d350237255f893af5d97ecdfc19a4f6871e5648c1c81e3ca0fe460a9aa61d3da

Analysis

max time kernel
1439s
max time network
1449s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
08-07-2024 19:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

install_all.bat
Size

1KB
MD5

14c8c5d0e4f363574f960bac35edba1c
SHA1

2332774bb6e5853421ad52839f3c9dadd6745851
SHA256

33d22c9dc2ce0dc748cd762b92b443cb4e09cab5e34507fefe4967023659c27d
SHA512

ce52e46bd460898f91129482e0a29c1b0f03983a8c0c73d1726937a8cfcfb3c9241e01da9f5f4ddfc6c3877acabae20e36f7cdd333055a605d2070ee322e5c93

Score

7^/10

persistence privilege_escalation

Malware Config

Signatures

Executes dropped EXE 3 IoCs

Processes:

install.exeinstall.exeSetup.exe

pid process

788 install.exe
1768 install.exe
2188 Setup.exe

pid	process
788	install.exe
1768	install.exe
2188	Setup.exe

Loads dropped DLL 64 IoCs

Processes:

MsiExec.exeMsiExec.exemsiexec.exe

pid	process
2952	MsiExec.exe
668	MsiExec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

vcredist2005_x86.exevcredist2005_x64.exevcredist2012_x86.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	vcredist2005_x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	vcredist2005_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f} = "\"C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe\" /burn.log.append \"C:\\Users\\Admin\\AppData\\Local\\Temp\\dd_vcredist_x86_20240708210606.log\" /passive /norestart ignored /burn.runonce"	vcredist2012_x86.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Drops file in System32 directory 36 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\system32\mfc100.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc100chs.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc100deu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm100.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm100u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm100.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc100kor.dll	msiexec.exe
File opened for modification	C:\Windows\system32\atl100.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcr100.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc100cht.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc100enu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100esn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100jpn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcomp100.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp100.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100kor.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc100u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm100u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc100rus.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100chs.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcr100.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100enu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100ita.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100rus.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc100ita.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc100jpn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\atl100.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp100.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100cht.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100deu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100fra.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc100esn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc100fra.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp100.dll	msiexec.exe

Drops file in Program Files directory 6 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia80.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VC\amd64\msdia80.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia90.dll	msiexec.exe
File created	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia90.dll	msiexec.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll	msiexec.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll	msiexec.exe

Drops file in Windows directory 64 IoCs

Processes:

msiexec.exeDrvInst.exeDrvInst.exeDrvInst.exe

description	ioc	process
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240708210552603.0	msiexec.exe
File created	C:\Windows\Installer\f782605.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI29E0.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708210531075.0\msvcr80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708210531153.0\mfc80u.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708210552712.0\8.0.50727.6195.cat	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240708210552556.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708210531153.0\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_150c9e8b.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708210531371.0\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_452bf920.cat	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240708210531075.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708210552447.0\amd64_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_d6cffeda.cat	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708210531371.0\vcomp.dll	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\f782600.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708210531402.0\8.0.50727.6195.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708210531449.0\8.0.50727.6195.policy	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708210552665.0\amd64_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_9c659d69.cat	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\f782609.ipi	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\f7825f6.ipi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708210531262.0\mfc80CHS.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708210531262.0\mfc80FRA.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708210552556.0\msvcr80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708210552665.0\mfc80ITA.dll	msiexec.exe
File created	C:\Windows\Installer\f7825f3.msi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708210531262.0\mfc80CHT.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708210531434.1\8.0.50727.6195.cat	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI918D.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708210552665.0\mfc80CHS.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708210531044.0\ATL80.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240708210531449.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708210531153.0\mfcm80.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240708210531044.0	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9F46.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI791C.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708210531262.0\mfc80ESP.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708210531262.0\mfc80KOR.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240708210531153.0	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240708210531418.0	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3DAF.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708210552556.0\msvcm80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708210531262.0\mfc80ENU.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708210552556.0\msvcp80.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA65A.tmp	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\f7825fb.ipi	msiexec.exe
File created	\??\c:\Windows\Installer\f782600.ipi	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\ul_ATL80.dll.97F81AF1_0E47_DC99_FF1F_C8B3B9A1E18E	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708210552603.0\mfc80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708210552696.0\vcomp.dll	msiexec.exe
File created	C:\Windows\Installer\f78260b.msp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC78D.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708210531262.0\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_6a5bb789.manifest	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708210552712.0\8.0.50727.6195.policy	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708210552728.0\8.0.50727.6195.policy	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240708210552728.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708210531262.0\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_6a5bb789.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708210531262.0\mfc80JPN.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708210552728.1\8.0.50727.6195.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240708210531075.0\msvcm80.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240708210552447.0	msiexec.exe
File opened for modification	C:\Windows\Installer\f78260e.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\ul_ATL80.dll.97F81AF1_0E47_DC99_FF1F_C8B3B9A1E18E	msiexec.exe

Event Triggered Execution: Installer Packages 1 TTPs 2 IoCs
persistence privilege_escalation

Installer Packages
T1546.016

Processes:

msiexec.exemsiexec.exe

pid process

2200 msiexec.exe
2136 msiexec.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1224 2392 WerFault.exe vcredist2012_x86.exe

pid	pid_target	process	target process
1224	2392	WerFault.exe	vcredist2012_x86.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Setup.exeSetup.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Setup.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

DrvInst.exeDrvInst.exemsiexec.exeDrvInst.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\34	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\35\52C64B7E	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\32	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\30	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\35\52C64B7E\@%SystemRoot%\system32\qagentrt.dll,-10 = "System Health Authentication"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\32	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\35\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption"	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe

Modifies registry class 64 IoCs

Processes:

msiexec.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFCLOC,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e006900450024005b004d00310025002e0064002700650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\c1c4f01781cc94c4c8fb1542c0981a2a\VC_Redist	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.ATL,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e007b004c0046003d0042004900620074004f002800650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\Version = "134278728"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.MFC,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32" = 5300530073002b005a0066007a00250039003500390027006e006a004d0066002c00350072002700460054005f00560043005f005200650064006900730074005f004d00460043005f007800380036003e00660074005a003f002800770035002b002e0034002c007e007b0044004700380037002b007800260000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.OpenMP,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64",type="win32" = 3600540043006c0046002e005f007400740035006200290038002100600024004b005a0046006d00460054005f00560043005f005200650064006900730074005f004f00700065006e004d0050005f007800360034003e0061005b0046005f0031006a0048006a005d003300680065005f004f005400590026006b003f00400000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFC,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e0021004d00210026005a005a006300300025006e00650038004d006b0062004900640046007700550000000000	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\92091D8AC5E822E408118470F0E997E6	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6E815EB96CCE9A53884E7857C57002F0\FT_VC_Redist_MFC_x86 = "VC_Redist_12222_x86_enu"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.ATL,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e00700052005e007000580049006000510075006f00650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\1 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\PackageCode = "84067013B7B56744BA0F51892982BC09"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E815EB96CCE9A53884E7857C57002F0\SourceList\LastUsedSource = "n;2;f:\\42eaeb60cd4f499bd74c4d\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\6 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.ATL,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e005a00310021003d00520046007900460072005700650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\67D6ECF5CD5FBA732B8B22BAC8DE1B4D\FT_VC_Redist_ATL_x64 = "VC_Redist_12222_amd64_enu"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1926E8D15D0BCE53481466615F760A7F\FT_VCRedist_x64_KB2565063_Detection	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\11 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\6 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6E815EB96CCE9A53884E7857C57002F0\FT_VC_Redist_OpenMP_x86 = "VC_Redist_12222_x86_enu"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Patches\2D0058F6F08A743309184BE1178C95B2\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Patches\2D0058F6F08A743309184BE1178C95B2\SourceList\LastUsedSource = "n;2;f:\\f6a3bc59bc6cd60109970e67923480\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AA5D9C68C00F12943B2F6CA09FE28244\c1c4f01781cc94c4c8fb1542c0981a2a	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\PackageCode = "C558A51006735C645AEE5A0FC6A310C9"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.MFC,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64",type="win32" = 3600540043006c0046002e005f007400740035006200290038002100600024004b005a0046006d00460054005f00560043005f005200650064006900730074005f004d00460043005f007800360034003e00360057002e002700490055007a0028005000330071003f0064004c0051004e00440029002500290000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1926E8D15D0BCE53481466615F760A7F\KB2544655 = "Servicing_Key"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A\ProductName = "Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\3 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFC,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e0069002a0048004e00530057007d0024007e005500650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\PackageName = "vcredist.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\10 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6E815EB96CCE9A53884E7857C57002F0	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.MFCLOC,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64",type="win32-policy" = 3600540043006c0046002e005f007400740035006200290038002100600024004b005a0046006d00460054005f00560043005f005200650064006900730074005f004d00460043004c004f0043005f007800360034003e004d0059006800540068002a003300600053003300260021006b00460048006f00490055007600570000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\Language = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\92091D8AC5E822E408118470F0E997E6	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.CRT,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64",type="win32-policy" = 3600540043006c0046002e005f007400740035006200290038002100600024004b005a0046006d00460054005f00560043005f005200650064006900730074005f004300520054005f007800360034003e002c007d0050004e002c00320065006e007a003300270070005b00550021006c004900720021006e0000000000	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AA5D9C68C00F12943B2F6CA09FE28244	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1926E8D15D0BCE53481466615F760A7F\Version = "167812379"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.ATL,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32" = 5300530073002b005a0066007a00250039003500390027006e006a004d0066002c00350072002700460054005f00560043005f005200650064006900730074005f00410054004c005f007800380036003e00550029004600250024002a0025005a00370038002c005d007b002d007400430064004f003700310000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A\Patches	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1D5E3C0FEDA1E123187686FED06E995A\VCRedist_x86_enu	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A\Version = "167812379"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\DeploymentFlags = "3"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.OpenMP,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32-policy" = 5300530073002b005a0066007a00250039003500390027006e006a004d0066002c00350072002700460054005f00560043005f005200650064006900730074005f004f00700065006e004d0050005f007800380036003e00690060003700480050004400240062002400350035007e004a007b00730074007e0029006200780000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1D5E3C0FEDA1E123187686FED06E995A\KB2524860 = "Servicing_Key"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\1 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.CRT,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32-policy" = 5300530073002b005a0066007a00250039003500390027006e006a004d0066002c00350072002700460054005f00560043005f005200650064006900730074005f004300520054005f007800380036003e006f006f0063007b006200340036003f004500380042006a005f0079005d005d007e004f006f002c0000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.MFCLOC,version="9.0.30729.6161",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32-policy" = 5300530073002b005a0066007a00250039003500390027006e006a004d0066002c00350072002700460054005f00560043005f005200650064006900730074005f004d00460043004c004f0043005f007800380036003e0042005b00240070007200510032006f004d003800720048007b00720067003d00320065006e002e0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E815EB96CCE9A53884E7857C57002F0\SourceList\Net\2 = "f:\\42eaeb60cd4f499bd74c4d\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\2 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A\Patches\2D0058F6F08A743309184BE1178C95B2 = ":SP1.1;:#SP1.1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\4 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 7 IoCs

Processes:

vcredist2005_x86.exevcredist2005_x64.exevcredist2008_x86.exevcredist2008_x64.exevcredist2010_x86.exevcredist2010_x64.exevcredist2012_x86.exe

pid	process
2992	vcredist2005_x86.exe
1104	vcredist2005_x64.exe
1964	vcredist2008_x86.exe
2604	vcredist2008_x64.exe
2996	vcredist2010_x86.exe
1452	vcredist2010_x64.exe
304	vcredist2012_x86.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

Processes:

msiexec.exeSetup.exeSetup.exe

pid	process
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
1572	Setup.exe
1572	Setup.exe
1572	Setup.exe
1572	Setup.exe
1572	Setup.exe
1572	Setup.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2188	Setup.exe
2188	Setup.exe
2188	Setup.exe
2188	Setup.exe
2188	Setup.exe
2188	Setup.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe
2832	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exeDrvInst.exe

description	pid	process
Token: SeShutdownPrivilege	2200	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2200	msiexec.exe
Token: SeRestorePrivilege	2832	msiexec.exe
Token: SeTakeOwnershipPrivilege	2832	msiexec.exe
Token: SeSecurityPrivilege	2832	msiexec.exe
Token: SeCreateTokenPrivilege	2200	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2200	msiexec.exe
Token: SeLockMemoryPrivilege	2200	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2200	msiexec.exe
Token: SeMachineAccountPrivilege	2200	msiexec.exe
Token: SeTcbPrivilege	2200	msiexec.exe
Token: SeSecurityPrivilege	2200	msiexec.exe
Token: SeTakeOwnershipPrivilege	2200	msiexec.exe
Token: SeLoadDriverPrivilege	2200	msiexec.exe
Token: SeSystemProfilePrivilege	2200	msiexec.exe
Token: SeSystemtimePrivilege	2200	msiexec.exe
Token: SeProfSingleProcessPrivilege	2200	msiexec.exe
Token: SeIncBasePriorityPrivilege	2200	msiexec.exe
Token: SeCreatePagefilePrivilege	2200	msiexec.exe
Token: SeCreatePermanentPrivilege	2200	msiexec.exe
Token: SeBackupPrivilege	2200	msiexec.exe
Token: SeRestorePrivilege	2200	msiexec.exe
Token: SeShutdownPrivilege	2200	msiexec.exe
Token: SeDebugPrivilege	2200	msiexec.exe
Token: SeAuditPrivilege	2200	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2200	msiexec.exe
Token: SeChangeNotifyPrivilege	2200	msiexec.exe
Token: SeRemoteShutdownPrivilege	2200	msiexec.exe
Token: SeUndockPrivilege	2200	msiexec.exe
Token: SeSyncAgentPrivilege	2200	msiexec.exe
Token: SeEnableDelegationPrivilege	2200	msiexec.exe
Token: SeManageVolumePrivilege	2200	msiexec.exe
Token: SeImpersonatePrivilege	2200	msiexec.exe
Token: SeCreateGlobalPrivilege	2200	msiexec.exe
Token: SeBackupPrivilege	2916	vssvc.exe
Token: SeRestorePrivilege	2916	vssvc.exe
Token: SeAuditPrivilege	2916	vssvc.exe
Token: SeBackupPrivilege	2832	msiexec.exe
Token: SeRestorePrivilege	2832	msiexec.exe
Token: SeRestorePrivilege	2020	DrvInst.exe
Token: SeRestorePrivilege	2020	DrvInst.exe
Token: SeRestorePrivilege	2020	DrvInst.exe
Token: SeRestorePrivilege	2020	DrvInst.exe
Token: SeRestorePrivilege	2020	DrvInst.exe
Token: SeRestorePrivilege	2020	DrvInst.exe
Token: SeRestorePrivilege	2020	DrvInst.exe
Token: SeLoadDriverPrivilege	2020	DrvInst.exe
Token: SeLoadDriverPrivilege	2020	DrvInst.exe
Token: SeLoadDriverPrivilege	2020	DrvInst.exe
Token: SeRestorePrivilege	2832	msiexec.exe
Token: SeTakeOwnershipPrivilege	2832	msiexec.exe
Token: SeRestorePrivilege	2832	msiexec.exe
Token: SeTakeOwnershipPrivilege	2832	msiexec.exe
Token: SeRestorePrivilege	2832	msiexec.exe
Token: SeTakeOwnershipPrivilege	2832	msiexec.exe
Token: SeRestorePrivilege	2832	msiexec.exe
Token: SeTakeOwnershipPrivilege	2832	msiexec.exe
Token: SeRestorePrivilege	2832	msiexec.exe
Token: SeTakeOwnershipPrivilege	2832	msiexec.exe
Token: SeRestorePrivilege	2832	msiexec.exe
Token: SeTakeOwnershipPrivilege	2832	msiexec.exe
Token: SeRestorePrivilege	2832	msiexec.exe
Token: SeTakeOwnershipPrivilege	2832	msiexec.exe
Token: SeRestorePrivilege	2832	msiexec.exe

Suspicious use of FindShellTrayWindow 9 IoCs

Processes:

msiexec.exemsiexec.exeinstall.exeinstall.exevcredist2012_x86.exe

pid	process
2200	msiexec.exe
2200	msiexec.exe
2136	msiexec.exe
2136	msiexec.exe
788	install.exe
788	install.exe
1768	install.exe
1768	install.exe
2392	vcredist2012_x86.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.exevcredist2005_x86.exemsiexec.exevcredist2005_x64.exevcredist2008_x86.exevcredist2008_x64.exe

description	pid	process	target process
PID 1692 wrote to memory of 2992	1692	cmd.exe	vcredist2005_x86.exe
PID 1692 wrote to memory of 2992	1692	cmd.exe	vcredist2005_x86.exe
PID 1692 wrote to memory of 2992	1692	cmd.exe	vcredist2005_x86.exe
PID 1692 wrote to memory of 2992	1692	cmd.exe	vcredist2005_x86.exe
PID 1692 wrote to memory of 2992	1692	cmd.exe	vcredist2005_x86.exe
PID 1692 wrote to memory of 2992	1692	cmd.exe	vcredist2005_x86.exe
PID 1692 wrote to memory of 2992	1692	cmd.exe	vcredist2005_x86.exe
PID 2992 wrote to memory of 2200	2992	vcredist2005_x86.exe	msiexec.exe
PID 2992 wrote to memory of 2200	2992	vcredist2005_x86.exe	msiexec.exe
PID 2992 wrote to memory of 2200	2992	vcredist2005_x86.exe	msiexec.exe
PID 2992 wrote to memory of 2200	2992	vcredist2005_x86.exe	msiexec.exe
PID 2992 wrote to memory of 2200	2992	vcredist2005_x86.exe	msiexec.exe
PID 2992 wrote to memory of 2200	2992	vcredist2005_x86.exe	msiexec.exe
PID 2992 wrote to memory of 2200	2992	vcredist2005_x86.exe	msiexec.exe
PID 2832 wrote to memory of 2952	2832	msiexec.exe	MsiExec.exe
PID 2832 wrote to memory of 2952	2832	msiexec.exe	MsiExec.exe
PID 2832 wrote to memory of 2952	2832	msiexec.exe	MsiExec.exe
PID 2832 wrote to memory of 2952	2832	msiexec.exe	MsiExec.exe
PID 2832 wrote to memory of 2952	2832	msiexec.exe	MsiExec.exe
PID 2832 wrote to memory of 2952	2832	msiexec.exe	MsiExec.exe
PID 2832 wrote to memory of 2952	2832	msiexec.exe	MsiExec.exe
PID 1692 wrote to memory of 1104	1692	cmd.exe	vcredist2005_x64.exe
PID 1692 wrote to memory of 1104	1692	cmd.exe	vcredist2005_x64.exe
PID 1692 wrote to memory of 1104	1692	cmd.exe	vcredist2005_x64.exe
PID 1692 wrote to memory of 1104	1692	cmd.exe	vcredist2005_x64.exe
PID 1692 wrote to memory of 1104	1692	cmd.exe	vcredist2005_x64.exe
PID 1692 wrote to memory of 1104	1692	cmd.exe	vcredist2005_x64.exe
PID 1692 wrote to memory of 1104	1692	cmd.exe	vcredist2005_x64.exe
PID 1104 wrote to memory of 2136	1104	vcredist2005_x64.exe	msiexec.exe
PID 1104 wrote to memory of 2136	1104	vcredist2005_x64.exe	msiexec.exe
PID 1104 wrote to memory of 2136	1104	vcredist2005_x64.exe	msiexec.exe
PID 1104 wrote to memory of 2136	1104	vcredist2005_x64.exe	msiexec.exe
PID 1104 wrote to memory of 2136	1104	vcredist2005_x64.exe	msiexec.exe
PID 1104 wrote to memory of 2136	1104	vcredist2005_x64.exe	msiexec.exe
PID 1104 wrote to memory of 2136	1104	vcredist2005_x64.exe	msiexec.exe
PID 2832 wrote to memory of 668	2832	msiexec.exe	MsiExec.exe
PID 2832 wrote to memory of 668	2832	msiexec.exe	MsiExec.exe
PID 2832 wrote to memory of 668	2832	msiexec.exe	MsiExec.exe
PID 2832 wrote to memory of 668	2832	msiexec.exe	MsiExec.exe
PID 2832 wrote to memory of 668	2832	msiexec.exe	MsiExec.exe
PID 2832 wrote to memory of 668	2832	msiexec.exe	MsiExec.exe
PID 2832 wrote to memory of 668	2832	msiexec.exe	MsiExec.exe
PID 1692 wrote to memory of 1964	1692	cmd.exe	vcredist2008_x86.exe
PID 1692 wrote to memory of 1964	1692	cmd.exe	vcredist2008_x86.exe
PID 1692 wrote to memory of 1964	1692	cmd.exe	vcredist2008_x86.exe
PID 1692 wrote to memory of 1964	1692	cmd.exe	vcredist2008_x86.exe
PID 1692 wrote to memory of 1964	1692	cmd.exe	vcredist2008_x86.exe
PID 1692 wrote to memory of 1964	1692	cmd.exe	vcredist2008_x86.exe
PID 1692 wrote to memory of 1964	1692	cmd.exe	vcredist2008_x86.exe
PID 1964 wrote to memory of 788	1964	vcredist2008_x86.exe	install.exe
PID 1964 wrote to memory of 788	1964	vcredist2008_x86.exe	install.exe
PID 1964 wrote to memory of 788	1964	vcredist2008_x86.exe	install.exe
PID 1964 wrote to memory of 788	1964	vcredist2008_x86.exe	install.exe
PID 1964 wrote to memory of 788	1964	vcredist2008_x86.exe	install.exe
PID 1964 wrote to memory of 788	1964	vcredist2008_x86.exe	install.exe
PID 1964 wrote to memory of 788	1964	vcredist2008_x86.exe	install.exe
PID 1692 wrote to memory of 2604	1692	cmd.exe	vcredist2008_x64.exe
PID 1692 wrote to memory of 2604	1692	cmd.exe	vcredist2008_x64.exe
PID 1692 wrote to memory of 2604	1692	cmd.exe	vcredist2008_x64.exe
PID 1692 wrote to memory of 2604	1692	cmd.exe	vcredist2008_x64.exe
PID 1692 wrote to memory of 2604	1692	cmd.exe	vcredist2008_x64.exe
PID 1692 wrote to memory of 2604	1692	cmd.exe	vcredist2008_x64.exe
PID 1692 wrote to memory of 2604	1692	cmd.exe	vcredist2008_x64.exe
PID 2604 wrote to memory of 1768	2604	vcredist2008_x64.exe	install.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\install_all.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1692

C:\Users\Admin\AppData\Local\Temp\vcredist2005_x86.exe
vcredist2005_x86.exe /q
2⤵
- Adds Run key to start application
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of WriteProcessMemory
PID:2992

C:\Windows\SysWOW64\msiexec.exe
msiexec /i vcredist.msi
3⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2200

C:\Users\Admin\AppData\Local\Temp\vcredist2005_x64.exe
vcredist2005_x64.exe /q
2⤵
- Adds Run key to start application
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of WriteProcessMemory
PID:1104

C:\Windows\SysWOW64\msiexec.exe
msiexec /i vcredist.msi
3⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of FindShellTrayWindow
PID:2136

C:\Users\Admin\AppData\Local\Temp\vcredist2008_x86.exe
vcredist2008_x86.exe /qb
2⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of WriteProcessMemory
PID:1964

\??\f:\42eaeb60cd4f499bd74c4d\install.exe
f:\42eaeb60cd4f499bd74c4d\.\install.exe /qb
3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:788

C:\Users\Admin\AppData\Local\Temp\vcredist2008_x64.exe
vcredist2008_x64.exe /qb
2⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of WriteProcessMemory
PID:2604

\??\f:\f4eccd51ba0b5173c6736877a8\install.exe
f:\f4eccd51ba0b5173c6736877a8\.\install.exe /qb
3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:1768

C:\Users\Admin\AppData\Local\Temp\vcredist2010_x86.exe
vcredist2010_x86.exe /passive /norestart
2⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:2996

\??\f:\f6a3bc59bc6cd60109970e67923480\Setup.exe
f:\f6a3bc59bc6cd60109970e67923480\Setup.exe /passive /norestart
3⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1572

C:\Users\Admin\AppData\Local\Temp\vcredist2010_x64.exe
vcredist2010_x64.exe /passive /norestart
2⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:1452

\??\f:\438f73ea5112e92a10a77ba0\Setup.exe
f:\438f73ea5112e92a10a77ba0\Setup.exe /passive /norestart
3⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2188

C:\Users\Admin\AppData\Local\Temp\vcredist2012_x86.exe
vcredist2012_x86.exe /passive /norestart
2⤵
- Adds Run key to start application
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:304

C:\Users\Admin\AppData\Local\Temp\vcredist2012_x86.exe
"C:\Users\Admin\AppData\Local\Temp\vcredist2012_x86.exe" /passive /norestart -burn.unelevated BurnPipe.{25E1D2C4-8BB7-4B05-8D73-88EA8E67377B} {C7EBA38B-9BFF-4604-83F7-F2D1941D7013} 304
3⤵
- Suspicious use of FindShellTrayWindow
PID:2392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 340
4⤵
- Program crash
PID:1224

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2832

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding A312D4DC96DCA7D9572224D02B71DFCF
2⤵
- Loads dropped DLL
PID:2952

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 240959E146DF811CDDA5BBBD27154991
2⤵
- Loads dropped DLL
PID:668

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2916

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003D8" "00000000000003CC"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2020

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot20" "" "" "65dbac317" "0000000000000000" "00000000000005A8" "00000000000002F4"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:804

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot21" "" "" "6f9bf5bcb" "0000000000000000" "00000000000002F4" "00000000000005D4"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1568

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f7825f7.rbs
Filesize
29KB

MD5
2813e0f44b771e8a9d50a9df5f5c3722

SHA1
05a9b0c3accf05ddf5233bf9f33b05699bc3e675

SHA256
9cea5c84be99e504f3ed16880e81f9dcda0e96d36fd250d7b317f0b660c9ba60

SHA512
f9ac3ab3573cc2cd816ea310bbebd68c0ff31cb1b92cef1c7cf63e53550bd0be23aa7f64e46a7fd349f7502498373c288a71839539a8522850a8a964c0b0f52f

Download Submit
C:\Config.Msi\f7825fc.rbs
Filesize
29KB

MD5
90f16e9e451db787191033d6b4ca6f50

SHA1
e0bbce13580d84c4bdffde136bf5849bc4168dcd

SHA256
ed0daa82dc6bd1fb36cc844d3948d91946bf30e8a5302cc93a10610d934cca67

SHA512
73965c0f863f10fada037f754dfcc2df513429723588524b396f070f50a288b653689b87dad7f44481bd8c1dddac8c19b291bef440ec07ae8d7b288c99f32536

Download Submit
C:\Config.Msi\f782601.rbs
Filesize
4KB

MD5
993d9e7529eaa0ab24e65a5d56d9e79e

SHA1
42efe23840e6f73d6732085aff3ce9883fd2db80

SHA256
1f894c168e9531dd3200f96b831e2b24bd4f3bd727f54b4dbb9e06b85608a9e3

SHA512
b0aac0e78cfd9d0e659f869cf7e85a9934e8a464f869d9178cbed1b7d8477431c3fa25422486cb4bc5aa7962da80af42d06ee633391ebc155e074a70b34d8c36

Download Submit
C:\Config.Msi\f782606.rbs
Filesize
29KB

MD5
86d941c9eee4434f6921932f0b056ee6

SHA1
d4e9a7779af193673b4ce59b9e62009362798836

SHA256
384a287beb13099a00fd3fc3ca2d7787ff02f17fc784c90c8d042f73281ec52f

SHA512
c3d2880eeec5950a3444935031ab90da60936e2fb63043c245bb66128126eb8c85edbfa028099d3265fde6645f66ce74684858b10a3a172f504b476c6de609ad

Download Submit
C:\Config.Msi\f78260a.rbs
Filesize
4KB

MD5
472f1c3e7b6dc5bda68cf8a982937db2

SHA1
5e228ee04b7264acb72cdfd97ca1dad1d5ea1402

SHA256
c878e7bac3465d9c3a21ea3a32ca642dda8dd274c60db24ef3ad69b045d8790f

SHA512
1c0d2a28b141fceebf3f57154036a04a30c6f99aa1bda6fb46970fa353cd59b6736b13cba5ca87c0aa9b9270f3caa4491ce723c498a8b1e71c9545b134efccf0

Download Submit
C:\Config.Msi\f78260f.rbs
Filesize
29KB

MD5
cf1f89e2ad907c1cd7556b2f9320e761

SHA1
201ee79e3223a3be12feb60cdd0d9fc6efb3d429

SHA256
30c437c549ce8304e7561edf11f8e29e49c9ad97bd4f790de1273165514d5c42

SHA512
a06f7b743b1cad14654addc529b2798dac1795bcb5f57cdb0875b13c5f787187e53882718d144ce68d26678bf31da423e806cb35272b42d4836dec22c83ee840

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
f9d52201e20e946607a652827f2b6b00

SHA1
71035b093523dd97ced8311d09a12f2ee1bd460a

SHA256
6d7290a23e246f9e880e7c8600bdf55f3793f7c63489c75243e4233b0ea62fff

SHA512
40521e49d5bbfc3f94b861557e7262bd9dcf5a80e9928d039a3fb77cb34f0a04575f75f55325b3695c830ed4eccdb702530ef7ce68265e748340d62a1cc34254

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2655.tmp
Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\HFIAD7F.tmp.html
Filesize
16KB

MD5
f3b09dcec1cb78f7d1d7605c272212a4

SHA1
ee997222ac73f3f0bf2fb07e3feea2bf8495e2d2

SHA256
15016da376f9a9b32c3352489ac5bece17e68213ce6b4d47291768cbf53512df

SHA512
7db5888fe739d28560f379ba46dbcc83a781118fb0ba11669dc1be33b39a47c8dd7a3bda348c5f3a360641890c3276695d9d61357f174214b92d75e78a7e45eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredis1.cab
Filesize
247KB

MD5
cc064d4b81619991de8131a86ad77681

SHA1
88d80d86cc20c27d7d2a872af719300bd2bb73f9

SHA256
913ee5a1cae3e5a1872b3a5efaaa00c58e4beb692492b138f76967da671b0477

SHA512
5aff0eb26cfc187bf58721b2b6d73357d9f1e66d1ac5340ad9ddc08b40ad0eda27a144cb3b650604637a7476c282ded83ed890de98a73ccaf0cc021da3a9eb25

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredis1.cab
Filesize
312KB

MD5
77a9bff5af149160775741e204734d47

SHA1
7b5126af69b5a79593f39db94180f1ff11b0e39d

SHA256
20a26ed9a1edf7763a9b515522c5e29720048a482c7fbc8b7ff6bbdd27e61038

SHA512
bb0440f58f07e113bddd9a0afb5aab8af6493218784fe5fa6f4032e3a37088f91b7e766dee87cec4a9ea11d425d27b3b536430de3a52222e8bca3e0247d81e3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredist.msi
Filesize
2.6MB

MD5
b20bbeb818222b657df49a9cfe4fed79

SHA1
3f6508e880b86502773a3275bc9527f046d45502

SHA256
91bdd063f6c53126737791c9eccf0b2f4cf44927831527245bc89a0be06c0cb4

SHA512
f534bc7bf1597e728940e6c3b77f864adfaa413bb1e080458326b692b0f96bddf4fbd294eeed36d7764a3578e6c8e919488bbf63b8fe2d4355ab3efd685424a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredist.msi
Filesize
3.0MB

MD5
6dbdf338a0a25cdb236d43ea3ca2395e

SHA1
685b6ea61e574e628392eaac8b10aff4309f1081

SHA256
200fef5d4994523a02c4daa00060db28eb289b99d47fc6c1305183101e72bdeb

SHA512
6b5b31c55cf72ab92b17fb6074b3901a1e6afe0796ef9bc831e4dfb97450376d2889cd24b1cf3fce60eb3c1bcd1b31254b5cfa3ef6107974dfa0b35c233daf5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_20240708_210558734-MSI_vc_red.msi.txt
Filesize
1KB

MD5
38d1587884aa3e470b54c69c780579c4

SHA1
cd3b62e8ffd59a5b3bb7dfaaa685fb42697ab172

SHA256
238921dd37505db2bf5413994778ab658076c3f5ca70c541d337df486a9c5983

SHA512
8ebdae99ba5a704bf640ea68f6e90fa7be903139a97bbc7f7cb42ea87b3128c2dc60465d4e9064a7f0ca5e968358332b0b58c58ed68deb6d50d1e7dc4267eb61

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_20240708_210558734-Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219-MSP0.txt
Filesize
1KB

MD5
1fc6d8a2a8ce62b2185cfa8a4c9454d5

SHA1
38882c5ad16e98632818c726f9cefe31aee40e4b

SHA256
629515dea8271af42d78b1a9c3e7764fdbfa29135ea57c1dacf6f9cf4fde5ded

SHA512
72ec28653285bb29f3de760ca222cdd0736886a903dc27b9fae768c055cd5bfb3a9b2305cd8e1b679a8e3ae40325b1001099cd42b402324f8c75298ad1450320

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar57F1.tmp
Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\VWLA277.tmp
Filesize
392B

MD5
e7213a9470b0aeb5545f3b64cf85ebbe

SHA1
1d8b64492a4251acb5869ea6dba5251f3749db13

SHA256
14e4036f7e3219b5c72825bdbf7df4173f51f7d909797d9d22670448ee2644d6

SHA512
8fc31987dccacf40f3ebf8d5d11299bc634c4e6ded8ae98ba09e873b8c5d94012eb9000974306152c8a9a62e8793e94e3231f328a54bee08ed298c0f4ccbb90f

Download Submit
C:\Users\Admin\AppData\Local\Temp\VWLAB5C.tmp
Filesize
392B

MD5
43533e248cfc9df2cf1cf4731d9c6a53

SHA1
af6754397761a2534a9379c215ec0d1492566cfb

SHA256
7440df4792766c429a5403ad81015b982c9843f6e4db02247250fc865bee2551

SHA512
c0af1c86e1849411aa37cb44c87b826d47d5aeac6ea25c7654d02b536653105eaa719560bfe979e81abe6d2de90813a0ad43fb387a914e71f73f0f393003610d

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI1116.txt
Filesize
2KB

MD5
82e8f583e824bb41409f3bc40778e87f

SHA1
ab4c9a9bf4c7783c2d40d27700e0da47b3e1223a

SHA256
f509ff89a2f819d6fdedbbdde558d51adfc155e14955c428b6d1670b4627ffd2

SHA512
5d13687c6ed7b82435932a85bef3338d93812e804de2367a1e801685064b9278c05f57d60229fda6d6faeabf61f86ccbab1d4cab7eb3b28a246a46a30c76235d

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI111D.txt
Filesize
2KB

MD5
02a12dbd9ea27848ca23fe1f7036af71

SHA1
5325b3fe7d0ad3ce9085797d5917dc6a55ce8ab2

SHA256
1e5b4dcb635b458a0913e0eb82456a41b33b8c81451d70ab35348c9ef71f7340

SHA512
857ba8373eb143ef6491ff4004cff6bdc96e321f48c94301b9b3c4f86757e34a16e536b838df8ab4f6827df0dc2584b5beaef7b3095455205e1a6449324eecd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\logo.png
Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Windows\Installer\MSI29E0.tmp
Filesize
28KB

MD5
85221b3bcba8dbe4b4a46581aa49f760

SHA1
746645c92594bfc739f77812d67cfd85f4b92474

SHA256
f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f

SHA512
060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d

Download Submit
F:\42eaeb60cd4f499bd74c4d\install.exe
Filesize
547KB

MD5
4138c31964fbcb3b7418e086933324c3

SHA1
97cc6f58fb064ab6c4a2f02fb665fef77d30532f

SHA256
b72056fc3df6f46069294c243fe5006879bf4a9d8eef388369a590ca41745f29

SHA512
40cf2f35c3a944fca93d58d66465f0308197f5485381ff07d3065e0f59e94fc3834313068e4e5e5da395413ff2d3d1c3ff6fa050f2256e118972bf21a5643557

Download Submit
F:\f4eccd51ba0b5173c6736877a8\install.exe
Filesize
834KB

MD5
f0995d5ebde916fa146f51d324cf410c

SHA1
6a03e96a663051683b82601b5c7be72d72ecdb1c

SHA256
f0110ab02e8a531e3e7d196c03f907c659e6262c75861dc0c8d05f6a3ccbdd6b

SHA512
8a2ca604c06077a1c5a7ac9782ff6815a4ea1b152502707120cf5a8edddcda7c8d1a71e16c80305a3fa098acb6ecf158c770e6d0a9cb2e57a9d875fb935664b8

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\f:\42eaeb60cd4f499bd74c4d\globdata.ini
Filesize
1KB

MD5
0a6b586fabd072bd7382b5e24194eac7

SHA1
60e3c7215c1a40fbfb3016d52c2de44592f8ca95

SHA256
7912e3fcf2698cf4f8625e563cd8215c6668739cae18bd6f27af2d25bec5c951

SHA512
b96b0448e9f0e94a7867b6bb103979e9ef2c0e074bcb85988d450d63de6edcf21dc83bb154aafb7de524af3c3734f0bb1ba649db0408612479322e1aa85be9f4

Download Submit
\??\f:\42eaeb60cd4f499bd74c4d\install.ini
Filesize
841B

MD5
f8f6c0e030cb622f065fe47d61da91d7

SHA1
cf6fa99747de8f35c6aea52df234c9c57583baa3

SHA256
c16727881c47a40077dc5a1f1ea71cbb28e3f4e156c0ae7074c6d7f5ecece21d

SHA512
b70c6d67dac5e6a0dbd17e3bcf570a95914482abad20d0304c02da22231070b4bc887720dbae972bc5066457e1273b68fde0805f1c1791e9466a5ca343485cde

Download Submit
\??\f:\42eaeb60cd4f499bd74c4d\install.res.1033.dll
Filesize
85KB

MD5
ff6003014eefc9c30abe20e3e1f5fbe8

SHA1
4a5bd05f94545f01efc10232385b8fecad300678

SHA256
a522c5ea3250cdd538a9ce7b4a06dfd5123e7eb05eef67509f2b975a8e1d3067

SHA512
3adc5c705bab7fa7b50517a5eb3301491f5150b56e1088ed436590458e963da204cd1875af75db89742403476a56a94c3f425c05327767bdb4bbee4859667ac2

Download Submit
\??\f:\42eaeb60cd4f499bd74c4d\vc_red.cab
Filesize
3.7MB

MD5
0ee84ab717bc400c5e96c8d9d329fbb0

SHA1
be4ba7bbb068c7256b70f4fd7634eaeb2ad04d0a

SHA256
461d575bc1a07f64c14f1da885d2f310bd282cbbedcd0a5cf8ffa7057411805d

SHA512
4a6b0619f471a51df09fb6c1eff4ed166cdb7ef57f79ffdf709fa952a7c2a176c338084689c8ace1a94024a24579e9ee0ab6d411c25a1b42b0f517c57749d1a2

Download Submit
\??\f:\42eaeb60cd4f499bd74c4d\vc_red.msi
Filesize
222KB

MD5
7e641e6a0b456271745c20c3bb8a18f9

SHA1
ae6cedcb81dc443611a310140ae4671789dbbf3a

SHA256
34c5e7d7ea270ee67f92d34843d89603d6d3b6d9ef5247b43ae3c59c909d380d

SHA512
f67d6bf69d094edcc93541332f31b326131ff89672edb30fd349def6952ad8bfd07dc2f0ca5967b48a7589eee5b7a14b9a2c1ebe0cba4ae2324f7957090ea903

Download Submit
\??\f:\f4eccd51ba0b5173c6736877a8\install.res.1033.dll
Filesize
84KB

MD5
e8ed5b7797472df6f5e1dae87c123e5e

SHA1
71e203899c3faf5e9eb5543bfd0eb748b78da566

SHA256
6ad479dd35201c74092068cccd6d12fd84a45d2c04e927b39901a9126f9e06dd

SHA512
dfdd6bba404753f6afbc804551550bdc771eccc034c01f4c5149beb6d98424cf7b86fc63aac361a1840df9bc8365c726baab672055534620db70ca2c0e2e1b3e

Download Submit
\??\f:\f4eccd51ba0b5173c6736877a8\vc_red.cab
Filesize
4.3MB

MD5
5cad07d592a2a43905d6b656b79a7abd

SHA1
9168413a66fe4e41ddd506a68e7f5e5feebf9d6b

SHA256
9f218cefe505a28a589b10f4e7c28ac479eca159e438012a9666e6f709bcf82f

SHA512
546065881b32421ba36076dd6848d98e444d89def7a4bfd3d7299d6de6f6f746a2abea2a00e24b02ba5ba2bde816a70529eb8ca48972ccc2d03f3ccb12df4261

Download Submit
\??\f:\f4eccd51ba0b5173c6736877a8\vc_red.msi
Filesize
230KB

MD5
4aa5bbddbf6b2d1cf509c566312f1203

SHA1
0557e25cf4c2aa1bcb170707cd282ae864d93d17

SHA256
017e62a7a046acf00f5565e60f8eed4c5f409913e7ddc2f431d4236bbfdabab8

SHA512
e32fad32aefb70592eec56c55eaf65d6a6ed33939a6cabe7ff0ec33f91c4687001a41575ccfcac448c4739b2af4e309c2ec9e526104fb292d04aa8746dfad8f9

Download Submit
\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll
Filesize
835KB

MD5
b370bef39a3665a33bd82b614ffbf361

SHA1
ac4608231fce95c4036dc04e1b0cf56ae813df03

SHA256
a9f818f65074355e9376f9519b6846333b395d9b2d884d8d15f8d2f4991b860a

SHA512
66ebf1275d86c07f5c86244b10187453ef40a550d74b9eb24ac3fbf51419786b87fdefe84812d85dc269cb49377e1b51732b697ae089cfbf35123ea90932fdb8

Download Submit
\Windows\SysWOW64\mfc100chs.dll
Filesize
35KB

MD5
c086a0aa8c39cb2ea09ea967d433733e

SHA1
b5139ed7a2af76ad71c1ed3625543c0c98256984

SHA256
21688ed8de2a5c9e95e25e750bd6d8a7bc5446172dae69af9df96feda022fc7e

SHA512
eaf03cf10669dd289e108370a6de7484acb0f59389eca6da907d579767de919b08a6388e635e06bb3d222dc4d9303f964634a6b8820572e796279063d192e926

Download Submit
\Windows\SysWOW64\mfc100cht.dll
Filesize
35KB

MD5
44ee19cb7dd5e5fd95c77fe9364de004

SHA1
9dde4a75e2344932f4a91d8ef9656203c2b3b655

SHA256
254e83fad56aa1a1cba3d5e0fc32509fee82482f210e238e81f7d8b117a69b8c

SHA512
2c636abf08d44eedf452edf02bf4243e76e14bb95e8a24012787ddffcce69c1d7fc4be98c4b5cd70532fe8420882e1ade228900c5f36669fdd90fe0383dde6af

Download Submit
\Windows\SysWOW64\mfc100deu.dll
Filesize
62KB

MD5
eca6624efebbe2c0c320ac942620c404

SHA1
acbeb473088cac5887e9d9823a00570a102a8705

SHA256
2bf46f1536ce621801fc621fabbe59f32ad856aa8ae085eb6e4469885c171da3

SHA512
860e7c994091418177dedc7d4e935985de0ceadc4eebb569d9e38024478daa78e621b57e722195915183c4e1935efd98c08e1e4c8cb2e7c47306ebfc097f49ad

Download Submit
\Windows\SysWOW64\mfc100enu.dll
Filesize
53KB

MD5
2a2c442f00b45e01d4c882eea69a01bc

SHA1
85145f0f784d3a4efa569deb77b54308a1a21b92

SHA256
d71db839de0bc1fcc01a125d57ced2aaea3f444a992426c316ce18c267c33a8c

SHA512
f18d9019eee843d707aa307714a15207be2ded2eceab518599fbed8a3826a1a56f815fe75fb37f36c93be13f3d90e025f790db6b3ba413bfd5cd040b2cc7dbf7

Download Submit
\Windows\SysWOW64\mfc100esn.dll
Filesize
62KB

MD5
b4e91c857c886c8731f7969d9a85665d

SHA1
a639781b1dc2c7bdd855be37fbb39b55ad5b734a

SHA256
7f3e218c1bf7bb0f00885afec8ed60c8edd48a73622feb2fce7cb282af1be900

SHA512
fbb841339b216fb677ddf798d004503a1c0c8a60d17edd502d2a893985cefba8b13febc594dcaa0ed9df823fbced0367d8c1074d7025e6bf6e6d4ec5cd1b2648

Download Submit
\Windows\SysWOW64\mfc100fra.dll
Filesize
62KB

MD5
bb21453c6707a7b5dd9f727ed375f284

SHA1
56e7a1011221b87af1b1ea766114161fb5dd4a3a

SHA256
8630d9b71a04bfcad5ed15c11cbf88f2de42abfa458bc66963e6d0d207dc01c8

SHA512
c74bbfcd5c407fa1d8189f1805e12e2261268059c3f4d7ee5d5492811d161906b27e9623be55649504b2888f3aae0ad98038f420c1969cb6693328c78ec6b1c8

Download Submit
\Windows\SysWOW64\mfc100ita.dll
Filesize
60KB

MD5
a99884aeac9c704600c6f5a44b3f7694

SHA1
1d65b58014f1ecffa3e8affa4b21ab4466732d9e

SHA256
54c711b8ec19ab39c881ba16af97dff6d1cd74c1e2fe6ff50ec51c466015aa6c

SHA512
dd2f6113b0d879c3699c97db42fbef03413dfccac9772596ace7fed5850b269ac0adc94c30439d5c37688e11ff73ffa53409d483bd2f419e16769b0213a5d46c

Download Submit
\Windows\SysWOW64\mfc100jpn.dll
Filesize
42KB

MD5
76022ed341931c473d2dfb27d56e37fd

SHA1
be2b19cc30093069e61349908153d22383feda7f

SHA256
0c7637e3ae7e2c429807194c470a1e7bd98ae02d67d543380367f142cf08173a

SHA512
0c30ac2a2a1bafb4462142ecaf059800ba262e2f82d82f229f78a0b91018d38ed101aca29ef01458dea6f9d34b8fd76940f7c8765ff8fe9d412ee3dba5419f42

Download Submit
memory/788-303-0x00000000751A0000-0x00000000751B7000-memory.dmp

Filesize
92KB

Download
memory/1572-494-0x0000000074F20000-0x0000000074F44000-memory.dmp

Filesize
144KB

Download
memory/1572-493-0x0000000074FC0000-0x0000000075088000-memory.dmp

Filesize
800KB

Download
memory/1768-389-0x000007FEF7080000-0x000007FEF7098000-memory.dmp

Filesize
96KB

Download
memory/2188-611-0x0000000074F30000-0x0000000074F54000-memory.dmp

Filesize
144KB

Download
memory/2188-610-0x0000000074FC0000-0x0000000075088000-memory.dmp

Filesize
800KB

Download
memory/2996-498-0x0000000075400000-0x0000000075411000-memory.dmp

Filesize
68KB

Download
memory/2996-497-0x0000000075210000-0x000000007524B000-memory.dmp

Filesize
236KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads