cc9a7ddcb53c96c1b2acb8a77f0259319cc51f3405e8b00036bddc612ee56db6

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	free+fn.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	free+fn.exe

Blocklisted process makes network request 4 IoCs

flow	pid	Process
113	980	rundll32.exe
128	5280	rundll32.exe
130	1496	rundll32.exe
132	1724	rundll32.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	free+fn.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	free+fn.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation	InstallChainer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation	EpicGamesLauncher.exe

Executes dropped EXE 7 IoCs

pid	Process
4752	mp.exe
3680	DXSETUP.exe
5464	InstallChainer.exe
3472	EpicOnlineServices.exe
3960	EpicOnlineServicesHost.exe
4028	EpicOnlineServicesUserHelper.exe
4676	EpicGamesLauncher.exe

Loads dropped DLL 64 IoCs

pid	Process
544	MsiExec.exe
544	MsiExec.exe
544	MsiExec.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
4832	rundll32.exe
5220	MsiExec.exe
5220	MsiExec.exe
980	rundll32.exe
980	rundll32.exe
980	rundll32.exe
980	rundll32.exe
980	rundll32.exe
5220	MsiExec.exe
5104	rundll32.exe
5104	rundll32.exe
5104	rundll32.exe
5104	rundll32.exe
5104	rundll32.exe
5220	MsiExec.exe
5836	rundll32.exe
5836	rundll32.exe
5836	rundll32.exe
5836	rundll32.exe
5836	rundll32.exe
5388	MsiExec.exe
1576	rundll32.exe
1576	rundll32.exe
1576	rundll32.exe
1576	rundll32.exe
1576	rundll32.exe
3680	DXSETUP.exe
3680	DXSETUP.exe
3680	DXSETUP.exe
3680	DXSETUP.exe
5388	MsiExec.exe
5388	MsiExec.exe
5220	MsiExec.exe
5220	MsiExec.exe
5280	rundll32.exe
5280	rundll32.exe
5280	rundll32.exe
5280	rundll32.exe
5280	rundll32.exe
5220	MsiExec.exe
5464	InstallChainer.exe
5464	InstallChainer.exe
5220	MsiExec.exe
5664	rundll32.exe
5664	rundll32.exe
5664	rundll32.exe
5664	rundll32.exe
5664	rundll32.exe
5220	MsiExec.exe
3260	rundll32.exe
3260	rundll32.exe
3260	rundll32.exe
3260	rundll32.exe
3260	rundll32.exe
5220	MsiExec.exe
5764	rundll32.exe
5764	rundll32.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1028	icacls.exe
1784	icacls.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe

Drops file in System32 directory 15 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\SET6ECD.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\d3dx11_43.dll	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\SET6F0C.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\d3dcsx_43.dll	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\D3DCompiler_43.dll	DXSETUP.exe
File created	C:\Windows\SysWOW64\SET6E9E.tmp	DXSETUP.exe
File created	C:\Windows\SysWOW64\SET6E50.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\xinput1_3.dll	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\d3dx10_43.dll	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\SET6E50.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\SET6FF6.tmp	DXSETUP.exe
File created	C:\Windows\SysWOW64\SET6FF6.tmp	DXSETUP.exe
File created	C:\Windows\SysWOW64\SET6F0C.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\SET6ECD.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\SET6E9E.tmp	DXSETUP.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4056	free+fn.exe
4056	free+fn.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	free+fn.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\en_GD.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt64l\zone\en_TC.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt64l\en_DK.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Slate\Common\SmallCheck.png	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt64l\zone\uz_AF.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\bs_Latn_BA.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\saq.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt64l\unit\th_TH.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt64l\curr\shi_MA.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt64l\lang\lt.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt64l\region\en_GH.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt64l\lang\en_BE.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\vai.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\dz.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ar_001.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\ff_CM.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt64l\lang\az.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt64l\lang\th.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Config\Base.ini	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\es_CR.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Slate\Icons\icon_error_16x.png	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt64l\lang\fi.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\fy.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\nus.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\es_PA.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Portal\SelfUpdateStaging\191B6AE24FE13DF801EAB4B5875B9E03	EpicGamesLauncher.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\lang\en_SB.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\unit\bo.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win32\api-ms-win-core-sysinfo-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt64l\zone\vun.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\en_CX.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\bs_Cyrl.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Slate\Icons\DefaultAppIcon.png	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\bn_BD.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\machine-secret	EpicOnlineServices.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\curr\luy.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt64l\unit\sn.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Slate\Icons\icon_Downloads_16x.png	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt64l\lang\gd.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\New UI\GoOnlineButton.png	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Slate\Common\TextBox_ReadOnly.png	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt64l\iw.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt64l\es_ES.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\mua.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\ast.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt64l\coll\mn.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt64l\rbnf\es_HN.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt64l\fa.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt64l\lang\ksb.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\sr_Latn_CS.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\fr_TN.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt64l\unit\tr.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt64l\region\ff_Latn_SN.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt64l\pt_PT.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\region\en_NU.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\my.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Slate\Common\Spinbox_Hovered.png	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\UI\DashedBorder.png	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Portal\Content\UI\NotificationBadge_RoundWarning.png	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\en_SZ.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\zone\zh_Hant_MO.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt64l\unit\sr_Cyrl_YU.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Launcher\Engine\Content\Internationalization\icudt64l\rbnf\lrc.res	msiexec.exe
File created	C:\Program Files (x86)\Epic Games\Epic Online Services\Engine\Content\Internationalization\icudt64l\zone\en_KN.res	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIDDEB.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIF1ED.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\E6AAF58BAA9A556409921E4ADE0CE5A1\1.3.93	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\E6AAF58BAA9A556409921E4ADE0CE5A1\1.3.93\F_CENTRAL_msvcr120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\E6AAF58BAA9A556409921E4ADE0CE5A1\1.3.93\F_CENTRAL_vccorlib120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA	msiexec.exe
File created	C:\Windows\Installer\e58eec2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA12A.tmp-\CustomActionManaged.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIA12A.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\Installer\SourceHash{B85FAA6E-A9AA-4655-9029-E1A4EDC05E1A}	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\E6AAF58BAA9A556409921E4ADE0CE5A1\1.3.93\F_CENTRAL_msvcp120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4B3D.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI727E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFD97.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI83A8.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\{57A956AB-4BCC-45C6-9B40-957E4E125568}\Installer.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDDEB.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIDFA2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDB69.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\E6AAF58BAA9A556409921E4ADE0CE5A1\1.3.93\F_CENTRAL_vccorlib120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA	msiexec.exe
File created	C:\Windows\Installer\{B85FAA6E-A9AA-4655-9029-E1A4EDC05E1A}\Installer.ico	msiexec.exe
File opened for modification	C:\Windows\Logs\DirectX.log	DXSETUP.exe
File opened for modification	C:\Windows\Installer\MSI8475.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIA12A.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSID992.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIFD97.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI46F.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI4B3D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8475.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8475.tmp-\CustomActionManaged.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIDAEB.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI93BB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e58eec0.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI46F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{B85FAA6E-A9AA-4655-9029-E1A4EDC05E1A}\Installer.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI762A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8B1E.tmp-\CustomAction.config	rundll32.exe
File created	C:\Windows\Installer\SourceHash{57A956AB-4BCC-45C6-9B40-957E4E125568}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDD00.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI83A8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI858F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI858F.tmp-\CustomActionManaged.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA0BC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\E6AAF58BAA9A556409921E4ADE0CE5A1\1.3.93\F_CENTRAL_msvcr120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8B1E.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSID992.tmp	msiexec.exe
File created	C:\Windows\Installer\e58eec0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4B3D.tmp-\CustomActionManaged.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI7135.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI734B.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\Installer\{57A956AB-4BCC-45C6-9B40-957E4E125568}\Installer.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDDEB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\e58eec3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8FA3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA12A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID58A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDDEB.tmp-\CustomActionManaged.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI46F.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIDAEB.tmp-\CustomActionManaged.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIF28A.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI734B.tmp	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 25 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DXSETUP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EpicOnlineServicesUserHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EpicGamesLauncher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallChainer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EpicOnlineServices.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000dd1768619d5d850c0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000dd1768610000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900dd176861000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1ddd176861000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000dd17686100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 58 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Epic Games\Unreal Engine\Identifiers	EpicOnlineServicesUserHelper.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	EpicOnlineServicesUserHelper.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DXSETUP.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	rundll32.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	DXSETUP.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "2"	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DXSETUP.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Epic Games\Unreal Engine	EpicOnlineServicesUserHelper.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Epic Games	EpicOnlineServicesUserHelper.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DXSETUP.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	rundll32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Epic Games\Unreal Engine\Identifiers\MachineId = "1C09A93841FC6F9DD9DEC49F81613D46"	EpicOnlineServicesUserHelper.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DXSETUP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\com.epicgames.launcher\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.launcher\shell\open\command\ = "\"C:\\Program Files (x86)\\Epic Games\\Launcher\\Portal\\Binaries\\Win32\\EpicGamesLauncher.exe\" %1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E6AAF58BAA9A556409921E4ADE0CE5A1\SourceList\PackageName = "EpicInstaller-15.17.1.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BA659A75CCB46C54B90459E7E4215586\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.eos\shell\open\command	EpicOnlineServicesUserHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.launcher\URL Protocol	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E6AAF58BAA9A556409921E4ADE0CE5A1\ProductIcon = "C:\\Windows\\Installer\\{B85FAA6E-A9AA-4655-9029-E1A4EDC05E1A}\\Installer.ico"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BA659A75CCB46C54B90459E7E4215586\PackageCode = "56098CA0BDDF2C5488BA2013A58A5B5F"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BA659A75CCB46C54B90459E7E4215586\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\2BCFAA43FBEEC904B97FAF707FE4CEEA	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.launcher\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E6AAF58BAA9A556409921E4ADE0CE5A1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E6AAF58BAA9A556409921E4ADE0CE5A1\DirectXRedist	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E6AAF58BAA9A556409921E4ADE0CE5A1\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BA659A75CCB46C54B90459E7E4215586\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\com.epicgames.launcher\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E6AAF58BAA9A556409921E4ADE0CE5A1\VCRedist	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E6AAF58BAA9A556409921E4ADE0CE5A1\Version = "16973917"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E6AAF58BAA9A556409921E4ADE0CE5A1\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E6AAF58BAA9A556409921E4ADE0CE5A1\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E6AAF58BAA9A556409921E4ADE0CE5A1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E6AAF58BAA9A556409921E4ADE0CE5A1\SourceList\Net\1 = "C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.eos\shell\open	EpicOnlineServicesUserHelper.exe
Key created	\REGISTRY\MACHINE\Software\Classes\com.epicgames.launcher\DefaultIcon	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\com.epicgames.launcher\shell	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E6AAF58BAA9A556409921E4ADE0CE5A1\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E6AAF58BAA9A556409921E4ADE0CE5A1\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BA659A75CCB46C54B90459E7E4215586\SourceList\Net\1 = "C:\\Program Files (x86)\\Epic Games\\Launcher\\Portal\\Extras\\EOS\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.eos\DefaultIcon	EpicOnlineServicesUserHelper.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E6AAF58BAA9A556409921E4ADE0CE5A1\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E6AAF58BAA9A556409921E4ADE0CE5A1\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\44F9670D954DF0540B48AC3E08267CB5	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BA659A75CCB46C54B90459E7E4215586\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.launcher	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.launcher\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E6AAF58BAA9A556409921E4ADE0CE5A1\PackageCode = "CB07B31A6571B6945BD975BABA14A4D7"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E6AAF58BAA9A556409921E4ADE0CE5A1\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BA659A75CCB46C54B90459E7E4215586\ProductIcon = "C:\\Windows\\Installer\\{57A956AB-4BCC-45C6-9B40-957E4E125568}\\Installer.ico"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BA659A75CCB46C54B90459E7E4215586\SourceList\LastUsedSource = "n;1;C:\\Program Files (x86)\\Epic Games\\Launcher\\Portal\\Extras\\EOS\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.eos\shell\open\command\ = "\"C:\\Program Files (x86)\\Epic Games\\Epic Online Services\\EpicOnlineServicesUserHelper.exe\" %1"	EpicOnlineServicesUserHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.launcher\shell\ = "open"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E6AAF58BAA9A556409921E4ADE0CE5A1\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E6AAF58BAA9A556409921E4ADE0CE5A1\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BA659A75CCB46C54B90459E7E4215586	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BA659A75CCB46C54B90459E7E4215586\SourceList\PackageName = "EpicOnlineServices.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BA659A75CCB46C54B90459E7E4215586\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\com.epicgames.launcher	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BA659A75CCB46C54B90459E7E4215586\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.eos\ = "Epic Online Services Link"	EpicOnlineServicesUserHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.launcher\ = "Epic Games Launcher Link"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E6AAF58BAA9A556409921E4ADE0CE5A1\ProductFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\classes\com.epicgames.eos	EpicOnlineServicesUserHelper.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BA659A75CCB46C54B90459E7E4215586\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.eos\shell\ = "open"	EpicOnlineServicesUserHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\com.epicgames.launcher\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E6AAF58BAA9A556409921E4ADE0CE5A1\ProductName = "Epic Games Launcher"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E6AAF58BAA9A556409921E4ADE0CE5A1\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E6AAF58BAA9A556409921E4ADE0CE5A1\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BA659A75CCB46C54B90459E7E4215586\ProductName = "Epic Online Services"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\2BCFAA43FBEEC904B97FAF707FE4CEEA\BA659A75CCB46C54B90459E7E4215586	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\44F9670D954DF0540B48AC3E08267CB5\E6AAF58BAA9A556409921E4ADE0CE5A1	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\BA659A75CCB46C54B90459E7E4215586	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BA659A75CCB46C54B90459E7E4215586\Version = "33554476"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BA659A75CCB46C54B90459E7E4215586\SourceList	msiexec.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 634391.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe
4056	free+fn.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	6044	msiexec.exe
Token: SeIncreaseQuotaPrivilege	6044	msiexec.exe
Token: SeSecurityPrivilege	940	msiexec.exe
Token: SeCreateTokenPrivilege	6044	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	6044	msiexec.exe
Token: SeLockMemoryPrivilege	6044	msiexec.exe
Token: SeIncreaseQuotaPrivilege	6044	msiexec.exe
Token: SeMachineAccountPrivilege	6044	msiexec.exe
Token: SeTcbPrivilege	6044	msiexec.exe
Token: SeSecurityPrivilege	6044	msiexec.exe
Token: SeTakeOwnershipPrivilege	6044	msiexec.exe
Token: SeLoadDriverPrivilege	6044	msiexec.exe
Token: SeSystemProfilePrivilege	6044	msiexec.exe
Token: SeSystemtimePrivilege	6044	msiexec.exe
Token: SeProfSingleProcessPrivilege	6044	msiexec.exe
Token: SeIncBasePriorityPrivilege	6044	msiexec.exe
Token: SeCreatePagefilePrivilege	6044	msiexec.exe
Token: SeCreatePermanentPrivilege	6044	msiexec.exe
Token: SeBackupPrivilege	6044	msiexec.exe
Token: SeRestorePrivilege	6044	msiexec.exe
Token: SeShutdownPrivilege	6044	msiexec.exe
Token: SeDebugPrivilege	6044	msiexec.exe
Token: SeAuditPrivilege	6044	msiexec.exe
Token: SeSystemEnvironmentPrivilege	6044	msiexec.exe
Token: SeChangeNotifyPrivilege	6044	msiexec.exe
Token: SeRemoteShutdownPrivilege	6044	msiexec.exe
Token: SeUndockPrivilege	6044	msiexec.exe
Token: SeSyncAgentPrivilege	6044	msiexec.exe
Token: SeEnableDelegationPrivilege	6044	msiexec.exe
Token: SeManageVolumePrivilege	6044	msiexec.exe
Token: SeImpersonatePrivilege	6044	msiexec.exe
Token: SeCreateGlobalPrivilege	6044	msiexec.exe
Token: SeCreateTokenPrivilege	6044	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	6044	msiexec.exe
Token: SeLockMemoryPrivilege	6044	msiexec.exe
Token: SeIncreaseQuotaPrivilege	6044	msiexec.exe
Token: SeMachineAccountPrivilege	6044	msiexec.exe
Token: SeTcbPrivilege	6044	msiexec.exe
Token: SeSecurityPrivilege	6044	msiexec.exe
Token: SeTakeOwnershipPrivilege	6044	msiexec.exe
Token: SeLoadDriverPrivilege	6044	msiexec.exe
Token: SeSystemProfilePrivilege	6044	msiexec.exe
Token: SeSystemtimePrivilege	6044	msiexec.exe
Token: SeProfSingleProcessPrivilege	6044	msiexec.exe
Token: SeIncBasePriorityPrivilege	6044	msiexec.exe
Token: SeCreatePagefilePrivilege	6044	msiexec.exe
Token: SeCreatePermanentPrivilege	6044	msiexec.exe
Token: SeBackupPrivilege	6044	msiexec.exe
Token: SeRestorePrivilege	6044	msiexec.exe
Token: SeShutdownPrivilege	6044	msiexec.exe
Token: SeDebugPrivilege	6044	msiexec.exe
Token: SeAuditPrivilege	6044	msiexec.exe
Token: SeSystemEnvironmentPrivilege	6044	msiexec.exe
Token: SeChangeNotifyPrivilege	6044	msiexec.exe
Token: SeRemoteShutdownPrivilege	6044	msiexec.exe
Token: SeUndockPrivilege	6044	msiexec.exe
Token: SeSyncAgentPrivilege	6044	msiexec.exe
Token: SeEnableDelegationPrivilege	6044	msiexec.exe
Token: SeManageVolumePrivilege	6044	msiexec.exe
Token: SeImpersonatePrivilege	6044	msiexec.exe
Token: SeCreateGlobalPrivilege	6044	msiexec.exe
Token: SeCreateTokenPrivilege	6044	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	6044	msiexec.exe
Token: SeLockMemoryPrivilege	6044	msiexec.exe

Suspicious use of FindShellTrayWindow 62 IoCs

pid	Process
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
6044	msiexec.exe
4384	msedge.exe
6044	msiexec.exe
4676	EpicGamesLauncher.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4676	EpicGamesLauncher.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4056 wrote to memory of 3220	4056	free+fn.exe	84
PID 4056 wrote to memory of 3220	4056	free+fn.exe	84
PID 4056 wrote to memory of 3088	4056	free+fn.exe	85
PID 4056 wrote to memory of 3088	4056	free+fn.exe	85
PID 4056 wrote to memory of 1620	4056	free+fn.exe	86
PID 4056 wrote to memory of 1620	4056	free+fn.exe	86
PID 4056 wrote to memory of 4464	4056	free+fn.exe	87
PID 4056 wrote to memory of 4464	4056	free+fn.exe	87
PID 4464 wrote to memory of 4752	4464	cmd.exe	88
PID 4464 wrote to memory of 4752	4464	cmd.exe	88
PID 4056 wrote to memory of 3512	4056	free+fn.exe	89
PID 4056 wrote to memory of 3512	4056	free+fn.exe	89
PID 4384 wrote to memory of 4188	4384	msedge.exe	99
PID 4384 wrote to memory of 4188	4384	msedge.exe	99
PID 4384 wrote to memory of 1520	4384	msedge.exe	100
PID 4384 wrote to memory of 1520	4384	msedge.exe	100
PID 4384 wrote to memory of 1520	4384	msedge.exe	100
PID 4384 wrote to memory of 1520	4384	msedge.exe	100
PID 4384 wrote to memory of 1520	4384	msedge.exe	100
PID 4384 wrote to memory of 1520	4384	msedge.exe	100
PID 4384 wrote to memory of 1520	4384	msedge.exe	100
PID 4384 wrote to memory of 1520	4384	msedge.exe	100
PID 4384 wrote to memory of 1520	4384	msedge.exe	100
PID 4384 wrote to memory of 1520	4384	msedge.exe	100
PID 4384 wrote to memory of 1520	4384	msedge.exe	100
PID 4384 wrote to memory of 1520	4384	msedge.exe	100
PID 4384 wrote to memory of 1520	4384	msedge.exe	100
PID 4384 wrote to memory of 1520	4384	msedge.exe	100
PID 4384 wrote to memory of 1520	4384	msedge.exe	100
PID 4384 wrote to memory of 1520	4384	msedge.exe	100
PID 4384 wrote to memory of 1520	4384	msedge.exe	100
PID 4384 wrote to memory of 1520	4384	msedge.exe	100
PID 4384 wrote to memory of 1520	4384	msedge.exe	100
PID 4384 wrote to memory of 1520	4384	msedge.exe	100
PID 4384 wrote to memory of 1520	4384	msedge.exe	100
PID 4384 wrote to memory of 1520	4384	msedge.exe	100
PID 4384 wrote to memory of 1520	4384	msedge.exe	100
PID 4384 wrote to memory of 1520	4384	msedge.exe	100
PID 4384 wrote to memory of 1520	4384	msedge.exe	100
PID 4384 wrote to memory of 1520	4384	msedge.exe	100
PID 4384 wrote to memory of 1520	4384	msedge.exe	100
PID 4384 wrote to memory of 1520	4384	msedge.exe	100
PID 4384 wrote to memory of 1520	4384	msedge.exe	100
PID 4384 wrote to memory of 1520	4384	msedge.exe	100
PID 4384 wrote to memory of 1520	4384	msedge.exe	100
PID 4384 wrote to memory of 1520	4384	msedge.exe	100
PID 4384 wrote to memory of 1520	4384	msedge.exe	100
PID 4384 wrote to memory of 1520	4384	msedge.exe	100
PID 4384 wrote to memory of 1520	4384	msedge.exe	100
PID 4384 wrote to memory of 1520	4384	msedge.exe	100
PID 4384 wrote to memory of 1520	4384	msedge.exe	100
PID 4384 wrote to memory of 1520	4384	msedge.exe	100
PID 4384 wrote to memory of 1520	4384	msedge.exe	100
PID 4384 wrote to memory of 1520	4384	msedge.exe	100
PID 4384 wrote to memory of 4020	4384	msedge.exe	101
PID 4384 wrote to memory of 4020	4384	msedge.exe	101
PID 4384 wrote to memory of 1844	4384	msedge.exe	102
PID 4384 wrote to memory of 1844	4384	msedge.exe	102
PID 4384 wrote to memory of 1844	4384	msedge.exe	102
PID 4384 wrote to memory of 1844	4384	msedge.exe	102
PID 4384 wrote to memory of 1844	4384	msedge.exe	102
PID 4384 wrote to memory of 1844	4384	msedge.exe	102
PID 4384 wrote to memory of 1844	4384	msedge.exe	102
PID 4384 wrote to memory of 1844	4384	msedge.exe	102

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\free+fn.exe
"C:\Users\Admin\AppData\Local\Temp\free+fn.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks for VirtualBox DLLs, possible anti-VM trick
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c color 2
  2⤵
  PID:1620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\mp.exe C:\Users\dr.sys
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4464
- - C:\Users\mp.exe
    C:\Users\mp.exe C:\Users\dr.sys
    3⤵
    - Executes dropped EXE
    PID:4752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c color 7
  2⤵
  PID:3512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffd30e746f8,0x7ffd30e74708,0x7ffd30e74718
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1784,5394818399686332311,7321606356868493150,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1784,5394818399686332311,7321606356868493150,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1784,5394818399686332311,7321606356868493150,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2580 /prefetch:8
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,5394818399686332311,7321606356868493150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,5394818399686332311,7321606356868493150,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,5394818399686332311,7321606356868493150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3016 /prefetch:1
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,5394818399686332311,7321606356868493150,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2244 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1784,5394818399686332311,7321606356868493150,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3484 /prefetch:8
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1784,5394818399686332311,7321606356868493150,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3484 /prefetch:8
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,5394818399686332311,7321606356868493150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,5394818399686332311,7321606356868493150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,5394818399686332311,7321606356868493150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,5394818399686332311,7321606356868493150,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,5394818399686332311,7321606356868493150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,5394818399686332311,7321606356868493150,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1784,5394818399686332311,7321606356868493150,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3804 /prefetch:8
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,5394818399686332311,7321606356868493150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1784,5394818399686332311,7321606356868493150,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1716 /prefetch:8
  2⤵
  PID:5828
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\EpicInstaller-15.17.1.msi"
  2⤵
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:6044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3092

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:940
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding BCF2117E2690AC4255D60EF2086DDAB6 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:544
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIECED.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240708875 5 CustomActionManaged!CustomActionManaged.CustomActions.ValidatePathLength
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4832
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 35301E34B559992AD119B0F41DD7D3BD
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5220
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIF28A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240710296 10 CustomActionManaged!CustomActionManaged.CustomActions.TelemetrySendStart
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:980
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIFD97.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240713109 16 CustomActionManaged!CustomActionManaged.CustomActions.SetStartupCmdlineArgs
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:5104
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI46F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240714875 22 CustomActionManaged!CustomActionManaged.CustomActions.CheckReparsePoints
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:5836
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI734B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240743234 50 CustomActionManaged!CustomActionManaged.CustomActions.TelemetrySendEnd
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:5280
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI83A8.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240747421 59 CustomActionManaged!CustomActionManaged.CustomActions.SetLauncherEpicGamesDirLoc
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:5664
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI8475.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240747671 65 CustomActionManaged!CustomActionManaged.CustomActions.SetLauncherInstallDirLoc
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:3260
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI858F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240747906 71 CustomActionManaged!CustomActionManaged.CustomActions.SetServiceWrapperDirLoc
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:5764
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI8B1E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240749328 77 CustomActionManaged!CustomActionManaged.TelemetryActions.TelemetrySendStart
    3⤵
    - Blocklisted process makes network request
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:1496
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIDFA2.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240770968 254 CustomActionManaged!CustomActionManaged.TelemetryActions.TelemetrySendEnd
    3⤵
    - Blocklisted process makes network request
    - System Location Discovery: System Language Discovery
    PID:1724
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 91404EA880D761C88624D7E92C0E0D38 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5388
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI4B3D.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240733046 31 CustomActionManaged!CustomActionManaged.CustomActions.MoveChainerToFolder
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:1576
- - C:\Windows\SysWOW64\icacls.exe
    "icacls.exe" "C:\Program Files (x86)\Epic Games\Launcher" /grant "BUILTIN\Users":(OI)(CI)F
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:1028
- - C:\Windows\SysWOW64\icacls.exe
    "icacls.exe" "C:\ProgramData\Epic" /grant "BUILTIN\Users":(OI)(CI)F
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:1784
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIA12A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240754968 99 CustomActionManaged!CustomActionManaged.CustomActions.RegisterProductID
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:6084
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSID992.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240769421 110 CustomActionManaged!CustomActionManaged.CustomActions.CopyServiceWrapper
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:3452
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIDAEB.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240769750 118 CustomActionManaged!CustomActionManaged.CustomActions.CreateRegistryKeys
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2936
- - C:\Program Files (x86)\Epic Games\Epic Online Services\EpicOnlineServices.exe
    "C:\Program Files (x86)\Epic Games\Epic Online Services\EpicOnlineServices.exe" --runApplication=createConfig
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    PID:3472
- - C:\Program Files (x86)\Epic Games\Epic Online Services\service\EpicOnlineServicesHost.exe
    "C:\Program Files (x86)\Epic Games\Epic Online Services\service\EpicOnlineServicesHost.exe" install
    3⤵
    - Executes dropped EXE
    PID:3960
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIDDEB.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240770515 247 CustomActionManaged!CustomActionManaged.CustomActions.ExecuteComponents
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    PID:5688
  - - C:\Program Files (x86)\Epic Games\Epic Online Services\EpicOnlineServicesUserHelper.exe
      "C:\Program Files (x86)\Epic Games\Epic Online Services\EpicOnlineServicesUserHelper.exe" --setup
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Modifies registry class
      PID:4028
- C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe
  "C:\Program Files (x86)\Epic Games\DirectXRedist\DXSETUP.exe" /silent
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:3680
- C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exe
  "C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\InstallChainer.exe" 44 "C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\EOS\EpicOnlineServices.msi" "EOSPRODUCTID=EpicGamesLauncher" "C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win32\EpicGamesLauncher.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5464
- - C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win32\EpicGamesLauncher.exe
    "C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win32\EpicGamesLauncher.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:4676

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4256

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:5852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Virtualization/Sandbox Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion