Overview
overview
9Static
static
3Beat Bange...es.url
windows10-1703-x64
1Beat Bange...es.url
windows10-1703-x64
1Beat Bange...up.exe
windows10-1703-x64
7Beat Bange...up.exe
windows10-1703-x64
7Beat Bange...ll.bat
windows10-1703-x64
7Beat Bange...st.exe
windows10-1703-x64
6Beat Bange...64.exe
windows10-1703-x64
7Beat Bange...86.exe
windows10-1703-x64
7Beat Bange...64.exe
windows10-1703-x64
9Beat Bange...86.exe
windows10-1703-x64
7Beat Bange...64.exe
windows10-1703-x64
7Beat Bange...86.exe
windows10-1703-x64
7Beat Bange...64.exe
windows10-1703-x64
7Beat Bange...86.exe
windows10-1703-x64
7Beat Bange...64.exe
windows10-1703-x64
7Beat Bange...86.exe
windows10-1703-x64
7Beat Bange...64.exe
windows10-1703-x64
4Beat Bange...86.exe
windows10-1703-x64
4Beat Bange...64.exe
windows10-1703-x64
7Beat Bange...86.exe
windows10-1703-x64
7Beat Bange...64.exe
windows10-1703-x64
7Beat Bange...86.exe
windows10-1703-x64
7Beat Bange...st.msi
windows10-1703-x64
6Beat Bange...le.exe
windows10-1703-x64
1Beat Bange...er.exe
windows10-1703-x64
1Beat Bange...eg.exe
windows10-1703-x64
1Beat Bange...be.exe
windows10-1703-x64
1Analysis
-
max time kernel
108s -
max time network
156s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
02-09-2024 19:23
Static task
static1
Behavioral task
behavioral1
Sample
Beat Banger - SteamGG.NET/SteamGG – Free Download Pre-installed Steam Games.url
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
Beat Banger - SteamGG.NET/_Redist/SteamGG – Free Download Pre-installed Steam Games.url
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
Beat Banger - SteamGG.NET/_Redist/dotNetFx40_Full_setup.exe
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
Beat Banger - SteamGG.NET/_Redist/dxwebsetup.exe
Resource
win10-20240404-en
Behavioral task
behavioral5
Sample
Beat Banger - SteamGG.NET/_Redist/install_all.bat
Resource
win10-20240404-en
Behavioral task
behavioral6
Sample
Beat Banger - SteamGG.NET/_Redist/oalinst.exe
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
Beat Banger - SteamGG.NET/_Redist/vcredist2005_x64.exe
Resource
win10-20240404-en
Behavioral task
behavioral8
Sample
Beat Banger - SteamGG.NET/_Redist/vcredist2005_x86.exe
Resource
win10-20240404-en
Behavioral task
behavioral9
Sample
Beat Banger - SteamGG.NET/_Redist/vcredist2008_x64.exe
Resource
win10-20240404-en
Behavioral task
behavioral10
Sample
Beat Banger - SteamGG.NET/_Redist/vcredist2008_x86.exe
Resource
win10-20240404-en
Behavioral task
behavioral11
Sample
Beat Banger - SteamGG.NET/_Redist/vcredist2010_x64.exe
Resource
win10-20240404-en
Behavioral task
behavioral12
Sample
Beat Banger - SteamGG.NET/_Redist/vcredist2010_x86.exe
Resource
win10-20240404-en
Behavioral task
behavioral13
Sample
Beat Banger - SteamGG.NET/_Redist/vcredist2012_x64.exe
Resource
win10-20240611-en
Behavioral task
behavioral14
Sample
Beat Banger - SteamGG.NET/_Redist/vcredist2012_x86.exe
Resource
win10-20240404-en
Behavioral task
behavioral15
Sample
Beat Banger - SteamGG.NET/_Redist/vcredist2013_x64.exe
Resource
win10-20240404-en
Behavioral task
behavioral16
Sample
Beat Banger - SteamGG.NET/_Redist/vcredist2013_x86.exe
Resource
win10-20240404-en
Behavioral task
behavioral17
Sample
Beat Banger - SteamGG.NET/_Redist/vcredist2015_2017_2019_2022_x64.exe
Resource
win10-20240404-en
Behavioral task
behavioral18
Sample
Beat Banger - SteamGG.NET/_Redist/vcredist2015_2017_2019_2022_x86.exe
Resource
win10-20240404-en
Behavioral task
behavioral19
Sample
Beat Banger - SteamGG.NET/_Redist/vcredist_2015-2019_x64.exe
Resource
win10-20240404-en
Behavioral task
behavioral20
Sample
Beat Banger - SteamGG.NET/_Redist/vcredist_2015-2019_x86.exe
Resource
win10-20240404-en
Behavioral task
behavioral21
Sample
Beat Banger - SteamGG.NET/_Redist/vcredist_x64.exe
Resource
win10-20240404-en
Behavioral task
behavioral22
Sample
Beat Banger - SteamGG.NET/_Redist/vcredist_x86.exe
Resource
win10-20240404-en
Behavioral task
behavioral23
Sample
Beat Banger - SteamGG.NET/_Redist/xnafx40_redist.msi
Resource
win10-20240404-en
Behavioral task
behavioral24
Sample
Beat Banger - SteamGG.NET/beatbanger.console.exe
Resource
win10-20240611-en
Behavioral task
behavioral25
Sample
Beat Banger - SteamGG.NET/beatbanger.exe
Resource
win10-20240404-en
Behavioral task
behavioral26
Sample
Beat Banger - SteamGG.NET/bin/win64/ffmpeg.exe
Resource
win10-20240404-en
Behavioral task
behavioral27
Sample
Beat Banger - SteamGG.NET/bin/win64/ffprobe.exe
Resource
win10-20240611-en
General
-
Target
Beat Banger - SteamGG.NET/_Redist/vcredist2005_x64.exe
-
Size
3.0MB
-
MD5
56eaf4e1237c974f6984edc93972c123
-
SHA1
ee916012783024dac67fc606457377932c826f05
-
SHA256
0551a61c85b718e1fa015b0c3e3f4c4eea0637055536c00e7969286b4fa663e0
-
SHA512
f8e15363e34db5b5445c41eea4dd80b2f682642cb8f1046f30ea4fb5f4f51b0b604f7bcb3000a35a7d3ba1d1bcc07df9b25e4533170c65640b2d137c19916736
-
SSDEEP
49152:+r67+stI6RWGTAdyvlADUrpTmcOgohwJpEM5grO3oc1OXZViFeRyDErkLUMHzkRN:AM9l8pUr9m30L5grOQXZKAsErkbQRN
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
MsiExec.exepid process 3000 MsiExec.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
vcredist2005_x64.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" vcredist2005_x64.exe -
Blocklisted process makes network request 1 IoCs
Processes:
msiexec.exeflow pid process 3 2068 msiexec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc process File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe -
Drops file in Program Files directory 1 IoCs
Processes:
msiexec.exedescription ioc process File created C:\Program Files (x86)\Common Files\Microsoft Shared\VC\amd64\msdia80.dll msiexec.exe -
Drops file in Windows directory 57 IoCs
Processes:
msiexec.exedescription ioc process File created C:\Windows\WinSxS\InstallTemp\20240902193305737.0\mfc80CHS.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240902193305737.0\mfc80FRA.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240902193305816.0\8.0.50727.6195.cat msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240902193305800.0 msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI2324.tmp msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240902193305706.0\amd64_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_4716846b.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240902193305659.0\amd64_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_d6cffeda.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240902193305675.0\msvcm80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240902193305706.0\mfc80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240902193305784.0\amd64_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_7735df00.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240902193305675.0\amd64_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_76301166.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240902193305737.0\mfc80ESP.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240902193305816.0\8.0.50727.6195.policy msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240902193305706.0 msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240902193305816.1 msiexec.exe File opened for modification C:\Windows\Installer\e581a3a.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI1D66.tmp msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240902193305737.0\amd64_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_9c659d69.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240902193305800.1\8.0.50727.6195.policy msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240902193305706.0\mfcm80u.dll msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240902193305816.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240902193305737.0\mfc80CHT.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240902193305816.2\8.0.50727.6195.policy msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240902193305659.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240902193305800.0\8.0.50727.6195.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240902193305800.1\8.0.50727.6195.cat msiexec.exe File created C:\Windows\Installer\e581a3e.msi msiexec.exe File created C:\Windows\Installer\e581a3a.msi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240902193305675.0\msvcp80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240902193305784.0\amd64_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_7735df00.manifest msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240902193305784.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240902193305659.0\ATL80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240902193305675.0\msvcr80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240902193305816.2\8.0.50727.6195.cat msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240902193305816.1\8.0.50727.6195.policy msiexec.exe File created C:\Windows\Installer\SourceHash{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028} msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240902193305737.0\mfc80DEU.dll msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240902193305675.0 msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240902193305737.0 msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240902193305816.2 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240902193305659.0\amd64_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_d6cffeda.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240902193305675.0\amd64_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_76301166.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240902193305737.0\mfc80ENU.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240902193305800.0\8.0.50727.6195.policy msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240902193305706.0\amd64_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_4716846b.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240902193305737.0\mfc80JPN.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240902193305816.1\8.0.50727.6195.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240902193305706.0\mfcm80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240902193305784.0\vcomp.dll msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240902193305800.1 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240902193305706.0\mfc80u.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240902193305737.0\amd64_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_9c659d69.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240902193305737.0\mfc80ITA.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240902193305737.0\mfc80KOR.dll msiexec.exe -
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
vcredist2005_x64.exemsiexec.exeMsiExec.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist2005_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe -
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\DeviceDesc svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Mfg svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006 svchost.exe -
Modifies data under HKEY_USERS 5 IoCs
Processes:
svchost.exemsiexec.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache svchost.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1A\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b msiexec.exe -
Modifies registry class 56 IoCs
Processes:
msiexec.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.CRT,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e004b0039007000540041002700650026005d002900650038004d006b0062004900640046007700550000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\Language = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Features\1af2a8da7e60d0b429d7e6453b3d0182 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Win32Assemblies\Global msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFC,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e00240062003000290043004b0076003d0035002700650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1af2a8da7e60d0b429d7e6453b3d0182\VC_Redist msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\ProductName = "Microsoft Visual C++ 2005 Redistributable (x64)" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\10 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Net msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\5 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\11 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFCLOC,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e00530021004900240047002e004f005f0078006800650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.OpenMP,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e007e0078002d00360076007a0045007a007e003200650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\92091D8AC5E822E408118470F0E997E6\1af2a8da7e60d0b429d7e6453b3d0182 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\2 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\92091D8AC5E822E408118470F0E997E6 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFCLOC,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e00500054005d002700660025002b0027004b002800650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1af2a8da7e60d0b429d7e6453b3d0182\Servicing_Key msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\PackageName = "vcredist.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\9 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\Version = "134278728" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\8 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\3 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\PackageCode = "C558A51006735C645AEE5A0FC6A310C9" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\1 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.ATL,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e005a00310021003d00520046007900460072005700650038004d006b0062004900640046007700550000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFC,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e0069002a0048004e00530057007d0024007e005500650038004d006b0062004900640046007700550000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\92091D8AC5E822E408118470F0E997E6 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\7 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\Clients = 3a0000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.CRT,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e0049004c005400540052005900320074004f005700650038004d006b0062004900640046007700550000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1af2a8da7e60d0b429d7e6453b3d0182 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\4 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.OpenMP,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e007a0050005400310026006e0073004b0064007a00650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\6 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.ATL,type="win32-policy",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e007b004c0046003d0042004900620074004f002800650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\InstanceType = "0" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1af2a8da7e60d0b429d7e6453b3d0182 msiexec.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
msiexec.exepid process 1292 msiexec.exe 1292 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
msiexec.exemsiexec.exevssvc.exedescription pid process Token: SeShutdownPrivilege 2068 msiexec.exe Token: SeIncreaseQuotaPrivilege 2068 msiexec.exe Token: SeSecurityPrivilege 1292 msiexec.exe Token: SeCreateTokenPrivilege 2068 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2068 msiexec.exe Token: SeLockMemoryPrivilege 2068 msiexec.exe Token: SeIncreaseQuotaPrivilege 2068 msiexec.exe Token: SeMachineAccountPrivilege 2068 msiexec.exe Token: SeTcbPrivilege 2068 msiexec.exe Token: SeSecurityPrivilege 2068 msiexec.exe Token: SeTakeOwnershipPrivilege 2068 msiexec.exe Token: SeLoadDriverPrivilege 2068 msiexec.exe Token: SeSystemProfilePrivilege 2068 msiexec.exe Token: SeSystemtimePrivilege 2068 msiexec.exe Token: SeProfSingleProcessPrivilege 2068 msiexec.exe Token: SeIncBasePriorityPrivilege 2068 msiexec.exe Token: SeCreatePagefilePrivilege 2068 msiexec.exe Token: SeCreatePermanentPrivilege 2068 msiexec.exe Token: SeBackupPrivilege 2068 msiexec.exe Token: SeRestorePrivilege 2068 msiexec.exe Token: SeShutdownPrivilege 2068 msiexec.exe Token: SeDebugPrivilege 2068 msiexec.exe Token: SeAuditPrivilege 2068 msiexec.exe Token: SeSystemEnvironmentPrivilege 2068 msiexec.exe Token: SeChangeNotifyPrivilege 2068 msiexec.exe Token: SeRemoteShutdownPrivilege 2068 msiexec.exe Token: SeUndockPrivilege 2068 msiexec.exe Token: SeSyncAgentPrivilege 2068 msiexec.exe Token: SeEnableDelegationPrivilege 2068 msiexec.exe Token: SeManageVolumePrivilege 2068 msiexec.exe Token: SeImpersonatePrivilege 2068 msiexec.exe Token: SeCreateGlobalPrivilege 2068 msiexec.exe Token: SeBackupPrivilege 484 vssvc.exe Token: SeRestorePrivilege 484 vssvc.exe Token: SeAuditPrivilege 484 vssvc.exe Token: SeBackupPrivilege 1292 msiexec.exe Token: SeRestorePrivilege 1292 msiexec.exe Token: SeRestorePrivilege 1292 msiexec.exe Token: SeTakeOwnershipPrivilege 1292 msiexec.exe Token: SeRestorePrivilege 1292 msiexec.exe Token: SeTakeOwnershipPrivilege 1292 msiexec.exe Token: SeRestorePrivilege 1292 msiexec.exe Token: SeTakeOwnershipPrivilege 1292 msiexec.exe Token: SeRestorePrivilege 1292 msiexec.exe Token: SeTakeOwnershipPrivilege 1292 msiexec.exe Token: SeRestorePrivilege 1292 msiexec.exe Token: SeTakeOwnershipPrivilege 1292 msiexec.exe Token: SeRestorePrivilege 1292 msiexec.exe Token: SeTakeOwnershipPrivilege 1292 msiexec.exe Token: SeRestorePrivilege 1292 msiexec.exe Token: SeTakeOwnershipPrivilege 1292 msiexec.exe Token: SeRestorePrivilege 1292 msiexec.exe Token: SeTakeOwnershipPrivilege 1292 msiexec.exe Token: SeRestorePrivilege 1292 msiexec.exe Token: SeTakeOwnershipPrivilege 1292 msiexec.exe Token: SeRestorePrivilege 1292 msiexec.exe Token: SeTakeOwnershipPrivilege 1292 msiexec.exe Token: SeRestorePrivilege 1292 msiexec.exe Token: SeTakeOwnershipPrivilege 1292 msiexec.exe Token: SeRestorePrivilege 1292 msiexec.exe Token: SeTakeOwnershipPrivilege 1292 msiexec.exe Token: SeRestorePrivilege 1292 msiexec.exe Token: SeTakeOwnershipPrivilege 1292 msiexec.exe Token: SeRestorePrivilege 1292 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
msiexec.exepid process 2068 msiexec.exe 2068 msiexec.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
vcredist2005_x64.exemsiexec.exedescription pid process target process PID 4516 wrote to memory of 2068 4516 vcredist2005_x64.exe msiexec.exe PID 4516 wrote to memory of 2068 4516 vcredist2005_x64.exe msiexec.exe PID 4516 wrote to memory of 2068 4516 vcredist2005_x64.exe msiexec.exe PID 1292 wrote to memory of 3488 1292 msiexec.exe srtasks.exe PID 1292 wrote to memory of 3488 1292 msiexec.exe srtasks.exe PID 1292 wrote to memory of 3000 1292 msiexec.exe MsiExec.exe PID 1292 wrote to memory of 3000 1292 msiexec.exe MsiExec.exe PID 1292 wrote to memory of 3000 1292 msiexec.exe MsiExec.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Beat Banger - SteamGG.NET\_Redist\vcredist2005_x64.exe"C:\Users\Admin\AppData\Local\Temp\Beat Banger - SteamGG.NET\_Redist\vcredist2005_x64.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Windows\SysWOW64\msiexec.exemsiexec /i vcredist.msi2⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2068
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:3488
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C3C355B93E6030529BCD4209B93AAFFD2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3000
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:484
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:2384
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
312KB
MD577a9bff5af149160775741e204734d47
SHA17b5126af69b5a79593f39db94180f1ff11b0e39d
SHA25620a26ed9a1edf7763a9b515522c5e29720048a482c7fbc8b7ff6bbdd27e61038
SHA512bb0440f58f07e113bddd9a0afb5aab8af6493218784fe5fa6f4032e3a37088f91b7e766dee87cec4a9ea11d425d27b3b536430de3a52222e8bca3e0247d81e3b
-
Filesize
3.0MB
MD56dbdf338a0a25cdb236d43ea3ca2395e
SHA1685b6ea61e574e628392eaac8b10aff4309f1081
SHA256200fef5d4994523a02c4daa00060db28eb289b99d47fc6c1305183101e72bdeb
SHA5126b5b31c55cf72ab92b17fb6074b3901a1e6afe0796ef9bc831e4dfb97450376d2889cd24b1cf3fce60eb3c1bcd1b31254b5cfa3ef6107974dfa0b35c233daf5a
-
Filesize
28KB
MD585221b3bcba8dbe4b4a46581aa49f760
SHA1746645c92594bfc739f77812d67cfd85f4b92474
SHA256f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f
SHA512060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d
-
Filesize
26.0MB
MD5bcc7c8073084a060e040e2e9a388741c
SHA126841de317d88c59e98b1ea00a5a9b7446a12d94
SHA256eec2bfa26e9d360f9b6e56fccc3a3b7f3c9f127aecb8a609d3cb06b6381f91f2
SHA51262d3aa7b72bf45890b33321a991af50faff2d22adc01bfa188e5fcdbf4b29b056d24c8a0d1fb469f6ece50f92f158c63758184381f9902d2413cc804a4cef0e0
-
\??\Volume{39cd0eda-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{935354f0-9a3f-4566-a8e3-02e7885f9ecc}_OnDiskSnapshotProp
Filesize5KB
MD53ba8efaf1baaa13d7171d33ed7148322
SHA1a5c9ce03ed687207e6b3b0474ea8e4ec1d8d0d4e
SHA25671f71b2d171cb974488bc728601e6712806c19480270a0ad08b052a538cec400
SHA51201ca5eae2d661007763c78776a9145afbf9ba13f00c61517d5f164f40b4a9af52807b40867f37b98dc02aa6557ed49e45daac5c3daa65c7e4cf937ae1dd07b5c