6f3f486d7a8409fc174198818c039152c6268bd9fdf210ee6be1c91bf832b7e9

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{43a03b9c-4770-409c-a999-587b60700b63} = "\"C:\\ProgramData\\Package Cache\\{43a03b9c-4770-409c-a999-587b60700b63}\\LauncherPrereqSetup_x64.exe\" /quiet /burn.log.append \"C:/Users/Admin/AppData/Local/EpicGamesLauncher/Saved/Logs/SelfUpdatePrereqInstall.log\" /burn.runonce"	LauncherPrereqSetup_x64.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	InstallChainer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	EpicGamesLauncher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	EpicGamesLauncher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	EpicGamesLauncher.exe

Drops file in System32 directory 54 IoCs

description	ioc	Process
File created	C:\Windows\system32\SETC5F6.tmp	infinst.exe
File created	C:\Windows\SysWOW64\SETC654.tmp	DXSetup.exe
File opened for modification	C:\Windows\system32\XAudio2_7.dll	infinst.exe
File opened for modification	C:\Windows\SysWOW64\d3dcsx_43.dll	DXSETUP.exe
File opened for modification	C:\Windows\system32\D3DCompiler_43.dll	infinst.exe
File opened for modification	C:\Windows\SysWOW64\D3DCompiler_43.dll	DXSETUP.exe
File opened for modification	C:\Windows\system32\SETBE26.tmp	infinst.exe
File created	C:\Windows\system32\SETC104.tmp	infinst.exe
File opened for modification	C:\Windows\system32\SETC5F6.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\XAudio2_7.dll	DXSetup.exe
File opened for modification	C:\Windows\SysWOW64\SETFD8A.tmp	DXSETUP.exe
File opened for modification	C:\Windows\system32\SETC104.tmp	infinst.exe
File created	C:\Windows\SysWOW64\SETFF6E.tmp	DXSETUP.exe
File created	C:\Windows\system32\SETBF01.tmp	infinst.exe
File opened for modification	C:\Windows\system32\D3DX9_43.dll	infinst.exe
File opened for modification	C:\Windows\system32\d3dx11_43.dll	infinst.exe
File opened for modification	C:\Windows\SysWOW64\SETFCAF.tmp	DXSETUP.exe
File created	C:\Windows\SysWOW64\SETFD8A.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\X3DAudio1_7.dll	DXSetup.exe
File opened for modification	C:\Windows\SysWOW64\XAPOFX1_5.dll	DXSetup.exe
File created	C:\Windows\SysWOW64\SETFCAF.tmp	DXSETUP.exe
File created	C:\Windows\SysWOW64\SETFDE8.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\SETFE36.tmp	DXSETUP.exe
File created	C:\Windows\SysWOW64\SETBFAC.tmp	DXSetup.exe
File created	C:\Windows\system32\SETC20E.tmp	infinst.exe
File opened for modification	C:\Windows\system32\SETC308.tmp	infinst.exe
File opened for modification	C:\Windows\system32\SETC6B1.tmp	infinst.exe
File opened for modification	C:\Windows\system32\SETC6C2.tmp	infinst.exe
File created	C:\Windows\SysWOW64\SETBEA3.tmp	DXSetup.exe
File opened for modification	C:\Windows\system32\SETC20E.tmp	infinst.exe
File created	C:\Windows\system32\SETC6B1.tmp	infinst.exe
File created	C:\Windows\system32\SETC6C2.tmp	infinst.exe
File opened for modification	C:\Windows\system32\xinput1_3.dll	infinst.exe
File opened for modification	C:\Windows\SysWOW64\SETBFAC.tmp	DXSetup.exe
File created	C:\Windows\system32\SETC402.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\d3dx10_43.dll	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\SETFDE8.tmp	DXSETUP.exe
File opened for modification	C:\Windows\system32\SETBF01.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\D3DX9_43.dll	DXSetup.exe
File opened for modification	C:\Windows\system32\d3dcsx_43.dll	infinst.exe
File opened for modification	C:\Windows\system32\SETC402.tmp	infinst.exe
File opened for modification	C:\Windows\system32\XAPOFX1_5.dll	infinst.exe
File opened for modification	C:\Windows\SysWOW64\xinput1_3.dll	DXSETUP.exe
File created	C:\Windows\SysWOW64\SETFE36.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\SETFF6E.tmp	DXSETUP.exe
File opened for modification	C:\Windows\system32\X3DAudio1_7.dll	infinst.exe
File opened for modification	C:\Windows\system32\d3dx10_43.dll	infinst.exe
File opened for modification	C:\Windows\SysWOW64\SETC655.tmp	DXSetup.exe
File created	C:\Windows\SysWOW64\SETC655.tmp	DXSetup.exe
File created	C:\Windows\system32\SETBE26.tmp	infinst.exe
File created	C:\Windows\system32\SETC308.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\SETC654.tmp	DXSetup.exe
File opened for modification	C:\Windows\SysWOW64\d3dx11_43.dll	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\SETBEA3.tmp	DXSetup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt64l\zone\bg.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Portal\SelfUpdateStaging\Install\Portal\Content\Web\modal\fonts\BrutalType-Bold\BrutalType-Bold.woff2	EpicGamesLauncher.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Portal\SelfUpdateStaging\Install\Portal\Extras\Overlay\Engine\Content\Internationalization\icudt64l\region\rof.res	EpicGamesLauncher.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Portal\SelfUpdateStaging\Install\Portal\Extras\Overlay\Engine\Content\Internationalization\icudt64l\unit\jmc.res	EpicGamesLauncher.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\sr_BA.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Slate\Common\VolumeControl_Mid.png	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt64l\curr\ta_LK.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt64l\curr\ii.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Portal\SelfUpdateStaging\Install\Portal\SysFiles\ui_LearnGrid2.layout	EpicGamesLauncher.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt64l\curr\asa.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt64l\zone\en_001.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Portal\SelfUpdateStaging\Install\Portal\Extras\Overlay\Engine\Content\Internationalization\icudt64l\en_MS.res	EpicGamesLauncher.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\jmc.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\yo_BJ.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt64l\lang\ewo.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\en_BS.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\gv.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt64l\lang\ki.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt64l\unit\en_FM.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\en_MO.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt64l\region\en_CC.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Portal\SelfUpdateStaging\Install\Portal\Extras\Overlay\Engine\Content\Internationalization\icudt64l\coll\az.res	EpicGamesLauncher.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Portal\SelfUpdateStaging\Install\Engine\Content\Slate\Fonts\DroidSansMono.ttf	EpicGamesLauncher.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\UI\RoundedCornersDropDownBackground.png	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Portal\SelfUpdateStaging\Install\Engine\Binaries\ThirdParty\ICU\icu4c-53_1\Win64\VS2015\icule53.dll	EpicGamesLauncher.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\UI\OffersNavigationRight.png	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Portal\SelfUpdateStaging\Install\Portal\Extras\Overlay\Engine\Content\Internationalization\icudt64l\lkt_US.res	EpicGamesLauncher.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Portal\SelfUpdateStaging\Install\Portal\Extras\Overlay\Engine\Content\Internationalization\icudt64l\region\rn.res	EpicGamesLauncher.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\en_RW.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\fy.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\en_VG.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\CEF\Win32\Resources\locales\ca.pak	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Portal\SelfUpdateStaging\Install\Portal\Extras\Overlay\Engine\Content\Internationalization\icudt64l\unit\shi_Tfng.res	EpicGamesLauncher.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Portal\SelfUpdateStaging\Install\Portal\Extras\Overlay\Engine\Content\Internationalization\icudt64l\zone\ee.res	EpicGamesLauncher.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ars.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt64l\ar_SA.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\sr_RS.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\sw.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Portal\SelfUpdateStaging\Install\Portal\Extras\Overlay\Engine\Content\Internationalization\icudt64l\curr\yue_CN.res	EpicGamesLauncher.exe
File opened for modification	C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\api-ms-win-crt-locale-l1-1-0.dll.old.ver	EpicGamesLauncher.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\CEF\Win32\Resources\locales\pt-BR.pak	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt64l\wae_CH.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Portal\SelfUpdateStaging\Install\Portal\Extras\Overlay\Engine\Content\Internationalization\icudt64l\brkitr\word.brk	EpicGamesLauncher.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Portal\SelfUpdateStaging\Install\Portal\Extras\Overlay\Engine\Content\Internationalization\icudt64l\sw_KE.res	EpicGamesLauncher.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Portal\SelfUpdateStaging\Install\Portal\Extras\Overlay\Win32\Resources\locales\fa.pak	EpicGamesLauncher.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\ksh.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Portal\SelfUpdateStaging\Install\Portal\Content\New UI\Social\SocialExpanderOpen_over.png	EpicGamesLauncher.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Portal\SelfUpdateStaging\Install\Portal\Extras\Overlay\Engine\Content\Internationalization\icudt64l\ee.res	EpicGamesLauncher.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt64l\curr\to.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt64l\zone\en_DE.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Portal\SelfUpdateStaging\Install\Portal\Extras\Overlay\Engine\Content\Internationalization\icudt64l\curr\nds.res	EpicGamesLauncher.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Portal\SelfUpdateStaging\Install\Portal\Extras\Overlay\Win64\Resources\locales\nb.pak	EpicGamesLauncher.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Portal\SelfUpdateStaging\Install\Portal\SysFiles\Approval.png	EpicGamesLauncher.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Portal\SelfUpdateStaging\Install\Portal\Extras\Overlay\Engine\Content\Internationalization\icudt64l\uz_Cyrl.res	EpicGamesLauncher.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Portal\SelfUpdateStaging\Install\Portal\SysFiles\0627_Valorant.png	EpicGamesLauncher.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\api-ms-win-core-localization-l1-2-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt64l\lang\wae.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt64l\zone\sg.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt64l\curr\shi_Latn.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Portal\SelfUpdateStaging\Install\Portal\Content\EcosystemStyle\secondary_split_btn_left.png	EpicGamesLauncher.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Portal\SelfUpdateStaging\Install\Portal\Extras\Overlay\Engine\Content\Internationalization\icudt64l\coll\ca.res	EpicGamesLauncher.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Portal\SelfUpdateStaging\Install\Portal\Extras\Overlay\Engine\Content\Internationalization\icudt64l\lang\sh_CS.res	EpicGamesLauncher.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\es_CO.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\en_SI.res	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI8C26.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7246.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\499C5C9F9B6F57D43B7EDA108B04379E\1.0.0\F_CENTRAL_msvcp120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B85FAA6E-A9AA-4655-9029-E1A4EDC05E1A}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI140C.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIB47D.tmp-\Jun2010_XAudio_x64.cab	rundll32.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\E6AAF58BAA9A556409921E4ADE0CE5A1\1.3.93\F_CENTRAL_vccorlib120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2A4.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIB47D.tmp-\Feb2010_X3DAudio_x64.cab	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIB47D.tmp-\Jun2010_D3DCompiler_43_x86.cab	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI135F.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI14B9.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSICB62.tmp-\Jun2010_d3dx10_43_x86.cab	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI88F8.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI7246.tmp-\CustomActionManaged.dll	rundll32.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\499C5C9F9B6F57D43B7EDA108B04379E\1.0.0\F_CENTRAL_msvcp100_x86.DF495DFD_79F6_34DF_BB1E_E58DB5BDCF2C	msiexec.exe
File opened for modification	C:\Windows\Installer\{F9C5C994-F6B9-4D75-B3E7-AD01B84073E9}\UnrealEngineLauncher.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICB62.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSICB62.tmp-\DXSETUP.exe	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6C66.tmp-\CustomActionManaged.dll	rundll32.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\499C5C9F9B6F57D43B7EDA108B04379E\1.0.0\F_CENTRAL_msvcp100_x64.1C11561A_11CB_36A7_8A47_D7A042055FA7	msiexec.exe
File opened for modification	C:\Windows\Installer\e577c35.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB47D.tmp-\Jun2010_d3dx11_43_x64.cab	rundll32.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File opened for modification	C:\Windows\Installer\MSI1E6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB47D.tmp-\dxupdate.cab	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIC9CB.tmp-\Jun2010_D3DCompiler_43_x64.cab	rundll32.exe
File opened for modification	C:\Windows\Installer\MSICB62.tmp-\dxupdate.cab	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI135F.tmp-\CustomActionManaged.dll	rundll32.exe
File created	C:\Windows\Installer\e577c3d.msi	msiexec.exe
File opened for modification	C:\Windows\DirectX.log	infinst.exe
File opened for modification	C:\Windows\Installer\MSIC9CB.tmp-\APR2007_xinput_x86.cab	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI804D.tmp	msiexec.exe
File opened for modification	C:\Windows\Logs\DirectX.log	DXSETUP.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File opened for modification	C:\Windows\Installer\MSIC9CB.tmp-\Jun2010_XAudio_x64.cab	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI804D.tmp-\CustomActionManaged.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIB47D.tmp-\Feb2010_X3DAudio_x86.cab	rundll32.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\499C5C9F9B6F57D43B7EDA108B04379E\1.0.0\F_CENTRAL_msvcr120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI70AF.tmp-\CustomActionManaged.dll	rundll32.exe
File created	C:\Windows\Installer\e577c37.msi	msiexec.exe
File created	C:\Windows\Installer\e577c38.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC9CB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI67D1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\499C5C9F9B6F57D43B7EDA108B04379E\1.0.0\F_CENTRAL_msvcp110_x86.F9D0B380_EB85_31D4_96AC_C6CB40086A55	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI70AF.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\499C5C9F9B6F57D43B7EDA108B04379E\1.0.0\F_CENTRAL_msvcr100_x64.1C11561A_11CB_36A7_8A47_D7A042055FA7	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID259.tmp-\CustomActionManaged.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI70AF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB47D.tmp-\CustomActionManaged.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSICB62.tmp-\Jun2010_d3dcsx_43_x86.cab	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIB47D.tmp-\Jun2010_D3DCompiler_43_x64.cab	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI3064.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAD58.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB47D.tmp-\Jun2010_d3dcsx_43_x64.cab	rundll32.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\499C5C9F9B6F57D43B7EDA108B04379E\1.0.0\F_CENTRAL_msvcp100_x64.1C11561A_11CB_36A7_8A47_D7A042055FA7	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI135F.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI140C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3064.tmp-\CustomActionManaged.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIC9CB.tmp-\CustomActionManaged.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSICB62.tmp-\Jun2010_XAudio_x86.cab	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6B9A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC9CB.tmp-\Jun2010_d3dx11_43_x86.cab	rundll32.exe

Executes dropped EXE 19 IoCs

pid	Process
1520	DXSETUP.exe
5540	InstallChainer.exe
5172	EpicOnlineServices.exe
3496	EpicOnlineServicesHost.exe
5664	EpicOnlineServicesUserHelper.exe
5756	EpicGamesLauncher.exe
10096	LauncherPrereqSetup_x64.exe
10128	LauncherPrereqSetup_x64.exe
10996	DXSetup.exe
5188	infinst.exe
5828	infinst.exe
2172	infinst.exe
2432	infinst.exe
6136	infinst.exe
9556	infinst.exe
9952	infinst.exe
852	infinst.exe
2160	EpicGamesLauncher.exe
8468	EpicGamesLauncher.exe

Loads dropped DLL 64 IoCs

pid	Process
4116	MsiExec.exe
4116	MsiExec.exe
4116	MsiExec.exe
1572	rundll32.exe
1572	rundll32.exe
1572	rundll32.exe
1572	rundll32.exe
1572	rundll32.exe
5032	MsiExec.exe
5032	MsiExec.exe
3408	rundll32.exe
3408	rundll32.exe
3408	rundll32.exe
3408	rundll32.exe
3408	rundll32.exe
5032	MsiExec.exe
5036	rundll32.exe
5036	rundll32.exe
5036	rundll32.exe
5036	rundll32.exe
5036	rundll32.exe
5032	MsiExec.exe
1524	rundll32.exe
1524	rundll32.exe
1524	rundll32.exe
1524	rundll32.exe
1524	rundll32.exe
1968	MsiExec.exe
212	rundll32.exe
212	rundll32.exe
212	rundll32.exe
212	rundll32.exe
212	rundll32.exe
1520	DXSETUP.exe
1520	DXSETUP.exe
1520	DXSETUP.exe
1520	DXSETUP.exe
1968	MsiExec.exe
1968	MsiExec.exe
5032	MsiExec.exe
5032	MsiExec.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe
5032	MsiExec.exe
5540	InstallChainer.exe
5540	InstallChainer.exe
5032	MsiExec.exe
5936	rundll32.exe
5936	rundll32.exe
5936	rundll32.exe
5936	rundll32.exe
5936	rundll32.exe
5032	MsiExec.exe
5932	rundll32.exe
5932	rundll32.exe
5932	rundll32.exe
5932	rundll32.exe
5932	rundll32.exe
5032	MsiExec.exe
3272	rundll32.exe
3272	rundll32.exe

Registers COM server for autorun 1 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_7.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cac1105f-619b-4d04-831a-44e1cbf12d57}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_7.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cac1105f-619b-4d04-831a-44e1cbf12d57}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cac1105f-619b-4d04-831a-44e1cbf12d57}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_7.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000072b368a908c284c40000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000072b368a90000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090072b368a9000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d72b368a9000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000072b368a900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
8336	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DXSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DXSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DXSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DXSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DXSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DXSETUP.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DXSETUP.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Epic Games\Unreal Engine	EpicOnlineServicesUserHelper.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DXSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DXSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DXSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DXSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DXSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DXSETUP.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Epic Games\Unreal Engine\Identifiers\MachineId = "6645936B4D09FFC9D9217C9D963C0B7A"	EpicOnlineServicesUserHelper.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DXSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DXSETUP.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DXSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DXSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DXSETUP.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DXSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DXSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DXSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DXSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DXSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DXSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Epic Games\Unreal Engine\Identifiers	EpicOnlineServicesUserHelper.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DXSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DXSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DXSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DXSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DXSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DXSetup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Epic Games	EpicOnlineServicesUserHelper.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	rundll32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\com.epicgames.launcher\DefaultIcon	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E6AAF58BAA9A556409921E4ADE0CE5A1\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.eos\URL Protocol	EpicOnlineServicesUserHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{43a03b9c-4770-409c-a999-587b60700b63}\ = "{43a03b9c-4770-409c-a999-587b60700b63}"	LauncherPrereqSetup_x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\com.epicgames.launcher	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E6AAF58BAA9A556409921E4ADE0CE5A1\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\BA659A75CCB46C54B90459E7E4215586\ProductFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\classes\com.epicgames.eos	EpicOnlineServicesUserHelper.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\499C5C9F9B6F57D43B7EDA108B04379E\Version = "16777216"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\499C5C9F9B6F57D43B7EDA108B04379E\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{F9C5C994-F6B9-4D75-B3E7-AD01B84073E9}v1.0.0.0\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cac1105f-619b-4d04-831a-44e1cbf12d57}\InProcServer32\ThreadingModel = "Both"	DXSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.launcher\shell\open\command\ = "\"C:\\Program Files (x86)\\Epic Games\\Launcher\\Portal\\Binaries\\Win32\\EpicGamesLauncher.exe\" %1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E6AAF58BAA9A556409921E4ADE0CE5A1\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BA659A75CCB46C54B90459E7E4215586\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.eos\shell\ = "open"	EpicOnlineServicesUserHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{F9C5C994-F6B9-4D75-B3E7-AD01B84073E9}\DisplayName = "Epic Games Launcher Prerequisites (x64)"	LauncherPrereqSetup_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}\ = "XAudio2"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.launcher\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\44F9670D954DF0540B48AC3E08267CB5	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{43a03b9c-4770-409c-a999-587b60700b63}\Dependents\{43a03b9c-4770-409c-a999-587b60700b63}	LauncherPrereqSetup_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\499C5C9F9B6F57D43B7EDA108B04379E\VCRedist	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\499C5C9F9B6F57D43B7EDA108B04379E\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}\ = "AudioReverb"	DXSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BA659A75CCB46C54B90459E7E4215586\SourceList\LastUsedSource = "n;1;C:\\Program Files (x86)\\Epic Games\\Launcher\\Portal\\Extras\\EOS\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.launcher\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\com.epicgames.launcher\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E6AAF58BAA9A556409921E4ADE0CE5A1\VCRedist	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\499C5C9F9B6F57D43B7EDA108B04379E\ProductName = "Epic Games Launcher Prerequisites (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}\ = "AudioReverb"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\44F9670D954DF0540B48AC3E08267CB5\E6AAF58BAA9A556409921E4ADE0CE5A1	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BA659A75CCB46C54B90459E7E4215586\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.eos\shell\open\command	EpicOnlineServicesUserHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\499C5C9F9B6F57D43B7EDA108B04379E\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\499C5C9F9B6F57D43B7EDA108B04379E\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}\InProcServer32\ThreadingModel = "Both"	DXSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_7.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E6AAF58BAA9A556409921E4ADE0CE5A1	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E6AAF58BAA9A556409921E4ADE0CE5A1\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BA659A75CCB46C54B90459E7E4215586\SourceList\PackageName = "EpicOnlineServices.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.eos\DefaultIcon	EpicOnlineServicesUserHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cac1105f-619b-4d04-831a-44e1cbf12d57}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_7.dll"	DXSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_7.dll"	DXSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{F9C5C994-F6B9-4D75-B3E7-AD01B84073E9}\Dependents	LauncherPrereqSetup_x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E6AAF58BAA9A556409921E4ADE0CE5A1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\499C5C9F9B6F57D43B7EDA108B04379E\SourceList\PackageName = "LauncherPrereqSetup_x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E6AAF58BAA9A556409921E4ADE0CE5A1\ProductName = "Epic Games Launcher"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BA659A75CCB46C54B90459E7E4215586\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.eos\shell	EpicOnlineServicesUserHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E6AAF58BAA9A556409921E4ADE0CE5A1\DirectXRedist	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E6AAF58BAA9A556409921E4ADE0CE5A1\Version = "16973917"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E6AAF58BAA9A556409921E4ADE0CE5A1\ProductIcon = "C:\\Windows\\Installer\\{B85FAA6E-A9AA-4655-9029-E1A4EDC05E1A}\\Installer.ico"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E6AAF58BAA9A556409921E4ADE0CE5A1\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\499C5C9F9B6F57D43B7EDA108B04379E\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{F9C5C994-F6B9-4D75-B3E7-AD01B84073E9}v1.0.0.0\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E6AAF58BAA9A556409921E4ADE0CE5A1\SourceList	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BA659A75CCB46C54B90459E7E4215586\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{43a03b9c-4770-409c-a999-587b60700b63}	LauncherPrereqSetup_x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cac1105f-619b-4d04-831a-44e1cbf12d57}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BA659A75CCB46C54B90459E7E4215586\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BA659A75CCB46C54B90459E7E4215586\ProductIcon = "C:\\Windows\\Installer\\{57A956AB-4BCC-45C6-9B40-957E4E125568}\\Installer.ico"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BA659A75CCB46C54B90459E7E4215586\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}\InProcServer32	DXSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E6AAF58BAA9A556409921E4ADE0CE5A1\SourceList\Media\1 = ";"	msiexec.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5	LauncherPrereqSetup_x64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 040000000100000010000000cb17e431673ee209fe455793f30afa1c0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c953000000010000006300000030613021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030109000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df1400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3617e000000010000000800000000c0032f2df8d6016800000001000000000000000300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e5190000000100000010000000d8b5fb368468620275d142ffd2aade372000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a	LauncherPrereqSetup_x64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 5c000000010000000400000000080000190000000100000010000000d8b5fb368468620275d142ffd2aade370300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e56800000001000000000000007e000000010000000800000000c0032f2df8d6011d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610b000000010000001200000056006500720069005300690067006e0000001400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331336200000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df09000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703017f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000006300000030613021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c9040000000100000010000000cb17e431673ee209fe455793f30afa1c2000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a	LauncherPrereqSetup_x64.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
5032	MsiExec.exe
5032	MsiExec.exe
5032	MsiExec.exe
5032	MsiExec.exe
5032	MsiExec.exe
5032	MsiExec.exe
2516	msiexec.exe
2516	msiexec.exe
2516	msiexec.exe
2516	msiexec.exe
2516	msiexec.exe
2516	msiexec.exe
2516	msiexec.exe
2516	msiexec.exe
2516	msiexec.exe
2516	msiexec.exe
2516	msiexec.exe
2516	msiexec.exe
2516	msiexec.exe
2516	msiexec.exe
2516	msiexec.exe
2516	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3016	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3016	msiexec.exe
Token: SeSecurityPrivilege	2516	msiexec.exe
Token: SeCreateTokenPrivilege	3016	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3016	msiexec.exe
Token: SeLockMemoryPrivilege	3016	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3016	msiexec.exe
Token: SeMachineAccountPrivilege	3016	msiexec.exe
Token: SeTcbPrivilege	3016	msiexec.exe
Token: SeSecurityPrivilege	3016	msiexec.exe
Token: SeTakeOwnershipPrivilege	3016	msiexec.exe
Token: SeLoadDriverPrivilege	3016	msiexec.exe
Token: SeSystemProfilePrivilege	3016	msiexec.exe
Token: SeSystemtimePrivilege	3016	msiexec.exe
Token: SeProfSingleProcessPrivilege	3016	msiexec.exe
Token: SeIncBasePriorityPrivilege	3016	msiexec.exe
Token: SeCreatePagefilePrivilege	3016	msiexec.exe
Token: SeCreatePermanentPrivilege	3016	msiexec.exe
Token: SeBackupPrivilege	3016	msiexec.exe
Token: SeRestorePrivilege	3016	msiexec.exe
Token: SeShutdownPrivilege	3016	msiexec.exe
Token: SeDebugPrivilege	3016	msiexec.exe
Token: SeAuditPrivilege	3016	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3016	msiexec.exe
Token: SeChangeNotifyPrivilege	3016	msiexec.exe
Token: SeRemoteShutdownPrivilege	3016	msiexec.exe
Token: SeUndockPrivilege	3016	msiexec.exe
Token: SeSyncAgentPrivilege	3016	msiexec.exe
Token: SeEnableDelegationPrivilege	3016	msiexec.exe
Token: SeManageVolumePrivilege	3016	msiexec.exe
Token: SeImpersonatePrivilege	3016	msiexec.exe
Token: SeCreateGlobalPrivilege	3016	msiexec.exe
Token: SeCreateTokenPrivilege	3016	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3016	msiexec.exe
Token: SeLockMemoryPrivilege	3016	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3016	msiexec.exe
Token: SeMachineAccountPrivilege	3016	msiexec.exe
Token: SeTcbPrivilege	3016	msiexec.exe
Token: SeSecurityPrivilege	3016	msiexec.exe
Token: SeTakeOwnershipPrivilege	3016	msiexec.exe
Token: SeLoadDriverPrivilege	3016	msiexec.exe
Token: SeSystemProfilePrivilege	3016	msiexec.exe
Token: SeSystemtimePrivilege	3016	msiexec.exe
Token: SeProfSingleProcessPrivilege	3016	msiexec.exe
Token: SeIncBasePriorityPrivilege	3016	msiexec.exe
Token: SeCreatePagefilePrivilege	3016	msiexec.exe
Token: SeCreatePermanentPrivilege	3016	msiexec.exe
Token: SeBackupPrivilege	3016	msiexec.exe
Token: SeRestorePrivilege	3016	msiexec.exe
Token: SeShutdownPrivilege	3016	msiexec.exe
Token: SeDebugPrivilege	3016	msiexec.exe
Token: SeAuditPrivilege	3016	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3016	msiexec.exe
Token: SeChangeNotifyPrivilege	3016	msiexec.exe
Token: SeRemoteShutdownPrivilege	3016	msiexec.exe
Token: SeUndockPrivilege	3016	msiexec.exe
Token: SeSyncAgentPrivilege	3016	msiexec.exe
Token: SeEnableDelegationPrivilege	3016	msiexec.exe
Token: SeManageVolumePrivilege	3016	msiexec.exe
Token: SeImpersonatePrivilege	3016	msiexec.exe
Token: SeCreateGlobalPrivilege	3016	msiexec.exe
Token: SeCreateTokenPrivilege	3016	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3016	msiexec.exe
Token: SeLockMemoryPrivilege	3016	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3016	msiexec.exe
3016	msiexec.exe
5756	EpicGamesLauncher.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5756	EpicGamesLauncher.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 4116	2516	msiexec.exe	92
PID 2516 wrote to memory of 4116	2516	msiexec.exe	92
PID 2516 wrote to memory of 4116	2516	msiexec.exe	92
PID 4116 wrote to memory of 1572	4116	MsiExec.exe	98
PID 4116 wrote to memory of 1572	4116	MsiExec.exe	98
PID 4116 wrote to memory of 1572	4116	MsiExec.exe	98
PID 2516 wrote to memory of 5032	2516	msiexec.exe	99
PID 2516 wrote to memory of 5032	2516	msiexec.exe	99
PID 2516 wrote to memory of 5032	2516	msiexec.exe	99
PID 5032 wrote to memory of 3408	5032	MsiExec.exe	100
PID 5032 wrote to memory of 3408	5032	MsiExec.exe	100
PID 5032 wrote to memory of 3408	5032	MsiExec.exe	100
PID 5032 wrote to memory of 5036	5032	MsiExec.exe	101
PID 5032 wrote to memory of 5036	5032	MsiExec.exe	101
PID 5032 wrote to memory of 5036	5032	MsiExec.exe	101
PID 5032 wrote to memory of 1524	5032	MsiExec.exe	102
PID 5032 wrote to memory of 1524	5032	MsiExec.exe	102
PID 5032 wrote to memory of 1524	5032	MsiExec.exe	102
PID 2516 wrote to memory of 1968	2516	msiexec.exe	103
PID 2516 wrote to memory of 1968	2516	msiexec.exe	103
PID 2516 wrote to memory of 1968	2516	msiexec.exe	103
PID 1968 wrote to memory of 212	1968	MsiExec.exe	104
PID 1968 wrote to memory of 212	1968	MsiExec.exe	104
PID 1968 wrote to memory of 212	1968	MsiExec.exe	104
PID 2516 wrote to memory of 1520	2516	msiexec.exe	107
PID 2516 wrote to memory of 1520	2516	msiexec.exe	107
PID 2516 wrote to memory of 1520	2516	msiexec.exe	107
PID 1968 wrote to memory of 4416	1968	MsiExec.exe	117
PID 1968 wrote to memory of 4416	1968	MsiExec.exe	117
PID 1968 wrote to memory of 4416	1968	MsiExec.exe	117
PID 1968 wrote to memory of 5156	1968	MsiExec.exe	119
PID 1968 wrote to memory of 5156	1968	MsiExec.exe	119
PID 1968 wrote to memory of 5156	1968	MsiExec.exe	119
PID 5032 wrote to memory of 5428	5032	MsiExec.exe	122
PID 5032 wrote to memory of 5428	5032	MsiExec.exe	122
PID 5032 wrote to memory of 5428	5032	MsiExec.exe	122
PID 2516 wrote to memory of 5540	2516	msiexec.exe	123
PID 2516 wrote to memory of 5540	2516	msiexec.exe	123
PID 2516 wrote to memory of 5540	2516	msiexec.exe	123
PID 5032 wrote to memory of 5936	5032	MsiExec.exe	124
PID 5032 wrote to memory of 5936	5032	MsiExec.exe	124
PID 5032 wrote to memory of 5936	5032	MsiExec.exe	124
PID 5032 wrote to memory of 5932	5032	MsiExec.exe	125
PID 5032 wrote to memory of 5932	5032	MsiExec.exe	125
PID 5032 wrote to memory of 5932	5032	MsiExec.exe	125
PID 5032 wrote to memory of 3272	5032	MsiExec.exe	126
PID 5032 wrote to memory of 3272	5032	MsiExec.exe	126
PID 5032 wrote to memory of 3272	5032	MsiExec.exe	126
PID 5032 wrote to memory of 2796	5032	MsiExec.exe	127
PID 5032 wrote to memory of 2796	5032	MsiExec.exe	127
PID 5032 wrote to memory of 2796	5032	MsiExec.exe	127
PID 1968 wrote to memory of 3980	1968	MsiExec.exe	128
PID 1968 wrote to memory of 3980	1968	MsiExec.exe	128
PID 1968 wrote to memory of 3980	1968	MsiExec.exe	128
PID 1968 wrote to memory of 5352	1968	MsiExec.exe	130
PID 1968 wrote to memory of 5352	1968	MsiExec.exe	130
PID 1968 wrote to memory of 5352	1968	MsiExec.exe	130
PID 1968 wrote to memory of 5312	1968	MsiExec.exe	131
PID 1968 wrote to memory of 5312	1968	MsiExec.exe	131
PID 1968 wrote to memory of 5312	1968	MsiExec.exe	131
PID 1968 wrote to memory of 5172	1968	MsiExec.exe	132
PID 1968 wrote to memory of 5172	1968	MsiExec.exe	132
PID 1968 wrote to memory of 5172	1968	MsiExec.exe	132
PID 1968 wrote to memory of 3496	1968	MsiExec.exe	134

