hxxps://nova[.]fnbuilds[.]services/Installer/2[.]6/NovaInstaller[.]exe

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 19:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://nova.fnbuilds.services/Installer/2.6/NovaInstaller.exe

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation	windowsdesktop-runtime-6.0.15-win-x64.exe

Executes dropped EXE 4 IoCs

pid	Process
4060	NovaInstaller.exe
3360	windowsdesktop-runtime-6.0.15-win-x64.exe
1392	windowsdesktop-runtime-6.0.15-win-x64.exe
5840	windowsdesktop-runtime-6.0.21-win-x64.exe

Loads dropped DLL 7 IoCs

pid	Process
4060	NovaInstaller.exe
4060	NovaInstaller.exe
4060	NovaInstaller.exe
1392	windowsdesktop-runtime-6.0.15-win-x64.exe
5144	MsiExec.exe
5144	MsiExec.exe
3892	MsiExec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{0f39db03-9030-48f3-82ef-5384bed81d85} = "\"C:\\ProgramData\\Package Cache\\{0f39db03-9030-48f3-82ef-5384bed81d85}\\windowsdesktop-runtime-6.0.21-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-6.0.21-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Threading.Tasks.Parallel.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Collections.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.IO.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Runtime.Serialization.Formatters.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Text.RegularExpressions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Xml.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\api-ms-win-core-rtlsupport-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Reflection.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Net.WebHeaderCollection.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Xml.ReaderWriter.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Reflection.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Xml.Serialization.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Net.HttpListener.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Reflection.Emit.ILGeneration.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Diagnostics.Contracts.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Linq.Queryable.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Runtime.Serialization.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\mscorlib.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.IO.FileSystem.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Reflection.DispatchProxy.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Runtime.Loader.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Net.NetworkInformation.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Collections.NonGeneric.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.ValueTuple.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Globalization.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\mscordbi.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\dbgshim.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.IO.IsolatedStorage.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Diagnostics.Tools.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Globalization.Calendars.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Reflection.Metadata.dll	msiexec.exe
File created	C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 6.0.21 (x64).swidtag	windowsdesktop-runtime-6.0.21-win-x64.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\api-ms-win-core-string-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\WindowsBase.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.ObjectModel.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Resources.ResourceManager.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.IO.UnmanagedMemoryStream.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.IO.Compression.Brotli.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.IO.Compression.ZipFile.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\api-ms-win-core-libraryloader-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\api-ms-win-crt-environment-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Collections.Immutable.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Transactions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Security.Cryptography.X509Certificates.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Runtime.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Configuration.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Security.Cryptography.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\api-ms-win-crt-private-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\api-ms-win-core-namedpipe-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Formats.Asn1.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\api-ms-win-core-datetime-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.IO.FileSystem.DriveInfo.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Data.Common.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Runtime.Numerics.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\api-ms-win-core-util-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\Microsoft.VisualBasic.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Transactions.Local.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\coreclr.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\hostpolicy.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Diagnostics.Process.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\api-ms-win-core-processthreads-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Runtime.Serialization.Json.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Memory.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.ServiceProcess.dll	msiexec.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI7826.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7BF0.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6DE3.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{8D2EC92E-5903-4B25-9406-182B8EFA834F}	msiexec.exe
File created	C:\Windows\Installer\e596bf4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e596bef.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e596bef.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7084.tmp	msiexec.exe
File created	C:\Windows\Installer\e596bf3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e596bf4.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe

Modifies registry class 36 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_48.87.64667_x64\Version = "48.87.64667"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_48.87.64667_x64\DisplayName = "Microsoft .NET Runtime - 6.0.21 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E29CE2D8309552B4496081B2E8AF38F4	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E29CE2D8309552B4496081B2E8AF38F4\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E29CE2D8309552B4496081B2E8AF38F4	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E29CE2D8309552B4496081B2E8AF38F4\ProductName = "Microsoft .NET Runtime - 6.0.21 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E29CE2D8309552B4496081B2E8AF38F4\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_48.87.64667_x64\Dependents	windowsdesktop-runtime-6.0.21-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{0f39db03-9030-48f3-82ef-5384bed81d85}\ = "{0f39db03-9030-48f3-82ef-5384bed81d85}"	windowsdesktop-runtime-6.0.21-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E29CE2D8309552B4496081B2E8AF38F4\PackageCode = "EF2F01B90458BB146B22309F93D02573"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E29CE2D8309552B4496081B2E8AF38F4\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E29CE2D8309552B4496081B2E8AF38F4\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E29CE2D8309552B4496081B2E8AF38F4\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E29CE2D8309552B4496081B2E8AF38F4\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_48.87.64667_x64	windowsdesktop-runtime-6.0.21-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\BE3E5325A595AB443B7CED4E083B14EB\E29CE2D8309552B4496081B2E8AF38F4	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E29CE2D8309552B4496081B2E8AF38F4\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{0f39db03-9030-48f3-82ef-5384bed81d85}	windowsdesktop-runtime-6.0.21-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{0f39db03-9030-48f3-82ef-5384bed81d85}\Dependents	windowsdesktop-runtime-6.0.21-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E29CE2D8309552B4496081B2E8AF38F4\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\BE3E5325A595AB443B7CED4E083B14EB	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E29CE2D8309552B4496081B2E8AF38F4\SourceList\PackageName = "dotnet-runtime-6.0.21-win-x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_48.87.64667_x64\Dependents\{0f39db03-9030-48f3-82ef-5384bed81d85}	windowsdesktop-runtime-6.0.21-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{0f39db03-9030-48f3-82ef-5384bed81d85}\Version = "6.0.21.32717"	windowsdesktop-runtime-6.0.21-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{0f39db03-9030-48f3-82ef-5384bed81d85}\Dependents\{0f39db03-9030-48f3-82ef-5384bed81d85}	windowsdesktop-runtime-6.0.21-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E29CE2D8309552B4496081B2E8AF38F4\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_48.87.64667_x64	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_48.87.64667_x64\ = "{8D2EC92E-5903-4B25-9406-182B8EFA834F}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E29CE2D8309552B4496081B2E8AF38F4\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E29CE2D8309552B4496081B2E8AF38F4\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E29CE2D8309552B4496081B2E8AF38F4\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{0f39db03-9030-48f3-82ef-5384bed81d85}\DisplayName = "Microsoft Windows Desktop Runtime - 6.0.21 (x64)"	windowsdesktop-runtime-6.0.21-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E29CE2D8309552B4496081B2E8AF38F4\MainFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E29CE2D8309552B4496081B2E8AF38F4\Version = "811072667"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E29CE2D8309552B4496081B2E8AF38F4\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{8D2EC92E-5903-4B25-9406-182B8EFA834F}v48.87.64667\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E29CE2D8309552B4496081B2E8AF38F4\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{8D2EC92E-5903-4B25-9406-182B8EFA834F}v48.87.64667\\"	msiexec.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 415454.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4356	msedge.exe
4356	msedge.exe
1004	msedge.exe
1004	msedge.exe
1400	identity_helper.exe
1400	identity_helper.exe
6020	msedge.exe
6020	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
1988	msiexec.exe
1988	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4060	NovaInstaller.exe
Token: SeShutdownPrivilege	5840	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeIncreaseQuotaPrivilege	5840	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeSecurityPrivilege	1988	msiexec.exe
Token: SeCreateTokenPrivilege	5840	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeAssignPrimaryTokenPrivilege	5840	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeLockMemoryPrivilege	5840	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeIncreaseQuotaPrivilege	5840	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeMachineAccountPrivilege	5840	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeTcbPrivilege	5840	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeSecurityPrivilege	5840	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeTakeOwnershipPrivilege	5840	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeLoadDriverPrivilege	5840	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeSystemProfilePrivilege	5840	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeSystemtimePrivilege	5840	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeProfSingleProcessPrivilege	5840	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeIncBasePriorityPrivilege	5840	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeCreatePagefilePrivilege	5840	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeCreatePermanentPrivilege	5840	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeBackupPrivilege	5840	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeRestorePrivilege	5840	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeShutdownPrivilege	5840	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeDebugPrivilege	5840	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeAuditPrivilege	5840	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeSystemEnvironmentPrivilege	5840	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeChangeNotifyPrivilege	5840	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeRemoteShutdownPrivilege	5840	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeUndockPrivilege	5840	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeSyncAgentPrivilege	5840	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeEnableDelegationPrivilege	5840	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeManageVolumePrivilege	5840	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeImpersonatePrivilege	5840	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeCreateGlobalPrivilege	5840	windowsdesktop-runtime-6.0.21-win-x64.exe
Token: SeRestorePrivilege	1988	msiexec.exe
Token: SeTakeOwnershipPrivilege	1988	msiexec.exe
Token: SeRestorePrivilege	1988	msiexec.exe
Token: SeTakeOwnershipPrivilege	1988	msiexec.exe
Token: SeRestorePrivilege	1988	msiexec.exe
Token: SeTakeOwnershipPrivilege	1988	msiexec.exe
Token: SeRestorePrivilege	1988	msiexec.exe
Token: SeTakeOwnershipPrivilege	1988	msiexec.exe
Token: SeRestorePrivilege	1988	msiexec.exe
Token: SeTakeOwnershipPrivilege	1988	msiexec.exe
Token: SeRestorePrivilege	1988	msiexec.exe
Token: SeTakeOwnershipPrivilege	1988	msiexec.exe
Token: SeRestorePrivilege	1988	msiexec.exe
Token: SeTakeOwnershipPrivilege	1988	msiexec.exe
Token: SeRestorePrivilege	1988	msiexec.exe
Token: SeTakeOwnershipPrivilege	1988	msiexec.exe
Token: SeRestorePrivilege	1988	msiexec.exe
Token: SeTakeOwnershipPrivilege	1988	msiexec.exe
Token: SeRestorePrivilege	1988	msiexec.exe
Token: SeTakeOwnershipPrivilege	1988	msiexec.exe
Token: SeRestorePrivilege	1988	msiexec.exe
Token: SeTakeOwnershipPrivilege	1988	msiexec.exe
Token: SeRestorePrivilege	1988	msiexec.exe
Token: SeTakeOwnershipPrivilege	1988	msiexec.exe
Token: SeRestorePrivilege	1988	msiexec.exe
Token: SeTakeOwnershipPrivilege	1988	msiexec.exe
Token: SeRestorePrivilege	1988	msiexec.exe
Token: SeTakeOwnershipPrivilege	1988	msiexec.exe
Token: SeRestorePrivilege	1988	msiexec.exe
Token: SeTakeOwnershipPrivilege	1988	msiexec.exe
Token: SeRestorePrivilege	1988	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4060	NovaInstaller.exe
3360	windowsdesktop-runtime-6.0.15-win-x64.exe
1392	windowsdesktop-runtime-6.0.15-win-x64.exe
5840	windowsdesktop-runtime-6.0.21-win-x64.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1004 wrote to memory of 1536	1004	msedge.exe	83
PID 1004 wrote to memory of 1536	1004	msedge.exe	83
PID 1004 wrote to memory of 1520	1004	msedge.exe	84
PID 1004 wrote to memory of 1520	1004	msedge.exe	84
PID 1004 wrote to memory of 1520	1004	msedge.exe	84
PID 1004 wrote to memory of 1520	1004	msedge.exe	84
PID 1004 wrote to memory of 1520	1004	msedge.exe	84
PID 1004 wrote to memory of 1520	1004	msedge.exe	84
PID 1004 wrote to memory of 1520	1004	msedge.exe	84
PID 1004 wrote to memory of 1520	1004	msedge.exe	84
PID 1004 wrote to memory of 1520	1004	msedge.exe	84
PID 1004 wrote to memory of 1520	1004	msedge.exe	84
PID 1004 wrote to memory of 1520	1004	msedge.exe	84
PID 1004 wrote to memory of 1520	1004	msedge.exe	84
PID 1004 wrote to memory of 1520	1004	msedge.exe	84
PID 1004 wrote to memory of 1520	1004	msedge.exe	84
PID 1004 wrote to memory of 1520	1004	msedge.exe	84
PID 1004 wrote to memory of 1520	1004	msedge.exe	84
PID 1004 wrote to memory of 1520	1004	msedge.exe	84
PID 1004 wrote to memory of 1520	1004	msedge.exe	84
PID 1004 wrote to memory of 1520	1004	msedge.exe	84
PID 1004 wrote to memory of 1520	1004	msedge.exe	84
PID 1004 wrote to memory of 1520	1004	msedge.exe	84
PID 1004 wrote to memory of 1520	1004	msedge.exe	84
PID 1004 wrote to memory of 1520	1004	msedge.exe	84
PID 1004 wrote to memory of 1520	1004	msedge.exe	84
PID 1004 wrote to memory of 1520	1004	msedge.exe	84
PID 1004 wrote to memory of 1520	1004	msedge.exe	84
PID 1004 wrote to memory of 1520	1004	msedge.exe	84
PID 1004 wrote to memory of 1520	1004	msedge.exe	84
PID 1004 wrote to memory of 1520	1004	msedge.exe	84
PID 1004 wrote to memory of 1520	1004	msedge.exe	84
PID 1004 wrote to memory of 1520	1004	msedge.exe	84
PID 1004 wrote to memory of 1520	1004	msedge.exe	84
PID 1004 wrote to memory of 1520	1004	msedge.exe	84
PID 1004 wrote to memory of 1520	1004	msedge.exe	84
PID 1004 wrote to memory of 1520	1004	msedge.exe	84
PID 1004 wrote to memory of 1520	1004	msedge.exe	84
PID 1004 wrote to memory of 1520	1004	msedge.exe	84
PID 1004 wrote to memory of 1520	1004	msedge.exe	84
PID 1004 wrote to memory of 1520	1004	msedge.exe	84
PID 1004 wrote to memory of 1520	1004	msedge.exe	84
PID 1004 wrote to memory of 4356	1004	msedge.exe	85
PID 1004 wrote to memory of 4356	1004	msedge.exe	85
PID 1004 wrote to memory of 3252	1004	msedge.exe	86
PID 1004 wrote to memory of 3252	1004	msedge.exe	86
PID 1004 wrote to memory of 3252	1004	msedge.exe	86
PID 1004 wrote to memory of 3252	1004	msedge.exe	86
PID 1004 wrote to memory of 3252	1004	msedge.exe	86
PID 1004 wrote to memory of 3252	1004	msedge.exe	86
PID 1004 wrote to memory of 3252	1004	msedge.exe	86
PID 1004 wrote to memory of 3252	1004	msedge.exe	86
PID 1004 wrote to memory of 3252	1004	msedge.exe	86
PID 1004 wrote to memory of 3252	1004	msedge.exe	86
PID 1004 wrote to memory of 3252	1004	msedge.exe	86
PID 1004 wrote to memory of 3252	1004	msedge.exe	86
PID 1004 wrote to memory of 3252	1004	msedge.exe	86
PID 1004 wrote to memory of 3252	1004	msedge.exe	86
PID 1004 wrote to memory of 3252	1004	msedge.exe	86
PID 1004 wrote to memory of 3252	1004	msedge.exe	86
PID 1004 wrote to memory of 3252	1004	msedge.exe	86
PID 1004 wrote to memory of 3252	1004	msedge.exe	86
PID 1004 wrote to memory of 3252	1004	msedge.exe	86
PID 1004 wrote to memory of 3252	1004	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://nova.fnbuilds.services/Installer/2.6/NovaInstaller.exe
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff80ad846f8,0x7ff80ad84708,0x7ff80ad84718
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,7762781567109162497,12688753896605585599,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2200,7762781567109162497,12688753896605585599,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2200,7762781567109162497,12688753896605585599,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,7762781567109162497,12688753896605585599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,7762781567109162497,12688753896605585599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,7762781567109162497,12688753896605585599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,7762781567109162497,12688753896605585599,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,7762781567109162497,12688753896605585599,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3496 /prefetch:8
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,7762781567109162497,12688753896605585599,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3496 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,7762781567109162497,12688753896605585599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,7762781567109162497,12688753896605585599,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,7762781567109162497,12688753896605585599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2200,7762781567109162497,12688753896605585599,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2200,7762781567109162497,12688753896605585599,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3820 /prefetch:8
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,7762781567109162497,12688753896605585599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2200,7762781567109162497,12688753896605585599,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6532 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,7762781567109162497,12688753896605585599,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6056 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6084
- C:\Users\Admin\Downloads\NovaInstaller.exe
  "C:\Users\Admin\Downloads\NovaInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4060
- - C:\Users\Admin\Downloads\windowsdesktop-runtime-6.0.15-win-x64.exe
    "windowsdesktop-runtime-6.0.15-win-x64.exe" /S
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3360
  - - C:\Windows\Temp\{7FA4B548-0262-4D56-BAB7-BF8BA833556D}\.cr\windowsdesktop-runtime-6.0.15-win-x64.exe
      "C:\Windows\Temp\{7FA4B548-0262-4D56-BAB7-BF8BA833556D}\.cr\windowsdesktop-runtime-6.0.15-win-x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\windowsdesktop-runtime-6.0.15-win-x64.exe" -burn.filehandle.attached=572 -burn.filehandle.self=680 /S
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1392
    - - C:\Windows\Temp\{2AE0530E-BDBD-4DA3-9921-53A6C651E28C}\.be\windowsdesktop-runtime-6.0.21-win-x64.exe
        
        "C:\Windows\Temp\{2AE0530E-BDBD-4DA3-9921-53A6C651E28C}\.be\windowsdesktop-runtime-6.0.21-win-x64.exe" -q -burn.elevated BurnPipe.{E6971D98-F280-419C-A2A9-B69FA3421EDB} {2E025FEF-0F85-4F27-8879-A053880D4383} 1392
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:5840

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3144

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1988
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D900E575CC3759F03E954CAF4B614006
  2⤵
  - Loads dropped DLL
  PID:5144
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding FA8A921C8E20A40912F342AE3876298B
  2⤵
  - Loads dropped DLL
  PID:3892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e596bf2.rbs

Filesize
56KB

MD5
56ac882255364dfae223bd8a55bbe6d5

SHA1
81711deee31f8a68fcb3e294ae84e0be2e1a01a0

SHA256
975dfdff2f5e4dbbdd9b22b55b0fa0ef12cf26dae88ab86d20e0466368d60a06

SHA512
03eb8047e02512db556199400c7319a437494e54e43bfeb16af045f0ade05ac0ce93813c47ec625f023a75323ae6897283c599e00d7a82b6f141a9e2d4f64aba

Download Submit
C:\Config.Msi\e596bf7.rbs

Filesize
9KB

MD5
8ddb4354e899e0e6a1827913fc4f95f1

SHA1
202010b84cc4199185edb76c8b827aeb019a5991

SHA256
d7b70dca6e4ba81245196d1ac190fd0d9034a49318b5252b8a83690bda71fac0

SHA512
988d3c0d434c4e6c6779acf97965160190679df8cc5b5047212cdce204fe10cdab9a5166811f772261c2b48dec230c583eaddb81f496223ebc19b48a6dcf5021

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4e96ed67859d0bafd47d805a71041f49

SHA1
7806c54ae29a6c8d01dcbc78e5525ddde321b16b

SHA256
bd13ddab4dc4bbf01ed50341953c9638f6d71faf92bc79fbfe93687432c2292d

SHA512
432201c3119779d91d13da55a26d4ff4ce4a9529e00b44ec1738029f92610d4e6e25c05694adf949c3e9c70fbbbbea723f63c29287906729f5e88a046a2edcb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1cbd0e9a14155b7f5d4f542d09a83153

SHA1
27a442a921921d69743a8e4b76ff0b66016c4b76

SHA256
243d05d6af19bfe3e06b1f7507342ead88f9d87b84e239ad1d144e9e454b548c

SHA512
17e5217d5bf67571afb0e7ef30ac21c11ea6553f89457548d96ee4461011f641a7872a37257239fa5f25702f027afb85d5bd9faf2f2f183992b8879407e56a0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0c0a2329-177c-41f1-a01a-b92e33619090.tmp

Filesize
5KB

MD5
4646e20132b483bbcbb846b686e3b0c6

SHA1
e40a7323c52fe58e194cbcc895a23f99ea641b81

SHA256
9cae921cce0fd64e7f5f932468d4acd5243f7a7daea032423f7ab79fb74a7ec0

SHA512
f85f00993b19238e765ad4dd63eb6a5f5cebb354609d1cfb57ad0d05c6e2eca7022a934e74d3fc2c078c3f954ed647ea85b274845b4ee297801e9b48dcf6d728

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
190B

MD5
9076166550b31452b9df44fd2d130484

SHA1
cbb1f73957b7e845cbeb0e4348b4c192a5dff6f5

SHA256
bbe2c3a524b09c4e8b4d76ce220fe92c944b3aef6bd2fe409e1e634e755ea2e7

SHA512
b085af154832ee44ae0374ce0f0e9bee2f119b3ff6870c968ff98b2ab449a025237dc97d767d80236760a94a0d6e7466f2fe362a649ad793bbd90a4fee16ab93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2602e14991213d4402ca5e1c4606d84e

SHA1
bd80f2c3bbf7e9602d64524246b0c25662c94e82

SHA256
52cbe531cb85298f33ddff1d83909c535552e8f2a949a2bac3eb8244ac8f7109

SHA512
fb0b677a5c968fb622f0991a7c0ea964c5fe46b4717ece650eae5344f0e4a57a7be038b9856fb875c71b7b944e64dd32b3332aeb42a76ae5aa3386efd2109fab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
203478c89f98fc85d9bbf85a5a16fb94

SHA1
342e32180b5add1d6da4eb322e00374360198a37

SHA256
4a926e7abd6eee12ce6678a73dfc9dadaa25d64df865f59384973ce01ca37681

SHA512
4fcdc82b1156bec8b456f4ff8c6e2359423efe62ca4b3ae0aa7168b593734e5947faae68cc66863ab82c24800c46e37a80cdd3fb7399469cbe32bbb3d4dc4c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4289a371d5941d04d8a6b1ab09603b08

SHA1
aaf50fa93450e62e5c53b5a3c4fe62223e06ac1a

SHA256
55c4b50f2464b22729d56a3ee1498b6c07a2deb8f790d5cd867ea224367e7531

SHA512
5fb7de5133e3753714f203fad5d26bd96d56ef39bdf7d84982b73fe246ea07ba23c8e190be60748f5a304cb089dd6ef490990c92106e925884e852909daedd24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
a3f735fe4b9998ac02e6947d328cd0f8

SHA1
d7002fa5d8974e4e4a338e785822b4152c880b0c

SHA256
a32eb799925878f23077e4afa06892c5b79b0d301000953bab87b952dc6105e4

SHA512
a988d3fdf3552eb2e868e2b2afceffead5c9f9626400e49a6c1f0038f7dc034b919c182ef2aad5ce0532194e2bf9a292b326bfb62ecc9bf45e162fba865bf916

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
825c44d7f47a52175b96ec481dd71368

SHA1
0c49647d0b40e1e155165f3b4e1c5aa929e455c1

SHA256
21e96d6eca5f4ce072647e1a85ae9a55088fe7c0a077b74fead304f01e123d9e

SHA512
4eb463221512e375f9866dfb7812338b4616cb891bc2d131d4dd2d4f323722adb9a062a379648d48df8050c3c2f49ba0d629736727c1b6b29a0a4459acfd78dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d1cf1798880a989ebf2d3b5c735a4497

SHA1
33a897634e384e0fe6a9a8c3134e7ecc793f6f41

SHA256
a60dad4ea508c8d006a50d1ac42c76ca50c23d2a1f998625a64338e26c5ffe88

SHA512
045c443c1b0e77a1c0a5149f663a8812061fbfbba5fa4741a8e9d8fdc8e170dd8a2ae2616dab38a325a00082a328c08ff34902fe8a688da7378d059a5c1cf218

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\NovaInstaller\rH6x8RhS34lYYw28wqjjlX+b55cNZWE=\D3DCompiler_47_cor3.dll

Filesize
4.7MB

MD5
03a60a6652caf4f49ea5912ce4e1b33c

SHA1
a0d949d4af7b1048dc55e39d1d1260a1e0660c4f

SHA256
b23e7b820ed5c6ea7dcd77817e2cd79f1cec9561d457172287ee634a8bd658c3

SHA512
6711d40d171ea200c92d062226a69f33eb41e9232d74291ef6f0202de73cf4dc54fbdd769104d2bb3e89dc2d81f2f2f3479e4258a5d6a54c545e56b07746b4c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\NovaInstaller\rH6x8RhS34lYYw28wqjjlX+b55cNZWE=\PresentationNative_cor3.dll

Filesize
1.2MB

MD5
607039b9e741f29a5996d255ae7ea39f

SHA1
9ea6ef007bee59e05dd9dd994da2a56a8675a021

SHA256
be81804da3077e93880b506e3f3061403ce6bf9ce50b9c0fcc63bb50b4352369

SHA512
0766c98228f6ccc907674e3b9cebe64eee234138b8d3f00848433388ad609fa38d17a961227e683e92241b163aa30cf06708a458f2bc4d3704d5aa7a7182ca50

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\NovaInstaller\rH6x8RhS34lYYw28wqjjlX+b55cNZWE=\wpfgfx_cor3.dll

Filesize
1.9MB

MD5
9c828f9cca7da40407bfe9521bae6402

SHA1
da09914b5a96c3ddf038e3cb176a8b5f31d71ae8

SHA256
7f9d0cd50f10c55848027e1fb9d7d780ebbf1eadbb5edd899f2af359aa9681e8

SHA512
01db920eb96999cb83d0e42c20ceb19b7aaed3d3c4ed71e26528cf05f8751f53885faab5255025c26ea4d1d479a460fc797d102dd22aebb550bd85f0748b6c0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.21_(x64)_20240507195023_000_dotnet_runtime_6.0.21_win_x64.msi.log

Filesize
2KB

MD5
5fe46c33a76d5088a4b757522a71b154

SHA1
0629df7975974f9fb35b09daef88898a73a61e6c

SHA256
da54f17260c39c40f9ddd72bdcb1f2497c3ad46ce8176d4347d0330ec6c7d375

SHA512
f6cb10579febf9f47dd2b6eee0378798e64064f755717611c4b607783a6967a21f07c722b898d1c85043cb0b3f0c4b228072604176e481759dedddc1a747dee0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.21_(x64)_20240507195023_001_dotnet_hostfxr_6.0.21_win_x64.msi.log

Filesize
2KB

MD5
97beb935e74c14bdefc3b4993f8777d7

SHA1
6801353bab2b01db3c56df8ebe0f3b3718eac29e

SHA256
ec0608971909258b7289e2aa06666ec084b314a25be6a773581463edd01f8486

SHA512
814044da1539fbc2abf25c17d552d38f393de351c6eb3b470467dea6ce7cce1e3dfc1448ecdfea63f887ad512ed48e6ce32f9f1804226adeada420e48c8b7188

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.21_(x64)_20240507195023_002_windowsdesktop_runtime_6.0.21_win_x64.msi.log

Filesize
2KB

MD5
2b93e802a21266684fb3ad34f2cb4a04

SHA1
93d2b5318e41273617b4ef07ee5af9b5149243a2

SHA256
43cbc9714f23c22b58d7c9d1ac36af9856a35d030ffc3516fdada61d7843d69c

SHA512
f989acb1f2cd3599d7a822920b43a3579a0a4b2d7ac4365da9970d3603cb98f74673b37d44d3aa413fe82a4976f10235376de000660492affef9ba7c60a65639

Download Submit
C:\Windows\Installer\MSI6DE3.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Temp\{2AE0530E-BDBD-4DA3-9921-53A6C651E28C}\.ba\bg.png

Filesize
4KB

MD5
9eb0320dfbf2bd541e6a55c01ddc9f20

SHA1
eb282a66d29594346531b1ff886d455e1dcd6d99

SHA256
9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79

SHA512
9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d

Download Submit
C:\Windows\Temp\{2AE0530E-BDBD-4DA3-9921-53A6C651E28C}\.ba\wixstdba.dll

Filesize
197KB

MD5
4356ee50f0b1a878e270614780ddf095

SHA1
b5c0915f023b2e4ed3e122322abc40c4437909af

SHA256
41a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104

SHA512
b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691

Download Submit
C:\Windows\Temp\{2AE0530E-BDBD-4DA3-9921-53A6C651E28C}\dotnet_hostfxr_6.0.21_win_x64.msi

Filesize
804KB

MD5
5dce0ef6b5d0bd2b850106a22b5e0264

SHA1
263cfbd815de6b877d084ab4b3d2f878d71c9b1f

SHA256
c98010f7c473bdb2a182e61aae35a20c044006fee26ffb378346cbdf255d2736

SHA512
fc7297d142cf8d0247ac86732182a031e819a4fc41b034d1b9a7dba5cdb56d73e158dd57132b6a083b3f6184859b4dca4a1a21205f6d11b2be6ca3913e89891b

Download Submit
C:\Windows\Temp\{2AE0530E-BDBD-4DA3-9921-53A6C651E28C}\dotnet_runtime_6.0.21_win_x64.msi

Filesize
25.7MB

MD5
0fda2bb0ba0c1dd265e9540265a035b7

SHA1
03461f9f268e5ec0a997990c05b16086a03505dc

SHA256
bb994af42653ab3738ea3b689f6870c2549f6f170f23a1a8a161c7e02ccec9b1

SHA512
acdcb21c4ac6587b7a7cc43078a075f2f06d71823ace65e175611e0ef8af2bc7c753b7618447ba6d9f24cbea63cf582bcd5f71ca3b7a79066ca6cd61c43ed7d6

Download Submit
C:\Windows\Temp\{2AE0530E-BDBD-4DA3-9921-53A6C651E28C}\windowsdesktop_runtime_6.0.21_win_x64.msi

Filesize
28.5MB

MD5
6ec2d8f7944d0766603fa3b043fe2410

SHA1
000a79c4792abbfdf65ca3b5367b7a3b02146732

SHA256
619074e13358e2c259086bf306083229ae8d3472187bc755951413858949cb68

SHA512
4f86befae9a437985e4ae491f416b0c06a72344ffccfb00c325e91d48244b46edee784003c0a519bc39fdb14409d949c7fe7cde7f51b3479d504c61d88f6371b

Download Submit
C:\Windows\Temp\{7FA4B548-0262-4D56-BAB7-BF8BA833556D}\.cr\windowsdesktop-runtime-6.0.15-win-x64.exe

Filesize
610KB

MD5
ff67a2a55ed6998ab527273d547fc00f

SHA1
852712b95ca05de8f336f07ff9ac672281b91215

SHA256
71dc12e39274b7a94f1a44b1ebe1a1507adf9884db5fdcd4cd9346b4c9fbe0c9

SHA512
48eb6bcb087d23ffb4e85501d23e55a4a15e8e0d2b4ca402a46df5946640f7e33c47deb785142af0fbc8cb10b6f9731500a370168cb43fd02642b29a880151d9

Download Submit
memory/4060-175-0x0000000180000000-0x0000000180A25000-memory.dmp

Filesize
10.1MB

Download
memory/4060-217-0x00000211F5690000-0x00000211F56D0000-memory.dmp

Filesize
256KB

Download
memory/4060-237-0x00000211F5B70000-0x00000211F5BB7000-memory.dmp

Filesize
284KB

Download
memory/4060-234-0x00000211D4FB0000-0x00000211D4FB8000-memory.dmp

Filesize
32KB

Download
memory/4060-231-0x00000211F5C70000-0x00000211F5D64000-memory.dmp

Filesize
976KB

Download
memory/4060-223-0x00000211F5660000-0x00000211F5672000-memory.dmp

Filesize
72KB

Download
memory/4060-241-0x00000211F57B0000-0x00000211F57DA000-memory.dmp

Filesize
168KB

Download
memory/4060-244-0x00000211F9F40000-0x00000211FA75C000-memory.dmp

Filesize
8.1MB

Download
memory/4060-220-0x00000211F5640000-0x00000211F5658000-memory.dmp

Filesize
96KB

Download
memory/4060-214-0x00000211F5620000-0x00000211F5636000-memory.dmp

Filesize
88KB

Download
memory/4060-196-0x00000211F56F0000-0x00000211F5770000-memory.dmp

Filesize
512KB

Download
memory/4060-193-0x00000211F74C0000-0x00000211F7D02000-memory.dmp

Filesize
8.3MB

Download
memory/4060-199-0x00000211D3660000-0x00000211D366D000-memory.dmp

Filesize
52KB

Download
memory/4060-202-0x00000211D3670000-0x00000211D3675000-memory.dmp

Filesize
20KB

Download
memory/4060-205-0x00000211F55E0000-0x00000211F55F3000-memory.dmp

Filesize
76KB

Download
memory/4060-211-0x00000211F5600000-0x00000211F5619000-memory.dmp

Filesize
100KB

Download
memory/4060-208-0x00000211D3650000-0x00000211D3657000-memory.dmp

Filesize
28KB

Download
memory/4060-190-0x00000211F55A0000-0x00000211F55DE000-memory.dmp

Filesize
248KB

Download
memory/4060-187-0x00000211D4F40000-0x00000211D4F84000-memory.dmp

Filesize
272KB

Download
memory/4060-184-0x00000211F5A10000-0x00000211F5B6E000-memory.dmp

Filesize
1.4MB

Download
memory/4060-181-0x00000211F57E0000-0x00000211F5A08000-memory.dmp

Filesize
2.2MB

Download
memory/4060-179-0x00000211F6530000-0x00000211F74B8000-memory.dmp

Filesize
15.5MB

Download