milleniumrat | hxxps://github[.]com/yehonatan5f/protonvpn-cracked/raw/main/_Getintopc[.]com_Proton_VPN_for_Pc_v1[.]16[.]1[.]7z

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	ProtonVPN_win_v1.16.1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	ProtonVPN.exe

Executes dropped EXE 14 IoCs

pid	Process
2756	ProtonVPN_win_v1.16.1.exe
412	ProtonVPN_win_v1.16.1.exe
3908	ProtonVPNTap.exe
4808	ProtonVPN_win_v1.16.1.exe
4668	tapinstall.exe
4924	tapinstall.exe
3540	tapinstall.exe
3892	MSIBE6F.tmp
2248	ProtonVPN.exe
1912	ProtonVPNService.exe
680	ProtonVPN.UpdateService.exe
2212	ProtonVPN.exe
1068	ProtonVPN.exe
5060	built.exe

Loads dropped DLL 58 IoCs

pid	Process
2756	ProtonVPN_win_v1.16.1.exe
2756	ProtonVPN_win_v1.16.1.exe
3900	MsiExec.exe
3900	MsiExec.exe
3900	MsiExec.exe
3900	MsiExec.exe
3900	MsiExec.exe
3900	MsiExec.exe
3900	MsiExec.exe
3900	MsiExec.exe
3900	MsiExec.exe
3900	MsiExec.exe
3900	MsiExec.exe
412	ProtonVPN_win_v1.16.1.exe
2756	ProtonVPN_win_v1.16.1.exe
3908	ProtonVPNTap.exe
3908	ProtonVPNTap.exe
1796	MsiExec.exe
2748	MsiExec.exe
2748	MsiExec.exe
2748	MsiExec.exe
2748	MsiExec.exe
2748	MsiExec.exe
2748	MsiExec.exe
3908	ProtonVPNTap.exe
2748	MsiExec.exe
4160	MsiExec.exe
4160	MsiExec.exe
4160	MsiExec.exe
4160	MsiExec.exe
4160	MsiExec.exe
4160	MsiExec.exe
4160	MsiExec.exe
4160	MsiExec.exe
4160	MsiExec.exe
4160	MsiExec.exe
4160	MsiExec.exe
4160	MsiExec.exe
4488	MsiExec.exe
4160	MsiExec.exe
2756	ProtonVPN_win_v1.16.1.exe
4488	MsiExec.exe
4488	MsiExec.exe
4488	MsiExec.exe
4160	MsiExec.exe
4160	MsiExec.exe
3292	rundll32.exe
3292	rundll32.exe
3292	rundll32.exe
3292	rundll32.exe
3292	rundll32.exe
4160	MsiExec.exe
4160	MsiExec.exe
4160	MsiExec.exe
3900	MsiExec.exe
1912	ProtonVPNService.exe
3900	MsiExec.exe
5060	built.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	ProtonVPN_win_v1.16.1.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	ProtonVPN_win_v1.16.1.exe
File opened (read-only)	\??\B:	ProtonVPNTap.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\B:	ProtonVPN_win_v1.16.1.exe
File opened (read-only)	\??\Z:	ProtonVPN_win_v1.16.1.exe
File opened (read-only)	\??\B:	ProtonVPN_win_v1.16.1.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	ProtonVPN_win_v1.16.1.exe
File opened (read-only)	\??\V:	ProtonVPN_win_v1.16.1.exe
File opened (read-only)	\??\R:	ProtonVPNTap.exe
File opened (read-only)	\??\V:	ProtonVPNTap.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	ProtonVPN_win_v1.16.1.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Y:	ProtonVPNTap.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	ProtonVPN_win_v1.16.1.exe
File opened (read-only)	\??\M:	ProtonVPNTap.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Z:	ProtonVPN_win_v1.16.1.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	ProtonVPN_win_v1.16.1.exe
File opened (read-only)	\??\O:	ProtonVPN_win_v1.16.1.exe
File opened (read-only)	\??\Q:	ProtonVPNTap.exe
File opened (read-only)	\??\S:	ProtonVPNTap.exe
File opened (read-only)	\??\S:	ProtonVPN_win_v1.16.1.exe
File opened (read-only)	\??\O:	ProtonVPNTap.exe
File opened (read-only)	\??\J:	ProtonVPN_win_v1.16.1.exe
File opened (read-only)	\??\R:	ProtonVPN_win_v1.16.1.exe
File opened (read-only)	\??\P:	ProtonVPN_win_v1.16.1.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	ProtonVPN_win_v1.16.1.exe
File opened (read-only)	\??\G:	ProtonVPN_win_v1.16.1.exe
File opened (read-only)	\??\L:	ProtonVPN_win_v1.16.1.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\P:	ProtonVPNTap.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	ProtonVPN_win_v1.16.1.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\E:	ProtonVPN_win_v1.16.1.exe
File opened (read-only)	\??\H:	ProtonVPN_win_v1.16.1.exe
File opened (read-only)	\??\U:	ProtonVPN_win_v1.16.1.exe
File opened (read-only)	\??\X:	ProtonVPNTap.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\U:	ProtonVPNTap.exe
File opened (read-only)	\??\T:	ProtonVPN_win_v1.16.1.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\P:	ProtonVPN_win_v1.16.1.exe
File opened (read-only)	\??\Y:	ProtonVPN_win_v1.16.1.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
24	raw.githubusercontent.com
110	raw.githubusercontent.com
111	raw.githubusercontent.com
23	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
108	ip-api.com