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\EpicInstaller-15.17.1.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3016

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E42A88BC395C0116DEBC2D8049AA8AEF C
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4116
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI7A62.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240614000 5 CustomActionManaged!CustomActionManaged.CustomActions.ValidatePathLength
    3⤵
    - Loads dropped DLL
    PID:1572
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 912F14852C46F83B1FAAC2384857EDE5
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5032
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI804D.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240615515 10 CustomActionManaged!CustomActionManaged.CustomActions.TelemetrySendStart
    3⤵
    - Blocklisted process makes network request
    - Drops file in Windows directory
    - Loads dropped DLL
    PID:3408
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI88F8.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240617718 16 CustomActionManaged!CustomActionManaged.CustomActions.SetStartupCmdlineArgs
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    PID:5036
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI8FD0.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240619484 22 CustomActionManaged!CustomActionManaged.CustomActions.CheckReparsePoints
    3⤵
    - Loads dropped DLL
    PID:1524
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI2A4.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240648875 50 CustomActionManaged!CustomActionManaged.CustomActions.TelemetrySendEnd
    3⤵
    - Blocklisted process makes network request
    - Drops file in Windows directory
    - Loads dropped DLL
    PID:5428
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI135F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240653140 59 CustomActionManaged!CustomActionManaged.CustomActions.SetLauncherEpicGamesDirLoc
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    PID:5936
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI140C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240653328 65 CustomActionManaged!CustomActionManaged.CustomActions.SetLauncherInstallDirLoc
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    PID:5932
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI14B9.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240653500 71 CustomActionManaged!CustomActionManaged.CustomActions.SetServiceWrapperDirLoc
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    PID:3272
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI1B23.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240655125 77 CustomActionManaged!CustomActionManaged.TelemetryActions.TelemetrySendStart
    3⤵
    - Blocklisted process makes network request
    PID:2796
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI7246.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240677421 254 CustomActionManaged!CustomActionManaged.TelemetryActions.TelemetrySendEnd
    3⤵
    - Blocklisted process makes network request
    - Drops file in Windows directory
    PID:3772
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D596F9478DA66B379949055C838914B0 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1968
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSID259.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240636531 31 CustomActionManaged!CustomActionManaged.CustomActions.MoveChainerToFolder
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    PID:212
- - C:\Windows\SysWOW64\icacls.exe
    "icacls.exe" "C:\Program Files (x86)\Epic Games\Launcher" /grant "BUILTIN\Users":(OI)(CI)F
    3⤵
    - Modifies file permissions
    PID:4416
- - C:\Windows\SysWOW64\icacls.exe
    "icacls.exe" "C:\ProgramData\Epic" /grant "BUILTIN\Users":(OI)(CI)F
    3⤵
    - Modifies file permissions
    PID:5156
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI3064.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240660562 99 CustomActionManaged!CustomActionManaged.CustomActions.RegisterProductID
    3⤵
    - Drops file in Windows directory
    PID:3980
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI6B9A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240675734 110 CustomActionManaged!CustomActionManaged.CustomActions.CopyServiceWrapper
    3⤵
    PID:5352
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI6C66.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240675937 118 CustomActionManaged!CustomActionManaged.CustomActions.CreateRegistryKeys
    3⤵
    - Drops file in Windows directory
    PID:5312
- - C:\Program Files (x86)\Epic Games\Epic Online Services\EpicOnlineServices.exe
    "C:\Program Files (x86)\Epic Games\Epic Online Services\EpicOnlineServices.exe" --runApplication=createConfig
    3⤵
    - Executes dropped EXE
    PID:5172
- - C:\Program Files (x86)\Epic Games\Epic Online Services\service\EpicOnlineServicesHost.exe
    "C:\Program Files (x86)\Epic Games\Epic Online Services\service\EpicOnlineServicesHost.exe" install
    3⤵
    - Executes dropped EXE
    PID:3496
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI70AF.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240677015 247 CustomActionManaged!CustomActionManaged.CustomActions.ExecuteComponents
    3⤵
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    PID:5360
  - - C:\Program Files (x86)\Epic Games\Epic Online Services\EpicOnlineServicesUserHelper.exe
      "C:\Program Files (x86)\Epic Games\Epic Online Services\EpicOnlineServicesUserHelper.exe" --setup
      4⤵
      Executes dropped EXE
      Modifies data under HKEY_USERS
      Modifies registry class
      PID:5664
- C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe
  "C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe" /silent
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies data under HKEY_USERS
  PID:1520
- C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exe
  "C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exe" 44 "C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\EpicOnlineServices.msi" "EOSPRODUCTID=EpicGamesLauncher" "C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win32\EpicGamesLauncher.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5540
- - C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win32\EpicGamesLauncher.exe
    "C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win32\EpicGamesLauncher.exe"
    3⤵
    - Checks computer location settings
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:5756
  - - C:\Program Files (x86)\Epic Games\Launcher\Portal\SelfUpdateStaging\Install\Portal\Extras\Redist\LauncherPrereqSetup_x64.exe
      "C:\Program Files (x86)\Epic Games\Launcher\Portal\SelfUpdateStaging\Install\Portal\Extras\Redist\LauncherPrereqSetup_x64.exe" /quiet /log "C:/Users/Admin/AppData/Local/EpicGamesLauncher/Saved/Logs/SelfUpdatePrereqInstall.log"
      4⤵
      Adds Run key to start application
      Executes dropped EXE
      Modifies registry class
      Modifies system certificate store
      PID:10096
    - - C:\Program Files (x86)\Epic Games\Launcher\Portal\SelfUpdateStaging\Install\Portal\Extras\Redist\LauncherPrereqSetup_x64.exe
        
        "C:\Program Files (x86)\Epic Games\Launcher\Portal\SelfUpdateStaging\Install\Portal\Extras\Redist\LauncherPrereqSetup_x64.exe" /quiet /log "C:/Users/Admin/AppData/Local/EpicGamesLauncher/Saved/Logs/SelfUpdatePrereqInstall.log" -burn.unelevated BurnPipe.{2B19D904-09A1-4F4B-8649-31642E3D5A49} {85B47E07-0A28-44AB-B7CA-8ACD3A7F2E99} 10096
        5⤵
        Executes dropped EXE
        
        PID:10128
  - - C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win32\EpicGamesLauncher.exe
      "C:/Program Files (x86)/Epic Games/Launcher/Portal/Binaries/Win32/EpicGamesLauncher.exe" -Commandlet=selfupdateinstall -newinstancecommand="IC1TYXZlVG9Vc2VyRGlyIC1NZXNzYWdpbmc$" -ForcedRestart
      4⤵
      Checks computer location settings
      Drops file in Program Files directory
      Executes dropped EXE
      PID:2160
    - - C:\Windows\SysWOW64\taskkill.exe
        
        "taskkill" /F /T /IM EpicWebHelper.exe
        5⤵
        Kills process with taskkill
        
        PID:8336
    - - C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win64\EpicGamesLauncher.exe
        
        "C:/Program Files (x86)/Epic Games/Launcher/Portal/Binaries/Win64/EpicGamesLauncher.exe" -SaveToUserDir -Messaging -ForcedRestart
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:8468
      - C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win64\EpicWebHelper.exe
        
        "C:/Program Files (x86)/Epic Games/Launcher/Engine/Binaries/Win64/EpicWebHelper.exe" --type=gpu-process --field-trial-handle=2044,1730126178667497949,11572408127400571684,131072 --disable-features=CalculateNativeWinOcclusion --no-sandbox --locales-dir-path="C:/Program Files (x86)/Epic Games/Launcher/Engine/Binaries/ThirdParty/CEF3/Win64/Resources/locales" --log-file=C:/Users/Admin/AppData/Local/EpicGamesLauncher/Saved/Logs/cef3.log --log-severity=warning --resources-dir-path="C:/Program Files (x86)/Epic Games/Launcher/Engine/Binaries/ThirdParty/CEF3/Win64/Resources" --user-agent-product="EpicGamesLauncher/16.5.1-33263044+++Portal+Release-Live UnrealEngine/4.27.0-33263044+++Portal+Release-Live Chrome/90.0.4430.212" --lang=en --gpu-preferences=SAAAAAAAAADgACAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --log-file=C:/Users/Admin/AppData/Local/EpicGamesLauncher/Saved/Logs/cef3.log --mojo-platform-channel-handle=1908 /prefetch:2
        6⤵
        
        PID:8716
      - C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win64\EpicWebHelper.exe
        
        "C:/Program Files (x86)/Epic Games/Launcher/Engine/Binaries/Win64/EpicWebHelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,1730126178667497949,11572408127400571684,131072 --disable-features=CalculateNativeWinOcclusion --lang=en-US --service-sandbox-type=none --no-sandbox --locales-dir-path="C:/Program Files (x86)/Epic Games/Launcher/Engine/Binaries/ThirdParty/CEF3/Win64/Resources/locales" --log-file=C:/Users/Admin/AppData/Local/EpicGamesLauncher/Saved/Logs/cef3.log --log-severity=warning --resources-dir-path="C:/Program Files (x86)/Epic Games/Launcher/Engine/Binaries/ThirdParty/CEF3/Win64/Resources" --user-agent-product="EpicGamesLauncher/16.5.1-33263044+++Portal+Release-Live UnrealEngine/4.27.0-33263044+++Portal+Release-Live Chrome/90.0.4430.212" --lang=en --log-file=C:/Users/Admin/AppData/Local/EpicGamesLauncher/Saved/Logs/cef3.log --mojo-platform-channel-handle=5088 /prefetch:8
        6⤵
        
        PID:1408
      - C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win64\EpicWebHelper.exe
        
        "C:/Program Files (x86)/Epic Games/Launcher/Engine/Binaries/Win64/EpicWebHelper.exe" --type=renderer --no-sandbox --log-file=C:/Users/Admin/AppData/Local/EpicGamesLauncher/Saved/Logs/cef3.log --field-trial-handle=2044,1730126178667497949,11572408127400571684,131072 --disable-features=CalculateNativeWinOcclusion --lang=en-US --locales-dir-path="C:/Program Files (x86)/Epic Games/Launcher/Engine/Binaries/ThirdParty/CEF3/Win64/Resources/locales" --log-file=C:/Users/Admin/AppData/Local/EpicGamesLauncher/Saved/Logs/cef3.log --log-severity=warning --resources-dir-path="C:/Program Files (x86)/Epic Games/Launcher/Engine/Binaries/ThirdParty/CEF3/Win64/Resources" --user-agent-product="EpicGamesLauncher/16.5.1-33263044+++Portal+Release-Live UnrealEngine/4.27.0-33263044+++Portal+Release-Live Chrome/90.0.4430.212" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
        6⤵
        
        PID:4756
      - C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win64\EpicWebHelper.exe
        
        "C:/Program Files (x86)/Epic Games/Launcher/Engine/Binaries/Win64/EpicWebHelper.exe" --type=renderer --no-sandbox --log-file=C:/Users/Admin/AppData/Local/EpicGamesLauncher/Saved/Logs/cef3.log --field-trial-handle=2044,1730126178667497949,11572408127400571684,131072 --disable-features=CalculateNativeWinOcclusion --lang=en-US --locales-dir-path="C:/Program Files (x86)/Epic Games/Launcher/Engine/Binaries/ThirdParty/CEF3/Win64/Resources/locales" --log-file=C:/Users/Admin/AppData/Local/EpicGamesLauncher/Saved/Logs/cef3.log --log-severity=warning --resources-dir-path="C:/Program Files (x86)/Epic Games/Launcher/Engine/Binaries/ThirdParty/CEF3/Win64/Resources" --user-agent-product="EpicGamesLauncher/16.5.1-33263044+++Portal+Release-Live UnrealEngine/4.27.0-33263044+++Portal+Release-Live Chrome/90.0.4430.212" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
        6⤵
        
        PID:2708
      - C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win64\EpicWebHelper.exe
        
        "C:/Program Files (x86)/Epic Games/Launcher/Engine/Binaries/Win64/EpicWebHelper.exe" --type=renderer --no-sandbox --log-file=C:/Users/Admin/AppData/Local/EpicGamesLauncher/Saved/Logs/cef3.log --field-trial-handle=2044,1730126178667497949,11572408127400571684,131072 --disable-features=CalculateNativeWinOcclusion --lang=en-US --locales-dir-path="C:/Program Files (x86)/Epic Games/Launcher/Engine/Binaries/ThirdParty/CEF3/Win64/Resources/locales" --log-file=C:/Users/Admin/AppData/Local/EpicGamesLauncher/Saved/Logs/cef3.log --log-severity=warning --resources-dir-path="C:/Program Files (x86)/Epic Games/Launcher/Engine/Binaries/ThirdParty/CEF3/Win64/Resources" --user-agent-product="EpicGamesLauncher/16.5.1-33263044+++Portal+Release-Live UnrealEngine/4.27.0-33263044+++Portal+Release-Live Chrome/90.0.4430.212" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6244 /prefetch:1
        6⤵
        
        PID:336
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D6108F31359ACA02E4072CD11FDBE31C E Global\MSI0000
  2⤵
  PID:10768
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIB47D.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240760093 261 CustomActionManaged!CustomActionManaged.CustomActions.InstallDirectX
    3⤵
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    PID:10812
  - - C:\Windows\Installer\MSIB47D.tmp-\DXSetup.exe
      "C:\Windows\Installer\MSIB47D.tmp-\DXSetup.exe" /silent
      4⤵
      Drops file in System32 directory
      Executes dropped EXE
      Modifies data under HKEY_USERS
      Modifies registry class
      PID:10996
    - - C:\Users\Admin\AppData\Local\Temp\DXB915.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DXB915.tmp\infinst.exe xinput1_3_x64.inf, Install_Driver
        5⤵
        Drops file in System32 directory
        Drops file in Windows directory
        Executes dropped EXE
        
        PID:5188
    - - C:\Users\Admin\AppData\Local\Temp\DXB915.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DXB915.tmp\infinst.exe X3DAudio1_7_x64.inf
        5⤵
        Drops file in System32 directory
        Executes dropped EXE
        
        PID:5828
    - - C:\Users\Admin\AppData\Local\Temp\DXB915.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DXB915.tmp\infinst.exe D3DX9_43_x64.inf
        5⤵
        Drops file in System32 directory
        Executes dropped EXE
        
        PID:2172
    - - C:\Users\Admin\AppData\Local\Temp\DXB915.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DXB915.tmp\infinst.exe d3dx10_43_x64.inf
        5⤵
        Drops file in System32 directory
        Drops file in Windows directory
        Executes dropped EXE
        
        PID:2432
    - - C:\Users\Admin\AppData\Local\Temp\DXB915.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DXB915.tmp\infinst.exe d3dx11_43_x64.inf
        5⤵
        Drops file in System32 directory
        Executes dropped EXE
        
        PID:6136
    - - C:\Users\Admin\AppData\Local\Temp\DXB915.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DXB915.tmp\infinst.exe d3dcsx_43_x64.inf
        5⤵
        Drops file in System32 directory
        Executes dropped EXE
        
        PID:9556
    - - C:\Users\Admin\AppData\Local\Temp\DXB915.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DXB915.tmp\infinst.exe D3DCompiler_43_x64.inf
        5⤵
        Drops file in System32 directory
        Drops file in Windows directory
        Executes dropped EXE
        
        PID:9952
    - - C:\Users\Admin\AppData\Local\Temp\DXB915.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DXB915.tmp\infinst.exe XAudio2_7_x64.inf
        5⤵
        Drops file in System32 directory
        Executes dropped EXE
        
        PID:852
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_7.dll
        5⤵
        Registers COM server for autorun
        Modifies registry class
        
        PID:10292
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIC9CB.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240765421 267 CustomActionManaged!CustomActionManaged.CustomActions.SetupLauncherLinkProtocol
    3⤵
    - Drops file in Windows directory
    PID:10704
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSICB62.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240765953 273 CustomActionManaged!CustomActionManaged.CustomActions.SetupLauncherShortcuts
    3⤵
    - Drops file in Windows directory
    PID:11172

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4496

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:1776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery