hxxps://drive[.]google[.]com/drive/folders/115OK-QwcHjQNsXKnK01PSbrt4sewb8Ee

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	regsvr32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	VRP.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	VRP.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	Remote Play Setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	UpdateModuleSetup.exe

Executes dropped EXE 11 IoCs

pid	Process
6060	Remote Play Setup.exe
5332	UpdateModuleSetup.exe
5440	setup.exe
5776	ISBEW64.exe
3688	setup.exe
5444	ISBEW64.exe
1868	DXSETUP.exe
6620	infinst.exe
6928	infinst.exe
7068	VRP.exe
1508	VRP.exe

Identifies Wine through registry keys 2 TTPs 3 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Wine	regsvr32.exe
Key opened	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Wine	VRP.exe
Key opened	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Wine	VRP.exe

Loads dropped DLL 48 IoCs

pid	Process
5440	setup.exe
5440	setup.exe
5440	setup.exe
5440	setup.exe
5440	setup.exe
5440	setup.exe
5440	setup.exe
5440	setup.exe
5440	setup.exe
3688	setup.exe
3688	setup.exe
3688	setup.exe
3688	setup.exe
3688	setup.exe
3688	setup.exe
3688	setup.exe
3688	setup.exe
3688	setup.exe
3688	setup.exe
3688	setup.exe
3688	setup.exe
3688	setup.exe
3688	setup.exe
3688	setup.exe
3688	setup.exe
5352	MsiExec.exe
1868	DXSETUP.exe
1868	DXSETUP.exe
1868	DXSETUP.exe
1868	DXSETUP.exe
1616	regsvr32.exe
3156	regsvr32.exe
3928	regsvr32.exe
3688	setup.exe
3688	setup.exe
3688	setup.exe
7068	VRP.exe
7068	VRP.exe
7068	VRP.exe
7068	VRP.exe
7068	VRP.exe
7068	VRP.exe
1508	VRP.exe
1508	VRP.exe
1508	VRP.exe
1508	VRP.exe
1508	VRP.exe
1508	VRP.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
6312	icacls.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\Temp\desktop.ini	setup.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PlayStation Tools\desktop.ini	setup.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\{B91A70F1-E447-4C87-9F19-29FE0145F0E8}\{07441A52-E208-478A-92B7-5C337CA8C131}\desktop.ini	setup.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	drive.google.com
10	drive.google.com

Drops file in System32 directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\SETAA02.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\D3DX9_42.dll	DXSETUP.exe
File opened for modification	C:\Windows\system32\SETAA6F.tmp	infinst.exe
File created	C:\Windows\system32\SETAA6F.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\d3dx10_42.dll	DXSETUP.exe
File opened for modification	C:\Windows\system32\SETAADC.tmp	infinst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe
File opened for modification	C:\Windows\system32\D3DX9_42.dll	infinst.exe
File opened for modification	C:\Windows\SysWOW64\SETAA9E.tmp	DXSETUP.exe
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe
File created	C:\Windows\SysWOW64\SETAA02.tmp	DXSETUP.exe
File created	C:\Windows\SysWOW64\SETAA9E.tmp	DXSETUP.exe
File opened for modification	C:\Windows\system32\d3dx10_42.dll	infinst.exe
File created	C:\Windows\system32\SETAADC.tmp	infinst.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
1616	regsvr32.exe
7068	VRP.exe
1508	VRP.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\Temp\setua639.rra	setup.exe
File opened for modification	C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\Temp\Uninstall.iss	setup.exe
File opened for modification	C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\VRPMFMGR.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\RU-RU\ResourceDll.dll.mui	setup.exe
File created	C:\Program Files (x86)\InstallShield Installation Information\{93EE2E6D-952F-4CDF-872C-89620E12D67A}\setu8469.rra	setup.exe
File opened for modification	C:\Program Files (x86)\InstallShield Installation Information	setup.exe
File created	C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\Temp\dxupa704.rra	setup.exe
File created	C:\Program Files (x86)\InstallShield Installation Information\{07441A52-E208-478A-92B7-5C337CA8C131}\layo895a.rra	setup.exe
File opened for modification	C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\Temp\DIFxData.ini	setup.exe
File created	C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\Version.txt	setup.exe
File created	C:\Program Files (x86)\InstallShield Installation Information\{07441A52-E208-478A-92B7-5C337CA8C131}\_Set89c8.rra	setup.exe
File opened for modification	C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\DE-DE\ResourceDll.dll.mui	setup.exe
File created	C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\RU-RU\VRPa5fa.rra	setup.exe
File created	C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\Temp\ISSea639.rra	setup.exe
File created	C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\Temp\setua648.rra	setup.exe
File created	C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\Temp\Aug2a668.rra	setup.exe
File created	C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\Temp\Devia6a6.rra	setup.exe
File created	C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\Temp\Resoa7a0.rra	setup.exe
File opened for modification	C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\{A80531E2-2F8B-4454-AE12-79F43762D75E}\Remote Play with PlayStation 3.msi	setup.exe
File opened for modification	C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\Temp\unsetattrib.bat	setup.exe
File created	C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\PL-PL\VRPa5eb.rra	setup.exe
File created	C:\Program Files (x86)\InstallShield Installation Information\{07441A52-E208-478A-92B7-5C337CA8C131}\data896a.rra	setup.exe
File opened for modification	C:\Program Files (x86)\InstallShield Installation Information\{07441A52-E208-478A-92B7-5C337CA8C131}\data1.cab	setup.exe
File created	C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\DE-DE\VRPa5ac.rra	setup.exe
File opened for modification	C:\Program Files (x86)\InstallShield Installation Information\{93EE2E6D-952F-4CDF-872C-89620E12D67A}\layout.bin	setup.exe
File created	C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\Temp\dataa639.rra	setup.exe
File created	C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\Temp\_IsRa7bf.rra	setup.exe
File created	C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\IT-IT\VRPRa5cb.rra	setup.exe
File opened for modification	C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\en-us\VRP.chm	setup.exe
File created	C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\Temp\layoa639.rra	setup.exe
File opened for modification	C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\Temp\DeviceInfo.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\Version.txt	setup.exe
File opened for modification	C:\Program Files (x86)\InstallShield Installation Information\{93EE2E6D-952F-4CDF-872C-89620E12D67A}\ISSetup.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\sonyjvtd.dll	setup.exe
File created	C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\JA-JP\VRPa5db.rra	setup.exe
File opened for modification	C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\JA-JP\VRPRes.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\Temp\License_US.rtf	setup.exe
File created	C:\Program Files (x86)\InstallShield Installation Information\{07441A52-E208-478A-92B7-5C337CA8C131}\ISSe89d7.rra	setup.exe
File created	C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\Temp\DSETa6b6.rra	setup.exe
File created	C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\IT-IT\Resoa5cb.rra	setup.exe
File opened for modification	C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\JA-JP\ResourceDll.dll.mui	setup.exe
File created	C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\Temp\setua7a0.rra	setup.exe
File opened for modification	C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\VRPSDK.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\ES-ES\VRP.chm	setup.exe
File created	C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\Temp\Fonta704.rra	setup.exe
File opened for modification	C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\Temp\isrt.dll	setup.exe
File opened for modification	C:\Program Files (x86)\InstallShield Installation Information\{93EE2E6D-952F-4CDF-872C-89620E12D67A}\_Setup.dll	setup.exe
File created	C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\_r_a_p_.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\Temp\default.pal	setup.exe
File created	C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\IT-IT\VRPa5cb.rra	setup.exe
File created	C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\PL-PL\VRPRa5fa.rra	setup.exe
File created	C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\PT-BR\Resoa5fa.rra	setup.exe
File opened for modification	C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\en-us\VRPRes.dll	setup.exe
File opened for modification	C:\Program Files (x86)\InstallShield Installation Information	setup.exe
File opened for modification	C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\Temp\License_RUS.rtf	setup.exe
File opened for modification	C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\Temp\License_CHS.rtf	setup.exe
File created	C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\Temp\Licea791.rra	setup.exe
File created	C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\JA-JP\Resoa5db.rra	setup.exe
File opened for modification	C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\Temp\Aug2009_d3dx10_42_x64.cab	setup.exe
File created	C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\Temp\unsea7bf.rra	setup.exe
File opened for modification	C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\RU-RU\VRPRes.dll	setup.exe
File created	C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\PT-BR\VRPa5fa.rra	setup.exe
File opened for modification	C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\Temp\data1.hdr	setup.exe
File created	C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\Temp\_Seta648.rra	setup.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\Installer\$PatchCache$\Managed\2E13508AB8F24544EA21974F73267DE5\1.1.0\F_CENTRAL_mfc100u_x86.DF495DFD_79F6_34DF_BB1E_E58DB5BDCF2C	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240823153714774.1\mfc80u.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240823153714774.1\mfcm80u.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240823153714836.0\8.0.50727.762.policy	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240823153714774.1\mfcm80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240823153714867.0\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e.cat	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240823153715102.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240823153714617.0\ATL80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240823153714680.0\8.0.50727.762.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240823153714680.1\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989.cat	msiexec.exe
File created	C:\Windows\Installer\e598e11.msi	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240823153715086.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240823153714680.0\8.0.50727.762.policy	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240823153714774.1\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_b77cec8e.manifest	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2E13508AB8F24544EA21974F73267DE5\1.1.0	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\2E13508AB8F24544EA21974F73267DE5\1.1.0\F_CENTRAL_msvcp100_x86.DF495DFD_79F6_34DF_BB1E_E58DB5BDCF2C	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240823153714930.0	msiexec.exe
File opened for modification	C:\Windows\Installer\e598e0d.msi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240823153714680.1\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240823153714930.0\mfc90.dll	msiexec.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File created	C:\Windows\WinSxS\InstallTemp\20240823153714680.1\msvcp80.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240823153714617.0	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240823153715102.1	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240823153714867.0\msvcp90.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240823153714930.0\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53.manifest	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\2E13508AB8F24544EA21974F73267DE5\1.1.0\F_CENTRAL_msvcr100_x86.DF495DFD_79F6_34DF_BB1E_E58DB5BDCF2C	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2E13508AB8F24544EA21974F73267DE5\1.1.0\F_CENTRAL_mfc100u_x86.DF495DFD_79F6_34DF_BB1E_E58DB5BDCF2C	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240823153714867.0	msiexec.exe
File created	C:\Windows\Installer\e598e0d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI93AC.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240823153714867.0\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240823153714930.0\mfcm90.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240823153715102.1\9.0.30729.4148.policy	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2E13508AB8F24544EA21974F73267DE5\1.1.0\F_CENTRAL_msvcp100_x86.DF495DFD_79F6_34DF_BB1E_E58DB5BDCF2C	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2E13508AB8F24544EA21974F73267DE5\1.1.0\F_CENTRAL_msvcr100_x86.DF495DFD_79F6_34DF_BB1E_E58DB5BDCF2C	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240823153714617.0\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_473666fd.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240823153714680.1\msvcr80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240823153714774.1\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_b77cec8e.cat	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2E13508AB8F24544EA21974F73267DE5\1.1.0\F_CENTRAL_mfcm100_x86.DF495DFD_79F6_34DF_BB1E_E58DB5BDCF2C	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240823153714852.0\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_353599c2.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240823153714867.0\msvcm90.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240823153714867.0\msvcr90.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240823153714680.0	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240823153714774.1	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240823153714852.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240823153714852.0\atl90.dll	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\2E13508AB8F24544EA21974F73267DE5\1.1.0\F_CENTRAL_atl100_x86.DF495DFD_79F6_34DF_BB1E_E58DB5BDCF2C	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2E13508AB8F24544EA21974F73267DE5\1.1.0\F_CENTRAL_mfc100_x86.DF495DFD_79F6_34DF_BB1E_E58DB5BDCF2C	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240823153715086.0\9.0.30729.4148.policy	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20240823153714680.1	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240823153715086.0\9.0.30729.4148.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240823153714774.0\8.0.50727.762.policy	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240823153714852.0\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_353599c2.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240823153714930.0\mfc90u.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240823153714774.0\8.0.50727.762.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240823153715102.0\9.0.30729.4148.policy	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240823153715102.1\9.0.30729.4148.cat	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\2E13508AB8F24544EA21974F73267DE5\1.1.0\F_CENTRAL_mfcm100u_x86.DF495DFD_79F6_34DF_BB1E_E58DB5BDCF2C	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240823153714680.1\msvcm80.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VRP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateModuleSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VRP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Remote Play Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DXSETUP.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3928	regsvr32.exe

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e7a671f193ce7b7c0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e7a671f10000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900e7a671f1000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de7a671f1000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000e7a671f100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	setup.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
2248	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133689009183460202"	chrome.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2E13508AB8F24544EA21974F73267DE5\PackageCode = "D4F6A40FEC183E74DB8AD6981A0CFD00"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1BD8D6AE-6EE1-42D9-A307-252FFAD207AD}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F369C92-5761-4535-BF8B-5DF1B046F58B}\TypeLib\ = "{EF964BDA-2596-4E86-B9E6-F6810FC628F6}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EB0EF7F3-23D5-4962-9C9D-A6931671E298}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RPSDK.CoreInterface	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RPSDK.CoreInterface\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{16C3A279-36CE-4605-8F4E-9F9C1951574A}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F369C92-5761-4535-BF8B-5DF1B046F58B}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EF964BDA-2596-4E86-B9E6-F6810FC628F6}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{649FA468-F043-4D18-91F4-5D6C8377EE7B}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1BD8D6AE-6EE1-42D9-A307-252FFAD207AD}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F0C68A5C-1280-436A-991F-6E44C51C1321}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{83CF0AC0-C816-482C-93D1-079A515B9D9F}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EB0EF7F3-23D5-4962-9C9D-A6931671E298}\TypeLib	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.MFC,type="win32",version="9.0.30729.4148",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 3f0078002d0021005f007d006f0061007a00390057002a006700580077004d0060007a00500046003e003700730035004e00610066002d005b005d003400370033005e00520059005300310067005e00450000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VRPMapping.InputMapping\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F0C68A5C-1280-436A-991F-6E44C51C1321}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EB0EF7F3-23D5-4962-9C9D-A6931671E298}\ProxyStubClsid32	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.CRT,type="win32",version="9.0.30729.4148",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 3f0078002d0021005f007d006f0061007a00390057002a006700580077004d0060007a00500046003e007e002700610061005a003d00250060003d00380048006f00420065002a005100300075006300600000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1BD8D6AE-6EE1-42D9-A307-252FFAD207AD}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F0C68A5C-1280-436A-991F-6E44C51C1321}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RPSDK.CoreInterface.1\ = "CoreInterface Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EB8188FB-7244-43A9-BDE0-4BC217B78B0D}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EB8188FB-7244-43A9-BDE0-4BC217B78B0D}\TypeLib\ = "{16C3A279-36CE-4605-8F4E-9F9C1951574A}"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2E13508AB8F24544EA21974F73267DE5\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2E13508AB8F24544EA21974F73267DE5\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EF964BDA-2596-4E86-B9E6-F6810FC628F6}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EF964BDA-2596-4E86-B9E6-F6810FC628F6}\1.0\0\win32\ = "C:\\Program Files (x86)\\Sony\\Remote Play with PlayStation 3\\VRPMapping.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2E13508AB8F24544EA21974F73267DE5	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{E9E70D4D-417B-4F6A-8FB8-129086EFBE69}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RPSDK.CoreInterface\ = "CoreInterface Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{16C3A279-36CE-4605-8F4E-9F9C1951574A}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VRPMapping.InputMapping\ = "InputMapping Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F369C92-5761-4535-BF8B-5DF1B046F58B}\ProgID\ = "VRPMapping.InputMapping.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{649FA468-F043-4D18-91F4-5D6C8377EE7B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RPSDK.CoreInterface\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB8188FB-7244-43A9-BDE0-4BC217B78B0D}\ = "IAudioCallback"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.CRT,type="win32",version="8.0.50727.4053",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 3f0078002d0021005f007d006f0061007a00390057002a006700580077004d0060007a00500046003e005f006a0030002c0059005d007300210053006f00650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EB0EF7F3-23D5-4962-9C9D-A6931671E298}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F0C68A5C-1280-436A-991F-6E44C51C1321}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EF964BDA-2596-4E86-B9E6-F6810FC628F6}\1.0\ = "VRPMapping 1.0 Type Library"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2E13508AB8F24544EA21974F73267DE5\SourceList\Net\1 = "C:\\Program Files (x86)\\Sony\\Remote Play with PlayStation 3\\{A80531E2-2F8B-4454-AE12-79F43762D75E}\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EF964BDA-2596-4E86-B9E6-F6810FC628F6}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EF964BDA-2596-4E86-B9E6-F6810FC628F6}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VRPMapping.InputMapping	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.ATL,type="win32",version="8.0.50727.4053",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 3f0078002d0021005f007d006f0061007a00390057002a006700580077004d0060007a00500046003e00700052005e007000580049006000510075006f00650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB8188FB-7244-43A9-BDE0-4BC217B78B0D}\TypeLib\ = "{16C3A279-36CE-4605-8F4E-9F9C1951574A}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VRPMapping.InputMapping\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB0EF7F3-23D5-4962-9C9D-A6931671E298}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RPSDK.CoreInterface.1	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F0C68A5C-1280-436A-991F-6E44C51C1321}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB8188FB-7244-43A9-BDE0-4BC217B78B0D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F369C92-5761-4535-BF8B-5DF1B046F58B}\VersionIndependentProgID\ = "VRPMapping.InputMapping"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2E13508AB8F24544EA21974F73267DE5\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2E13508AB8F24544EA21974F73267DE5\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{16C3A279-36CE-4605-8F4E-9F9C1951574A}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\Sony\\Remote Play with PlayStation 3"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB0EF7F3-23D5-4962-9C9D-A6931671E298}\ = "IInputMapping"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{649FA468-F043-4D18-91F4-5D6C8377EE7B}\TypeLib\ = "{EF964BDA-2596-4E86-B9E6-F6810FC628F6}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RPSDK.CoreInterface.1\CLSID\ = "{1BD8D6AE-6EE1-42D9-A307-252FFAD207AD}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{16C3A279-36CE-4605-8F4E-9F9C1951574A}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{83CF0AC0-C816-482C-93D1-079A515B9D9F}\ = "IPlaybackCallback"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VRPMapping.InputMapping.1\ = "InputMapping Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{585E4DDA-85F9-411E-B1D4-06821D57F051}	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
4200	chrome.exe
4200	chrome.exe
5224	msedge.exe
5224	msedge.exe
6060	Remote Play Setup.exe
6060	Remote Play Setup.exe
6060	Remote Play Setup.exe
6060	Remote Play Setup.exe
5440	setup.exe
5440	setup.exe
5260	msiexec.exe
5260	msiexec.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
1616	regsvr32.exe
1616	regsvr32.exe
7068	VRP.exe
7068	VRP.exe
1508	VRP.exe
1508	VRP.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe
Token: SeShutdownPrivilege	4200	chrome.exe
Token: SeCreatePagefilePrivilege	4200	chrome.exe

Suspicious use of FindShellTrayWindow 48 IoCs

pid	Process
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe
4200	chrome.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
6060	Remote Play Setup.exe
6060	Remote Play Setup.exe
6060	Remote Play Setup.exe
5332	UpdateModuleSetup.exe
3928	regsvr32.exe
7068	VRP.exe
1508	VRP.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4200 wrote to memory of 2368	4200	chrome.exe	84
PID 4200 wrote to memory of 2368	4200	chrome.exe	84
PID 4200 wrote to memory of 1504	4200	chrome.exe	85
PID 4200 wrote to memory of 1504	4200	chrome.exe	85
PID 4200 wrote to memory of 1504	4200	chrome.exe	85
PID 4200 wrote to memory of 1504	4200	chrome.exe	85
PID 4200 wrote to memory of 1504	4200	chrome.exe	85
PID 4200 wrote to memory of 1504	4200	chrome.exe	85
PID 4200 wrote to memory of 1504	4200	chrome.exe	85
PID 4200 wrote to memory of 1504	4200	chrome.exe	85
PID 4200 wrote to memory of 1504	4200	chrome.exe	85
PID 4200 wrote to memory of 1504	4200	chrome.exe	85
PID 4200 wrote to memory of 1504	4200	chrome.exe	85
PID 4200 wrote to memory of 1504	4200	chrome.exe	85
PID 4200 wrote to memory of 1504	4200	chrome.exe	85
PID 4200 wrote to memory of 1504	4200	chrome.exe	85
PID 4200 wrote to memory of 1504	4200	chrome.exe	85
PID 4200 wrote to memory of 1504	4200	chrome.exe	85
PID 4200 wrote to memory of 1504	4200	chrome.exe	85
PID 4200 wrote to memory of 1504	4200	chrome.exe	85
PID 4200 wrote to memory of 1504	4200	chrome.exe	85
PID 4200 wrote to memory of 1504	4200	chrome.exe	85
PID 4200 wrote to memory of 1504	4200	chrome.exe	85
PID 4200 wrote to memory of 1504	4200	chrome.exe	85
PID 4200 wrote to memory of 1504	4200	chrome.exe	85
PID 4200 wrote to memory of 1504	4200	chrome.exe	85
PID 4200 wrote to memory of 1504	4200	chrome.exe	85
PID 4200 wrote to memory of 1504	4200	chrome.exe	85
PID 4200 wrote to memory of 1504	4200	chrome.exe	85
PID 4200 wrote to memory of 1504	4200	chrome.exe	85
PID 4200 wrote to memory of 1504	4200	chrome.exe	85
PID 4200 wrote to memory of 1504	4200	chrome.exe	85
PID 4200 wrote to memory of 4588	4200	chrome.exe	86
PID 4200 wrote to memory of 4588	4200	chrome.exe	86
PID 4200 wrote to memory of 892	4200	chrome.exe	87
PID 4200 wrote to memory of 892	4200	chrome.exe	87
PID 4200 wrote to memory of 892	4200	chrome.exe	87
PID 4200 wrote to memory of 892	4200	chrome.exe	87
PID 4200 wrote to memory of 892	4200	chrome.exe	87
PID 4200 wrote to memory of 892	4200	chrome.exe	87
PID 4200 wrote to memory of 892	4200	chrome.exe	87
PID 4200 wrote to memory of 892	4200	chrome.exe	87
PID 4200 wrote to memory of 892	4200	chrome.exe	87
PID 4200 wrote to memory of 892	4200	chrome.exe	87
PID 4200 wrote to memory of 892	4200	chrome.exe	87
PID 4200 wrote to memory of 892	4200	chrome.exe	87
PID 4200 wrote to memory of 892	4200	chrome.exe	87
PID 4200 wrote to memory of 892	4200	chrome.exe	87
PID 4200 wrote to memory of 892	4200	chrome.exe	87
PID 4200 wrote to memory of 892	4200	chrome.exe	87
PID 4200 wrote to memory of 892	4200	chrome.exe	87
PID 4200 wrote to memory of 892	4200	chrome.exe	87
PID 4200 wrote to memory of 892	4200	chrome.exe	87
PID 4200 wrote to memory of 892	4200	chrome.exe	87
PID 4200 wrote to memory of 892	4200	chrome.exe	87
PID 4200 wrote to memory of 892	4200	chrome.exe	87
PID 4200 wrote to memory of 892	4200	chrome.exe	87
PID 4200 wrote to memory of 892	4200	chrome.exe	87
PID 4200 wrote to memory of 892	4200	chrome.exe	87
PID 4200 wrote to memory of 892	4200	chrome.exe	87
PID 4200 wrote to memory of 892	4200	chrome.exe	87
PID 4200 wrote to memory of 892	4200	chrome.exe	87
PID 4200 wrote to memory of 892	4200	chrome.exe	87
PID 4200 wrote to memory of 892	4200	chrome.exe	87

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://drive.google.com/drive/folders/115OK-QwcHjQNsXKnK01PSbrt4sewb8Ee
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff90a03cc40,0x7ff90a03cc4c,0x7ff90a03cc58
  2⤵
  PID:2368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1724,i,1694629170418087985,6615267948981828870,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1708 /prefetch:2
  2⤵
  PID:1504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2136,i,1694629170418087985,6615267948981828870,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  PID:4588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2240,i,1694629170418087985,6615267948981828870,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1988 /prefetch:8
  2⤵
  PID:892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3124,i,1694629170418087985,6615267948981828870,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3140 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3116,i,1694629170418087985,6615267948981828870,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4588,i,1694629170418087985,6615267948981828870,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4648 /prefetch:8
  2⤵
  PID:2380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3180,i,1694629170418087985,6615267948981828870,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4964,i,1694629170418087985,6615267948981828870,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4644,i,1694629170418087985,6615267948981828870,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4404 /prefetch:1
  2⤵
  PID:456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4328,i,1694629170418087985,6615267948981828870,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3420 /prefetch:8
  2⤵
  PID:4088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=3396,i,1694629170418087985,6615267948981828870,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4912 /prefetch:8
  2⤵
  PID:2700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5324,i,1694629170418087985,6615267948981828870,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5088 /prefetch:8
  2⤵
  PID:1252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=952,i,1694629170418087985,6615267948981828870,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3392 /prefetch:8
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:5144

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault1dbfcb02h89aeh4106hb9abhe994f8d7eeac
1⤵
PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ff8f54446f8,0x7ff8f5444708,0x7ff8f5444718
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,18198518236071682395,8900425637939985262,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,18198518236071682395,8900425637939985262,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,18198518236071682395,8900425637939985262,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:5312

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5480

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5520

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:5792

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:5836

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5996

C:\Users\Admin\Downloads\Remote Play Setup.exe
"C:\Users\Admin\Downloads\Remote Play Setup.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:6060
- C:\ProgramData\Sony Corporation\Sony Packaging Manager\PackagingTemp\{4DA836DB-2868-489E-892A-DBB9C6F71AD0}\UpdateModuleSetup.exe
  "C:\ProgramData\Sony Corporation\Sony Packaging Manager\PackagingTemp\{4DA836DB-2868-489E-892A-DBB9C6F71AD0}\UpdateModuleSetup.exe" Yes|C:\ProgramData\Sony Corporation\Sony Packaging Manager\PackagingTemp\{4DA836DB-2868-489E-892A-DBB9C6F71AD0}\setup.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5332
- - C:\ProgramData\Sony Corporation\Sony Packaging Manager\PackagingTemp\{4DA836DB-2868-489E-892A-DBB9C6F71AD0}\setup.exe
    "C:\ProgramData\Sony Corporation\Sony Packaging Manager\PackagingTemp\{4DA836DB-2868-489E-892A-DBB9C6F71AD0}\setup.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:5440
  - - C:\Users\Admin\AppData\Local\Temp\{28576B03-74C9-49A4-AA8C-F2A4529443ED}\ISBEW64.exe
      C:\Users\Admin\AppData\Local\Temp\{28576B03-74C9-49A4-AA8C-F2A4529443ED}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E2980B83-B4C8-406E-8BA3-EB19F9447BAC}
      4⤵
      Executes dropped EXE
      PID:5776
  - - C:\Windows\SysWOW64\taskkill.exe
      C:\Windows\SysWOW64\taskkill.exe /F /IM VRP.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:2248
  - - C:\ProgramData\Sony Corporation\Sony Packaging Manager\PackagingTemp\{4DA836DB-2868-489E-892A-DBB9C6F71AD0}\vrp\setup.exe
      "C:\ProgramData\Sony Corporation\Sony Packaging Manager\PackagingTemp\{4DA836DB-2868-489E-892A-DBB9C6F71AD0}\vrp\setup.exe" /s
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops desktop.ini file(s)
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Checks SCSI registry key(s)
      Checks processor information in registry
      PID:3688
    - - C:\Users\Admin\AppData\Local\Temp\{B91A70F1-E447-4C87-9F19-29FE0145F0E8}\ISBEW64.exe
        
        C:\Users\Admin\AppData\Local\Temp\{B91A70F1-E447-4C87-9F19-29FE0145F0E8}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F47C1CA3-5410-4343-9EDB-10BEDBCA28B0}
        5⤵
        Executes dropped EXE
        
        PID:5444
    - - C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\Temp\DXSETUP.exe
        
        "C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\Temp\DXSETUP.exe" /silent
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1868
      - C:\Users\Admin\AppData\Local\Temp\DXA83C.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DXA83C.tmp\infinst.exe D3DX9_42_x64.inf
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:6620
      - C:\Users\Admin\AppData\Local\Temp\DXA83C.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DXA83C.tmp\infinst.exe d3dx10_42_x64.inf
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:6928
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        C:\Windows\SysWOW64\regsvr32.exe /s "C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\VRPSDK.dll"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Identifies Wine through registry keys
        Loads dropped DLL
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:1616
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        C:\Windows\SysWOW64\regsvr32.exe /s "C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\VRPMFMGR.dll"
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:3156
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        C:\Windows\SysWOW64\regsvr32.exe /s "C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\VRPMapping.dll"
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:3928
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\ProgramData\Sony Corporation\Remote Play with PlayStation 3\KeyAssign.xml" /grant *S-1-1-0:F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:6312

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:6052

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:368

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5260
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 422BB52226E78A89E8CF9043CE62B56F
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5352

C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\VRP.exe
"C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\VRP.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:7068

C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\VRP.exe
"C:\Program Files (x86)\Sony\Remote Play with PlayStation 3\VRP.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Virtualization/Sandbox Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion