hxxps://www[.]security-eye-software[.]com/

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{64697678-0000-0010-8000-00AA00389B71}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{64697678-0000-0010-8000-00AA00389B71}\InprocServer32\ = "C:\\Windows\\system32\\xvid.ax"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{64697678-0000-0010-8000-00AA00389B71}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00000001-4FEF-40D3-B3FA-E0531B897F98}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00000001-4FEF-40D3-B3FA-E0531B897F98}\InprocServer32\ = "C:\\Windows\\system32\\xvid.ax"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00000001-4FEF-40D3-B3FA-E0531B897F98}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1516-434-0x0000000000A40000-0x0000000000D18000-memory.dmp	upx
behavioral1/files/0x0006000000023275-559.dat	upx
behavioral1/files/0x0006000000023273-543.dat	upx
behavioral1/files/0x0006000000023272-535.dat	upx
behavioral1/files/0x0006000000023278-575.dat	upx
behavioral1/files/0x0006000000023280-652.dat	upx
behavioral1/files/0x000e00000002319d-886.dat	upx
behavioral1/memory/1516-908-0x0000000000A40000-0x0000000000D18000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	rundll32.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	xvid.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
45	ipinfo.io

Drops file in System32 directory 18 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\SET2A64.tmp	rundll32.exe
File opened for modification	C:\Windows\system32\SET3187.tmp	rundll32.exe
File opened for modification	C:\Windows\system32\xvidvfw.dll	rundll32.exe
File opened for modification	C:\Windows\system32\SET3197.tmp	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\SET2A63.tmp	rundll32.exe
File opened for modification	C:\Windows\system32\xvidcore.dll	rundll32.exe
File created	C:\Windows\system32\SET3197.tmp	rundll32.exe
File created	C:\Windows\system32\SET3198.tmp	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\xvidvfw.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\SET2A64.tmp	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\xvidcore.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\SET2A65.tmp	rundll32.exe
File created	C:\Windows\SysWOW64\SET2A65.tmp	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\xvid.ax	rundll32.exe
File created	C:\Windows\system32\SET3187.tmp	rundll32.exe
File created	C:\Windows\SysWOW64\SET2A63.tmp	rundll32.exe
File opened for modification	C:\Windows\system32\xvid.ax	rundll32.exe
File opened for modification	C:\Windows\system32\SET3198.tmp	rundll32.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	se.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Xvid\xvid.png	xvid.exe
File opened for modification	C:\Program Files (x86)\Xvid\statsreader.txt	xvid.exe
File created	C:\Program Files (x86)\Xvid\xvid.png	xvid.exe
File created	C:\Program Files (x86)\Xvid\uninstbr.000	xvid.exe
File created	C:\Program Files (x86)\Security Eye\is-LN825.tmp	se-setup.tmp
File created	C:\Program Files (x86)\Security Eye\is-6323J.tmp	se-setup.tmp
File created	C:\Program Files (x86)\Security Eye\is-H8PPL.tmp	se-setup.tmp
File opened for modification	C:\Program Files (x86)\Security Eye\unins000.dat	se-setup.tmp
File opened for modification	C:\Program Files (x86)\Xvid\xvid_encraw.exe	xvid.exe
File created	C:\Program Files (x86)\Xvid\statsreader.txt	xvid.exe
File created	C:\Program Files (x86)\Xvid\update.ini	xvid.exe
File created	C:\Program Files (x86)\Xvid\autoupdate-windows.exe	xvid.exe
File created	C:\Program Files (x86)\Security Eye\is-K4LFB.tmp	se-setup.tmp
File created	C:\Program Files (x86)\Security Eye\is-GKPD5.tmp	se-setup.tmp
File created	C:\Program Files (x86)\Security Eye\is-77NL5.tmp	se-setup.tmp
File created	C:\Program Files (x86)\Xvid\OGMCalc.exe	xvid.exe
File opened for modification	C:\Program Files (x86)\Security Eye\msvcr100.dll	se-setup.tmp
File created	C:\Program Files (x86)\Security Eye\is-BVGAD.tmp	se-setup.tmp
File opened for modification	C:\Program Files (x86)\Security Eye\avdevice_datastead_rtsp_x86-58.dll	se-setup.tmp
File created	C:\Program Files (x86)\Security Eye\is-BFSBO.tmp	se-setup.tmp
File opened for modification	C:\Program Files (x86)\Xvid\CheckUpdate.exe	xvid.exe
File created	C:\Program Files (x86)\Xvid\AviC.exe	xvid.exe
File opened for modification	C:\Program Files (x86)\Xvid\AviC.exe	xvid.exe
File opened for modification	C:\Program Files (x86)\Xvid\tcl42CD.tmp	xvid.exe
File created	C:\Program Files (x86)\Security Eye\is-1DU2T.tmp	se-setup.tmp
File created	C:\Program Files (x86)\Security Eye\is-MARMG.tmp	se-setup.tmp
File created	C:\Program Files (x86)\Xvid\xvid_encraw.exe	xvid.exe
File opened for modification	C:\Program Files (x86)\Security Eye\libeay32.dll	se-setup.tmp
File created	C:\Program Files (x86)\Security Eye\is-F9QP5.tmp	se-setup.tmp
File created	C:\Program Files (x86)\Security Eye\is-65P5D.tmp	se-setup.tmp
File opened for modification	C:\Program Files (x86)\Xvid\xvidw.ico	xvid.exe
File created	C:\Program Files (x86)\Xvid\LICENSE	xvid.exe
File created	C:\Program Files (x86)\Xvid\xvid.inf	xvid.exe
File created	C:\Program Files (x86)\Security Eye\is-5OFDG.tmp	se-setup.tmp
File created	C:\Program Files (x86)\Security Eye\is-9G1OD.tmp	se-setup.tmp
File created	C:\Program Files (x86)\Security Eye\is-0GTT3.tmp	se-setup.tmp
File created	C:\Program Files (x86)\Xvid\xvid.ico	xvid.exe
File created	C:\Program Files (x86)\Security Eye\is-V1G6V.tmp	se-setup.tmp
File opened for modification	C:\Program Files (x86)\Xvid\Uninstall Xvid Video Codec.lnk	xvid.exe
File opened for modification	C:\Program Files (x86)\Security Eye\swresample_datastead_rtsp_x86-3.dll	se-setup.tmp
File created	C:\Program Files (x86)\Security Eye\is-NB4Q9.tmp	se-setup.tmp
File created	C:\Program Files (x86)\Security Eye\is-6CNH9.tmp	se-setup.tmp
File created	C:\Program Files (x86)\Xvid\uninstall.exe	xvid.exe
File opened for modification	C:\Program Files (x86)\Security Eye\ssleay32.dll	se-setup.tmp
File created	C:\Program Files (x86)\Security Eye\is-PL6C3.tmp	se-setup.tmp
File created	C:\Program Files (x86)\Security Eye\is-81DCB.tmp	se-setup.tmp
File opened for modification	C:\Program Files (x86)\Security Eye\smsengine.dll	se-setup.tmp
File opened for modification	C:\Program Files (x86)\Security Eye\avresample_datastead_rtsp_x86-4.dll	se-setup.tmp
File opened for modification	C:\Program Files (x86)\Xvid\update.ini	xvid.exe
File created	C:\Program Files (x86)\Security Eye\is-AMCPU.tmp	se-setup.tmp
File opened for modification	C:\Program Files (x86)\Xvid\Xvid_Quant_Matrices.zip	xvid.exe
File opened for modification	C:\Program Files (x86)\Security Eye\avutil_datastead_rtsp_x86-56.dll	se-setup.tmp
File created	C:\Program Files (x86)\Security Eye\is-28V8V.tmp	se-setup.tmp
File opened for modification	C:\Program Files (x86)\Security Eye\website.url	se-setup.tmp
File opened for modification	C:\Program Files (x86)\Security Eye\xvid.exe	se-setup.tmp
File created	C:\Program Files (x86)\Security Eye\is-1D8FD.tmp	se-setup.tmp
File opened for modification	C:\Program Files (x86)\Xvid\autoupdate-windows.exe	xvid.exe
File opened for modification	C:\Program Files (x86)\Security Eye\avfilter_datastead_rtsp_x86-7.dll	se-setup.tmp
File created	C:\Program Files (x86)\Xvid\StatsReader.exe	xvid.exe
File created	C:\Program Files (x86)\Xvid\MiniCalc.exe	xvid.exe
File opened for modification	C:\Program Files (x86)\Xvid\OGMCalc.exe	xvid.exe
File created	C:\Program Files (x86)\Xvid\uninstall.dat	xvid.exe
File opened for modification	C:\Program Files (x86)\Security Eye\avformat_datastead_rtsp_x86-58.dll	se-setup.tmp
File opened for modification	C:\Program Files (x86)\Security Eye\avstream_datastead_rtsp_x86.dll	se-setup.tmp

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	\??\c:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\xvid.inf	rundll32.exe
File opened for modification	C:\Windows\INF\SET3186.tmp	rundll32.exe
File created	C:\Windows\INF\SET3186.tmp	rundll32.exe
File opened for modification	C:\Windows\INF\xvid.inf	rundll32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\INF\SET2A62.tmp	rundll32.exe
File created	C:\Windows\INF\SET2A62.tmp	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI1275.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 9 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	xvid.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	xvid.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	xvid.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\22\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{64697678-0000-0010-8000-00AA00389B71}\CLSID = "{64697678-0000-0010-8000-00AA00389B71}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C7CC1A23-8B8A-4BFD-A96C-B5E735E055BA}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C7CC1A23-8B8A-4BFD-A96C-B5E735E055BA}\InprocServer32\ = "C:\\Program Files (x86)\\Security Eye\\DatasteadRtspSource_x86.ax"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000001-4FEF-40D3-B3FA-E0531B897F98}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{64697678-0000-0010-8000-00AA00389B71}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{55D1139D-5E0D-4123-9AED-575D7B039569}\FriendlyName = "Datastead RTSP/RTMP/HTTP/ONVIF Source"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{55D1139D-5E0D-4123-9AED-575D7B039569}\CLSID = "{55D1139D-5E0D-4123-9AED-575D7B039569}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance\{ACD90353-84FA-4232-8BC3-010B6A2178A6}\FriendlyName = "Datastead URL Source"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\rtmp	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\rtmp\Source Filter = "{ACD90353-84FA-4232-8BC3-010B6A2178A6}"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\MediaFoundation\Transforms\64697678-0000-0010-8000-00aa00389b71\OutputTypes = 7669647300001000800000aa00389b7100000000000000000000000000000000	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{64697678-0000-0010-8000-00AA00389B71}\FilterData = 020000000200800002000000000000003070693300000000000000001800000000000000000000003074793300000000d0010000e00100003174793300000000d0010000f00100003274793300000000d0010000000200003374793300000000d0010000100200003474793300000000d0010000200200003574793300000000d0010000300200003674793300000000d0010000400200003774793300000000d0010000500200003874793300000000d0010000600200003974793300000000d0010000700200003a74793300000000d0010000800200003b74793300000000d0010000900200003c74793300000000d0010000a00200003d74793300000000d0010000b00200003e74793300000000d0010000c00200003f74793300000000d0010000d00200004074793300000000d0010000e00200004174793300000000d0010000f00200004274793300000000d0010000000300004374793300000000d0010000100300004474793300000000d0010000200300004574793300000000d0010000300300004674793300000000d0010000400300004774793300000000d0010000500300003170693308000000000000000100000000000000000000003074793300000000d0010000600300007669647300001000800000aa00389b717876696400001000800000aa00389b715856494400001000800000aa00389b716469767800001000800000aa00389b714449565800001000800000aa00389b716478353000001000800000aa00389b714458353000001000800000aa00389b713369767800001000800000aa00389b713349565800001000800000aa00389b713369763000001000800000aa00389b713349563000001000800000aa00389b713369763100001000800000aa00389b713349563100001000800000aa00389b713369763200001000800000aa00389b713349563200001000800000aa00389b716c6d703400001000800000aa00389b714c4d503400001000800000aa00389b71726d703400001000800000aa00389b71524d503400001000800000aa00389b71736d703400001000800000aa00389b71534d503400001000800000aa00389b716864783400001000800000aa00389b714844583400001000800000aa00389b716d70347600001000800000aa00389b714d50345600001000800000aa00389b7100000000000000000000000000000000	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MediaFoundation\Transforms\Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\rtsp	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\MediaFoundation\Transforms\64697678-0000-0010-8000-00aa00389b71	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\MediaFoundation\Transforms\Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{64697678-0000-0010-8000-00AA00389B71}	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A\Patches\Patches = 3200440030003000350038004600360046003000380041003700340033003300300039003100380034004200450031003100370038004300390035004200320000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{C7CC1A23-8B8A-4BFD-A96C-B5E735E055BA}\FriendlyName = "Datastead Video Renderer"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{55D1139D-5E0D-4123-9AED-575D7B039569}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A\Patches	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ACD90353-84FA-4232-8BC3-010B6A2178A6}\ = "Datastead URL Source"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ACD90353-84FA-4232-8BC3-010B6A2178A6}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ACD90353-84FA-4232-8BC3-010B6A2178A6}\InprocServer32\ = "C:\\Program Files (x86)\\Security Eye\\DatasteadRtspSource_x86.ax"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5B3B6926-A78F-4963-836C-88070FCA26E3}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5B3B6926-A78F-4963-836C-88070FCA26E3}\ = "Datastead RTSP/RTMP/HTTP/ONVIF Source Properties"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{ACD90353-84FA-4232-8BC3-010B6A2178A6}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{64697678-0000-0010-8000-00AA00389B71}\InprocServer32\ = "C:\\Windows\\SysWow64\\xvid.ax"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MediaFoundation\Transforms	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ACD90353-84FA-4232-8BC3-010B6A2178A6}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5B3B6926-A78F-4963-836C-88070FCA26E3}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{64697678-0000-0010-8000-00AA00389B71}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5B3B6926-A78F-4963-836C-88070FCA26E3}\InprocServer32\ = "C:\\Program Files (x86)\\Security Eye\\DatasteadRtspSource_x86.ax"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{ACD90353-84FA-4232-8BC3-010B6A2178A6}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00000001-4FEF-40D3-B3FA-E0531B897F98}\InprocServer32\ = "C:\\Windows\\system32\\xvid.ax"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C7CC1A23-8B8A-4BFD-A96C-B5E735E055BA}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\MediaFoundation\Transforms\64697678-0000-0010-8000-00aa00389b71\ = "Xvid MPEG-4 Video Decoder MFT"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{55D1139D-5E0D-4123-9AED-575D7B039569}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\MediaFoundation\Transforms\Categories\d6c02d4b-6833-45b4-971a-05a4b04bab91	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000001-4FEF-40D3-B3FA-E0531B897F98}\ = "Xvid MPEG-4 Video DecoderAbout"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{55D1139D-5E0D-4123-9AED-575D7B039569}\FilterData = 0200000000002000020000000000000030706933080000000000000001000000000000000000000030747933000000006000000070000000317069330800000000000000010000000000000000000000307479330000000080000000700000007669647300001000800000aa00389b71000000000000000000000000000000006175647300001000800000aa00389b71	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance\{ACD90353-84FA-4232-8BC3-010B6A2178A6}\CLSID = "{ACD90353-84FA-4232-8BC3-010B6A2178A6}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{64697678-0000-0010-8000-00AA00389B71}\FriendlyName = "Xvid MPEG-4 Video Decoder"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{55D1139D-5E0D-4123-9AED-575D7B039569}\InprocServer32	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{55D1139D-5E0D-4123-9AED-575D7B039569}\FilterData = 02000000000020000200000000000000307069330800000001000000010000000000000060000000307479330000000070000000800000003170693308000000010000000100000000000000600000003074793300000000900000008000000081426cfb5303d111905f0000c0cc16ba7669647300001000800000aa00389b71000000000000000000000000000000006175647300001000800000aa00389b71	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\udp	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\MediaFoundation\Transforms\Categories\d6c02d4b-6833-45b4-971a-05a4b04bab91\64697678-0000-0010-8000-00aa00389b71	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{532EB21B-6A01-4F66-AB9D-EB33A2966421}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{532EB21B-6A01-4F66-AB9D-EB33A2966421}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11D0-BD3B-00A0C911CE86}\Instance\{ACD90353-84FA-4232-8BC3-010B6A2178A6}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sdp	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C7CC1A23-8B8A-4BFD-A96C-B5E735E055BA}\ = "Datastead Video Renderer"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{55D1139D-5E0D-4123-9AED-575D7B039569}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{ACD90353-84FA-4232-8BC3-010B6A2178A6}\FriendlyName = "Datastead URL Source"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{ACD90353-84FA-4232-8BC3-010B6A2178A6}\FilterData = 0200000000002000020000000000000030706933080000000000000001000000000000000000000030747933000000006000000070000000317069330800000000000000010000000000000000000000307479330000000080000000700000007669647300001000800000aa00389b71000000000000000000000000000000006175647300001000800000aa00389b71	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{64697678-0000-0010-8000-00AA00389B71}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00000001-4FEF-40D3-B3FA-E0531B897F98}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00000001-4FEF-40D3-B3FA-E0531B897F98}\InprocServer32	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{64697678-0000-0010-8000-00AA00389B71}\FilterData = 020000000200800002000000000000003070693300000000000000001800000000000000000000003074793300000000d0010000e00100003174793300000000d0010000f00100003274793300000000d0010000000200003374793300000000d0010000100200003474793300000000d0010000200200003574793300000000d0010000300200003674793300000000d0010000400200003774793300000000d0010000500200003874793300000000d0010000600200003974793300000000d0010000700200003a74793300000000d0010000800200003b74793300000000d0010000900200003c74793300000000d0010000a00200003d74793300000000d0010000b00200003e74793300000000d0010000c00200003f74793300000000d0010000d00200004074793300000000d0010000e00200004174793300000000d0010000f00200004274793300000000d0010000000300004374793300000000d0010000100300004474793300000000d0010000200300004574793300000000d0010000300300004674793300000000d0010000400300004774793300000000d0010000500300003170693308000000000000000100000000000000000000003074793300000000d0010000600300007669647300001000800000aa00389b717876696400001000800000aa00389b715856494400001000800000aa00389b716469767800001000800000aa00389b714449565800001000800000aa00389b716478353000001000800000aa00389b714458353000001000800000aa00389b713369767800001000800000aa00389b713349565800001000800000aa00389b713369763000001000800000aa00389b713349563000001000800000aa00389b713369763100001000800000aa00389b713349563100001000800000aa00389b713369763200001000800000aa00389b713349563200001000800000aa00389b716c6d703400001000800000aa00389b714c4d503400001000800000aa00389b71726d703400001000800000aa00389b71524d503400001000800000aa00389b71736d703400001000800000aa00389b71534d503400001000800000aa00389b716864783400001000800000aa00389b714844583400001000800000aa00389b716d70347600001000800000aa00389b714d50345600001000800000aa00389b7100000000000000000000000000000000	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{532EB21B-6A01-4F66-AB9D-EB33A2966421}\ = "Datastead RTSP/RTMP/HTTP/ONVIF Source Properties"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance\{ACD90353-84FA-4232-8BC3-010B6A2178A6}\FilterData = 02000000000020000200000000000000307069330800000001000000010000000000000060000000307479330000000070000000800000003170693308000000010000000100000000000000600000003074793300000000900000008000000081426cfb5303d111905f0000c0cc16ba7669647300001000800000aa00389b71000000000000000000000000000000006175647300001000800000aa00389b71	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\onvif\Source Filter = "{ACD90353-84FA-4232-8BC3-010B6A2178A6}"	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
1212	chrome.exe
1212	chrome.exe
728	se-setup.tmp
728	se-setup.tmp
3344	Setup.exe
3344	Setup.exe
3344	Setup.exe
3344	Setup.exe
3344	Setup.exe
3344	Setup.exe
3344	Setup.exe
3344	Setup.exe
3344	Setup.exe
3344	Setup.exe
3344	Setup.exe
3344	Setup.exe
4372	chrome.exe
4372	chrome.exe
2636	msiexec.exe
2636	msiexec.exe
2252	se.exe
2252	se.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe
Token: SeShutdownPrivilege	1212	chrome.exe
Token: SeCreatePagefilePrivilege	1212	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe
1212	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1212 wrote to memory of 316	1212	chrome.exe	61
PID 1212 wrote to memory of 316	1212	chrome.exe	61
PID 1212 wrote to memory of 3960	1212	chrome.exe	89
PID 1212 wrote to memory of 3960	1212	chrome.exe	89
PID 1212 wrote to memory of 3960	1212	chrome.exe	89
PID 1212 wrote to memory of 3960	1212	chrome.exe	89
PID 1212 wrote to memory of 3960	1212	chrome.exe	89
PID 1212 wrote to memory of 3960	1212	chrome.exe	89
PID 1212 wrote to memory of 3960	1212	chrome.exe	89
PID 1212 wrote to memory of 3960	1212	chrome.exe	89
PID 1212 wrote to memory of 3960	1212	chrome.exe	89
PID 1212 wrote to memory of 3960	1212	chrome.exe	89
PID 1212 wrote to memory of 3960	1212	chrome.exe	89
PID 1212 wrote to memory of 3960	1212	chrome.exe	89
PID 1212 wrote to memory of 3960	1212	chrome.exe	89
PID 1212 wrote to memory of 3960	1212	chrome.exe	89
PID 1212 wrote to memory of 3960	1212	chrome.exe	89
PID 1212 wrote to memory of 3960	1212	chrome.exe	89
PID 1212 wrote to memory of 3960	1212	chrome.exe	89
PID 1212 wrote to memory of 3960	1212	chrome.exe	89
PID 1212 wrote to memory of 3960	1212	chrome.exe	89
PID 1212 wrote to memory of 3960	1212	chrome.exe	89
PID 1212 wrote to memory of 3960	1212	chrome.exe	89
PID 1212 wrote to memory of 3960	1212	chrome.exe	89
PID 1212 wrote to memory of 3960	1212	chrome.exe	89
PID 1212 wrote to memory of 3960	1212	chrome.exe	89
PID 1212 wrote to memory of 3960	1212	chrome.exe	89
PID 1212 wrote to memory of 3960	1212	chrome.exe	89
PID 1212 wrote to memory of 3960	1212	chrome.exe	89
PID 1212 wrote to memory of 3960	1212	chrome.exe	89
PID 1212 wrote to memory of 3960	1212	chrome.exe	89
PID 1212 wrote to memory of 3960	1212	chrome.exe	89
PID 1212 wrote to memory of 3960	1212	chrome.exe	89
PID 1212 wrote to memory of 3960	1212	chrome.exe	89
PID 1212 wrote to memory of 3960	1212	chrome.exe	89
PID 1212 wrote to memory of 3960	1212	chrome.exe	89
PID 1212 wrote to memory of 3960	1212	chrome.exe	89
PID 1212 wrote to memory of 3960	1212	chrome.exe	89
PID 1212 wrote to memory of 3960	1212	chrome.exe	89
PID 1212 wrote to memory of 3960	1212	chrome.exe	89
PID 1212 wrote to memory of 1312	1212	chrome.exe	85
PID 1212 wrote to memory of 1312	1212	chrome.exe	85
PID 1212 wrote to memory of 2744	1212	chrome.exe	86
PID 1212 wrote to memory of 2744	1212	chrome.exe	86
PID 1212 wrote to memory of 2744	1212	chrome.exe	86
PID 1212 wrote to memory of 2744	1212	chrome.exe	86
PID 1212 wrote to memory of 2744	1212	chrome.exe	86
PID 1212 wrote to memory of 2744	1212	chrome.exe	86
PID 1212 wrote to memory of 2744	1212	chrome.exe	86
PID 1212 wrote to memory of 2744	1212	chrome.exe	86
PID 1212 wrote to memory of 2744	1212	chrome.exe	86
PID 1212 wrote to memory of 2744	1212	chrome.exe	86
PID 1212 wrote to memory of 2744	1212	chrome.exe	86
PID 1212 wrote to memory of 2744	1212	chrome.exe	86
PID 1212 wrote to memory of 2744	1212	chrome.exe	86
PID 1212 wrote to memory of 2744	1212	chrome.exe	86
PID 1212 wrote to memory of 2744	1212	chrome.exe	86
PID 1212 wrote to memory of 2744	1212	chrome.exe	86
PID 1212 wrote to memory of 2744	1212	chrome.exe	86
PID 1212 wrote to memory of 2744	1212	chrome.exe	86
PID 1212 wrote to memory of 2744	1212	chrome.exe	86
PID 1212 wrote to memory of 2744	1212	chrome.exe	86
PID 1212 wrote to memory of 2744	1212	chrome.exe	86
PID 1212 wrote to memory of 2744	1212	chrome.exe	86

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.security-eye-software.com/
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8c6779758,0x7ff8c6779768,0x7ff8c6779778
  2⤵
  PID:316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1896 --field-trial-handle=1900,i,5188229234056347959,10118520469589004633,131072 /prefetch:8
  2⤵
  PID:1312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2192 --field-trial-handle=1900,i,5188229234056347959,10118520469589004633,131072 /prefetch:8
  2⤵
  PID:2744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2972 --field-trial-handle=1900,i,5188229234056347959,10118520469589004633,131072 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2940 --field-trial-handle=1900,i,5188229234056347959,10118520469589004633,131072 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1572 --field-trial-handle=1900,i,5188229234056347959,10118520469589004633,131072 /prefetch:2
  2⤵
  PID:3960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4008 --field-trial-handle=1900,i,5188229234056347959,10118520469589004633,131072 /prefetch:1
  2⤵
  PID:1208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5476 --field-trial-handle=1900,i,5188229234056347959,10118520469589004633,131072 /prefetch:8
  2⤵
  PID:516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2924 --field-trial-handle=1900,i,5188229234056347959,10118520469589004633,131072 /prefetch:8
  2⤵
  PID:2248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5980 --field-trial-handle=1900,i,5188229234056347959,10118520469589004633,131072 /prefetch:8
  2⤵
  PID:2116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6000 --field-trial-handle=1900,i,5188229234056347959,10118520469589004633,131072 /prefetch:8
  2⤵
  PID:3112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5016 --field-trial-handle=1900,i,5188229234056347959,10118520469589004633,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4372

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:904

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2016

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap25379:78:7zEvent25388
1⤵
PID:4076

C:\Users\Admin\Downloads\se-setup.exe
"C:\Users\Admin\Downloads\se-setup.exe"
1⤵
- Executes dropped EXE
PID:4784
- C:\Users\Admin\AppData\Local\Temp\is-0DROB.tmp\se-setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-0DROB.tmp\se-setup.tmp" /SL5="$502D4,32099305,121344,C:\Users\Admin\Downloads\se-setup.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  PID:728
- - C:\Users\Admin\AppData\Local\Temp\is-86KKH.tmp\vcredist_x86.exe
    "C:\Users\Admin\AppData\Local\Temp\is-86KKH.tmp\vcredist_x86.exe" /q
    3⤵
    - Executes dropped EXE
    PID:1352
  - - \??\f:\931f6926d93543f62f2458e6\Setup.exe
      f:\931f6926d93543f62f2458e6\Setup.exe /q
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      PID:3344
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Security Eye\DatasteadRtspSource_x86.ax"
    3⤵
    - Loads dropped DLL
    - Modifies registry class
    PID:2864
- - C:\Program Files (x86)\Security Eye\xvid.exe
    "C:\Program Files (x86)\Security Eye\xvid.exe" --mode unattended --AutoUpdater no --decode_divx yes --decode_3ivx no --decode_other no
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Drops file in Program Files directory
    - Checks processor information in registry
    PID:1516
  - - C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\System32\rundll32.exe setupapi.dll,InstallHinfSection DefaultInstall 0 C:\Users\Admin\AppData\Local\Temp/xvid_x86/xvid.inf
      4⤵
      Adds Run key to start application
      Drops file in System32 directory
      Drops file in Windows directory
      PID:1316
    - - C:\Windows\SysWOW64\runonce.exe
        
        "C:\Windows\system32\runonce.exe" -r
        5⤵
        Checks processor information in registry
        
        PID:3672
      - C:\Windows\SysWOW64\grpconv.exe
        
        "C:\Windows\System32\grpconv.exe" -o
        6⤵
        
        PID:208
  - - C:\Windows\SysWOW64\regsvr32.exe
      C:\Windows\System32\regsvr32.exe /s C:\Windows\system32/xvid.ax
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:4208
  - - C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe setupapi.dll,InstallHinfSection DefaultInstall 0 C:\Users\Admin\AppData\Local\Temp/xvid_x64/xvid.inf
      4⤵
      Adds Run key to start application
      Drops file in System32 directory
      Drops file in Windows directory
      PID:4628
    - - C:\Windows\system32\runonce.exe
        
        "C:\Windows\system32\runonce.exe" -r
        5⤵
        Checks processor information in registry
        
        PID:1100
      - C:\Windows\System32\grpconv.exe
        
        "C:\Windows\System32\grpconv.exe" -o
        6⤵
        
        PID:5116
  - - C:\Windows\System32\regsvr32.exe
      C:\Windows\System32\regsvr32.exe /s C:\Windows/system32/xvid.ax
      4⤵
      Loads dropped DLL
      Registers COM server for autorun
      Modifies registry class
      PID:1496
  - - C:\Users\Admin\AppData\Local\Temp\xvid_x86\SETPRI~1.EXE
      C:\Users\Admin\AppData\Local\Temp\xvid_x86\SETPRI~1.EXE
      4⤵
      Executes dropped EXE
      PID:4864
  - - C:\Users\Admin\AppData\Local\Temp\xvid_x64\SETPRI~1.EXE
      C:\Users\Admin\AppData\Local\Temp\xvid_x64\SETPRI~1.EXE
      4⤵
      Executes dropped EXE
      PID:3224
  - - C:\Users\Admin\AppData\Local\Temp\xvid_x86\setavi32.exe
      C:\Users\Admin\AppData\Local\Temp\xvid_x86\setavi32.exe
      4⤵
      Executes dropped EXE
      PID:4932
  - - C:\Users\Admin\AppData\Local\Temp\xvid_x64\setavi64.exe
      C:\Users\Admin\AppData\Local\Temp\xvid_x64\setavi64.exe
      4⤵
      Executes dropped EXE
      PID:64
- - C:\Program Files (x86)\Security Eye\se.exe
    "C:\Program Files (x86)\Security Eye\se.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks for VirtualBox DLLs, possible anti-VM trick
    - Suspicious behavior: EnumeratesProcesses
    PID:2252

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery