agenttesla | ac0ad6fa6a84cd64a77bd52cb09bf01213b6e2bccccd09d7dabea222419a3bc6

Analysis

max time kernel
141s
max time network
158s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
27-04-2024 22:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

X-TPM.msi
Size

41.1MB
MD5

1c3ae290b4057032b76e189009cbeaf0
SHA1

06d5dc01195e2f499806e76049b6c3a28fa029d0
SHA256

ac0ad6fa6a84cd64a77bd52cb09bf01213b6e2bccccd09d7dabea222419a3bc6
SHA512

e9cbea7a43e2fdaf8233a64c89f52c47eb80ac5489f249d9dc8656898c83b01626e7b8fd94525209098ce8a8828874875bed856d1741f0d603ad3fd771d9a64a
SSDEEP

786432:QA2pJpNITFIyP9uI4SD+o/iNmvYMONJfzYj40ZNhUmfIyU3rzyAB2AeS75/3e1C:QVnD2FIyP9uI8o0lJfi40ZNjj2Xy49e8

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\X-TPM\X-TPM\Guna.UI2.dll	family_agenttesla
behavioral1/memory/2972-134-0x0000000006340000-0x0000000006536000-memory.dmp	family_agenttesla

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

X-TPM.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000\Control Panel\International\Geo\Nation X-TPM.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000\Control Panel\International\Geo\Nation	X-TPM.exe

Drops file in Windows directory 12 IoCs

Processes:

msiexec.exeMicrosoftEdge.exe

description	ioc	process
File created	C:\Windows\Installer\SourceHash{8EEB1B70-FDF0-453C-B215-4D734D2F627E}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7433.tmp	msiexec.exe
File created	C:\Windows\Installer\e586f03.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6FFB.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\Installer\e586f01.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e586f01.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7134.tmp	msiexec.exe

Executes dropped EXE 1 IoCs

Processes:

X-TPM.exe

pid process

2972 X-TPM.exe

pid	process
2972	X-TPM.exe

Loads dropped DLL 10 IoCs

Processes:

MsiExec.exeMsiExec.exeX-TPM.exe

pid	process
4468	MsiExec.exe
4468	MsiExec.exe
4468	MsiExec.exe
4468	MsiExec.exe
4468	MsiExec.exe
4468	MsiExec.exe
1240	MsiExec.exe
1240	MsiExec.exe
2972	X-TPM.exe
2972	X-TPM.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Mfg	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceDesc	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Mfg	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Mfg	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

X-TPM.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	X-TPM.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	X-TPM.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	X-TPM.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

X-TPM.exebrowser_broker.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000\Software\Microsoft\Internet Explorer\TypedURLs	X-TPM.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

svchost.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1A\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b	msiexec.exe

Modifies registry class 64 IoCs

Processes:

msiexec.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\CA0B7637B36B62C40B2265CCA224C649	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B72164C = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07B1BEE80FDFC3542B51D437D4F226E7\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\07B1BEE80FDFC3542B51D437D4F226E7	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07B1BEE80FDFC3542B51D437D4F226E7\PackageCode = "5E31490CA5D6DCF4190042B69095785E"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07B1BEE80FDFC3542B51D437D4F226E7\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07B1BEE80FDFC3542B51D437D4F226E7\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07B1BEE80FDFC3542B51D437D4F226E7\SourceList	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07B1BEE80FDFC3542B51D437D4F226E7\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07B1BEE80FDFC3542B51D437D4F226E7\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07B1BEE80FDFC3542B51D437D4F226E7\Version = "16973824"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\CA0B7637B36B62C40B2265CCA224C649\07B1BEE80FDFC3542B51D437D4F226E7	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 3dc648c2f498da01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07B1BEE80FDFC3542B51D437D4F226E7\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07B1BEE80FDFC3542B51D437D4F226E7\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-0876022 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07B1BEE80FDFC3542B51D437D4F226E7\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07B1BEE80FDFC3542B51D437D4F226E7\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify.	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07B1BEE80FDFC3542B51D437D4F226E7	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{DED2D178-D7EC-451C-A6C9-75611DB367C9} = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07B1BEE80FDFC3542B51D437D4F226E7\SourceList\PackageName = "X-TPM.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07B1BEE80FDFC3542B51D437D4F226E7\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07B1BEE80FDFC3542B51D437D4F226E7\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07B1BEE80FDFC3542B51D437D4F226E7\ProductName = "X-TPM"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

msiexec.exe

pid process

3248 msiexec.exe
3248 msiexec.exe

pid	process
3248	msiexec.exe
3248	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	3068	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3068	msiexec.exe
Token: SeSecurityPrivilege	3248	msiexec.exe
Token: SeCreateTokenPrivilege	3068	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3068	msiexec.exe
Token: SeLockMemoryPrivilege	3068	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3068	msiexec.exe
Token: SeMachineAccountPrivilege	3068	msiexec.exe
Token: SeTcbPrivilege	3068	msiexec.exe
Token: SeSecurityPrivilege	3068	msiexec.exe
Token: SeTakeOwnershipPrivilege	3068	msiexec.exe
Token: SeLoadDriverPrivilege	3068	msiexec.exe
Token: SeSystemProfilePrivilege	3068	msiexec.exe
Token: SeSystemtimePrivilege	3068	msiexec.exe
Token: SeProfSingleProcessPrivilege	3068	msiexec.exe
Token: SeIncBasePriorityPrivilege	3068	msiexec.exe
Token: SeCreatePagefilePrivilege	3068	msiexec.exe
Token: SeCreatePermanentPrivilege	3068	msiexec.exe
Token: SeBackupPrivilege	3068	msiexec.exe
Token: SeRestorePrivilege	3068	msiexec.exe
Token: SeShutdownPrivilege	3068	msiexec.exe
Token: SeDebugPrivilege	3068	msiexec.exe
Token: SeAuditPrivilege	3068	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3068	msiexec.exe
Token: SeChangeNotifyPrivilege	3068	msiexec.exe
Token: SeRemoteShutdownPrivilege	3068	msiexec.exe
Token: SeUndockPrivilege	3068	msiexec.exe
Token: SeSyncAgentPrivilege	3068	msiexec.exe
Token: SeEnableDelegationPrivilege	3068	msiexec.exe
Token: SeManageVolumePrivilege	3068	msiexec.exe
Token: SeImpersonatePrivilege	3068	msiexec.exe
Token: SeCreateGlobalPrivilege	3068	msiexec.exe
Token: SeCreateTokenPrivilege	3068	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3068	msiexec.exe
Token: SeLockMemoryPrivilege	3068	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3068	msiexec.exe
Token: SeMachineAccountPrivilege	3068	msiexec.exe
Token: SeTcbPrivilege	3068	msiexec.exe
Token: SeSecurityPrivilege	3068	msiexec.exe
Token: SeTakeOwnershipPrivilege	3068	msiexec.exe
Token: SeLoadDriverPrivilege	3068	msiexec.exe
Token: SeSystemProfilePrivilege	3068	msiexec.exe
Token: SeSystemtimePrivilege	3068	msiexec.exe
Token: SeProfSingleProcessPrivilege	3068	msiexec.exe
Token: SeIncBasePriorityPrivilege	3068	msiexec.exe
Token: SeCreatePagefilePrivilege	3068	msiexec.exe
Token: SeCreatePermanentPrivilege	3068	msiexec.exe
Token: SeBackupPrivilege	3068	msiexec.exe
Token: SeRestorePrivilege	3068	msiexec.exe
Token: SeShutdownPrivilege	3068	msiexec.exe
Token: SeDebugPrivilege	3068	msiexec.exe
Token: SeAuditPrivilege	3068	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3068	msiexec.exe
Token: SeChangeNotifyPrivilege	3068	msiexec.exe
Token: SeRemoteShutdownPrivilege	3068	msiexec.exe
Token: SeUndockPrivilege	3068	msiexec.exe
Token: SeSyncAgentPrivilege	3068	msiexec.exe
Token: SeEnableDelegationPrivilege	3068	msiexec.exe
Token: SeManageVolumePrivilege	3068	msiexec.exe
Token: SeImpersonatePrivilege	3068	msiexec.exe
Token: SeCreateGlobalPrivilege	3068	msiexec.exe
Token: SeCreateTokenPrivilege	3068	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3068	msiexec.exe
Token: SeLockMemoryPrivilege	3068	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

3068 msiexec.exe
3068 msiexec.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exe

pid process

4140 MicrosoftEdge.exe
4200 MicrosoftEdgeCP.exe

pid	process
3068	msiexec.exe
3068	msiexec.exe

pid	process
4140	MicrosoftEdge.exe
4200	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

msiexec.exe

description	pid	process	target process
PID 3248 wrote to memory of 4468	3248	msiexec.exe	MsiExec.exe
PID 3248 wrote to memory of 4468	3248	msiexec.exe	MsiExec.exe
PID 3248 wrote to memory of 4468	3248	msiexec.exe	MsiExec.exe
PID 3248 wrote to memory of 1608	3248	msiexec.exe	srtasks.exe
PID 3248 wrote to memory of 1608	3248	msiexec.exe	srtasks.exe
PID 3248 wrote to memory of 1240	3248	msiexec.exe	MsiExec.exe
PID 3248 wrote to memory of 1240	3248	msiexec.exe	MsiExec.exe
PID 3248 wrote to memory of 1240	3248	msiexec.exe	MsiExec.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\X-TPM.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3068

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3248

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 061440E7D35E0658A54DD6BE8BAA3A86 C
2⤵
- Loads dropped DLL
PID:4468

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
2⤵
PID:1608

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding DDDBC9A9C8B5B71BEF2C9A369DB56D08
2⤵
- Loads dropped DLL
PID:1240

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:4792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc
1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:3116

C:\Users\Admin\AppData\Roaming\X-TPM\X-TPM\X-TPM.exe
"C:\Users\Admin\AppData\Roaming\X-TPM\X-TPM\X-TPM.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
- Modifies Internet Explorer settings
PID:2972

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4140

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:236

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4200

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:2068

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5088

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e586f02.rbs
Filesize
15KB

MD5
f40d8414e188e47b71f7e837433fcf52

SHA1
e60cbae0d8bca50e3b92a38fbd857dde957d82cc

SHA256
fd68c987245e6671b7834ca39de009cd3f7ef89eeb6135c40c6ea473907976aa

SHA512
2e34d46613e013d18aacd01e4fb9cf0044fa8335587c8676b541320ceb7b0f7aef304f526d65c5b5c94e3f20d090fd5c4748d34199898f5cf109dd42183424c6

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_8BB34D7AC6ADCC019FE5325FE9DECAE8
Filesize
422B

MD5
c2ecf1ef8294ee7f6da515c6e9cedca4

SHA1
af242482ea411598ffffbdb7164c0c6a13e6692a

SHA256
1ee7acd8a856b6689cd1c04c50bab613e5a8f773e8297899e73db294b093fc1d

SHA512
833f26de90bead4eac55c3b83230f28b0c58b2a66f27671f95aee3cc8ec9944abc243f2d2562b24dfd82c46c72f1cbd1e8b1e115c1f4a9020f26321be5bd8e71

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_91B924923180E8714F1EDBCBF8DDC70F
Filesize
414B

MD5
6ee2df0b64b618c117b178e2eb01be34

SHA1
9184bab437e79c18624760525eca00ad0b4fac82

SHA256
4593a731166cce3cb22094d8c9f2c09e8a3b61918e03b2a14af601781ed93c79

SHA512
fae506c08b28349b6b50656968dc1f66613ab39708a0a1de9e62389f13c271ac67bbc6752bd03db7357cc7d774750e99a1823b42ad118b516508faff297e17e8

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\FDCKBH4I\ABDELLAH[1].png
Filesize
39KB

MD5
3404a714fbb43470cbadebdb63ccfb1f

SHA1
ef0b4b81319e760ecc53c4b25b05ea3cb1af7324

SHA256
5f7c441abb982d3da22f22f11c0422b3865d4b7e422b76ceb60acf508a57e911

SHA512
6e6f521a5eb43c16d1c821ce013d02c838da0aa9cf3a3933ba23bb184907abe5654c4c4f548647f942edc175f8f8dc3cdae094b0528ed0c50336f8208c7e79b4

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_91B924923180E8714F1EDBCBF8DDC70F
Filesize
471B

MD5
d77116e4a9939fddab4a7b2ca9284425

SHA1
e762aa845a264143b6b8fea4e54cfacc75ac27fc

SHA256
0d780f10922d260e5e51c92dbdf407bba5de23add35bcf9fc2795e234c9ed74a

SHA512
1860c0eb47cde8a540d4d866c9540d1106491b6082c6a0219b439f3fd0b84d32312af9e7e9440d909f225b2da5646ad69de844930ec844d88cb7d237af07f139

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIE7A1.tmp
Filesize
559KB

MD5
fe4d2f9cad2f30990e8f845d4052c2fd

SHA1
3c2ebd01fdd78f2424d8c76e36404933e4a71a11

SHA256
1e28349bf342dd176ff7a899b73e7a1b5792c95e099212a72d7dfe9e75836695

SHA512
6dd5d5d30002d18d37a1068730657c84142bf0bd81cc9aab6bcb67286b4f4dd5b77e3b8fb3e6356ea86e26a79805e50a33e686859f5d9e065129a34b7cac66f4

Download Submit
C:\Users\Admin\AppData\Roaming\X-TPM\X-TPM\Guna.UI2.dll
Filesize
1.9MB

MD5
a6c5c5d8f6a0e33f789c1c9c070a38d6

SHA1
f36efdf71e737c78e83d8d284ba03b5d5aff95f1

SHA256
cf423a447e5c1dc8bc0b84ef005e2e942fa149ba4f9caf7e2f12f672cad55385

SHA512
fd679781213be3b7ec6a39b2dacb2b96c356d4276e8b23995f243cbda88f56e311f2933244f50e50a27c72d664b67bb337ab0053c5e83fd934bbb67d6576a124

Download Submit
C:\Users\Admin\AppData\Roaming\X-TPM\X-TPM\X-TPM.exe
Filesize
1.4MB

MD5
fa05c4a10950d5eb86306dee7ca9e1d5

SHA1
d27d10b5739b67a2edea9e46626103030b0ef506

SHA256
1726fc654f1a86dc6f17a47febd507c8cd0fbaab5b6c5dfae21c158af72256cd

SHA512
746c34523c1f693159c9d1f08109046b2d16f6e2a796ca9f4d0a1fa8f758ec4e8af6daf6f15c18fd51df6e623961a854e39cdf8af0697340e626f7c48ef4ae43

Download Submit
C:\Users\Admin\AppData\Roaming\X-TPM\X-TPM\X-TPM.exe.config
Filesize
2KB

MD5
ae36eae877b17f0c6eaa5150cdc207f8

SHA1
8e13196355e71167f2ef84dab46f45fc84ce8578

SHA256
e96d39129b1ad1fd895e6572aa3bfd7320839e6faa6fbb4a76976ad32ac0ab32

SHA512
15214b0b99d26087b6780a0a2e797980d9b137b1e44f68ab9cd68e53013b5a367ca68e491803bc00bba917147658719dee1c777c240196575e521700a354d142

Download Submit
C:\Users\Admin\AppData\Roaming\X-TPM\X-TPM\xtpmdb.ldb
Filesize
128B

MD5
0cafad6dd69dc1596fd183be091440ab

SHA1
beae00e0fc00c1c33c01220a28135be644701a99

SHA256
98ece97d73b586dabf1059d518845f7625beacb4b0bdb8d034d920a4a67a2d02

SHA512
ca88d6c918eddce05a66d85f46ae5c8ff246ca0742e5dc9df7764e266fdd5849899cc9978ee5425d79e51749658babf3bc39764ea4b760ae0ce6d5af94c6ad2f

Download Submit
C:\Users\Admin\AppData\Roaming\X-TPM\X-TPM\xtpmdb.mdb
Filesize
3.4MB

MD5
4f082743f5c089242dc46cf38db7a08d

SHA1
26a0e210398ead374b5271fe4f036f17766bfb4f

SHA256
e1458d36bb81a452fd4b9a9ab08df272de43bb45b5fb2922f5c0905bc88ca810

SHA512
bb353348c75a873ef724e3429e1f73f59aca9f8ffd4ac836a991f302683b2e3f7eba827daac37991e3a0cbaf36c259f3cedaf0f907e01fb46166f6aeb7720e76

Download Submit
C:\Windows\Installer\e586f01.msi
Filesize
41.1MB

MD5
1c3ae290b4057032b76e189009cbeaf0

SHA1
06d5dc01195e2f499806e76049b6c3a28fa029d0

SHA256
ac0ad6fa6a84cd64a77bd52cb09bf01213b6e2bccccd09d7dabea222419a3bc6

SHA512
e9cbea7a43e2fdaf8233a64c89f52c47eb80ac5489f249d9dc8656898c83b01626e7b8fd94525209098ce8a8828874875bed856d1741f0d603ad3fd771d9a64a

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Filesize
26.0MB

MD5
e368aa4f4e4d38c35b0d96a72704789d

SHA1
c8d4056ce2352b2534f0710a4238718c30801ae1

SHA256
a63450bc00b099a7ec5d35aac33c3ded576c6f19dee1e17d19d7553d0d89fb98

SHA512
fed0e678c54ff92fda2574dd3503f3490b4e07c696a23dfe12bbe56f54a469012880f6d9266caa09b1d8f8fc195bb7b1a72e06337a27e685ab94ea688bc3f20a

Download Submit
\??\Volume{34d48da6-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{0bfe91f0-f324-44b7-a1b0-869624acd86e}_OnDiskSnapshotProp
Filesize
5KB

MD5
2c1e8a759f98fddab4fd804e3c41bf21

SHA1
ec8c59e5ed598f6d55439d0218f600a740a4290a

SHA256
fc605e1d2ad04a450307f5b0c65a7694fe00d935513ccd83390fb5ecaf094499

SHA512
6ffc79b68dcf847d25104f65691b74cadec1335cf1f4c029d44cf15c45a851fd2a920f6225949e95d230ad89ee613f84770b6cb0a7dd716923c6c59f047b349d

Download Submit
memory/2068-322-0x0000029F23800000-0x0000029F23900000-memory.dmp

Filesize
1024KB

Download
memory/2972-140-0x000000000E240000-0x000000000E27C000-memory.dmp

Filesize
240KB

Download
memory/2972-138-0x0000000009AD0000-0x0000000009B1B000-memory.dmp

Filesize
300KB

Download
memory/2972-129-0x00000000057A0000-0x00000000057AA000-memory.dmp

Filesize
40KB

Download
memory/2972-127-0x0000000005E40000-0x000000000633E000-memory.dmp

Filesize
5.0MB

Download
memory/2972-141-0x0000000009DD0000-0x0000000009DF0000-memory.dmp

Filesize
128KB

Download
memory/2972-126-0x00000000058A0000-0x000000000593C000-memory.dmp

Filesize
624KB

Download
memory/2972-125-0x0000000000CD0000-0x0000000000E38000-memory.dmp

Filesize
1.4MB

Download
memory/2972-135-0x00000000092A0000-0x00000000095F0000-memory.dmp

Filesize
3.3MB

Download
memory/2972-134-0x0000000006340000-0x0000000006536000-memory.dmp

Filesize
2.0MB

Download
memory/2972-128-0x0000000005940000-0x00000000059D2000-memory.dmp

Filesize
584KB

Download
memory/2972-130-0x0000000005AA0000-0x0000000005AF6000-memory.dmp

Filesize
344KB

Download
memory/4140-313-0x000002B4478C0000-0x000002B4478C2000-memory.dmp

Filesize
8KB

Download
memory/4140-294-0x000002B44A520000-0x000002B44A530000-memory.dmp

Filesize
64KB

Download
memory/4140-278-0x000002B44A420000-0x000002B44A430000-memory.dmp

Filesize
64KB

Download
memory/5088-515-0x000001D480E80000-0x000001D480E82000-memory.dmp

Filesize
8KB

Download
memory/5088-404-0x000001D480110000-0x000001D480112000-memory.dmp

Filesize
8KB

Download
memory/5088-513-0x000001D480E60000-0x000001D480E62000-memory.dmp

Filesize
8KB

Download
memory/5088-415-0x000001D483CC0000-0x000001D483CE0000-memory.dmp

Filesize
128KB

Download
memory/5088-416-0x000001D484300000-0x000001D484320000-memory.dmp

Filesize
128KB

Download
memory/5088-418-0x000001D480640000-0x000001D480740000-memory.dmp

Filesize
1024KB

Download
memory/5088-527-0x000001D481C70000-0x000001D481C72000-memory.dmp

Filesize
8KB

Download
memory/5088-525-0x000001D481C50000-0x000001D481C52000-memory.dmp

Filesize
8KB

Download
memory/5088-576-0x000001D480740000-0x000001D480840000-memory.dmp

Filesize
1024KB

Download
memory/5088-517-0x000001D4815B0000-0x000001D4815B2000-memory.dmp

Filesize
8KB

Download
memory/5088-340-0x000001DCEE700000-0x000001DCEE800000-memory.dmp

Filesize
1024KB

Download
memory/5088-406-0x000001D480150000-0x000001D480152000-memory.dmp

Filesize
8KB

Download
memory/5088-519-0x000001D4815D0000-0x000001D4815D2000-memory.dmp

Filesize
8KB

Download
memory/5088-615-0x000001D481D70000-0x000001D481D72000-memory.dmp

Filesize
8KB

Download
memory/5088-612-0x000001D481C20000-0x000001D481C22000-memory.dmp

Filesize
8KB

Download
memory/5088-619-0x000001D481D90000-0x000001D481D92000-memory.dmp

Filesize
8KB

Download
memory/5088-622-0x000001D481DA0000-0x000001D481DA2000-memory.dmp

Filesize
8KB

Download
memory/5088-624-0x000001D481DC0000-0x000001D481DC2000-memory.dmp

Filesize
8KB

Download
memory/5088-628-0x000001D481DF0000-0x000001D481DF2000-memory.dmp

Filesize
8KB

Download
memory/5088-654-0x000001DCEE4E0000-0x000001DCEE4F0000-memory.dmp

Filesize
64KB

Download
memory/5088-410-0x000001D480210000-0x000001D480212000-memory.dmp

Filesize
8KB

Download
memory/5088-341-0x000001DCEE700000-0x000001DCEE800000-memory.dmp

Filesize
1024KB

Download