efa19e5908e4063d1b104b810136d3138f4b34d1350c00123ae1543fbc93c012

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{A6EADE66-0000-0000-484E-7E8A45000000}	MsiExec.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 4 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe	msiexec.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 12 IoCs

pid	Process
2340	Uninst.exe
5044	uninstaller.exe
3292	Un_A.exe
4544	firefox.exe
5244	firefox.exe
4180	default-browser-agent.exe
2656	firefox.exe
4452	firefox.exe
4484	Un_B.exe
5756	MSI792E.tmp
5688	MSIDFD3.tmp
5560	FullTrustNotifier.exe

Loads dropped DLL 64 IoCs

pid	Process
4456	helper.exe
4456	helper.exe
4456	helper.exe
4456	helper.exe
3292	Un_A.exe
3292	Un_A.exe
3292	Un_A.exe
3292	Un_A.exe
3292	Un_A.exe
3292	Un_A.exe
3292	Un_A.exe
3292	Un_A.exe
3292	Un_A.exe
3292	Un_A.exe
3292	Un_A.exe
3292	Un_A.exe
3292	Un_A.exe
3292	Un_A.exe
3292	Un_A.exe
3292	Un_A.exe
3292	Un_A.exe
3292	Un_A.exe
3292	Un_A.exe
3292	Un_A.exe
3292	Un_A.exe
3292	Un_A.exe
3292	Un_A.exe
3292	Un_A.exe
3292	Un_A.exe
3292	Un_A.exe
3292	Un_A.exe
3292	Un_A.exe
3292	Un_A.exe
3292	Un_A.exe
3292	Un_A.exe
3292	Un_A.exe
4484	Un_B.exe
3292	Un_A.exe
5756	MSI792E.tmp
5756	MSI792E.tmp
5756	MSI792E.tmp
5756	MSI792E.tmp
5756	MSI792E.tmp
5756	MSI792E.tmp
5756	MSI792E.tmp
5756	MSI792E.tmp
5756	MSI792E.tmp
5756	MSI792E.tmp
5756	MSI792E.tmp
5756	MSI792E.tmp
5756	MSI792E.tmp
5756	MSI792E.tmp
5756	MSI792E.tmp
5756	MSI792E.tmp
5756	MSI792E.tmp
5756	MSI792E.tmp
5756	MSI792E.tmp
5756	MSI792E.tmp
5756	MSI792E.tmp
5756	MSI792E.tmp
5756	MSI792E.tmp
5756	MSI792E.tmp
5756	MSI792E.tmp
5756	MSI792E.tmp

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	firefox.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	firefox.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	Un_A.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	msiexec.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Indicator Removal: Clear Persistence 1 TTPs 12 IoCs

remove IFEO.

defense_evasion

Clear Persistence

T1070.009

description	ioc	Process
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe\MitigationOptions	MsiExec.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe\MitigationOptions	MsiExec.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe\MitigationOptions	MsiExec.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe\DisableExceptionChainValidation	msiexec.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe\DisableExceptionChainValidation	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe	msiexec.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe\DisableExceptionChainValidation	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe	msiexec.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe\MitigationOptions	MsiExec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe	msiexec.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe\DisableExceptionChainValidation	msiexec.exe

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

Browser Extensions

T1176

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{DBC80044-A445-435B-BC74-9C25C1C588A9}	MSI792E.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}	MSI792E.tmp

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Elevation.tmp	MsiExec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\[email protected]	MsiExec.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\security\java.security	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\close.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\de-de\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_filter-hover_32.svg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-tw\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\deploy\splash.gif	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-cn\AppStore_icon.svg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\LICENSE.txt	msiexec.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-console-l1-1-0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\uk-ua\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\deployJava1.dll	msiexec.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\wsdetect.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\adc_logo.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\css\main-selector.css	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\s_thumbnailview_18.svg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AGMGPUOptIn.ini	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\ended_review_or_form.gif	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fi-fi\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\uk-ua\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\it-it\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\[email protected]	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\dot_2x.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\progress.gif	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\[email protected]	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\share_icons2x.png	MsiExec.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hu-hu\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_filterselected-dark-hover_32.svg	MsiExec.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\management\snmp.acl.template	msiexec.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-string-l1-1-0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-ae\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\go-mobile.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\s_radio_unselected_18.svg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\createpdf.svg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\ZX______.PFB	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\cs-cz\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\icons_retina.png	MsiExec.exe
File opened for modification	C:\Program Files\Mozilla Firefox\vcruntime140_1.dll	Un_A.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fi-fi\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\images\example_icons2x.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\nl-nl\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\editpdf.svg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\zh-cn\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\3difr.x3d	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ro-ro\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\css\main-selector.css	MsiExec.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jpeg.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\empty.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sl-si\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\fi-fi\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files\Mozilla Firefox\freebl3.dll	Un_A.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\reviewers.gif	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\de-de\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\css\main.css	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\libcef.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\fr-ma\ui-strings.js	MsiExec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\F_CENTRAL_msvcp120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\IA32.api	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\QRCode.pmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF949D174BE7D848E5.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDB66.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\BIBUtils.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\CYRILLIC.TXT	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\Bib.dll_NON_OPT	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\ccme_ecc.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\WindowsMedia.mpp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDB77.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\APIFile_8.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\GREEK.TXT	msiexec.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\XDPFile_8.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID8D3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrosup64.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\CORPCHAR.TXT2	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8621.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF29504283F59B6A42.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\drvSOFT.x3d	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\JP2KLib.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFC04.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID7E3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDF06.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\CROATIAN.TXT	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\TURKISH.TXT	msiexec.exe
File created	C:\Windows\SystemTemp\~DFCE38546241A70166.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI873B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\Annots.api	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\rdrservicesupdater.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adobehunspellplugin.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\displaylanguagenames.en_gb_e	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\dummy.dic	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\F_CENTRAL_vccorlib120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\Spelling.api	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI87F9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID8A3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adobearmhelper.exe.BDCA7721_F290_4124_BBED_7A15FE7694EB	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFC03.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\TrackedSend.aapp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIED49.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFBC2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\CP1253.TXT	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\EPDF_RHP.aapp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\info.plist	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\MCIMPP.mpp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF468BA55A616B28C6.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE082.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adobearm.exe.BDCA7721_F290_4124_BBED_7A15FE7694EB	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\Updater.api_NON_OPT	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID892.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\CP1254.TXT	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\Multimedia.api_NON_OPT	msiexec.exe
File created	C:\Windows\SystemTemp\~DFCCBC615CC1CE098C.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroPDFImpl.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AGM.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\ICELAND.TXT	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\nppdf32.dll	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA7E8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeLinguistic.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\home.aapp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reflow.api_NON_OPT	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\nppdf32.dll_Apollo	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Uninstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIDFD3.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Un_B.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaureg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FullTrustNotifier.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Uninst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Un_A.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ab2f6650cf45871d0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000ab2f66500000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900ab2f6650000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dab2f6650000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000ab2f665000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Checks processor information in registry 2 TTPs 14 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msiexec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msiexec.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Control Panel\Colors	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Control Panel\Colors	firefox.exe

Modifies Internet Explorer settings 1 TTPs 14 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BD57A9B2-4E7D-4892-9107-9F4106472DA4}	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{5852F5ED-8BF4-11D4-A245-0080C6F74284}	MSI792E.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}	MSI792E.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{76E2369A-75BA-41F9-8B9E-16059E5CF9A6}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B3FB63-66F4-4EFC-B717-BB283B85E79B}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C6A861C-B233-4994-AFB1-C158EE4FC578}	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{44D1B085-E495-4B5F-9EE6-34795C46E7E7}	MSI792E.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\ACTIVEX COMPATIBILITY\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}	MSI792E.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B723F941-52A2-4392-B500-60F3889659B4}	MsiExec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7AC06A6F-4C88-4707-8DEC-61017CB50E1E}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E1F80F4-953F-41E7-8460-E64AE5BE4ED3}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B7278BD0-7970-47D6-8954-99B2343EED88}	msiexec.exe

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\EUDC	MSI792E.tmp
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = ec0800004b4999770e22db01	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Console	MSI792E.tmp
Key created	\REGISTRY\USER\.DEFAULT\Console	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Environment	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\System	MSI792E.tmp
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	MSI792E.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "1"	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Keyboard Layout	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Printers	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel	MSI792E.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Printers	MSI792E.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Keyboard Layout	MSI792E.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 279851777033c515b41ef3b3ff0c0bd5275a8d42e00687f4287975c6df3b6f02	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	MSI792E.tmp
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	MSI792E.tmp
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	MSI792E.tmp
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Java VM\EnableJavaConsole = "0"	MSI792E.tmp
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\EUDC	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\System	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Environment	MSI792E.tmp

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0224-ABCDEFFEDCBB}	MSI792E.tmp
Key deleted	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0212-ABCDEFFEDCBC}\INPROCSERVER32	MSI792E.tmp
Key deleted	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0381-ABCDEFFEDCBB}	MSI792E.tmp
Key deleted	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0101-ABCDEFFEDCBA}\INPROCSERVER32	MSI792E.tmp
Key deleted	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0034-ABCDEFFEDCBB}	MSI792E.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0014-0002-0085-ABCDEFFEDCBB}\INPROCSERVER32	MSI792E.tmp
Key deleted	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0201-ABCDEFFEDCBA}\INPROCSERVER32	MSI792E.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0016-0000-FFFF-ABCDEFFEDCBA}\INPROCSERVER32	MSI792E.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0009-ABCDEFFEDCBB}	MSI792E.tmp
Key deleted	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0169-ABCDEFFEDCBB}	MSI792E.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0017-0000-0056-ABCDEFFEDCBB}\INPROCSERVER32	MSI792E.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0017-0000-0289-ABCDEFFEDCBA}\INPROCSERVER32	MSI792E.tmp
Key deleted	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0075-ABCDEFFEDCBC}	MSI792E.tmp
Key deleted	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0153-ABCDEFFEDCBC}	MSI792E.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0017-0000-0174-ABCDEFFEDCBB}\INPROCSERVER32	MSI792E.tmp
Key deleted	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0330-ABCDEFFEDCBA}\INPROCSERVER32	MSI792E.tmp
Key deleted	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0323-ABCDEFFEDCBA}	MSI792E.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0035-ABCDEFFEDCBB}	MSI792E.tmp
Key deleted	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0166-ABCDEFFEDCBC}	MSI792E.tmp
Key deleted	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0217-ABCDEFFEDCBC}	MSI792E.tmp
Key deleted	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0282-ABCDEFFEDCBB}	MSI792E.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}	MSI792E.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0017-0000-0326-ABCDEFFEDCBA}\INPROCSERVER32	MSI792E.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{566A7BC7-B295-41B7-A818-12F9E5CA46CA}\NumMethods	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0015-0000-0074-ABCDEFFEDCBC}\INPROCSERVER32	MSI792E.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0018-0000-0052-ABCDEFFEDCBC}\INPROCSERVER32	MSI792E.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0018-0000-0127-ABCDEFFEDCBB}\INPROCSERVER32	MSI792E.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0303-ABCDEFFEDCBA}	MSI792E.tmp
Key deleted	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0040-ABCDEFFEDCBA}	MSI792E.tmp
Key deleted	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0161-ABCDEFFEDCBA}	MSI792E.tmp
Key deleted	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0259-ABCDEFFEDCBC}	MSI792E.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0059-ABCDEFFEDCBA}	MSI792E.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0017-0000-0014-ABCDEFFEDCBC}\INPROCSERVER32	MSI792E.tmp
Key deleted	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0071-ABCDEFFEDCBB}	MSI792E.tmp
Key deleted	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0085-ABCDEFFEDCBA}	MSI792E.tmp
Key deleted	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0082-ABCDEFFEDCBA}\INPROCSERVER32	MSI792E.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0017-0000-0282-ABCDEFFEDCBA}\INPROCSERVER32	MSI792E.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7EA23D88-569E-4EFD-9851-A1528A7745F9}\ProxyStubClsid32	msiexec.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0274-ABCDEFFEDCBA}	MSI792E.tmp
Key deleted	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0047-ABCDEFFEDCBA}	MSI792E.tmp
Key deleted	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0040-ABCDEFFEDCBB}	MSI792E.tmp
Key deleted	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0050-ABCDEFFEDCBB}	MSI792E.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0014-0002-0075-ABCDEFFEDCBA}\INPROCSERVER32	MSI792E.tmp
Key deleted	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0013-ABCDEFFEDCBB}\INPROCSERVER32	MSI792E.tmp
Key deleted	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0328-ABCDEFFEDCBA}	MSI792E.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBB}	MSI792E.tmp
Key deleted	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0349-ABCDEFFEDCBB}	MSI792E.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0018-ABCDEFFEDCBA}	MSI792E.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0298-ABCDEFFEDCBC}	MSI792E.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0015-0000-0097-ABCDEFFEDCBC}\INPROCSERVER32	MSI792E.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0016-0000-0083-ABCDEFFEDCBA}\INPROCSERVER32	MSI792E.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0017-0000-0223-ABCDEFFEDCBC}\INPROCSERVER32	MSI792E.tmp
Key deleted	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}	MSI792E.tmp
Key deleted	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0152-ABCDEFFEDCBB}	MSI792E.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0016-0000-0084-ABCDEFFEDCBC}\INPROCSERVER32	MSI792E.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0015-0000-0065-ABCDEFFEDCBB}\INPROCSERVER32	MSI792E.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0017-0000-0306-ABCDEFFEDCBC}\INPROCSERVER32	MSI792E.tmp
Key deleted	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0097-ABCDEFFEDCBC}\INPROCSERVER32	MSI792E.tmp
Key deleted	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0196-ABCDEFFEDCBC}\INPROCSERVER32	MSI792E.tmp
Key deleted	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0069-ABCDEFFEDCBA}	MSI792E.tmp
Key deleted	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0052-ABCDEFFEDCBB}\INPROCSERVER32	MSI792E.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0275-ABCDEFFEDCBB}	MSI792E.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0311-ABCDEFFEDCBA}	MSI792E.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0282-ABCDEFFEDCBA}	MSI792E.tmp

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
460	msedge.exe
460	msedge.exe
4796	msedge.exe
4796	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4576	Subnautica v1.0-v20210512 Plus 15 Trainer.exe
Token: SeShutdownPrivilege	1496	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1496	msiexec.exe
Token: SeSecurityPrivilege	2284	msiexec.exe
Token: SeCreateTokenPrivilege	1496	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1496	msiexec.exe
Token: SeLockMemoryPrivilege	1496	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1496	msiexec.exe
Token: SeMachineAccountPrivilege	1496	msiexec.exe
Token: SeTcbPrivilege	1496	msiexec.exe
Token: SeSecurityPrivilege	1496	msiexec.exe
Token: SeTakeOwnershipPrivilege	1496	msiexec.exe
Token: SeLoadDriverPrivilege	1496	msiexec.exe
Token: SeSystemProfilePrivilege	1496	msiexec.exe
Token: SeSystemtimePrivilege	1496	msiexec.exe
Token: SeProfSingleProcessPrivilege	1496	msiexec.exe
Token: SeIncBasePriorityPrivilege	1496	msiexec.exe
Token: SeCreatePagefilePrivilege	1496	msiexec.exe
Token: SeCreatePermanentPrivilege	1496	msiexec.exe
Token: SeBackupPrivilege	1496	msiexec.exe
Token: SeRestorePrivilege	1496	msiexec.exe
Token: SeShutdownPrivilege	1496	msiexec.exe
Token: SeDebugPrivilege	1496	msiexec.exe
Token: SeAuditPrivilege	1496	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1496	msiexec.exe
Token: SeChangeNotifyPrivilege	1496	msiexec.exe
Token: SeRemoteShutdownPrivilege	1496	msiexec.exe
Token: SeUndockPrivilege	1496	msiexec.exe
Token: SeSyncAgentPrivilege	1496	msiexec.exe
Token: SeEnableDelegationPrivilege	1496	msiexec.exe
Token: SeManageVolumePrivilege	1496	msiexec.exe
Token: SeImpersonatePrivilege	1496	msiexec.exe
Token: SeCreateGlobalPrivilege	1496	msiexec.exe
Token: SeBackupPrivilege	924	vssvc.exe
Token: SeRestorePrivilege	924	vssvc.exe
Token: SeAuditPrivilege	924	vssvc.exe
Token: SeBackupPrivilege	2284	msiexec.exe
Token: SeRestorePrivilege	2284	msiexec.exe
Token: SeBackupPrivilege	3568	srtasks.exe
Token: SeRestorePrivilege	3568	srtasks.exe
Token: SeSecurityPrivilege	3568	srtasks.exe
Token: SeTakeOwnershipPrivilege	3568	srtasks.exe
Token: SeBackupPrivilege	3568	srtasks.exe
Token: SeRestorePrivilege	3568	srtasks.exe
Token: SeSecurityPrivilege	3568	srtasks.exe
Token: SeTakeOwnershipPrivilege	3568	srtasks.exe
Token: SeShutdownPrivilege	5676	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5676	msiexec.exe
Token: SeCreateTokenPrivilege	5676	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5676	msiexec.exe
Token: SeLockMemoryPrivilege	5676	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5676	msiexec.exe
Token: SeMachineAccountPrivilege	5676	msiexec.exe
Token: SeTcbPrivilege	5676	msiexec.exe
Token: SeSecurityPrivilege	5676	msiexec.exe
Token: SeTakeOwnershipPrivilege	5676	msiexec.exe
Token: SeLoadDriverPrivilege	5676	msiexec.exe
Token: SeSystemProfilePrivilege	5676	msiexec.exe
Token: SeSystemtimePrivilege	5676	msiexec.exe
Token: SeProfSingleProcessPrivilege	5676	msiexec.exe
Token: SeIncBasePriorityPrivilege	5676	msiexec.exe
Token: SeCreatePagefilePrivilege	5676	msiexec.exe
Token: SeCreatePermanentPrivilege	5676	msiexec.exe
Token: SeBackupPrivilege	5676	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3876	Uninstall.exe
2340	Uninst.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 4968	4796	msedge.exe	80
PID 4796 wrote to memory of 4968	4796	msedge.exe	80
PID 4796 wrote to memory of 4792	4796	msedge.exe	81
PID 4796 wrote to memory of 4792	4796	msedge.exe	81
PID 4796 wrote to memory of 4792	4796	msedge.exe	81
PID 4796 wrote to memory of 4792	4796	msedge.exe	81
PID 4796 wrote to memory of 4792	4796	msedge.exe	81
PID 4796 wrote to memory of 4792	4796	msedge.exe	81
PID 4796 wrote to memory of 4792	4796	msedge.exe	81
PID 4796 wrote to memory of 4792	4796	msedge.exe	81
PID 4796 wrote to memory of 4792	4796	msedge.exe	81
PID 4796 wrote to memory of 4792	4796	msedge.exe	81
PID 4796 wrote to memory of 4792	4796	msedge.exe	81
PID 4796 wrote to memory of 4792	4796	msedge.exe	81
PID 4796 wrote to memory of 4792	4796	msedge.exe	81
PID 4796 wrote to memory of 4792	4796	msedge.exe	81
PID 4796 wrote to memory of 4792	4796	msedge.exe	81
PID 4796 wrote to memory of 4792	4796	msedge.exe	81
PID 4796 wrote to memory of 4792	4796	msedge.exe	81
PID 4796 wrote to memory of 4792	4796	msedge.exe	81
PID 4796 wrote to memory of 4792	4796	msedge.exe	81
PID 4796 wrote to memory of 4792	4796	msedge.exe	81
PID 4796 wrote to memory of 4792	4796	msedge.exe	81
PID 4796 wrote to memory of 4792	4796	msedge.exe	81
PID 4796 wrote to memory of 4792	4796	msedge.exe	81
PID 4796 wrote to memory of 4792	4796	msedge.exe	81
PID 4796 wrote to memory of 4792	4796	msedge.exe	81
PID 4796 wrote to memory of 4792	4796	msedge.exe	81
PID 4796 wrote to memory of 4792	4796	msedge.exe	81
PID 4796 wrote to memory of 4792	4796	msedge.exe	81
PID 4796 wrote to memory of 4792	4796	msedge.exe	81
PID 4796 wrote to memory of 4792	4796	msedge.exe	81
PID 4796 wrote to memory of 4792	4796	msedge.exe	81
PID 4796 wrote to memory of 4792	4796	msedge.exe	81
PID 4796 wrote to memory of 4792	4796	msedge.exe	81
PID 4796 wrote to memory of 4792	4796	msedge.exe	81
PID 4796 wrote to memory of 4792	4796	msedge.exe	81
PID 4796 wrote to memory of 4792	4796	msedge.exe	81
PID 4796 wrote to memory of 4792	4796	msedge.exe	81
PID 4796 wrote to memory of 4792	4796	msedge.exe	81
PID 4796 wrote to memory of 4792	4796	msedge.exe	81
PID 4796 wrote to memory of 4792	4796	msedge.exe	81
PID 4796 wrote to memory of 460	4796	msedge.exe	82
PID 4796 wrote to memory of 460	4796	msedge.exe	82
PID 4796 wrote to memory of 744	4796	msedge.exe	83
PID 4796 wrote to memory of 744	4796	msedge.exe	83
PID 4796 wrote to memory of 744	4796	msedge.exe	83
PID 4796 wrote to memory of 744	4796	msedge.exe	83
PID 4796 wrote to memory of 744	4796	msedge.exe	83
PID 4796 wrote to memory of 744	4796	msedge.exe	83
PID 4796 wrote to memory of 744	4796	msedge.exe	83
PID 4796 wrote to memory of 744	4796	msedge.exe	83
PID 4796 wrote to memory of 744	4796	msedge.exe	83
PID 4796 wrote to memory of 744	4796	msedge.exe	83
PID 4796 wrote to memory of 744	4796	msedge.exe	83
PID 4796 wrote to memory of 744	4796	msedge.exe	83
PID 4796 wrote to memory of 744	4796	msedge.exe	83
PID 4796 wrote to memory of 744	4796	msedge.exe	83
PID 4796 wrote to memory of 744	4796	msedge.exe	83
PID 4796 wrote to memory of 744	4796	msedge.exe	83
PID 4796 wrote to memory of 744	4796	msedge.exe	83
PID 4796 wrote to memory of 744	4796	msedge.exe	83
PID 4796 wrote to memory of 744	4796	msedge.exe	83
PID 4796 wrote to memory of 744	4796	msedge.exe	83

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Subnautica v1.0-v20210512 Plus 15 Trainer.exe
"C:\Users\Admin\AppData\Local\Temp\Subnautica v1.0-v20210512 Plus 15 Trainer.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd43953cb8,0x7ffd43953cc8,0x7ffd43953cd8
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,4055819015257714491,1205312659395327683,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,4055819015257714491,1205312659395327683,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,4055819015257714491,1205312659395327683,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2540 /prefetch:8
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4055819015257714491,1205312659395327683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4055819015257714491,1205312659395327683,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4055819015257714491,1205312659395327683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4084 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4055819015257714491,1205312659395327683,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3972 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,4055819015257714491,1205312659395327683,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5112 /prefetch:8
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,4055819015257714491,1205312659395327683,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3508 /prefetch:8
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4055819015257714491,1205312659395327683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4055819015257714491,1205312659395327683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4055819015257714491,1205312659395327683,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4055819015257714491,1205312659395327683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4055819015257714491,1205312659395327683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4055819015257714491,1205312659395327683,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4055819015257714491,1205312659395327683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1328 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4055819015257714491,1205312659395327683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6468 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4055819015257714491,1205312659395327683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4055819015257714491,1205312659395327683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6768 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,4055819015257714491,1205312659395327683,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5308 /prefetch:2
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4055819015257714491,1205312659395327683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4055819015257714491,1205312659395327683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4055819015257714491,1205312659395327683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6188 /prefetch:1
  2⤵
  PID:1032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3932

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1996

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding
1⤵
PID:3868

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
PID:5004

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:1412

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
PID:1512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:1000

C:\Program Files\7-Zip\Uninstall.exe
"C:\Program Files\7-Zip\Uninstall.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3876
- C:\Users\Admin\AppData\Local\Temp\7z992C7F24\Uninst.exe
  C:\Users\Admin\AppData\Local\Temp\7z992C7F24\Uninst.exe /N /D="C:\Program Files\7-Zip\"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2340

C:\Windows\system32\msiexec.exe
"C:\Windows\system32\msiexec.exe" /qb /x {AC76BA86-7AD7-1033-7B44-AC0F074E4100}
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1496

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Event Triggered Execution: Image File Execution Options Injection
- Drops desktop.ini file(s)
- Enumerates connected drives
- Indicator Removal: Clear Persistence
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2284
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3568
- C:\Windows\Installer\MSI792E.tmp
  "C:\Windows\Installer\MSI792E.tmp" INSTALLDIR="C:\Program Files\Java\jre-1.8\\" ProductCode={77924AE4-039E-4CA4-87B4-2F64180381F0}
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - Modifies Internet Explorer settings
  - Modifies data under HKEY_USERS
  - Modifies registry class
  PID:5756
- - C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe
    "C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe" -u auto-update
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3064
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\SysWOW64\msiexec.exe" /x {4A03706F-666A-4037-7777-5F2748764D10} /qn
      4⤵
      System Location Discovery: System Language Discovery
      PID:2072
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 4467EABDC93AF8A71069462D06CEF08E E Global\MSI0000
  2⤵
  PID:5260
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 9BD9AA8DA837C9CC58C3AC696611E378
  2⤵
  PID:5496
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3F4E33695E171CCDB6D51519F0B1587A E Global\MSI0000
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5652
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding A69D14843AFBF780BED07AB82D710155
  2⤵
  PID:3328
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 47E5912CFE7FDA36176E197BECADB3D1 E Global\MSI0000
  2⤵
  - Modifies data under HKEY_USERS
  PID:5952
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 0377CBF6A3AC77BCB7E5FBAA0E1C9DCF
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:6020
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 04E8AE071A0FF87A6501E0904BF18843 E Global\MSI0000
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Indicator Removal: Clear Persistence
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  PID:2856
- C:\Windows\Installer\MSIDFD3.tmp
  "C:\Windows\Installer\MSIDFD3.tmp" /b 3 120 0
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5688
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe" ClearToasts
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5560

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:924

C:\Program Files\Mozilla Firefox\uninstall\helper.exe
"C:\Program Files\Mozilla Firefox\uninstall\helper.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4456
- C:\Program Files\Mozilla Firefox\uninstall\uninstaller.exe
  "C:\Program Files\Mozilla Firefox\uninstall\uninstaller.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5044
- - C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
    "C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Program Files\Mozilla Firefox\uninstall\
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops desktop.ini file(s)
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    PID:3292
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --backgroundtask uninstall
      4⤵
      Executes dropped EXE
      PID:4544
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --backgroundtask uninstall
        5⤵
        Executes dropped EXE
        Checks whether UAC is enabled
        Checks processor information in registry
        Modifies Control Panel
        
        PID:5244
  - - C:\Program Files\Mozilla Firefox\default-browser-agent.exe
      "C:\Program Files\Mozilla Firefox\default-browser-agent.exe" uninstall 308046B0AF4A39CB
      4⤵
      Executes dropped EXE
      PID:4180
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --backgroundtask defaultagent uninstall 308046B0AF4A39CB
        5⤵
        Executes dropped EXE
        
        PID:2656
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --backgroundtask defaultagent uninstall 308046B0AF4A39CB
        6⤵
        Executes dropped EXE
        Checks whether UAC is enabled
        Checks processor information in registry
        Modifies Control Panel
        
        PID:4452
  - - C:\Program Files (x86)\Mozilla Maintenance Service\uninstall.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\uninstall.exe" /S
      4⤵
      System Location Discovery: System Language Discovery
      PID:6060
    - - C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_B.exe
        
        "C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_B.exe" /S _?=C:\Program Files (x86)\Mozilla Maintenance Service\
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:4484
      - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe" uninstall
        6⤵
        
        PID:2036

C:\Windows\system32\msiexec.exe
"C:\Windows\system32\msiexec.exe" /qb /x {77924AE4-039E-4CA4-87B4-2F64180381F0}
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5676

C:\Windows\system32\msiexec.exe
"C:\Windows\system32\msiexec.exe" /qb /x {64A3A4F4-B792-11D6-A78A-00B0D0180381}
1⤵
PID:2128

C:\Windows\system32\msiexec.exe
"C:\Windows\system32\msiexec.exe" /qb /x {AC76BA86-7AD7-1033-7B44-AC0F074E4100}
1⤵
PID:5584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Browser Extensions

T1176

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery