	setup.exe
File opened (read-only)	\??\V:	setup.exe
File opened (read-only)	\??\B:	driver_setup.exe
File opened (read-only)	\??\S:	driver_setup.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	DrvInst.exe
File opened (read-only)	\??\M:	DrvInst.exe
File opened (read-only)	\??\E:	setup.exe
File opened (read-only)	\??\H:	setup.exe
File opened (read-only)	\??\V:	driver_setup.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	DrvInst.exe
File opened (read-only)	\??\O:	setup.exe
File opened (read-only)	\??\P:	setup.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	DrvInst.exe
File opened (read-only)	\??\N:	setup.exe

Drops file in System32 directory 64 IoCs

Processes:

DrvInst.exeDrvInst.exeDrvInst.exeDrvInst.exeDrvInst.exe

description	ioc	process
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wcebth.inf_amd64_92cde66e1cfb521e\wow64-rapispxy.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wcebth.inf_amd64_92cde66e1cfb521e\fr-FR\fr-FR-wmdConn.cpl.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1ab62f1a-787a-714f-a8ff-6e2dd79fce22}\fr-FR	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{30f10e14-2a40-2b47-9a44-5fe6e14b0d95}\nl-NL\SETD1DC.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{9748c544-8444-6a49-ac05-72c0764202da}\SETE26D.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wcebth.inf_amd64_92cde66e1cfb521e\pt-BR\pt-BR-wcescomm.dll.mui	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{1ab62f1a-787a-714f-a8ff-6e2dd79fce22}\el-GR\SETBAFC.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{1ab62f1a-787a-714f-a8ff-6e2dd79fce22}\SETBDA1.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{30f10e14-2a40-2b47-9a44-5fe6e14b0d95}\pt-BR\pt-BR-wmdc.exe.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1ab62f1a-787a-714f-a8ff-6e2dd79fce22}\sv-SE\sv-SE-wcescomm.dll.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{a5043543-1140-af48-ad43-134cec26fb7b}\pt-BR\pt-BR-setup.exe.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wcebth.inf_amd64_92cde66e1cfb521e\da-DK\da-DK-wcescomm.dll.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{30f10e14-2a40-2b47-9a44-5fe6e14b0d95}\de-DE\SETD4CA.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wcebth.inf_amd64_92cde66e1cfb521e\da-DK\da-DK-wmdConn.cpl.mui	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{a5043543-1140-af48-ad43-134cec26fb7b}\el-GR\SETE5E4.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{a5043543-1140-af48-ad43-134cec26fb7b}\de-DE\SETEC0C.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1ab62f1a-787a-714f-a8ff-6e2dd79fce22}\wmcoinst-070531-0952.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1ab62f1a-787a-714f-a8ff-6e2dd79fce22}\pt-PT\pt-PT-wcescomm.dll.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{30f10e14-2a40-2b47-9a44-5fe6e14b0d95}\es-ES\es-ES-rapimgr.dll.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{a5043543-1140-af48-ad43-134cec26fb7b}\wmcoinst-070531-0952.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wceusbsh.inf_amd64_ed7e79d05f4c4512\fr-FR\fr-FR-wmdConn.cpl.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wceusbsh.inf_amd64_ed7e79d05f4c4512\tr-TR\tr-TR-wcescomm.dll.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{a5043543-1140-af48-ad43-134cec26fb7b}\cs-CZ\SETE755.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{1ab62f1a-787a-714f-a8ff-6e2dd79fce22}\fr-FR\SETBB53.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1ab62f1a-787a-714f-a8ff-6e2dd79fce22}\pt-PT\SETBF97.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{a5043543-1140-af48-ad43-134cec26fb7b}\wow64-ceutil.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{a5043543-1140-af48-ad43-134cec26fb7b}\fr-FR\SETE66A.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{a5043543-1140-af48-ad43-134cec26fb7b}\rapi.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{a5043543-1140-af48-ad43-134cec26fb7b}\sv-SE\sv-SE-rapimgr.dll.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1ab62f1a-787a-714f-a8ff-6e2dd79fce22}\ja-JP\ja-JP-wmdConn.cpl.mui	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{30f10e14-2a40-2b47-9a44-5fe6e14b0d95}\hu-HU\SETD392.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{a5043543-1140-af48-ad43-134cec26fb7b}\wcescomm.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wcebth.inf_amd64_92cde66e1cfb521e\dtptdns.dll	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{1ab62f1a-787a-714f-a8ff-6e2dd79fce22}\nl-NL\SETBC72.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1ab62f1a-787a-714f-a8ff-6e2dd79fce22}\nl-NL\nl-NL-setup.exe.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wcerndis.inf_amd64_7f46c8a40bd97188\wow64-rapispxy.dll	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{a5043543-1140-af48-ad43-134cec26fb7b}\it-IT\SETE9A4.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{a5043543-1140-af48-ad43-134cec26fb7b}\sk-SK\sk-SK-wmdc.exe.mui	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{a5043543-1140-af48-ad43-134cec26fb7b}\zh-TW\SETED06.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1ab62f1a-787a-714f-a8ff-6e2dd79fce22}\pt-BR\pt-BR-wcescomm.dll.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wcerndis.inf_amd64_7f46c8a40bd97188\fi-FI\fi-FI-rapimgr.dll.mui	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{30f10e14-2a40-2b47-9a44-5fe6e14b0d95}\it-IT\SETD36C.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1ab62f1a-787a-714f-a8ff-6e2dd79fce22}\es-ES\es-ES-wmdc.exe.mui	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{a5043543-1140-af48-ad43-134cec26fb7b}\SETE813.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wceusbsh.inf_amd64_ed7e79d05f4c4512\zh-CN\zh-CN-wcescomm.dll.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{a5043543-1140-af48-ad43-134cec26fb7b}\ja-JP\ja-JP-rapimgr.dll.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{a5043543-1140-af48-ad43-134cec26fb7b}\zh-TW\SETECE5.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wcebth.inf_amd64_92cde66e1cfb521e\it-IT\it-IT-rapimgr.dll.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{30f10e14-2a40-2b47-9a44-5fe6e14b0d95}\cs-CZ\cs-CZ-wcescomm.dll.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{30f10e14-2a40-2b47-9a44-5fe6e14b0d95}\ko-KR\SETD2D3.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{30f10e14-2a40-2b47-9a44-5fe6e14b0d95}\hu-HU\SETD391.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1ab62f1a-787a-714f-a8ff-6e2dd79fce22}\el-GR\el-GR-wmdConn.cpl.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{a5043543-1140-af48-ad43-134cec26fb7b}\zh-CN\SETE6DF.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{a5043543-1140-af48-ad43-134cec26fb7b}\zh-TW\SETECE5.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{30f10e14-2a40-2b47-9a44-5fe6e14b0d95}\ro-RO\SETD453.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wceusbsh.inf_amd64_ed7e79d05f4c4512\en-US\en-US-wcescomm.dll.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{a5043543-1140-af48-ad43-134cec26fb7b}\ko-KR\SETE8C9.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1ab62f1a-787a-714f-a8ff-6e2dd79fce22}\wow64-rapispxy.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{30f10e14-2a40-2b47-9a44-5fe6e14b0d95}\ko-KR\ko-KR-rapimgr.dll.mui	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{30f10e14-2a40-2b47-9a44-5fe6e14b0d95}\en-US\SETD3B4.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1ab62f1a-787a-714f-a8ff-6e2dd79fce22}\setup.exe	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wcerndis.inf_amd64_7f46c8a40bd97188\ko-KR\ko-KR-wcescomm.dll.mui	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{a5043543-1140-af48-ad43-134cec26fb7b}\en-US\SETEA2B.tmp	DrvInst.exe

Drops file in Windows directory 64 IoCs

Processes:

msiexec.exeDrvInst.exe

description	ioc	process
File created	C:\Windows\WindowsMobile\pt-PT\Formdll.dll.mui	msiexec.exe
File created	C:\Windows\Installer\e58a379.msi	msiexec.exe
File opened for modification	C:\Windows\WindowsMobile\sk-SK\wmdConn.cpl.mui	DrvInst.exe
File opened for modification	C:\Windows\WindowsMobile\zh-TW\rapimgr.dll.mui	DrvInst.exe
File created	C:\Windows\WindowsMobile\it-IT\ceappmgr.exe.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\pt-BR\BakRestr.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\ja-JP\InkStore.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\fr-FR\wmdsyncman.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\ko-KR\olregdll.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\Serial\tr-tr\tr-tr-rapimgr.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\Bluetooth\fr-fr\fr-fr-wmdConn.cpl.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\Bluetooth\sv-se\sv-se-wmdConn.cpl.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\en-US\eula.rtf	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\RNDIS\nb-no\nb-no-setup.exe.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\RNDIS\sk-sk\sk-sk-wmdConn.cpl.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\cs-CZ\legacysyncengine.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\Serial\cs-cz\cs-cz-wmdc.exe.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\Bluetooth\da-dk\da-dk-wmdc.exe.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\Bluetooth\fr-fr\fr-fr-setup.exe.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\RNDIS\it-it\it-it-wmdc.exe.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\RNDIS\zh-cn\zh-cn-rapimgr.dll.mui	msiexec.exe
File opened for modification	C:\Windows\WindowsMobile\ko-KR\wcescomm.dll.mui	DrvInst.exe
File created	C:\Windows\WindowsMobile\el-GR\Inkx.dll.mui	msiexec.exe
File opened for modification	C:\Windows\WindowsMobile\ko-KR\rapimgr.dll.mui	DrvInst.exe
File created	C:\Windows\WindowsMobile\ru-RU\VComCtl.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\tr-TR\wmdsyncman.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\RNDIS\da-dk\da-dk-wcescomm.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\RNDIS\es-es\es-es-setup.exe.mui	msiexec.exe
File opened for modification	C:\Windows\WindowsMobile\setup.exe	DrvInst.exe
File opened for modification	C:\Windows\WindowsMobile\da-DK\rapimgr.dll.mui	DrvInst.exe
File created	C:\Windows\WindowsMobile\ko-KR\wmdc.exe.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\ru-RU\AirSyncEngine.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Help\hu-HU\wm_devmgr.chm	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\Bluetooth\wmupdate.msi	msiexec.exe
File opened for modification	C:\Windows\WindowsMobile\sk-SK\rapimgr.dll.mui	DrvInst.exe
File created	C:\Windows\WindowsMobile\es-ES\inplace.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\es-ES\Formdll.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\ro-RO\olregdll.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\tr-TR\ceappmgr.exe.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\Serial\en-us\en-us-rapimgr.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\Serial\ru-ru\ru-ru-wmdConn.cpl.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\Bluetooth\el-gr\el-gr-rapimgr.dll.mui	msiexec.exe
File opened for modification	C:\Windows\WindowsMobile\fr-FR\wcescomm.dll.mui	DrvInst.exe
File opened for modification	C:\Windows\WindowsMobile\el-GR\setup.exe.mui	DrvInst.exe
File created	C:\Windows\WindowsMobile\pt-PT\InkStore.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\sk-SK\VComCtl.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\ja-JP\BakRestr.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\da-DK\CEFStore.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\zh-CN\BakRestr.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\RNDIS\el-gr\el-gr-rapimgr.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\Serial\hu-hu\hu-hu-rapimgr.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\Bluetooth\ru-ru\ru-ru-rapimgr.dll.mui	msiexec.exe
File opened for modification	C:\Windows\WindowsMobile\sv-SE\wmdcBase.exe.mui	DrvInst.exe
File created	C:\Windows\WindowsMobile\it-IT\inkres.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\nb-NO\outstore.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\ru-RU\olregdll.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\zh-CN\httpsys.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\Bluetooth\hu-hu\hu-hu-wmdc.exe.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\Bluetooth\nl-nl\nl-nl-wcescomm.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\de-DE\olregdll.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\es-ES\eula.rtf	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\Serial\wmdc.exe	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\Serial\it-it\it-it-wcescomm.dll.mui	msiexec.exe
File created	C:\Windows\WindowsMobile\Drivers\Bluetooth\rapistub.dll	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

svchost.exeDrvInst.exedriver_setup.exeDrvInst.exeMsiExec.exeDrvInst.exevssvc.exeDrvInst.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	driver_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	driver_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	MsiExec.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	driver_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	driver_setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	driver_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	driver_setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	driver_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	driver_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	driver_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

MsiExec.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosDate MsiExec.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosDate	MsiExec.exe

Modifies Internet Explorer settings 1 TTPs 15 IoCs

adware spyware

Modify Registry

Processes:

msiexec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB1-070F-11D3-9307-00C04FAE2D4F}\CLSID = "{1FBA04EE-3024-11D2-8F1F-0000F87ABD16}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB1-070F-11D3-9307-00C04FAE2D4F}\clsidExtension = "{2EAF5BB0-070F-11D3-9307-00C04FAE2D4F}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB1-070F-11D3-9307-00C04FAE2D4F}\	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB2-070F-11D3-9307-00C04FAE2D4F}\MenuCustomize = "Tools"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB2-070F-11D3-9307-00C04FAE2D4F}\MenuText = "@C:\\Windows\\WindowsMobile\\INetRepl.dll,-223"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB2-070F-11D3-9307-00C04FAE2D4F}\MenuStatusBar = "@C:\\Windows\\WindowsMobile\\INetRepl.dll,-224"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB2-070F-11D3-9307-00C04FAE2D4F}\	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB1-070F-11D3-9307-00C04FAE2D4F}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB1-070F-11D3-9307-00C04FAE2D4F}\Default Visible = "Yes"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB1-070F-11D3-9307-00C04FAE2D4F}\Icon = "C:\\Windows\\WindowsMobile\\INetRepl.dll,210"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB1-070F-11D3-9307-00C04FAE2D4F}\HotIcon = "C:\\Windows\\WindowsMobile\\INetRepl.dll,211"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB1-070F-11D3-9307-00C04FAE2D4F}\ButtonText = "@C:\\Windows\\WindowsMobile\\INetRepl.dll,-222"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB2-070F-11D3-9307-00C04FAE2D4F}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB2-070F-11D3-9307-00C04FAE2D4F}\CLSID = "{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2EAF5BB2-070F-11D3-9307-00C04FAE2D4F}\clsidExtension = "{2EAF5BB0-070F-11D3-9307-00C04FAE2D4F}"	msiexec.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

DrvInst.exeDrvInst.exeDrvInst.exeDrvInst.exeDrvInst.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23\52C64B7E\@%systemroot%\system32\FirewallControlPanel.dll,-12122 = "Windows Defender Firewall"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\24	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\24	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe

Modifies registry class 64 IoCs

Processes:

DrvInst.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{258A260C-95CF-46F0-ACFE-695D6463C190}	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B4FD053E-4810-46DB-889B-20E638E334F0}\ProxyStubClsid32\ = "{DCBEB807-14D0-4CBD-926C-B991F4FD1B91}"	DrvInst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{567C5EE9-A990-4649-A029-E8A8766EDEA6}\ProxyStubClsid32	DrvInst.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{9BDE217E-C5E8-11DB-AD95-482856D89593}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C46EC31-15F2-11d2-8CE7-0000F80275D9}\LocalServer32\ = "C:\\Windows\\WindowsMobile\\InkForm.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1A52C610-B080-4f7d-9277-6F89AA966620}\InprocServer32\ = "C:\\Windows\\WindowsMobile\\wmdsyncman.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{412E4330-A2EA-4A1C-B723-873E5FA1C618}\NumMethods\ = "11"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1A15B6A1-5CE7-482b-8D65-2D5E886296F3}\ProxyStubClsid32\ = "{52959703-387A-43D6-9746-75CC08DFB3F9}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9BDE217E-C5E8-11DB-AD95-482856D89593}\ = "IEnrollStatusNotifySink"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B49696CB-1CA4-491f-972A-246EB554069B}\NumMethods\ = "17"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VoiceCtl.VoicePlay\ = "VoicePlay Class"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8A0F1632-3905-4CA4-AEA4-7E094ECBB9A7}\NumMethods	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4ED4A55B-629E-4B3D-9F18-86CCE9581262}\InProcServer32\ = "%windir%\\system32\\WcesCommProxy.dll"	DrvInst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{77DCCB29-AE02-4A2B-B2FE-EA721F209864}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7D7D6BB1-EC74-4DF0-A429-3AFE8BB10125}\ = "IActiveSyncStatusEventSink"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AE2B3505-7E70-475F-86B4-782FAC03A0D1}\NumMethods	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BF765622-C5EF-11DB-B1CD-0D5656D89593}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2EAF5BB0-070F-11D3-9307-00C04FAE2D4F}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4475F45B-5612-4FE0-A324-8743E8885AAE}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{661a448a-1816-11db-9616-00e08161165f}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{122CC07F-3333-42aa-9ABC-6BAE729A4C85}\InprocServer32\ = "C:\\Windows\\WindowsMobile\\inplace.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6B7AD2F5-32BF-4b5c-ABEA-FB123102E9AE}\VersionIndependentProgID	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63ACBD2914B91DD449A1EA1D94DD730F\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{77F311EA-56A7-4AB5-AB64-A5F4B7B5355E}\ProxyStubClsid32	DrvInst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FF4C4832-2BEA-4472-98A3-F931BEB8F62B}\VersionIndpendentProgId	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C4CFEBD-6B87-4909-88B9-9C39A796C2D2}\ = "AirSync Desktop Engine"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{939763D4-D83A-4e20-BA8C-4C30EC31B82A}\NumMethods\ = "6"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7D7D6BB1-EC74-4DF0-A429-3AFE8BB10125}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{1A15B6A1-5CE7-482b-8D65-2D5E886296F3}\NumMethods	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1A52C610-B080-4f7d-9277-6F89AA966620}\ = "WindowsMobile Handler Context Menu"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B4FD053E-4810-46DB-889B-20E638E334F0}\ProxyStubClsid32\ = "{DCBEB807-14D0-4CBD-926C-B991F4FD1B91}"	DrvInst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C5297E5C-0642-4D74-B0CF-04AED816AA38}	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{77F311EA-56A7-4AB5-AB64-A5F4B7B5355E}\ProxyStubClsid32\ = "{412E4330-A2EA-4A1C-B723-873E5FA1C618}"	DrvInst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.RAPIStub.1	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.DccMan.3\ = "Microsoft.DccMan.3"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B7A7BAEB-622E-11d2-9851-00C04F8ECDC8}\AppID = "{A154EDDD-891E-4aea-86E5-C44CDE238170}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AE2B3505-7E70-475F-86B4-782FAC03A0D1}\NumMethods\ = "17"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3B5AA27A-CBF9-48C9-96F8-4ACE84FB8512}\InprocServer32\6.1.0.0\	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B4FD053E-4810-46DB-889B-20E638E334F0}\NumMethods	DrvInst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB3307E0-29BA-4d2d-95AB-98A8BF09C486}\NumMethods	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{AE2B3505-7E70-475F-86B4-782FAC03A0D1}\NumMethods	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\26FE22E5880B9694CB4F01BE23634CE3	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{258A260C-95CF-46F0-ACFE-695D6463C190}\NumMethods	DrvInst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{449FE623-24B0-454B-A889-129BB05DDBED}\ProxyStubClsid32	DrvInst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{19a70ae6-18db-11db-9617-00e08161165f}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C4CFEBD-6B87-4909-88B9-9C39A796C2D2}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{77DCCB29-AE02-4A2B-B2FE-EA721F209864}\ProxyStubClsid32\ = "{77DCCB29-AE02-4A2B-B2FE-EA721F209864}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B4FD053E-4810-46DB-889B-20E638E334F0}\NumMethods	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DCBEB807-14D0-4CBD-926C-B991F4FD1B91}\ProxyStubClsid32\ = "{DCBEB807-14D0-4CBD-926C-B991F4FD1B91}"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.AirSyncEngine.Desktop.1\CLSID\ = "{3C4CFEBD-6B87-4909-88B9-9C39A796C2D2}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9D6B4DF1-5197-4167-B8D5-6BD71561BE87}\ProxyStubClsid32\ = "{52959703-387A-43D6-9746-75CC08DFB3F9}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63ACBD2914B91DD449A1EA1D94DD730F\Language = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.RAPIMgr.1\CLSID	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DC276626FCFB9A94EAEFBAF0DEB3CFB5\SourceList\Net\1 = "C:\\Windows\\WindowsMobile\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{928F538A-195A-4CCB-B1F1-DEB8393A0469}\NumMethods	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DCBEB807-14D0-4CBD-926C-B991F4FD1B91}\InprocServer32\ = "%windir%\\system32\\rapiproxystub.dll"	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4ED4A55B-629E-4B3D-9F18-86CCE9581262}\ = "IDccManPriv"	DrvInst.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{52959703-387A-43D6-9746-75CC08DFB3F9}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{B49696CB-1CA4-491f-972A-246EB554069B}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{661a448a-1816-11db-9616-00e08161165f}\NumMethods	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A08B43D3-4968-417b-907B-0FB3927EE685}	DrvInst.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{661a448a-1816-11db-9616-00e08161165f}\ProxyStubClsid32\ = "{52959703-387A-43D6-9746-75CC08DFB3F9}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{17C2DE21-04E1-42b9-9414-E0973E71657F}\NumMethods	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Microsoft.AirSyncStatusListener.1	msiexec.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

msiexec.exe

pid process

1340 msiexec.exe
1340 msiexec.exe
1340 msiexec.exe
1340 msiexec.exe
1340 msiexec.exe
1340 msiexec.exe

pid	process
1340	msiexec.exe
1340	msiexec.exe
1340	msiexec.exe
1340	msiexec.exe
1340	msiexec.exe
1340	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exedriver_setup.exe

description	pid	process
Token: SeSecurityPrivilege	1340	msiexec.exe
Token: SeCreateTokenPrivilege	2296	driver_setup.exe
Token: SeAssignPrimaryTokenPrivilege	2296	driver_setup.exe
Token: SeLockMemoryPrivilege	2296	driver_setup.exe
Token: SeIncreaseQuotaPrivilege	2296	driver_setup.exe
Token: SeMachineAccountPrivilege	2296	driver_setup.exe
Token: SeTcbPrivilege	2296	driver_setup.exe
Token: SeSecurityPrivilege	2296	driver_setup.exe
Token: SeTakeOwnershipPrivilege	2296	driver_setup.exe
Token: SeLoadDriverPrivilege	2296	driver_setup.exe
Token: SeSystemProfilePrivilege	2296	driver_setup.exe
Token: SeSystemtimePrivilege	2296	driver_setup.exe
Token: SeProfSingleProcessPrivilege	2296	driver_setup.exe
Token: SeIncBasePriorityPrivilege	2296	driver_setup.exe
Token: SeCreatePagefilePrivilege	2296	driver_setup.exe
Token: SeCreatePermanentPrivilege	2296	driver_setup.exe
Token: SeBackupPrivilege	2296	driver_setup.exe
Token: SeRestorePrivilege	2296	driver_setup.exe
Token: SeShutdownPrivilege	2296	driver_setup.exe
Token: SeDebugPrivilege	2296	driver_setup.exe
Token: SeAuditPrivilege	2296	driver_setup.exe
Token: SeSystemEnvironmentPrivilege	2296	driver_setup.exe
Token: SeChangeNotifyPrivilege	2296	driver_setup.exe
Token: SeRemoteShutdownPrivilege	2296	driver_setup.exe
Token: SeUndockPrivilege	2296	driver_setup.exe
Token: SeSyncAgentPrivilege	2296	driver_setup.exe
Token: SeEnableDelegationPrivilege	2296	driver_setup.exe
Token: SeManageVolumePrivilege	2296	driver_setup.exe
Token: SeImpersonatePrivilege	2296	driver_setup.exe
Token: SeCreateGlobalPrivilege	2296	driver_setup.exe
Token: SeShutdownPrivilege	2296	driver_setup.exe
Token: SeIncreaseQuotaPrivilege	2296	driver_setup.exe
Token: SeCreateTokenPrivilege	2296	driver_setup.exe
Token: SeAssignPrimaryTokenPrivilege	2296	driver_setup.exe
Token: SeLockMemoryPrivilege	2296	driver_setup.exe
Token: SeIncreaseQuotaPrivilege	2296	driver_setup.exe
Token: SeMachineAccountPrivilege	2296	driver_setup.exe
Token: SeTcbPrivilege	2296	driver_setup.exe
Token: SeSecurityPrivilege	2296	driver_setup.exe
Token: SeTakeOwnershipPrivilege	2296	driver_setup.exe
Token: SeLoadDriverPrivilege	2296	driver_setup.exe
Token: SeSystemProfilePrivilege	2296	driver_setup.exe
Token: SeSystemtimePrivilege	2296	driver_setup.exe
Token: SeProfSingleProcessPrivilege	2296	driver_setup.exe
Token: SeIncBasePriorityPrivilege	2296	driver_setup.exe
Token: SeCreatePagefilePrivilege	2296	driver_setup.exe
Token: SeCreatePermanentPrivilege	2296	driver_setup.exe
Token: SeBackupPrivilege	2296	driver_setup.exe
Token: SeRestorePrivilege	2296	driver_setup.exe
Token: SeShutdownPrivilege	2296	driver_setup.exe
Token: SeDebugPrivilege	2296	driver_setup.exe
Token: SeAuditPrivilege	2296	driver_setup.exe
Token: SeSystemEnvironmentPrivilege	2296	driver_setup.exe
Token: SeChangeNotifyPrivilege	2296	driver_setup.exe
Token: SeRemoteShutdownPrivilege	2296	driver_setup.exe
Token: SeUndockPrivilege	2296	driver_setup.exe
Token: SeSyncAgentPrivilege	2296	driver_setup.exe
Token: SeEnableDelegationPrivilege	2296	driver_setup.exe
Token: SeManageVolumePrivilege	2296	driver_setup.exe
Token: SeImpersonatePrivilege	2296	driver_setup.exe
Token: SeCreateGlobalPrivilege	2296	driver_setup.exe
Token: SeCreateTokenPrivilege	2296	driver_setup.exe
Token: SeAssignPrimaryTokenPrivilege	2296	driver_setup.exe
Token: SeLockMemoryPrivilege	2296	driver_setup.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

driver_setup.exe

pid process

2296 driver_setup.exe
2296 driver_setup.exe
2296 driver_setup.exe
2296 driver_setup.exe

pid	process
2296	driver_setup.exe
2296	driver_setup.exe
2296	driver_setup.exe
2296	driver_setup.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

af48efac2b7d97cc0b70559a0a2be8cfeae961306ed16f0c91706a3bef6d61fc.exemsiexec.exesvchost.exeDrvInst.exesetup.exeMsiExec.exewmdc.exe

description	pid	process	target process
PID 416 wrote to memory of 2296	416	af48efac2b7d97cc0b70559a0a2be8cfeae961306ed16f0c91706a3bef6d61fc.exe	driver_setup.exe
PID 416 wrote to memory of 2296	416	af48efac2b7d97cc0b70559a0a2be8cfeae961306ed16f0c91706a3bef6d61fc.exe	driver_setup.exe
PID 1340 wrote to memory of 3200	1340	msiexec.exe	MsiExec.exe
PID 1340 wrote to memory of 3200	1340	msiexec.exe	MsiExec.exe
PID 1340 wrote to memory of 4904	1340	msiexec.exe	srtasks.exe
PID 1340 wrote to memory of 4904	1340	msiexec.exe	srtasks.exe
PID 1340 wrote to memory of 2420	1340	msiexec.exe	MsiExec.exe
PID 1340 wrote to memory of 2420	1340	msiexec.exe	MsiExec.exe
PID 1340 wrote to memory of 1988	1340	msiexec.exe	MsiExec.exe
PID 1340 wrote to memory of 1988	1340	msiexec.exe	MsiExec.exe
PID 4172 wrote to memory of 2388	4172	svchost.exe	DrvInst.exe
PID 4172 wrote to memory of 2388	4172	svchost.exe	DrvInst.exe
PID 4172 wrote to memory of 3524	4172	svchost.exe	DrvInst.exe
PID 4172 wrote to memory of 3524	4172	svchost.exe	DrvInst.exe
PID 4172 wrote to memory of 3096	4172	svchost.exe	DrvInst.exe
PID 4172 wrote to memory of 3096	4172	svchost.exe	DrvInst.exe
PID 4172 wrote to memory of 4440	4172	svchost.exe	DrvInst.exe
PID 4172 wrote to memory of 4440	4172	svchost.exe	DrvInst.exe
PID 4172 wrote to memory of 1648	4172	svchost.exe	DrvInst.exe
PID 4172 wrote to memory of 1648	4172	svchost.exe	DrvInst.exe
PID 1648 wrote to memory of 2012	1648	DrvInst.exe	setup.exe
PID 1648 wrote to memory of 2012	1648	DrvInst.exe	setup.exe
PID 2012 wrote to memory of 1588	2012	setup.exe	wmdcBase.exe
PID 2012 wrote to memory of 1588	2012	setup.exe	wmdcBase.exe
PID 1340 wrote to memory of 1904	1340	msiexec.exe	MsiExec.exe
PID 1340 wrote to memory of 1904	1340	msiexec.exe	MsiExec.exe
PID 1340 wrote to memory of 1596	1340	msiexec.exe	MsiExec.exe
PID 1340 wrote to memory of 1596	1340	msiexec.exe	MsiExec.exe
PID 1340 wrote to memory of 660	1340	msiexec.exe	MsiExec.exe
PID 1340 wrote to memory of 660	1340	msiexec.exe	MsiExec.exe
PID 1340 wrote to memory of 660	1340	msiexec.exe	MsiExec.exe
PID 1340 wrote to memory of 1804	1340	msiexec.exe	MsiExec.exe
PID 1340 wrote to memory of 1804	1340	msiexec.exe	MsiExec.exe
PID 1340 wrote to memory of 4728	1340	msiexec.exe	MsiExec.exe
PID 1340 wrote to memory of 4728	1340	msiexec.exe	MsiExec.exe
PID 1340 wrote to memory of 4728	1340	msiexec.exe	MsiExec.exe
PID 4728 wrote to memory of 1568	4728	MsiExec.exe	InstallForm.exe
PID 4728 wrote to memory of 1568	4728	MsiExec.exe	InstallForm.exe
PID 4728 wrote to memory of 1568	4728	MsiExec.exe	InstallForm.exe
PID 2012 wrote to memory of 4616	2012	setup.exe	wmdc.exe
PID 2012 wrote to memory of 4616	2012	setup.exe	wmdc.exe
PID 4616 wrote to memory of 1764	4616	wmdc.exe	pcaui.exe
PID 4616 wrote to memory of 1764	4616	wmdc.exe	pcaui.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\af48efac2b7d97cc0b70559a0a2be8cfeae961306ed16f0c91706a3bef6d61fc.exe
"C:\Users\Admin\AppData\Local\Temp\af48efac2b7d97cc0b70559a0a2be8cfeae961306ed16f0c91706a3bef6d61fc.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:416
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\driver_setup.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\driver_setup.exe /i drvupdate-amd64.msi
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2296

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Registers COM server for autorun
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 1F328B27BB95C8B576F16D3EE6AE9247 C
  2⤵
  - Loads dropped DLL
  PID:3200
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4904
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 37D8BE2D16BD68903464EE9FB359F198
  2⤵
  - Loads dropped DLL
  PID:2420
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 64B4C2BEBE4E5A7E0FFDE37C9581E1F1 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Checks SCSI registry key(s)
  PID:1988
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding E3C6C40F634DDCDED275577AD543E29D C
  2⤵
  - Loads dropped DLL
  PID:1904
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 8993C0D768EA289CB4A8DBE0A86E9269
  2⤵
  - Loads dropped DLL
  PID:1596
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B406F873F0A4014A36290E87C958135D
  2⤵
  - Checks BIOS information in registry
  - Loads dropped DLL
  - Enumerates system info in registry
  PID:660
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 30D18589533FF23FAE84E5E9819D42D7 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  PID:1804
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6E91F9BDAC1898842CD709885502A8A7 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4728
- - C:\Windows\WindowsMobile\InstallForm.exe
    C:\Windows\WindowsMobile\InstallForm.exe Install
    3⤵
    - Executes dropped EXE
    PID:1568

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:4172
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "1" "C:\Windows\WindowsMobile\Drivers\RNDIS\wcerndis.inf" "9" "4658cc0c3" "0000000000000148" "WinSta0\Default" "0000000000000158" "208" "C:\Windows\WindowsMobile\Drivers\RNDIS"
  2⤵
  - Drops file in System32 directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:2388
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "1" "C:\Windows\WindowsMobile\Drivers\Serial\wceusbsh.inf" "9" "4e3e87c83" "0000000000000158" "WinSta0\Default" "000000000000015C" "208" "C:\Windows\WindowsMobile\Drivers\Serial"
  2⤵
  - Drops file in System32 directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:3524
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "1" "C:\Windows\WindowsMobile\Drivers\WPD\wpdrapi.inf" "9" "448c3e0d7" "000000000000017C" "WinSta0\Default" "0000000000000180" "208" "C:\Windows\WindowsMobile\Drivers\WPD"
  2⤵
  - Drops file in System32 directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:3096
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "1" "C:\Windows\WindowsMobile\Drivers\Bluetooth\wcebth.inf" "9" "410b0571b" "000000000000018C" "WinSta0\Default" "0000000000000180" "208" "C:\Windows\WindowsMobile\Drivers\Bluetooth"
  2⤵
  - Drops file in System32 directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:4440
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "1" "0" "windowsmobiledriverinstaller\UMB\2&26a98e85&0&{339AC98A-10AD-48A9-9711-47DDB58A2FB9}" "" "" "4f89411e3" "0000000000000000"
  2⤵
  - Sets DLL path for service in the registry
  - Loads dropped DLL
  - Registers COM server for autorun
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1648
- - C:\Windows\WindowsMobile\setup.exe
    C:\Windows\WindowsMobile\setup.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Suspicious use of WriteProcessMemory
    PID:2012
  - - C:\Windows\WindowsMobile\wmdcBase.exe
      "C:\Windows\WindowsMobile\wmdcBase.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1588
  - - C:\Windows\WindowsMobile\wmdc.exe
      "C:\Windows\WindowsMobile\wmdc.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:4616
    - - C:\Windows\system32\pcaui.exe
        
        "C:\Windows\system32\pcaui.exe" -g {11111111-1111-1111-1111-111111111111} -x {f58ec02d-77c3-4891-9583-49fd51990df1} -a "Windows Mobile Device Center 6.1" -v "Microsoft" -s "To work properly, this app must be reinstalled after you upgrade Windows." -n 4 -f 0 -k 0 -e "C:\Windows\WindowsMobile\wmdc.exe"
        5⤵
        
        PID:1764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WindowsMobile -s RapiMgr
1⤵
- Loads dropped DLL
PID:776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WindowsMobile -s WcesComm
1⤵
- Loads dropped DLL
PID:1116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WindowsMobile -s WcesComm
1⤵
- Loads dropped DLL
PID:2400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery