netsupport | 3bee17c7d5dd6c2bb4a8e691679d6a5aac5f5b4400c4f68d9c1a37d35a39670a

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	CPPlayer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	CPPlayer.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e57e0ea.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57e0ea.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{DCE33C24-54AC-4134-8C0C-AA3D26865F9C}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE3E8.tmp	msiexec.exe
File created	C:\Windows\Installer\e57e0ec.msi	msiexec.exe

Executes dropped EXE 2 IoCs

pid	Process
3168	CPPlayer.exe
4392	CPPlayer.exe

Loads dropped DLL 56 IoCs

pid	Process
3168	CPPlayer.exe
3168	CPPlayer.exe
3168	CPPlayer.exe
3168	CPPlayer.exe
3168	CPPlayer.exe
3168	CPPlayer.exe
3168	CPPlayer.exe
3168	CPPlayer.exe
3168	CPPlayer.exe
3168	CPPlayer.exe
3168	CPPlayer.exe
3168	CPPlayer.exe
3168	CPPlayer.exe
3168	CPPlayer.exe
3168	CPPlayer.exe
3168	CPPlayer.exe
3168	CPPlayer.exe
3168	CPPlayer.exe
3168	CPPlayer.exe
3168	CPPlayer.exe
3168	CPPlayer.exe
3168	CPPlayer.exe
3168	CPPlayer.exe
3168	CPPlayer.exe
3168	CPPlayer.exe
3168	CPPlayer.exe
3168	CPPlayer.exe
3168	CPPlayer.exe
3168	CPPlayer.exe
3168	CPPlayer.exe
3168	CPPlayer.exe
3168	CPPlayer.exe
4392	CPPlayer.exe
4392	CPPlayer.exe
4392	CPPlayer.exe
4392	CPPlayer.exe
4392	CPPlayer.exe
4392	CPPlayer.exe
4392	CPPlayer.exe
4392	CPPlayer.exe
4392	CPPlayer.exe
4392	CPPlayer.exe
4392	CPPlayer.exe
4392	CPPlayer.exe
4392	CPPlayer.exe
4392	CPPlayer.exe
4392	CPPlayer.exe
4392	CPPlayer.exe
4392	CPPlayer.exe
4392	CPPlayer.exe
4392	CPPlayer.exe
4392	CPPlayer.exe
4392	CPPlayer.exe
4392	CPPlayer.exe
4392	CPPlayer.exe
4392	CPPlayer.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
812	4392	WerFault.exe	100

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000008bec060def88e6600000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800008bec060d0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809008bec060d000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d8bec060d000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000008bec060d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4692	msiexec.exe
4692	msiexec.exe
1864	powershell.exe
1864	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1888	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1888	msiexec.exe
Token: SeSecurityPrivilege	4692	msiexec.exe
Token: SeCreateTokenPrivilege	1888	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1888	msiexec.exe
Token: SeLockMemoryPrivilege	1888	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1888	msiexec.exe
Token: SeMachineAccountPrivilege	1888	msiexec.exe
Token: SeTcbPrivilege	1888	msiexec.exe
Token: SeSecurityPrivilege	1888	msiexec.exe
Token: SeTakeOwnershipPrivilege	1888	msiexec.exe
Token: SeLoadDriverPrivilege	1888	msiexec.exe
Token: SeSystemProfilePrivilege	1888	msiexec.exe
Token: SeSystemtimePrivilege	1888	msiexec.exe
Token: SeProfSingleProcessPrivilege	1888	msiexec.exe
Token: SeIncBasePriorityPrivilege	1888	msiexec.exe
Token: SeCreatePagefilePrivilege	1888	msiexec.exe
Token: SeCreatePermanentPrivilege	1888	msiexec.exe
Token: SeBackupPrivilege	1888	msiexec.exe
Token: SeRestorePrivilege	1888	msiexec.exe
Token: SeShutdownPrivilege	1888	msiexec.exe
Token: SeDebugPrivilege	1888	msiexec.exe
Token: SeAuditPrivilege	1888	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1888	msiexec.exe
Token: SeChangeNotifyPrivilege	1888	msiexec.exe
Token: SeRemoteShutdownPrivilege	1888	msiexec.exe
Token: SeUndockPrivilege	1888	msiexec.exe
Token: SeSyncAgentPrivilege	1888	msiexec.exe
Token: SeEnableDelegationPrivilege	1888	msiexec.exe
Token: SeManageVolumePrivilege	1888	msiexec.exe
Token: SeImpersonatePrivilege	1888	msiexec.exe
Token: SeCreateGlobalPrivilege	1888	msiexec.exe
Token: SeBackupPrivilege	1668	vssvc.exe
Token: SeRestorePrivilege	1668	vssvc.exe
Token: SeAuditPrivilege	1668	vssvc.exe
Token: SeBackupPrivilege	4692	msiexec.exe
Token: SeRestorePrivilege	4692	msiexec.exe
Token: SeRestorePrivilege	4692	msiexec.exe
Token: SeTakeOwnershipPrivilege	4692	msiexec.exe
Token: SeRestorePrivilege	4692	msiexec.exe
Token: SeTakeOwnershipPrivilege	4692	msiexec.exe
Token: SeRestorePrivilege	4692	msiexec.exe
Token: SeTakeOwnershipPrivilege	4692	msiexec.exe
Token: SeRestorePrivilege	4692	msiexec.exe
Token: SeTakeOwnershipPrivilege	4692	msiexec.exe
Token: SeRestorePrivilege	4692	msiexec.exe
Token: SeTakeOwnershipPrivilege	4692	msiexec.exe
Token: SeRestorePrivilege	4692	msiexec.exe
Token: SeTakeOwnershipPrivilege	4692	msiexec.exe
Token: SeRestorePrivilege	4692	msiexec.exe
Token: SeTakeOwnershipPrivilege	4692	msiexec.exe
Token: SeRestorePrivilege	4692	msiexec.exe
Token: SeTakeOwnershipPrivilege	4692	msiexec.exe
Token: SeRestorePrivilege	4692	msiexec.exe
Token: SeTakeOwnershipPrivilege	4692	msiexec.exe
Token: SeRestorePrivilege	4692	msiexec.exe
Token: SeTakeOwnershipPrivilege	4692	msiexec.exe
Token: SeRestorePrivilege	4692	msiexec.exe
Token: SeTakeOwnershipPrivilege	4692	msiexec.exe
Token: SeRestorePrivilege	4692	msiexec.exe
Token: SeTakeOwnershipPrivilege	4692	msiexec.exe
Token: SeRestorePrivilege	4692	msiexec.exe
Token: SeTakeOwnershipPrivilege	4692	msiexec.exe
Token: SeRestorePrivilege	4692	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1888	msiexec.exe
1888	msiexec.exe
3168	CPPlayer.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4692 wrote to memory of 3912	4692	msiexec.exe	95
PID 4692 wrote to memory of 3912	4692	msiexec.exe	95
PID 4692 wrote to memory of 3168	4692	msiexec.exe	98
PID 4692 wrote to memory of 3168	4692	msiexec.exe	98
PID 4692 wrote to memory of 3168	4692	msiexec.exe	98
PID 3168 wrote to memory of 4392	3168	CPPlayer.exe	100
PID 3168 wrote to memory of 4392	3168	CPPlayer.exe	100
PID 3168 wrote to memory of 4392	3168	CPPlayer.exe	100
PID 3168 wrote to memory of 1100	3168	CPPlayer.exe	104
PID 3168 wrote to memory of 1100	3168	CPPlayer.exe	104
PID 3168 wrote to memory of 1100	3168	CPPlayer.exe	104
PID 1100 wrote to memory of 1864	1100	cmd.exe	106
PID 1100 wrote to memory of 1864	1100	cmd.exe	106
PID 1100 wrote to memory of 1864	1100	cmd.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\WinIconMakerFreeSetup.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1888

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3912
- C:\Users\Admin\AppData\Local\Programs\WinIcon Maker Free\CPPlayer.exe
  "C:\Users\Admin\AppData\Local\Programs\WinIcon Maker Free\CPPlayer.exe"
  2⤵
  - Adds Run key to start application
  - Maps connected drives based on registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3168
- - C:\Users\Admin\AppData\Local\Programs\WinIcon Maker Free\CPPlayer.exe
    "C:\Users\Admin\AppData\Local\Programs\WinIcon Maker Free\CPPlayer.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4392
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4392 -s 1784
      4⤵
      Program crash
      PID:812
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Programs\WinIcon Maker Free\CPPlayer.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1100
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Programs\WinIcon Maker Free\CPPlayer.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1864

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1668

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x390 0x2f4
1⤵
PID:1344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4392 -ip 4392
1⤵
PID:1152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery