rhadamanthys | b4346702b4b5029cbd627b5df724550f8b783ba22876e5070dadc0ed5c214df2

Analysis

max time kernel
239s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10-09-2024 03:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4346702b4b5029cbd627b5df724550f8b783ba22876e5070dadc0ed5c214df2.msi
Size

23.0MB
MD5

4295dda40427af8df6738b3531d63389
SHA1

cb5a45de787c34eda399a3cad64abd3b6133f514
SHA256

b4346702b4b5029cbd627b5df724550f8b783ba22876e5070dadc0ed5c214df2
SHA512

31ae6245cc6188e9d8b471c9cb169263fb7189e3d7653266857db01e3b92b1773ddc1971e3468734f48294f48aaf1a1e93b21d3ffc89dc30f6fcf8549c6a24e2
SSDEEP

393216:u66L7jpW/sxwA0Ip5AGgrJmD1Y5D9xAgAmBOn4AZENqMJiaErOQtt4KgTD5v2X:uHWUxOQxZDKNfAuOri9rQtlKy

Score

10^/10

rhadamanthys discovery execution persistence privilege_escalation stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

MsiExec.exe

description pid process target process

PID 2268 created 1252 2268 MsiExec.exe Explorer.EXE
Blocklisted process makes network request 3 IoCs

Processes:

msiexec.exemsiexec.exe

flow pid process

3 2664 msiexec.exe
5 2664 msiexec.exe
7 2016 msiexec.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

2172 powershell.exe

description	pid	process	target process
PID 2268 created 1252	2268	MsiExec.exe	Explorer.EXE

flow	pid	process
3	2664	msiexec.exe
5	2664	msiexec.exe
7	2016	msiexec.exe

pid	process
2172	powershell.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Drops file in Program Files directory 64 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Program Files (x86)\GitExtensions\System.Linq.Queryable.dll	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\EasyHook32.dll	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\gitex.cmd	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\Microsoft.VisualStudio.Validation.dll	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\pl\Microsoft.VisualStudio.Composition.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\set-telemetry.ps1	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\Translation\Simplified Chinese.xlf	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\System.Collections.NonGeneric.dll	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\System.Security.Cryptography.Csp.dll	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\Plugins\AutoCompileSubmodules.dll	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\ja\Microsoft.VisualStudio.Validation.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\Plugins\es\Microsoft.TeamFoundation.Core.WebApi.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\System.Reflection.Extensions.dll	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\System.Threading.Tasks.Parallel.dll	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\Plugins\cs\Microsoft.VisualStudio.Services.Common.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\Plugins\tr\Microsoft.TeamFoundation.Core.WebApi.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\Translation\Simplified Chinese.gif	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\Translation\Spanish.xlf	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\Dictionaries\de-DE.dic	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\Plugins\DeleteUnusedBranches.dll	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\Plugins\pl\Microsoft.TeamFoundation.Common.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\PuTTY\puttygen.exe	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\System.IO.IsolatedStorage.dll	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\Microsoft.WindowsAPICodePack.dll	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\Plugins\tr\Microsoft.TeamFoundation.Dashboards.WebApi.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\Plugins\zh-Hant\Microsoft.TeamFoundation.Core.WebApi.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\Translation\Polish.xlf	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\AdysTech.CredentialManager.dll	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\Plugins\Microsoft.TeamFoundation.Build2.WebApi.dll	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\Plugins\Microsoft.TeamFoundation.Core.WebApi.dll	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\Dictionaries\nl-NL.dic	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\System.Xml.ReaderWriter.dll	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\System.Xml.XDocument.dll	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\Plugins\it\Microsoft.TeamFoundation.Dashboards.WebApi.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\Plugins\tr\Microsoft.VisualStudio.Services.Common.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\System.Collections.Specialized.dll	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\System.Net.Ping.dll	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\System.Net.Sockets.dll	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\System.Threading.dll	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\Plugins\TfsInterop.Vs2012.dll	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\ConEmu\ConEmu64.exe	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\Dictionaries\es-MX.dic	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\Dictionaries\fr-FR.dic	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\fr\Microsoft.VisualStudio.Composition.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\Translation\French.gif	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\Plugins\it\Microsoft.TeamFoundation.Common.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\Plugins\ja\Microsoft.TeamFoundation.Core.WebApi.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\Dictionaries\ru-RU.dic	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\Plugins\zh-Hans\Microsoft.VisualStudio.Services.Common.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\Translation\Russian.xlf	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\System.ComponentModel.TypeConverter.dll	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\System.IO.FileSystem.Watcher.dll	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\System.Reactive.Linq.dll	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\System.ValueTuple.dll	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\Themes\win10default.css	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\ConEmu\ConEmuCD64.dll	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\Dictionaries\en-CA.dic	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\Plugins\JiraCommitHintPlugin.dll	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\PuTTY\pageant.exe	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\System.Net.Requests.dll	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\fr\Microsoft.VisualStudio.Threading.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\GitExtensionsShellEx64.dll	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\ICSharpCode.SharpZipLib.dll	msiexec.exe
File created	C:\Program Files (x86)\GitExtensions\Plugins\Microsoft.VisualStudio.Services.Common.dll	msiexec.exe

Drops file in Windows directory 42 IoCs

Processes:

msiexec.exengen.exengen.exeDrvInst.exengen.exeDrvInst.exengen.exe

description	ioc	process
File created	C:\Windows\Installer\f77b26e.msi	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat	ngen.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	ngen.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI3525.tmp	msiexec.exe
File created	C:\Windows\Installer\{9DA925A7-6D52-41F8-B91E-872C0FCC2E9D}\gitextensions.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\{9DA925A7-6D52-41F8-B91E-872C0FCC2E9D}\gitextensions.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI566D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6628.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	ngen.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIB7C7.tmp	msiexec.exe
File created	C:\Windows\Installer\f77b273.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI658B.tmp	msiexec.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File opened for modification	C:\Windows\Installer\f77b26e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3209.tmp	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat	ngen.exe
File created	C:\Windows\Installer\f77b26f.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log	ngen.exe
File opened for modification	C:\Windows\Installer\f77b273.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICDC8.tmp	msiexec.exe
File created	C:\Windows\Installer\f77b271.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f77b26f.ipi	msiexec.exe
File created	C:\Windows\Installer\f77b272.msi	msiexec.exe
File created	C:\Windows\Installer\f77b275.msi	msiexec.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\Installer\f77b272.msi	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe

Loads dropped DLL 6 IoCs

Processes:

MsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exe

pid process

2268 MsiExec.exe
360 MsiExec.exe
2672 MsiExec.exe
2672 MsiExec.exe
2220 MsiExec.exe
2220 MsiExec.exe
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
persistence privilege_escalation

Installer Packages
T1546.016

Msiexec
T1218.007

Processes:

msiexec.exe

pid process

2664 msiexec.exe

pid	process
2664	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

MsiExec.exemsiexec.exeMsiExec.exengen.exedialer.exeMsiExec.exepowershell.exeMsiExec.exengen.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dialer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

DrvInst.exeDrvInst.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\system32\qagentrt.dll,-10 = "System Health Authentication"	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\system32\p2pcollab.dll,-8042 = "Peer to Peer Trust"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e\52C64B7E	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe

Modifies registry class 64 IoCs

Processes:

msiexec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\GitExtensions	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\GitExtensions\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\GitExtensions2\ = "{3C16B20A-BA16-4156-916F-0A375ECFFE24}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7A529AD925D68F149BE178C2F0CCE2D9\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GitExtensions\shell\open\command\ = "\"C:\\Program Files (x86)\\GitExtensions\\GitExtensions.exe\" openrepo \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3C16B20A-BA16-4156-916F-0A375ECFFE24}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\github-windows	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\github-mac	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7A529AD925D68F149BE178C2F0CCE2D9\roRO = "Dictionaries"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7A529AD925D68F149BE178C2F0CCE2D9\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7A529AD925D68F149BE178C2F0CCE2D9\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\git\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{3C16B20A-BA16-4156-916F-0A375ECFFE24}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7A529AD925D68F149BE178C2F0CCE2D9\JiraCommitHintPlugin = "Plugins"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7A529AD925D68F149BE178C2F0CCE2D9\Translation = "GitExtensions"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F44E241F0BCCADE479DE975C6A0CB160\DefaultFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\github-mac\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\github-mac\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7A529AD925D68F149BE178C2F0CCE2D9\enAU = "Dictionaries"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7A529AD925D68F149BE178C2F0CCE2D9\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\Background\shellex\ContextMenuHandlers\GitExtensions2\ = "{3C16B20A-BA16-4156-916F-0A375ECFFE24}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\github-windows\shell\open\command\ = "\"C:\\Program Files (x86)\\GitExtensions\\GitExtensions.exe\" %1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\github-mac\ = "URL: Github for Mac Protocol"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7A529AD925D68F149BE178C2F0CCE2D9\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7A529AD925D68F149BE178C2F0CCE2D9\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\GitExtensions2\ = "{3C16B20A-BA16-4156-916F-0A375ECFFE24}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7A529AD925D68F149BE178C2F0CCE2D9\DeleteUnusedBranches = "Plugins"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7A529AD925D68F149BE178C2F0CCE2D9\enCA = "Dictionaries"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7A529AD925D68F149BE178C2F0CCE2D9\ProductName = "Git Extensions 3.4.3.9999"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7A529AD925D68F149BE178C2F0CCE2D9\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7A529AD925D68F149BE178C2F0CCE2D9\GitExtensions.desktop = "GitExtensions"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7A529AD925D68F149BE178C2F0CCE2D9\JenkinsIntegration = "Plugins"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7A529AD925D68F149BE178C2F0CCE2D9\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\github-mac\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3C16B20A-BA16-4156-916F-0A375ECFFE24}\ = "GitExtensions Shell Extension"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3C16B20A-BA16-4156-916F-0A375ECFFE24}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7A529AD925D68F149BE178C2F0CCE2D9\ReleaseNotesGenerator = "Plugins"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7A529AD925D68F149BE178C2F0CCE2D9\esMX = "Dictionaries"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{3C16B20A-BA16-4156-916F-0A375ECFFE24}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7A529AD925D68F149BE178C2F0CCE2D9\CreateLocalBranches = "Plugins"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\git	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\Version = "16777216"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\DeploymentFlags = "2"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GitExtensions\shell\open\ = "Open Git Extentions Repository"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\github-windows\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\github-windows	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A425586BD2489EF4F8012A4FFEF4857B	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Directory\shellex\ContextMenuHandlers\GitExtensions2	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\github-mac\shell\open\command\ = "\"C:\\Program Files (x86)\\GitExtensions\\GitExtensions.exe\" %1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7A529AD925D68F149BE178C2F0CCE2D9\AutoCompileSubmodules = "Plugins"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7A529AD925D68F149BE178C2F0CCE2D9\Gource = "Plugins"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7A529AD925D68F149BE178C2F0CCE2D9\DiffScripts = "GitExtensions"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7A529AD925D68F149BE178C2F0CCE2D9\deDE = "Dictionaries"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AE08E0413505CD24BAE0F60F4EE9B6FC\7A529AD925D68F149BE178C2F0CCE2D9	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F44E241F0BCCADE479DE975C6A0CB160\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\*\shellex\ContextMenuHandlers\GitExtensions2	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\git\URL Protocol	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7A529AD925D68F149BE178C2F0CCE2D9\FindLargeFiles = "Plugins"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7A529AD925D68F149BE178C2F0CCE2D9\GitFlow = "Plugins"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

MsiExec.exemsiexec.exedialer.exepowershell.exe

pid	process
2268	MsiExec.exe
2268	MsiExec.exe
2016	msiexec.exe
2016	msiexec.exe
2308	dialer.exe
2308	dialer.exe
2308	dialer.exe
2308	dialer.exe
2016	msiexec.exe
2016	msiexec.exe
2172	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exeDrvInst.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	2664	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2664	msiexec.exe
Token: SeRestorePrivilege	2016	msiexec.exe
Token: SeTakeOwnershipPrivilege	2016	msiexec.exe
Token: SeSecurityPrivilege	2016	msiexec.exe
Token: SeCreateTokenPrivilege	2664	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2664	msiexec.exe
Token: SeLockMemoryPrivilege	2664	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2664	msiexec.exe
Token: SeMachineAccountPrivilege	2664	msiexec.exe
Token: SeTcbPrivilege	2664	msiexec.exe
Token: SeSecurityPrivilege	2664	msiexec.exe
Token: SeTakeOwnershipPrivilege	2664	msiexec.exe
Token: SeLoadDriverPrivilege	2664	msiexec.exe
Token: SeSystemProfilePrivilege	2664	msiexec.exe
Token: SeSystemtimePrivilege	2664	msiexec.exe
Token: SeProfSingleProcessPrivilege	2664	msiexec.exe
Token: SeIncBasePriorityPrivilege	2664	msiexec.exe
Token: SeCreatePagefilePrivilege	2664	msiexec.exe
Token: SeCreatePermanentPrivilege	2664	msiexec.exe
Token: SeBackupPrivilege	2664	msiexec.exe
Token: SeRestorePrivilege	2664	msiexec.exe
Token: SeShutdownPrivilege	2664	msiexec.exe
Token: SeDebugPrivilege	2664	msiexec.exe
Token: SeAuditPrivilege	2664	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2664	msiexec.exe
Token: SeChangeNotifyPrivilege	2664	msiexec.exe
Token: SeRemoteShutdownPrivilege	2664	msiexec.exe
Token: SeUndockPrivilege	2664	msiexec.exe
Token: SeSyncAgentPrivilege	2664	msiexec.exe
Token: SeEnableDelegationPrivilege	2664	msiexec.exe
Token: SeManageVolumePrivilege	2664	msiexec.exe
Token: SeImpersonatePrivilege	2664	msiexec.exe
Token: SeCreateGlobalPrivilege	2664	msiexec.exe
Token: SeBackupPrivilege	2156	vssvc.exe
Token: SeRestorePrivilege	2156	vssvc.exe
Token: SeAuditPrivilege	2156	vssvc.exe
Token: SeBackupPrivilege	2016	msiexec.exe
Token: SeRestorePrivilege	2016	msiexec.exe
Token: SeRestorePrivilege	1672	DrvInst.exe
Token: SeRestorePrivilege	1672	DrvInst.exe
Token: SeRestorePrivilege	1672	DrvInst.exe
Token: SeRestorePrivilege	1672	DrvInst.exe
Token: SeRestorePrivilege	1672	DrvInst.exe
Token: SeRestorePrivilege	1672	DrvInst.exe
Token: SeRestorePrivilege	1672	DrvInst.exe
Token: SeLoadDriverPrivilege	1672	DrvInst.exe
Token: SeLoadDriverPrivilege	1672	DrvInst.exe
Token: SeLoadDriverPrivilege	1672	DrvInst.exe
Token: SeRestorePrivilege	2016	msiexec.exe
Token: SeTakeOwnershipPrivilege	2016	msiexec.exe
Token: SeRestorePrivilege	2016	msiexec.exe
Token: SeTakeOwnershipPrivilege	2016	msiexec.exe
Token: SeShutdownPrivilege	1784	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1784	msiexec.exe
Token: SeCreateTokenPrivilege	1784	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1784	msiexec.exe
Token: SeLockMemoryPrivilege	1784	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1784	msiexec.exe
Token: SeMachineAccountPrivilege	1784	msiexec.exe
Token: SeTcbPrivilege	1784	msiexec.exe
Token: SeSecurityPrivilege	1784	msiexec.exe
Token: SeTakeOwnershipPrivilege	1784	msiexec.exe
Token: SeLoadDriverPrivilege	1784	msiexec.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

msiexec.exemsiexec.exe

pid process

2664 msiexec.exe
1784 msiexec.exe
2664 msiexec.exe
1784 msiexec.exe

pid	process
2664	msiexec.exe
1784	msiexec.exe
2664	msiexec.exe
1784	msiexec.exe

Suspicious use of WriteProcessMemory 61 IoCs

Processes:

msiexec.exeMsiExec.exeMsiExec.exeMsiExec.exe

description	pid	process	target process
PID 2016 wrote to memory of 2268	2016	msiexec.exe	MsiExec.exe
PID 2016 wrote to memory of 2268	2016	msiexec.exe	MsiExec.exe
PID 2016 wrote to memory of 2268	2016	msiexec.exe	MsiExec.exe
PID 2016 wrote to memory of 2268	2016	msiexec.exe	MsiExec.exe
PID 2016 wrote to memory of 2268	2016	msiexec.exe	MsiExec.exe
PID 2016 wrote to memory of 2268	2016	msiexec.exe	MsiExec.exe
PID 2016 wrote to memory of 2268	2016	msiexec.exe	MsiExec.exe
PID 2268 wrote to memory of 1784	2268	MsiExec.exe	msiexec.exe
PID 2268 wrote to memory of 1784	2268	MsiExec.exe	msiexec.exe
PID 2268 wrote to memory of 1784	2268	MsiExec.exe	msiexec.exe
PID 2268 wrote to memory of 1784	2268	MsiExec.exe	msiexec.exe
PID 2268 wrote to memory of 1784	2268	MsiExec.exe	msiexec.exe
PID 2268 wrote to memory of 1784	2268	MsiExec.exe	msiexec.exe
PID 2268 wrote to memory of 1784	2268	MsiExec.exe	msiexec.exe
PID 2268 wrote to memory of 2308	2268	MsiExec.exe	dialer.exe
PID 2268 wrote to memory of 2308	2268	MsiExec.exe	dialer.exe
PID 2268 wrote to memory of 2308	2268	MsiExec.exe	dialer.exe
PID 2268 wrote to memory of 2308	2268	MsiExec.exe	dialer.exe
PID 2268 wrote to memory of 2308	2268	MsiExec.exe	dialer.exe
PID 2268 wrote to memory of 2308	2268	MsiExec.exe	dialer.exe
PID 2016 wrote to memory of 360	2016	msiexec.exe	MsiExec.exe
PID 2016 wrote to memory of 360	2016	msiexec.exe	MsiExec.exe
PID 2016 wrote to memory of 360	2016	msiexec.exe	MsiExec.exe
PID 2016 wrote to memory of 360	2016	msiexec.exe	MsiExec.exe
PID 2016 wrote to memory of 360	2016	msiexec.exe	MsiExec.exe
PID 2016 wrote to memory of 360	2016	msiexec.exe	MsiExec.exe
PID 2016 wrote to memory of 360	2016	msiexec.exe	MsiExec.exe
PID 2016 wrote to memory of 2672	2016	msiexec.exe	MsiExec.exe
PID 2016 wrote to memory of 2672	2016	msiexec.exe	MsiExec.exe
PID 2016 wrote to memory of 2672	2016	msiexec.exe	MsiExec.exe
PID 2016 wrote to memory of 2672	2016	msiexec.exe	MsiExec.exe
PID 2016 wrote to memory of 2672	2016	msiexec.exe	MsiExec.exe
PID 2016 wrote to memory of 2672	2016	msiexec.exe	MsiExec.exe
PID 2016 wrote to memory of 2672	2016	msiexec.exe	MsiExec.exe
PID 2672 wrote to memory of 2172	2672	MsiExec.exe	powershell.exe
PID 2672 wrote to memory of 2172	2672	MsiExec.exe	powershell.exe
PID 2672 wrote to memory of 2172	2672	MsiExec.exe	powershell.exe
PID 2672 wrote to memory of 2172	2672	MsiExec.exe	powershell.exe
PID 2016 wrote to memory of 2220	2016	msiexec.exe	MsiExec.exe
PID 2016 wrote to memory of 2220	2016	msiexec.exe	MsiExec.exe
PID 2016 wrote to memory of 2220	2016	msiexec.exe	MsiExec.exe
PID 2016 wrote to memory of 2220	2016	msiexec.exe	MsiExec.exe
PID 2016 wrote to memory of 2220	2016	msiexec.exe	MsiExec.exe
PID 2016 wrote to memory of 2220	2016	msiexec.exe	MsiExec.exe
PID 2016 wrote to memory of 2220	2016	msiexec.exe	MsiExec.exe
PID 2220 wrote to memory of 1956	2220	MsiExec.exe	ngen.exe
PID 2220 wrote to memory of 1956	2220	MsiExec.exe	ngen.exe
PID 2220 wrote to memory of 1956	2220	MsiExec.exe	ngen.exe
PID 2220 wrote to memory of 1956	2220	MsiExec.exe	ngen.exe
PID 2220 wrote to memory of 2132	2220	MsiExec.exe	ngen.exe
PID 2220 wrote to memory of 2132	2220	MsiExec.exe	ngen.exe
PID 2220 wrote to memory of 2132	2220	MsiExec.exe	ngen.exe
PID 2220 wrote to memory of 2132	2220	MsiExec.exe	ngen.exe
PID 2220 wrote to memory of 1912	2220	MsiExec.exe	ngen.exe
PID 2220 wrote to memory of 1912	2220	MsiExec.exe	ngen.exe
PID 2220 wrote to memory of 1912	2220	MsiExec.exe	ngen.exe
PID 2220 wrote to memory of 1912	2220	MsiExec.exe	ngen.exe
PID 2220 wrote to memory of 316	2220	MsiExec.exe	ngen.exe
PID 2220 wrote to memory of 316	2220	MsiExec.exe	ngen.exe
PID 2220 wrote to memory of 316	2220	MsiExec.exe	ngen.exe
PID 2220 wrote to memory of 316	2220	MsiExec.exe	ngen.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1252
- C:\Windows\system32\msiexec.exe
  msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\b4346702b4b5029cbd627b5df724550f8b783ba22876e5070dadc0ed5c214df2.msi
  2⤵
  - Blocklisted process makes network request
  - Enumerates connected drives
  - Event Triggered Execution: Installer Packages
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2664
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2308

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7DE915DF86DF71A3B75E2EFA422400AD
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\dXNlcg==.msi"
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:1784
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2405718282FC8527520EA51617B28C1E C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:360
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F8C4DC12CEC7C0D0F5CBA01737F35633
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2672
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -InputFormat None -ExecutionPolicy Bypass -Command "& 'C:\Program Files (x86)\GitExtensions\set-telemetry.ps1' 1; exit $($Error.Count)"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2172
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 92315C43DE14069951C7BA9F28C2FC54 M Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\GitExtensions\GitExtensions.exe" /queue:1
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:1956
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\GitExtensions\GitExtensions.exe" /queue:1
    3⤵
    - Drops file in Windows directory
    PID:2132
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe update /queue
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:1912
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe update /queue
    3⤵
    - Drops file in Windows directory
    PID:316

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2156

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005EC" "000000000000049C"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1672

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot20" "" "" "65dbac317" "0000000000000000" "00000000000002C8" "000000000000049C"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f77b270.rbs

Filesize
6KB

MD5
13447f454cc2200b836cfda2a2d36a43

SHA1
944ae2a2bbe4d59c491896a094dbfe8956cf23fb

SHA256
632506111bbc9edca1d7969e272b4e87bbda8bade86e980aab5811b3e3b0d0a3

SHA512
bda1f65991cfd846ed50d8e87ee22143e3370a36ce08c38b22ebe6cacdd4226e1280a82516709399003e60c57fdc01d72a99e8799feaab35a667e2d1d1ab5706

Download Submit
C:\Config.Msi\f77b274.rbs

Filesize
374KB

MD5
d215d9aece7a22fb681abba85f2e7e35

SHA1
182d4b44712c2967f862bab6dd2b16dd95b6eefa

SHA256
ba81f55c89b98ba36d287d1061e30b24a21d56f5d7baab39f19c604b0b958942

SHA512
c4be2ea1ed4cd3de1429cd94b84581574ffd01154bb090d71c20e165ca91d50bed08e1a980a4b97c4453529a4088c77036fa847155f5697e145c764dd3ffe1cc

Download Submit
C:\Program Files (x86)\GitExtensions\GitExtensions.exe

Filesize
60KB

MD5
79cfa8efd0538e708032f4397bdd1126

SHA1
bba7b2666d1253d23dd06194edc44587d9d56c85

SHA256
86e6b413bbbb9e84fa5ef4898313c6f7848854e0bfc5f94fc537f3c23c27001e

SHA512
09853af9e9a0c7527b1c0047f22e95c221b6fa91bca8c674b126b773a838ec7dc99e1de5007927ba54edd3fe8f6d58568598d40a39c475b38f1e38ec36b95058

Download Submit
C:\Program Files (x86)\GitExtensions\set-telemetry.ps1

Filesize
14KB

MD5
46aa555e44a8a327b91bea688604102a

SHA1
4e70f82e8df312e5791cc2c739481594ae423b48

SHA256
84bbd4cdf41af135871d612cb2869cd698c09fa623317ff36d8eda16565360f8

SHA512
44e06c72c8cef051ba24dd387eb51465d4a02ef69863dbf842674568a91d9ea645670bbb753b966c48b17bf3d415ee9c7bfcd1164025dd433c600f3bb26c0022

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07298EE8EBA9732300AE62BDCA6B6898

Filesize
1KB

MD5
e11e31581aae545302f6176a117b4d95

SHA1
743af0529bd032a0f44a83cdd4baa97b7c2ec49a

SHA256
2e7bf16cc22485a7bbe2aa8696750761b0ae39be3b2fe9d0cc6d4ef73491425c

SHA512
c63aba6ca79c60a92b3bd26d784a5436e45a626022958bf6c194afc380c7bfb01fadf0b772513bbdbd7f1bb73691b0edb2f60b2f235ec9e0b81c427e04fbe451

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07298EE8EBA9732300AE62BDCA6B6898

Filesize
312B

MD5
ca4ed5e440650e1fedef97672db3e6a6

SHA1
8aafdfbe62386e8fc3a79d0b21ed07f123e8140a

SHA256
5771e4c408a13a30080215ef91a1e970ae8790dc600834a6d286646d17288a35

SHA512
a19fbe42af4ab09da6ec157e32a36b7b5856e11d5e6e1ba33f89e6112b0254339aa0069e9f6098752d4d76310b1c6213dfd510966831046c2cec95d6a2828783

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f4a8c927105e18426b998ca87396238b

SHA1
cf103b4b0ac63df590d89e2efe092c20bfa5b92c

SHA256
db9d1ab71493a30d55ae66e8a2d2119e0cf44d03580745cd8156ac46dcaed09d

SHA512
2e9756e5010cc3ed53f58af3f3ebdf9866222c1b395bc42487b672cc77fce7e29aa4e10c2152f0d5c8a0f04d9c0821c293d44ff9df9b8fdab28a599ca3fabe0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5063.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIE408.tmp

Filesize
113KB

MD5
4fdd16752561cf585fed1506914d73e0

SHA1
f00023b9ae3c8ce5b7bb92f25011eaebe6f9d424

SHA256
aecd2d2fe766f6d439acc2bbf1346930ecc535012cf5ad7b3273d2875237b7e7

SHA512
3695e7eb1e35ec959243a91ab5b4454eb59aeef0f2699aa5de8e03de8fbb89f756a89130526da5c08815408cb700284a17936522ad2cad594c3e6e9d18a3f600

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar51CD.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\dXNlcg==.msi

Filesize
22.3MB

MD5
e969fa4b30951a66e9bf28b21fd75174

SHA1
dc818acf470ad20f56f464e4839650564f023a7f

SHA256
96811ea4f9266ba8ee5c758c146fbc84f3cfe5ec4c5c966b5885e11b5f696f74

SHA512
6da2ec033f58843a06270ef04c55ba0ee8449df685f1902ab953bf511acd0a4735532db3bff73858c082005b4df27d5c376a4fb324f9506b85564356286b0f68

Download Submit
C:\Windows\Installer\MSI566D.tmp

Filesize
211KB

MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
C:\Windows\Installer\MSIB7C7.tmp

Filesize
193KB

MD5
7e274959f4347527c246a2c6343105e7

SHA1
8885c1a2624ccd01102d9eabfa9050fd19093f16

SHA256
dbe502732e67c80c03fba12a885f3c68023eeff31fcde8170f4733d8261b540e

SHA512
bf4666efec860030f2795ebdb5ed34a11f2611a342ea1b752dd232072425420b9155804fc43ed7546c4fd3973bc68cdfc9c5cd9765d3c529891a0862173df4b9

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Filesize
108KB

MD5
52924f042c18b7e23b5c5d22909869ba

SHA1
e18dfa4105ff92b1feaaf908842b6dfe4ec62157

SHA256
3c975d8ad5861ce5673837f7aeb1b0c426cefba318cf860520cb8921f78533fa

SHA512
c9ed13a4b4df7a9b94f2ffbef7fd6b59f723e67862753b82dfa0e30c257a2db75388ff8499aad6d95b2a43c349998bec0c79e89167a8669dfc38f9211d1d3157

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Filesize
108KB

MD5
274c2eaf39d4ad8235d68460ad838f83

SHA1
f7368ab0f550a88bf04cd341d2cce75e48cac39e

SHA256
983aaf79b8ec937db6b1513af24a2ac95818ba931436e983e513927fd917c7cc

SHA512
50644df71d2176a977c7d60c6ed92ee17fcd8da6e9875b90d6cfaaf0411341484e72d3b4cd63ce71375ef9eaf41354752f7b0b7a7195a2b66828f1bdbdfd1301

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log

Filesize
117KB

MD5
3350c9d6e82d7d6a21b5a0f2d15d4330

SHA1
0ff4f61d05c9d98c12383dbe8b2e04db8f5f2641

SHA256
d8a1ec8ad537a58e63dfaa8bb42f6e3e0c2eeb2111fb25aa7306a2a1fca9aad2

SHA512
c3176e0dcd09b3130e7de490d37fe39454330e6aab94f336f34c2c73f72c061c6708df46237913d591c1890021f0b8ce51d306e9475901e4ceecc81c1e5cb11d

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log

Filesize
117KB

MD5
84fcb6e41990c988012b72a63e9ce098

SHA1
c04781f3476c2db452812b3d59b10ccad2afc810

SHA256
f6742ed2cae41005cef1dac634cdc11c010651819d24a110edf2f89ede3bb23b

SHA512
60c5c35a7625b5e908591212dfb993e02a19adf44d283bde44215be00048de254c929c5b36474bb4ae2e027c1e41622ec91976abe97a8e4fc0501833fc552266

Download Submit
\Windows\Installer\MSI3525.tmp

Filesize
135KB

MD5
54b5196bac438d837d6abfab87985b20

SHA1
5ba90a7b50ce43ec10cac7f842f5cdf6d4e867c8

SHA256
cb717468948c4c7f026615a15bbdf22328dc939d908f994099cb206e04705b24

SHA512
b56c4cfdffb294cf5501bf27361fb1a317d05e3539835b0bef265ba21e440340cacdd59bdeb147a12e2647ef1812ac48a956ece8d76458251827e25cad1aa346

Download Submit
memory/2268-146-0x00000000050F0000-0x00000000054F0000-memory.dmp

Filesize
4.0MB

Download
memory/2268-147-0x00000000050F0000-0x00000000054F0000-memory.dmp

Filesize
4.0MB

Download
memory/2268-150-0x00000000771E0000-0x0000000077227000-memory.dmp

Filesize
284KB

Download
memory/2268-148-0x0000000077970000-0x0000000077B19000-memory.dmp

Filesize
1.7MB

Download
memory/2308-151-0x0000000000090000-0x0000000000099000-memory.dmp

Filesize
36KB

Download
memory/2308-154-0x0000000077970000-0x0000000077B19000-memory.dmp

Filesize
1.7MB

Download
memory/2308-156-0x00000000771E0000-0x0000000077227000-memory.dmp

Filesize
284KB

Download
memory/2308-153-0x0000000001D50000-0x0000000002150000-memory.dmp

Filesize
4.0MB

Download