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\ResourceCleaner.pdb	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{07db87d5-d582-f84e-9e89-4e539ec0deeb}\SETBBD1.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{07db87d5-d582-f84e-9e89-4e539ec0deeb}\SETBBD2.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{07db87d5-d582-f84e-9e89-4e539ec0deeb}\tapprotonvpn.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_87687f1c2d66f901\oemvista.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_87687f1c2d66f901\oemvista.PNF	tapinstall.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{07db87d5-d582-f84e-9e89-4e539ec0deeb}\tapprotonvpn.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{07db87d5-d582-f84e-9e89-4e539ec0deeb}\oemvista.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{07db87d5-d582-f84e-9e89-4e539ec0deeb}	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{07db87d5-d582-f84e-9e89-4e539ec0deeb}\SETBBD1.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{07db87d5-d582-f84e-9e89-4e539ec0deeb}\SETBBD2.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{07db87d5-d582-f84e-9e89-4e539ec0deeb}\SETBBD3.tmp	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\tmp\ResourceCleaner.pdb	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\symbols\tmp\ResourceCleaner.pdb	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\wntdll.pdb	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\dll\wntdll.pdb	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\wntdll.pdb	MsiExec.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ProtonVPN.UpdateService.exe.log	ProtonVPN.UpdateService.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{07db87d5-d582-f84e-9e89-4e539ec0deeb}\SETBBD3.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_87687f1c2d66f901\tapprotonvpn.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_87687f1c2d66f901\tapprotonvpn.cat	DrvInst.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ProtonVPNService.exe.log	ProtonVPNService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPN\DnsClient.dll	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPN\x86\GoSrp.dll	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPN\DeviceId.dll	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPN\ProtonVPN.Service.Contract.dll	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPN\es-MX\ProtonVPN.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPN\ProtonVPN.ErrorMessage.exe	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPN\ProtonVPN.UpdateService.exe	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPN\Resources\64-bit\libssl-1_1-x64.dll	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPN\PInvoke.Kernel32.dll	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPN\ProtonVPN.Common.dll	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPN\ProtonVPN.Vpn.dll	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPN\ProtonVPN.exe.config	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPN\Resources\64-bit\libpkcs11-helper-1.dll	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPN\Resources\64-bit\openvpn.exe	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPN\CalcBinding.dll	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPN\ProtonVPN.NetworkFilter.dll	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPN\pl\ProtonVPN.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPN\Resources\32-bit\openvpn.exe	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPN\TapInstaller.dll	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPN\TapInstaller.CA.dll	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPN\es-ES\ProtonVPN.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPNTap\windows10\x86\OemVista.inf	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPN\LICENSE	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPN\it\ProtonVPN.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPNTap\windows7\x86\tapprotonvpn.sys	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPNTap\windows10\x86\tapprotonvpn.cat	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPN\Resources\32-bit\libssl-1_1.dll	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPN\ProtonVPNService.exe.config	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPNTap\windows10\x64\tapprotonvpn.Sys	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPNTap\windows10\x86\tapprotonvpn.Sys	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPN\Autofac.dll	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPN\OxyPlot.dll	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPN\Polly.Contrib.WaitAndRetry.dll	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPN\ProtonVPNService.exe	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPN\ProtonVPN.Resource.dll	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPN\Albireo.Base32.dll	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPN\PluralNet.dll	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPN\Caliburn.Micro.Platform.dll	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPN\OxyPlot.Wpf.dll	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPN\System.Windows.Interactivity.dll	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPN\fa\ProtonVPN.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPNTap\windows10\x64\tapprotonvpn.cat	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPN\GalaSoft.MvvmLight.Platform.dll	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPN\x86\ProtonVPN.NetworkUtil.dll	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPN\ARSoft.Tools.Net.dll	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPN\BouncyCastle.Crypto.dll	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPN\fr\ProtonVPN.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPN\Resources\32-bit\liblzo2-2.dll	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPN\Resources\config.ovpn	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPN\Newtonsoft.Json.dll	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPN\PInvoke.Windows.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPN\x64\Win10\ProtonVPN.SplitTunnelDriver.sys	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPN\nl\ProtonVPN.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPN\System.Buffers.dll	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPNTap\windows10\x64\OemVista.inf	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPN\de\ProtonVPN.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPN\x86\ProtonVPN.IpFilter.dll	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPNTap\windows7\x64\OemVista.inf	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPN\Resources\64-bit\libcrypto-1_1-x64.dll	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPN\Polly.dll	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPN\ProtonVPN.exe	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPN\Resources\32-bit\libpkcs11-helper-1.dll	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPN\NLog.dll	msiexec.exe
File created	C:\Program Files (x86)\Proton Technologies\ProtonVPN\x64\ProtonVPN.IpFilter.dll	msiexec.exe

Drops file in Windows directory 57 IoCs

description	ioc	Process
File created	C:\Windows\Installer\SourceHash{BCB82CD9-F514-4F93-A6D9-F898494DC927}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA9FA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAD3E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIADCB.tmp	msiexec.exe
File created	C:\Windows\Installer\e5d6309.msi	msiexec.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI64CA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAA59.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAE97.tmp	msiexec.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIA9CA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAC7F.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI65D6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAF54.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB419.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBA65.tmp-\TapInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIBE3E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAB17.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB4C6.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\Installer\MSI6693.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{BCB82CD9-F514-4F93-A6D9-F898494DC927}\protonvpn.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBA65.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5d6302.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6597.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5d6307.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAA7A.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{CC56589D-2FE8-4B38-9024-0ABCD9F3CB0E}	msiexec.exe
File created	C:\Windows\Installer\{CC56589D-2FE8-4B38-9024-0ABCD9F3CB0E}\protonvpn.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBA65.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	tapinstall.exe
File created	C:\Windows\Installer\e5d6302.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAA39.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{CC56589D-2FE8-4B38-9024-0ABCD9F3CB0E}\protonvpn.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBE5F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI647B.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI67CC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB553.tmp	msiexec.exe
File created	C:\Windows\Tasks\{CC56589D-2FE8-4B38-9024-0ABCD9F3CB0E}.job	ProtonVPN_win_v1.16.1.exe
File opened for modification	C:\Windows\Installer\MSI63BE.tmp	msiexec.exe
File created	C:\Windows\Installer\e5d6306.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI642C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAD0E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBA65.tmp-\CustomAction.config	rundll32.exe
File created	C:\Windows\Installer\e5d6307.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBE6F.tmp	msiexec.exe
File created	C:\Windows\Installer\{BCB82CD9-F514-4F93-A6D9-F898494DC927}\protonvpn.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA93B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB408.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBE70.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIA9A9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIACBF.tmp	msiexec.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3868	powershell.exe
4176	powershell.exe
4344	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\UpperFilters	DrvInst.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	tapinstall.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	tapinstall.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000c9712a8ab103c3e30000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000c9712a8a0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900c9712a8a000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dc9712a8a000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000c9712a8a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	tapinstall.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	tapinstall.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
2876	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 55 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c\52C64B7E	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update"	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	DrvInst.exe

Modifies registry class 50 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9DC28BCB415F39F46A9D8F8994D49C72	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9DC28BCB415F39F46A9D8F8994D49C72\ProductName = "ProtonVPNTap"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D98565CC8EF283B40942A0CB9D3FBCE0	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D98565CC8EF283B40942A0CB9D3FBCE0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\F7F9B32EA0AAA184E8ACAF9697B45FA0\9DC28BCB415F39F46A9D8F8994D49C72	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D98565CC8EF283B40942A0CB9D3FBCE0\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D98565CC8EF283B40942A0CB9D3FBCE0\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D42101B218F21BB41956F4B9B1B10A9F\D98565CC8EF283B40942A0CB9D3FBCE0	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D98565CC8EF283B40942A0CB9D3FBCE0\PackageCode = "84B03808A965F5E46AD3E8C7CFF9F8AF"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D98565CC8EF283B40942A0CB9D3FBCE0\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9DC28BCB415F39F46A9D8F8994D49C72\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9DC28BCB415F39F46A9D8F8994D49C72\SourceList\PackageName = "ProtonVPNTap.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9DC28BCB415F39F46A9D8F8994D49C72\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\{BCB82CD9-F514-4F93-A6D9-F898494DC927}\\94DC927\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D98565CC8EF283B40942A0CB9D3FBCE0\MainFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D98565CC8EF283B40942A0CB9D3FBCE0\Version = "17825793"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D98565CC8EF283B40942A0CB9D3FBCE0\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9DC28BCB415F39F46A9D8F8994D49C72	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9DC28BCB415F39F46A9D8F8994D49C72\Assignment = "1"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9DC28BCB415F39F46A9D8F8994D49C72\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D98565CC8EF283B40942A0CB9D3FBCE0\ProductName = "ProtonVPN"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D98565CC8EF283B40942A0CB9D3FBCE0\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D98565CC8EF283B40942A0CB9D3FBCE0\ProductIcon = "C:\\Windows\\Installer\\{CC56589D-2FE8-4B38-9024-0ABCD9F3CB0E}\\protonvpn.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9DC28BCB415F39F46A9D8F8994D49C72\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\{BCB82CD9-F514-4F93-A6D9-F898494DC927}\\94DC927\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D98565CC8EF283B40942A0CB9D3FBCE0\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D98565CC8EF283B40942A0CB9D3FBCE0\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9DC28BCB415F39F46A9D8F8994D49C72\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9DC28BCB415F39F46A9D8F8994D49C72\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9DC28BCB415F39F46A9D8F8994D49C72\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D98565CC8EF283B40942A0CB9D3FBCE0\FD92F08164915A061A35616A2E484	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D98565CC8EF283B40942A0CB9D3FBCE0\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D98565CC8EF283B40942A0CB9D3FBCE0\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9DC28BCB415F39F46A9D8F8994D49C72\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9DC28BCB415F39F46A9D8F8994D49C72\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9DC28BCB415F39F46A9D8F8994D49C72\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9DC28BCB415F39F46A9D8F8994D49C72\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D98565CC8EF283B40942A0CB9D3FBCE0\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\{CC56589D-2FE8-4B38-9024-0ABCD9F3CB0E}\\9F3CB0E\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D98565CC8EF283B40942A0CB9D3FBCE0\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\{CC56589D-2FE8-4B38-9024-0ABCD9F3CB0E}\\9F3CB0E\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9DC28BCB415F39F46A9D8F8994D49C72\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9DC28BCB415F39F46A9D8F8994D49C72\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9DC28BCB415F39F46A9D8F8994D49C72\ProductIcon = "C:\\Windows\\Installer\\{BCB82CD9-F514-4F93-A6D9-F898494DC927}\\protonvpn.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9DC28BCB415F39F46A9D8F8994D49C72\Version = "16842752"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D98565CC8EF283B40942A0CB9D3FBCE0\SourceList\PackageName = "ProtonVPN_win_v1.16.1.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D98565CC8EF283B40942A0CB9D3FBCE0\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D98565CC8EF283B40942A0CB9D3FBCE0\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\F7F9B32EA0AAA184E8ACAF9697B45FA0	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9DC28BCB415F39F46A9D8F8994D49C72\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D98565CC8EF283B40942A0CB9D3FBCE0\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D42101B218F21BB41956F4B9B1B10A9F	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9DC28BCB415F39F46A9D8F8994D49C72\PackageCode = "91EAFF615C5E1B24BB3510A61899F139"	msiexec.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD	ProtonVPNTap.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 040000000100000010000000c5dfb849ca051355ee2dba1ac33eb0280f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	ProtonVPNTap.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 5c000000010000000400000000080000190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab040000000100000010000000c5dfb849ca051355ee2dba1ac33eb0282000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	ProtonVPNTap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD	ProtonVPN_win_v1.16.1.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	ProtonVPN_win_v1.16.1.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	ProtonVPN_win_v1.16.1.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4848	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2708	msedge.exe
2708	msedge.exe
1328	msedge.exe
1328	msedge.exe
3480	identity_helper.exe
3480	identity_helper.exe
4452	msedge.exe
4452	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3900	MsiExec.exe
3900	MsiExec.exe
3900	MsiExec.exe
3900	MsiExec.exe
3148	msiexec.exe
3148	msiexec.exe
4176	powershell.exe
4176	powershell.exe
4160	MsiExec.exe
4160	MsiExec.exe
4160	MsiExec.exe
4160	MsiExec.exe
3148	msiexec.exe
3148	msiexec.exe
4488	MsiExec.exe
4488	MsiExec.exe
4344	powershell.exe
4344	powershell.exe
3292	rundll32.exe
3292	rundll32.exe
3292	rundll32.exe
3292	rundll32.exe
3868	powershell.exe
3868	powershell.exe
3868	powershell.exe
1912	ProtonVPNService.exe
1912	ProtonVPNService.exe
5060	built.exe
5060	built.exe
5060	built.exe
5060	built.exe
5060	built.exe
5060	built.exe
5060	built.exe
5060	built.exe
5060	built.exe
5060	built.exe
5060	built.exe
5060	built.exe
5060	built.exe
5060	built.exe
5060	built.exe
5060	built.exe
5060	built.exe
5060	built.exe
5060	built.exe
5060	built.exe
5060	built.exe
5060	built.exe
5060	built.exe
5060	built.exe
5060	built.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	2056	7zG.exe
Token: 35	2056	7zG.exe
Token: SeSecurityPrivilege	2056	7zG.exe
Token: SeSecurityPrivilege	2056	7zG.exe
Token: SeSecurityPrivilege	3148	msiexec.exe
Token: SeCreateTokenPrivilege	2756	ProtonVPN_win_v1.16.1.exe
Token: SeAssignPrimaryTokenPrivilege	2756	ProtonVPN_win_v1.16.1.exe
Token: SeLockMemoryPrivilege	2756	ProtonVPN_win_v1.16.1.exe
Token: SeIncreaseQuotaPrivilege	2756	ProtonVPN_win_v1.16.1.exe
Token: SeMachineAccountPrivilege	2756	ProtonVPN_win_v1.16.1.exe
Token: SeTcbPrivilege	2756	ProtonVPN_win_v1.16.1.exe
Token: SeSecurityPrivilege	2756	ProtonVPN_win_v1.16.1.exe
Token: SeTakeOwnershipPrivilege	2756	ProtonVPN_win_v1.16.1.exe
Token: SeLoadDriverPrivilege	2756	ProtonVPN_win_v1.16.1.exe
Token: SeSystemProfilePrivilege	2756	ProtonVPN_win_v1.16.1.exe
Token: SeSystemtimePrivilege	2756	ProtonVPN_win_v1.16.1.exe
Token: SeProfSingleProcessPrivilege	2756	ProtonVPN_win_v1.16.1.exe
Token: SeIncBasePriorityPrivilege	2756	ProtonVPN_win_v1.16.1.exe
Token: SeCreatePagefilePrivilege	2756	ProtonVPN_win_v1.16.1.exe
Token: SeCreatePermanentPrivilege	2756	ProtonVPN_win_v1.16.1.exe
Token: SeBackupPrivilege	2756	ProtonVPN_win_v1.16.1.exe
Token: SeRestorePrivilege	2756	ProtonVPN_win_v1.16.1.exe
Token: SeShutdownPrivilege	2756	ProtonVPN_win_v1.16.1.exe
Token: SeDebugPrivilege	2756	ProtonVPN_win_v1.16.1.exe
Token: SeAuditPrivilege	2756	ProtonVPN_win_v1.16.1.exe
Token: SeSystemEnvironmentPrivilege	2756	ProtonVPN_win_v1.16.1.exe
Token: SeChangeNotifyPrivilege	2756	ProtonVPN_win_v1.16.1.exe
Token: SeRemoteShutdownPrivilege	2756	ProtonVPN_win_v1.16.1.exe
Token: SeUndockPrivilege	2756	ProtonVPN_win_v1.16.1.exe
Token: SeSyncAgentPrivilege	2756	ProtonVPN_win_v1.16.1.exe
Token: SeEnableDelegationPrivilege	2756	ProtonVPN_win_v1.16.1.exe
Token: SeManageVolumePrivilege	2756	ProtonVPN_win_v1.16.1.exe
Token: SeImpersonatePrivilege	2756	ProtonVPN_win_v1.16.1.exe
Token: SeCreateGlobalPrivilege	2756	ProtonVPN_win_v1.16.1.exe
Token: SeCreateTokenPrivilege	2756	ProtonVPN_win_v1.16.1.exe
Token: SeAssignPrimaryTokenPrivilege	2756	ProtonVPN_win_v1.16.1.exe
Token: SeLockMemoryPrivilege	2756	ProtonVPN_win_v1.16.1.exe
Token: SeIncreaseQuotaPrivilege	2756	ProtonVPN_win_v1.16.1.exe
Token: SeMachineAccountPrivilege	2756	ProtonVPN_win_v1.16.1.exe
Token: SeTcbPrivilege	2756	ProtonVPN_win_v1.16.1.exe
Token: SeSecurityPrivilege	2756	ProtonVPN_win_v1.16.1.exe
Token: SeTakeOwnershipPrivilege	2756	ProtonVPN_win_v1.16.1.exe
Token: SeLoadDriverPrivilege	2756	ProtonVPN_win_v1.16.1.exe
Token: SeSystemProfilePrivilege	2756	ProtonVPN_win_v1.16.1.exe
Token: SeSystemtimePrivilege	2756	ProtonVPN_win_v1.16.1.exe
Token: SeProfSingleProcessPrivilege	2756	ProtonVPN_win_v1.16.1.exe
Token: SeIncBasePriorityPrivilege	2756	ProtonVPN_win_v1.16.1.exe
Token: SeCreatePagefilePrivilege	2756	ProtonVPN_win_v1.16.1.exe
Token: SeCreatePermanentPrivilege	2756	ProtonVPN_win_v1.16.1.exe
Token: SeBackupPrivilege	2756	ProtonVPN_win_v1.16.1.exe
Token: SeRestorePrivilege	2756	ProtonVPN_win_v1.16.1.exe
Token: SeShutdownPrivilege	2756	ProtonVPN_win_v1.16.1.exe
Token: SeDebugPrivilege	2756	ProtonVPN_win_v1.16.1.exe
Token: SeAuditPrivilege	2756	ProtonVPN_win_v1.16.1.exe
Token: SeSystemEnvironmentPrivilege	2756	ProtonVPN_win_v1.16.1.exe
Token: SeChangeNotifyPrivilege	2756	ProtonVPN_win_v1.16.1.exe
Token: SeRemoteShutdownPrivilege	2756	ProtonVPN_win_v1.16.1.exe
Token: SeUndockPrivilege	2756	ProtonVPN_win_v1.16.1.exe
Token: SeSyncAgentPrivilege	2756	ProtonVPN_win_v1.16.1.exe
Token: SeEnableDelegationPrivilege	2756	ProtonVPN_win_v1.16.1.exe
Token: SeManageVolumePrivilege	2756	ProtonVPN_win_v1.16.1.exe
Token: SeImpersonatePrivilege	2756	ProtonVPN_win_v1.16.1.exe
Token: SeCreateGlobalPrivilege	2756	ProtonVPN_win_v1.16.1.exe
Token: SeCreateTokenPrivilege	2756	ProtonVPN_win_v1.16.1.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5060	built.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1328 wrote to memory of 2712	1328	msedge.exe	82
PID 1328 wrote to memory of 2712	1328	msedge.exe	82
PID 1328 wrote to memory of 1140	1328	msedge.exe	83
PID 1328 wrote to memory of 1140	1328	msedge.exe	83
PID 1328 wrote to memory of 1140	1328	msedge.exe	83
PID 1328 wrote to memory of 1140	1328	msedge.exe	83
PID 1328 wrote to memory of 1140	1328	msedge.exe	83
PID 1328 wrote to memory of 1140	1328	msedge.exe	83
PID 1328 wrote to memory of 1140	1328	msedge.exe	83
PID 1328 wrote to memory of 1140	1328	msedge.exe	83
PID 1328 wrote to memory of 1140	1328	msedge.exe	83
PID 1328 wrote to memory of 1140	1328	msedge.exe	83
PID 1328 wrote to memory of 1140	1328	msedge.exe	83
PID 1328 wrote to memory of 1140	1328	msedge.exe	83
PID 1328 wrote to memory of 1140	1328	msedge.exe	83
PID 1328 wrote to memory of 1140	1328	msedge.exe	83
PID 1328 wrote to memory of 1140	1328	msedge.exe	83
PID 1328 wrote to memory of 1140	1328	msedge.exe	83
PID 1328 wrote to memory of 1140	1328	msedge.exe	83
PID 1328 wrote to memory of 1140	1328	msedge.exe	83
PID 1328 wrote to memory of 1140	1328	msedge.exe	83
PID 1328 wrote to memory of 1140	1328	msedge.exe	83
PID 1328 wrote to memory of 1140	1328	msedge.exe	83
PID 1328 wrote to memory of 1140	1328	msedge.exe	83
PID 1328 wrote to memory of 1140	1328	msedge.exe	83
PID 1328 wrote to memory of 1140	1328	msedge.exe	83
PID 1328 wrote to memory of 1140	1328	msedge.exe	83
PID 1328 wrote to memory of 1140	1328	msedge.exe	83
PID 1328 wrote to memory of 1140	1328	msedge.exe	83
PID 1328 wrote to memory of 1140	1328	msedge.exe	83
PID 1328 wrote to memory of 1140	1328	msedge.exe	83
PID 1328 wrote to memory of 1140	1328	msedge.exe	83
PID 1328 wrote to memory of 1140	1328	msedge.exe	83
PID 1328 wrote to memory of 1140	1328	msedge.exe	83
PID 1328 wrote to memory of 1140	1328	msedge.exe	83
PID 1328 wrote to memory of 1140	1328	msedge.exe	83
PID 1328 wrote to memory of 1140	1328	msedge.exe	83
PID 1328 wrote to memory of 1140	1328	msedge.exe	83
PID 1328 wrote to memory of 1140	1328	msedge.exe	83
PID 1328 wrote to memory of 1140	1328	msedge.exe	83
PID 1328 wrote to memory of 1140	1328	msedge.exe	83
PID 1328 wrote to memory of 1140	1328	msedge.exe	83
PID 1328 wrote to memory of 2708	1328	msedge.exe	84
PID 1328 wrote to memory of 2708	1328	msedge.exe	84
PID 1328 wrote to memory of 3044	1328	msedge.exe	85
PID 1328 wrote to memory of 3044	1328	msedge.exe	85
PID 1328 wrote to memory of 3044	1328	msedge.exe	85
PID 1328 wrote to memory of 3044	1328	msedge.exe	85
PID 1328 wrote to memory of 3044	1328	msedge.exe	85
PID 1328 wrote to memory of 3044	1328	msedge.exe	85
PID 1328 wrote to memory of 3044	1328	msedge.exe	85
PID 1328 wrote to memory of 3044	1328	msedge.exe	85
PID 1328 wrote to memory of 3044	1328	msedge.exe	85
PID 1328 wrote to memory of 3044	1328	msedge.exe	85
PID 1328 wrote to memory of 3044	1328	msedge.exe	85
PID 1328 wrote to memory of 3044	1328	msedge.exe	85
PID 1328 wrote to memory of 3044	1328	msedge.exe	85
PID 1328 wrote to memory of 3044	1328	msedge.exe	85
PID 1328 wrote to memory of 3044	1328	msedge.exe	85
PID 1328 wrote to memory of 3044	1328	msedge.exe	85
PID 1328 wrote to memory of 3044	1328	msedge.exe	85
PID 1328 wrote to memory of 3044	1328	msedge.exe	85
PID 1328 wrote to memory of 3044	1328	msedge.exe	85
PID 1328 wrote to memory of 3044	1328	msedge.exe	85

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/yehonatan5f/protonvpn-cracked/raw/main/_Getintopc.com_Proton_VPN_for_Pc_v1.16.1.7z
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcdad846f8,0x7ffcdad84708,0x7ffcdad84718
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,16626365585650245569,11567654087068247145,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,16626365585650245569,11567654087068247145,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,16626365585650245569,11567654087068247145,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16626365585650245569,11567654087068247145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16626365585650245569,11567654087068247145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,16626365585650245569,11567654087068247145,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,16626365585650245569,11567654087068247145,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16626365585650245569,11567654087068247145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16626365585650245569,11567654087068247145,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2084,16626365585650245569,11567654087068247145,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3344 /prefetch:8
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16626365585650245569,11567654087068247145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16626365585650245569,11567654087068247145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16626365585650245569,11567654087068247145,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6188 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2084,16626365585650245569,11567654087068247145,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6468 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,16626365585650245569,11567654087068247145,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2276 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3616

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2472

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3828

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:972

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\_Getintopc.com_Proton_VPN_for_Pc_v1.16.1\" -spe -an -ai#7zMap15440:140:7zEvent25349
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2056

C:\Users\Admin\Downloads\_Getintopc.com_Proton_VPN_for_Pc_v1.16.1\Proton_VPN_for_Pc_v1.16.1\ProtonVPN_win_v1.16.1.exe
"C:\Users\Admin\Downloads\_Getintopc.com_Proton_VPN_for_Pc_v1.16.1\Proton_VPN_for_Pc_v1.16.1\ProtonVPN_win_v1.16.1.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:2756
- C:\Users\Admin\AppData\Roaming\Proton Technologies AG\ProtonVPN\prerequisites\ProtonVPNTap.exe
  "C:\Users\Admin\AppData\Roaming\Proton Technologies AG\ProtonVPN\prerequisites\ProtonVPNTap.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - Modifies system certificate store
  PID:3908
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\system32\msiexec.exe" /i C:\Users\Admin\AppData\Local\Temp\{BCB82CD9-F514-4F93-A6D9-F898494DC927}\94DC927\ProtonVPNTap.msi AI_SETUPEXEPATH="C:\Users\Admin\AppData\Roaming\Proton Technologies AG\ProtonVPN\prerequisites\ProtonVPNTap.exe" SETUPEXEDIR="C:\Users\Admin\AppData\Roaming\Proton Technologies AG\ProtonVPN\prerequisites\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1716001407 "
    3⤵
    - Enumerates connected drives
    PID:1452
- C:\Users\Admin\Downloads\_Getintopc.com_Proton_VPN_for_Pc_v1.16.1\Proton_VPN_for_Pc_v1.16.1\ProtonVPN_win_v1.16.1.exe
  "C:\Users\Admin\Downloads\_Getintopc.com_Proton_VPN_for_Pc_v1.16.1\Proton_VPN_for_Pc_v1.16.1\ProtonVPN_win_v1.16.1.exe" /i C:\Users\Admin\AppData\Local\Temp\{CC56589D-2FE8-4B38-9024-0ABCD9F3CB0E}\9F3CB0E\ProtonVPN_win_v1.16.1.msi AI_EUIMSI=1 APPDIR="C:\Program Files (x86)\Proton Technologies\ProtonVPN" SECONDSEQUENCE="1" CLIENTPROCESSID="2756" AI_MORE_CMD_LINE=1
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  PID:4808

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3148
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3AACEBC14865169A001FD9B91449F7D9 C
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:3900
- - C:\Users\Admin\Downloads\_Getintopc.com_Proton_VPN_for_Pc_v1.16.1\Proton_VPN_for_Pc_v1.16.1\ProtonVPN_win_v1.16.1.exe
    "C:\Users\Admin\Downloads\_Getintopc.com_Proton_VPN_for_Pc_v1.16.1\Proton_VPN_for_Pc_v1.16.1\ProtonVPN_win_v1.16.1.exe" /groupsextract:103; /out:"C:\Users\Admin\AppData\Roaming\Proton Technologies AG\ProtonVPN\prerequisites" /callbackid:3900
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:412
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 54A0F220F0981A15D11B33FB8FE5D060 C
  2⤵
  - Loads dropped DLL
  PID:1796
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 0101FC26114F4509878078515AE88BBB
  2⤵
  - Loads dropped DLL
  PID:2748
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss67D7.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4176
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3940
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 86BC1BC4B665AC5D195F5248288ED6B6
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:4160
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssB54B.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4344
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /F /TN "ProtonVPN Update" /RU INTERACTIVE /IT /RL HIGHEST /TR "'C:\Program Files (x86)\Proton Technologies\ProtonVPN\ProtonVPN.UpdateService.exe' update" /SC ONEVENT /EC Application /MO "*[System[Provider[@Name='ProtonVPN'] and EventID=1]]"
      4⤵
      Creates scheduled task(s)
      PID:2876
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIBA65.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241023578 214 TapInstaller!TapInstaller.CustomActions.InstallTapAdapter
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    PID:3292
  - - C:\Program Files (x86)\Proton Technologies\ProtonVPNTap\installer\x64\tapinstall.exe
      "C:\Program Files (x86)\Proton Technologies\ProtonVPNTap\installer\x64\tapinstall.exe" hwids tapprotonvpn
      4⤵
      Executes dropped EXE
      Checks SCSI registry key(s)
      PID:4668
  - - C:\Program Files (x86)\Proton Technologies\ProtonVPNTap\installer\x64\tapinstall.exe
      "C:\Program Files (x86)\Proton Technologies\ProtonVPNTap\installer\x64\tapinstall.exe" install OemVista.inf tapprotonvpn
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      Checks SCSI registry key(s)
      PID:4924
  - - C:\Program Files (x86)\Proton Technologies\ProtonVPNTap\installer\x64\tapinstall.exe
      "C:\Program Files (x86)\Proton Technologies\ProtonVPNTap\installer\x64\tapinstall.exe" status tapprotonvpn
      4⤵
      Executes dropped EXE
      Checks SCSI registry key(s)
      PID:3540
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pssBE77.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3868
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E43BDD07F409A0A8B733140F07482C04 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:4488
- - C:\Windows\SysWOW64\cmd.exe
    /C "C:\Users\Admin\AppData\Local\Temp\{04E6A140-824F-4A61-B4F3-E59B3A84D54B}.bat"
    3⤵
    PID:5024
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      PID:2248
- - C:\Windows\SysWOW64\cmd.exe
    /C "C:\Users\Admin\AppData\Local\Temp\{04E6A140-824F-4A61-B4F3-E59B3A84D54B}.bat"
    3⤵
    PID:720
- C:\Windows\Installer\MSIBE6F.tmp
  "C:\Windows\Installer\MSIBE6F.tmp" /EnforcedRunAsAdmin /DontWait /dir "C:\Program Files (x86)\Proton Technologies\ProtonVPN\" "C:\Program Files (x86)\Proton Technologies\ProtonVPN\ProtonVPN.exe"
  2⤵
  - Executes dropped EXE
  PID:3892

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\_Getintopc.com_Proton_VPN_for_Pc_v1.16.1\Proton_VPN_for_Pc_v1.16.1\Read Me - Leggimi by JA.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4848

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:748

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:4872
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{ecafb828-029d-3041-a6a4-96cc2b95352c}\oemvista.inf" "9" "4334ff507" "0000000000000148" "WinSta0\Default" "0000000000000160" "208" "c:\program files (x86)\proton technologies\protonvpntap\windows10\x64"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:2112
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:3beb73aff103cc24:tapprotonvpn.ndi:9.24.2.601:tapprotonvpn," "4334ff507" "0000000000000148"
  2⤵
  - Drops file in Drivers directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  PID:688

C:\Program Files (x86)\Proton Technologies\ProtonVPN\ProtonVPN.exe
"C:\Program Files (x86)\Proton Technologies\ProtonVPN\ProtonVPN.exe"
1⤵
- Executes dropped EXE
PID:2248

C:\Program Files (x86)\Proton Technologies\ProtonVPN\ProtonVPNService.exe
"C:\Program Files (x86)\Proton Technologies\ProtonVPN\ProtonVPNService.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1912

C:\Program Files (x86)\Proton Technologies\ProtonVPN\ProtonVPN.UpdateService.exe
"C:\Program Files (x86)\Proton Technologies\ProtonVPN\ProtonVPN.UpdateService.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:680

C:\Users\Admin\Downloads\_Getintopc.com_Proton_VPN_for_Pc_v1.16.1\Proton_VPN_for_Pc_v1.16.1\CRACK\ProtonVPN.exe
"C:\Users\Admin\Downloads\_Getintopc.com_Proton_VPN_for_Pc_v1.16.1\Proton_VPN_for_Pc_v1.16.1\CRACK\ProtonVPN.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:2212
- C:\Users\Admin\AppData\Roaming\ProtonVPN.exe
  "C:\Users\Admin\AppData\Roaming\ProtonVPN.exe"
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Users\Admin\AppData\Roaming\built.exe
  "C:\Users\Admin\AppData\Roaming\built.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery