f11bec29bd627dfae257e9930986222e21aac26f310307c5d4397b9c4baa738a

Analysis

max time kernel
1348s
max time network
1423s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
21-11-2024 15:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WorldBox.God.Simulator.v0.22.9.558/Game/_Redist/xnafx40_redist.msi
Size

6.7MB
MD5

97c2eebb30c5a88c68c8f24f37183f1d
SHA1

49efdc29f65fc8263c196338552c7009fc96c5de
SHA256

e6c41d692ebcba854dad4b1c52bb7ddd05926bad3105595d6596b8bab01c25e7
SHA512

c9d1017b274ceb1b4ee624cf7e628787c32a727c64f715fbce1f1ae929d9114f8fe1291e34583cec615619b0128c01206b07efc878e7a5c57b792453f73fd0da
SSDEEP

98304:wynfL329J1XswfXO6wiBB+4RZg6aENaCZAU5PMO0MntfERyJGH2YPq/:wYD3C1XXfzH+4cLHU5PM/Mnt+YGlq

Score

6^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe

Drops file in System32 directory 21 IoCs

Processes:

DXSETUP.exe

description	ioc	process
File created	C:\Windows\SysWOW64\SET4B0E.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\D3DX9_41.dll	DXSETUP.exe
File created	C:\Windows\SysWOW64\SET4BC9.tmp	DXSETUP.exe
File created	C:\Windows\SysWOW64\SET4C86.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\xinput1_3.dll	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\X3DAudio1_7.dll	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\xactengine3_6.dll	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\XAudio2_6.dll	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\SET4C86.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\SET4B0E.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\SET4A81.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\SET4BC9.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\SET4BF8.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\SET49D5.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\d3dx9_33.dll	DXSETUP.exe
File created	C:\Windows\SysWOW64\SET4A81.tmp	DXSETUP.exe
File created	C:\Windows\SysWOW64\SET4BF8.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\SET4C56.tmp	DXSETUP.exe
File created	C:\Windows\SysWOW64\SET4C56.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\XAPOFX1_4.dll	DXSETUP.exe
File created	C:\Windows\SysWOW64\SET49D5.tmp	DXSETUP.exe

Drops file in Program Files directory 14 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\DXSETUP.exe	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\XNA\Framework\v4.0\XnaNative.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\dxupdate.cab	msiexec.exe
File created	C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\APR2007_xinput_x86.cab	msiexec.exe
File created	C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\Mar2009_d3dx9_41_x86.cab	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\XNA\Framework\v4.0\EULA.en-US.txt	msiexec.exe
File created	C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\APR2007_d3dx9_33_x86.cab	msiexec.exe
File created	C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\dsetup32.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\Feb2010_xact_x86.cab	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\XNA\Framework\Shared\xnavisualizer.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\XNA\Framework\Shared\XnaVisualizerPS.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\DSETUP.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\Feb2010_X3DAudio_x86.cab	msiexec.exe
File created	C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\Feb2010_XAudio_x86.cab	msiexec.exe

Drops file in Windows directory 29 IoCs

Processes:

msiexec.exeDXSETUP.exe

description	ioc	process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\assembly\tmp\M1M9XY62\Microsoft.Xna.Framework.Game.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\0AA7CFB2C445A3E47869763FEB56B59E\4.0.20823\F_CENTRAL_msvcp100_x86.DF495DFD_79F6_34DF_BB1E_E58DB5BDCF2C	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\0AA7CFB2C445A3E47869763FEB56B59E\4.0.20823\F_CENTRAL_msvcr100_x86.DF495DFD_79F6_34DF_BB1E_E58DB5BDCF2C	msiexec.exe
File created	C:\Windows\Installer\e58411b.msi	msiexec.exe
File created	C:\Windows\assembly\GACLock.dat	msiexec.exe
File created	C:\Windows\assembly\tmp\Z1SBRA34\Microsoft.Xna.Framework.Xact.dll	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\0AA7CFB2C445A3E47869763FEB56B59E\4.0.20823\F_CENTRAL_msvcr100_x86.DF495DFD_79F6_34DF_BB1E_E58DB5BDCF2C	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\assembly\tmp\YFYVE43E\Microsoft.Xna.Framework.Graphics.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\0AA7CFB2C445A3E47869763FEB56B59E	msiexec.exe
File created	C:\Windows\assembly\tmp\0YHBK8TH\Microsoft.Xna.Framework.dll	msiexec.exe
File created	C:\Windows\assembly\tmp\W8HSTVAM\Microsoft.Xna.Framework.Storage.dll	msiexec.exe
File created	C:\Windows\assembly\tmp\61TUXZ46\Microsoft.Xna.Framework.Video.dll	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\0AA7CFB2C445A3E47869763FEB56B59E\4.0.20823\F_CENTRAL_msvcp100_x86.DF495DFD_79F6_34DF_BB1E_E58DB5BDCF2C	msiexec.exe
File created	C:\Windows\Installer\{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4225.tmp	msiexec.exe
File created	C:\Windows\assembly\tmp\YNLIERRM\Microsoft.Xna.Framework.Input.Touch.dll	msiexec.exe
File created	C:\Windows\assembly\tmp\SQ4FQYU7\Microsoft.Xna.Framework.Net.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\e58411b.msi	msiexec.exe
File created	C:\Windows\assembly\tmp\GGET5BEV\Microsoft.Xna.Framework.GamerServices.dll	msiexec.exe
File opened for modification	C:\Windows\Logs\DirectX.log	DXSETUP.exe
File created	C:\Windows\Installer\SourceHash{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4EB8.tmp	msiexec.exe
File created	C:\Windows\assembly\tmp\NOGHO0SN\Microsoft.Xna.Framework.Avatar.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\0AA7CFB2C445A3E47869763FEB56B59E\4.0.20823	msiexec.exe
File created	C:\Windows\Installer\e58411d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}\ProductIcon	msiexec.exe

Executes dropped EXE 1 IoCs

Processes:

DXSETUP.exe

pid process

4632 DXSETUP.exe
Loads dropped DLL 7 IoCs

Processes:

DXSETUP.exeMsiExec.exe

pid process

4632 DXSETUP.exe
4632 DXSETUP.exe
4632 DXSETUP.exe
4632 DXSETUP.exe
4632 DXSETUP.exe
4632 DXSETUP.exe
1016 MsiExec.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
persistence privilege_escalation

Installer Packages
T1546.016

Msiexec
T1218.007

Processes:

msiexec.exe

pid process

3260 msiexec.exe

pid	process
4632	DXSETUP.exe

pid	process
4632	DXSETUP.exe
4632	DXSETUP.exe
4632	DXSETUP.exe
4632	DXSETUP.exe
4632	DXSETUP.exe
4632	DXSETUP.exe
1016	MsiExec.exe

pid	process
3260	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

DXSETUP.exeMsiExec.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DXSETUP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssvc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000019d0c28f61a52ade0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000019d0c28f0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090019d0c28f000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d19d0c28f000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000019d0c28f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 53 IoCs

Processes:

DXSETUP.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DXSETUP.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DXSETUP.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "6"	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DXSETUP.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DXSETUP.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DXSETUP.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DXSETUP.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DXSETUP.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	DXSETUP.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\System32\urlmon.dll,-4200 = "Open File - Security Warning"	DXSETUP.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DXSETUP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DXSETUP.exe

Modifies registry class 64 IoCs

Processes:

msiexec.exeMsiExec.exeDXSETUP.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\ProductName = "Microsoft XNA Framework Redistributable 4.0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8122FF4-9E52-4374-B3D9-B4063E77109D}\ = "VisualizerPlugin Class"	MsiExec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\Microsoft.Xna.Framework.Graphics,fileVersion="4.0.20823.0",version="4.0.0.00000",culture="neutral",publicKeyToken="842CF8BE1DE50553",processorArchitecture="x86" = 6c00660060002e003200510046002b00300041004c0048005600370077003800680027002100740058004e0041004600720061006d00650077006f0072006b005200650064006900730074003e0055006a0064003f003d002e00310076002400390053007e005a00340068007b0055006f007a00690000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0AA7CFB2C445A3E47869763FEB56B59E	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248d8a3b-6256-44d3-a018-2ac96c459f47}\ = "XACT Engine"	DXSETUP.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\DirectShow\MediaObjects\a8122ff4-9e52-4374-b3d9-b4063e77109d\InputTypes = 6175647300001000800000aa00389b710100000000001000800000aa00389b71	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e48c5a3f-93ef-43bb-a092-2c7ceb946f27}	DXSETUP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8122FF4-9E52-4374-B3D9-B4063E77109D}\InprocServer32\ThreadingModel = "Both"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\DirectShow\MediaObjects\Categories\f3602b3f-0592-48df-a4cd-674721e7ebeb\a8122ff4-9e52-4374-b3d9-b4063e77109d	MsiExec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\Microsoft.Xna.Framework.Input.Touch,fileVersion="4.0.20823.0",version="4.0.0.00000",culture="neutral",publicKeyToken="842CF8BE1DE50553",processorArchitecture="MSIL" = 6c00660060002e003200510046002b00300041004c0048005600370077003800680027002100740058004e0041004600720061006d00650077006f0072006b005200650064006900730074003e0050006a006300540058005b0053007b00610039003700380070002d005d0061006c0065004900260000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0AA7CFB2C445A3E47869763FEB56B59E\XNAFrameworkRedist	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248d8a3b-6256-44d3-a018-2ac96c459f47}\InProcServer32\ = "C:\\Windows\\SysWow64\\xactengine3_6.dll"	DXSETUP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3eda9b49-2085-498b-9bb2-39a6778493de}	DXSETUP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\DirectShow\MediaObjects\Categories	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\DirectShow\MediaObjects\a8122ff4-9e52-4374-b3d9-b4063e77109d	MsiExec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\Microsoft.Xna.Framework,fileVersion="4.0.20823.0",version="4.0.0.00000",culture="neutral",publicKeyToken="842CF8BE1DE50553",processorArchitecture="x86" = 6c00660060002e003200510046002b00300041004c0048005600370077003800680027002100740058004e0041004600720061006d00650077006f0072006b005200650064006900730074003e0065006a0036002d0051005b002d0065003900400060004a003d006e0079005e005b005d002a00710000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cecec95a-d894-491a-bee3-5e106fb59f2d}	DXSETUP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3eda9b49-2085-498b-9bb2-39a6778493de}\ = "XAudio2"	DXSETUP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e48c5a3f-93ef-43bb-a092-2c7ceb946f27}\ = "AudioVolumeMeter"	DXSETUP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\500BB8FAD5F3D2A4D9EFC01E0702D939	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3eda9b49-2085-498b-9bb2-39a6778493de}\InProcServer32	DXSETUP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e48c5a3f-93ef-43bb-a092-2c7ceb946f27}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_6.dll"	DXSETUP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cecec95a-d894-491a-bee3-5e106fb59f2d}\InProcServer32	DXSETUP.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\Microsoft.Xna.Framework.Xact,fileVersion="4.0.20823.0",version="4.0.0.00000",culture="neutral",publicKeyToken="842CF8BE1DE50553",processorArchitecture="x86" = 6c00660060002e003200510046002b00300041004c0048005600370077003800680027002100740058004e0041004600720061006d00650077006f0072006b005200650064006900730074003e0058003600520051006200610026006500470040005b002d003200630041007600560064007300740000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\Microsoft.Xna.Framework.Storage,fileVersion="4.0.20823.0",version="4.0.0.00000",culture="neutral",publicKeyToken="842CF8BE1DE50553",processorArchitecture="MSIL" = 6c00660060002e003200510046002b00300041004c0048005600370077003800680027002100740058004e0041004600720061006d00650077006f0072006b005200650064006900730074003e007b0072006100690027004a006300710041003d00550070005d002e0026004d0043007a007100590000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\Microsoft.Xna.Framework.Video,fileVersion="4.0.20823.0",version="4.0.0.00000",culture="neutral",publicKeyToken="842CF8BE1DE50553",processorArchitecture="MSIL" = 6c00660060002e003200510046002b00300041004c0048005600370077003800680027002100740058004e0041004600720061006d00650077006f0072006b005200650064006900730074003e00550048004a0055006e0053003d0052005d00380048004d005d00250038005d00400059006900750000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cecec95a-d894-491a-bee3-5e106fb59f2d}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_6.dll"	DXSETUP.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\DirectShow\MediaObjects\a8122ff4-9e52-4374-b3d9-b4063e77109d\OutputTypes = 6175647300001000800000aa00389b710100000000001000800000aa00389b71	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248d8a3b-6256-44d3-a018-2ac96c459f47}\InProcServer32\ThreadingModel = "Both"	DXSETUP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8122FF4-9E52-4374-B3D9-B4063E77109D}\InprocServer32	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\500BB8FAD5F3D2A4D9EFC01E0702D939\0AA7CFB2C445A3E47869763FEB56B59E	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\SourceList	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e48c5a3f-93ef-43bb-a092-2c7ceb946f27}\InProcServer32	DXSETUP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8122FF4-9E52-4374-B3D9-B4063E77109D}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WorldBox.God.Simulator.v0.22.9.558\\Game\\_Redist\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\WorldBox.God.Simulator.v0.22.9.558\\Game\\_Redist\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cecec95a-d894-491a-bee3-5e106fb59f2d}\ = "AudioReverb"	DXSETUP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3eda9b49-2085-498b-9bb2-39a6778493de}\InProcServer32\ThreadingModel = "Both"	DXSETUP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8122FF4-9E52-4374-B3D9-B4063E77109D}\InprocServer32\ = "C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\XNA\\Framework\\Shared\\xnavisualizer.dll"	MsiExec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\Microsoft.Xna.Framework.Game,fileVersion="4.0.20823.0",version="4.0.0.00000",culture="neutral",publicKeyToken="842CF8BE1DE50553",processorArchitecture="x86" = 6c00660060002e003200510046002b00300041004c0048005600370077003800680027002100740058004e0041004600720061006d00650077006f0072006b005200650064006900730074003e0048006100380066004c0049004f0071007b003f00380032003100310034002e002400740052006c0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0AA7CFB2C445A3E47869763FEB56B59E\DXRedist	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\ProductIcon = "C:\\Windows\\Installer\\{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}\\ProductIcon"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\PackageCode = "CC1B48CD503865840BBC69BD0DED73A5"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248d8a3b-6256-44d3-a018-2ac96c459f47}	DXSETUP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248d8a3b-6256-44d3-a018-2ac96c459f47}\InProcServer32	DXSETUP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e48c5a3f-93ef-43bb-a092-2c7ceb946f27}\InProcServer32\ThreadingModel = "Both"	DXSETUP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cecec95a-d894-491a-bee3-5e106fb59f2d}\InProcServer32\ThreadingModel = "Both"	DXSETUP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\DirectShow\MediaObjects\a8122ff4-9e52-4374-b3d9-b4063e77109d\ = "XnaVisualizerDmo"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\Microsoft.Xna.Framework.GamerServices,fileVersion="4.0.20823.0",version="4.0.0.00000",culture="neutral",publicKeyToken="842CF8BE1DE50553",processorArchitecture="MSIL" = 6c00660060002e003200510046002b00300041004c0048005600370077003800680027002100740058004e0041004600720061006d00650077006f0072006b005200650064006900730074003e007a00770076007100640077006800410066003d007a0027006500360077004900760034006700560000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\Microsoft.Xna.Framework.Avatar,fileVersion="4.0.20823.0",version="4.0.0.00000",culture="neutral",publicKeyToken="842CF8BE1DE50553",processorArchitecture="MSIL" = 6c00660060002e003200510046002b00300041004c0048005600370077003800680027002100740058004e0041004600720061006d00650077006f0072006b005200650064006900730074003e006000490066005200610038006c007d006e00400064003100700042005b00330060002c003900350000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA7CFB2C445A3E47869763FEB56B59E\SourceList\PackageName = "xnafx40_redist.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\DirectShow\MediaObjects\Categories\f3602b3f-0592-48df-a4cd-674721e7ebeb	MsiExec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

msiexec.exe

pid process

3804 msiexec.exe
3804 msiexec.exe

pid	process
3804	msiexec.exe
3804	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exe

description	pid	process
Token: SeShutdownPrivilege	3260	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3260	msiexec.exe
Token: SeSecurityPrivilege	3804	msiexec.exe
Token: SeCreateTokenPrivilege	3260	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3260	msiexec.exe
Token: SeLockMemoryPrivilege	3260	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3260	msiexec.exe
Token: SeMachineAccountPrivilege	3260	msiexec.exe
Token: SeTcbPrivilege	3260	msiexec.exe
Token: SeSecurityPrivilege	3260	msiexec.exe
Token: SeTakeOwnershipPrivilege	3260	msiexec.exe
Token: SeLoadDriverPrivilege	3260	msiexec.exe
Token: SeSystemProfilePrivilege	3260	msiexec.exe
Token: SeSystemtimePrivilege	3260	msiexec.exe
Token: SeProfSingleProcessPrivilege	3260	msiexec.exe
Token: SeIncBasePriorityPrivilege	3260	msiexec.exe
Token: SeCreatePagefilePrivilege	3260	msiexec.exe
Token: SeCreatePermanentPrivilege	3260	msiexec.exe
Token: SeBackupPrivilege	3260	msiexec.exe
Token: SeRestorePrivilege	3260	msiexec.exe
Token: SeShutdownPrivilege	3260	msiexec.exe
Token: SeDebugPrivilege	3260	msiexec.exe
Token: SeAuditPrivilege	3260	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3260	msiexec.exe
Token: SeChangeNotifyPrivilege	3260	msiexec.exe
Token: SeRemoteShutdownPrivilege	3260	msiexec.exe
Token: SeUndockPrivilege	3260	msiexec.exe
Token: SeSyncAgentPrivilege	3260	msiexec.exe
Token: SeEnableDelegationPrivilege	3260	msiexec.exe
Token: SeManageVolumePrivilege	3260	msiexec.exe
Token: SeImpersonatePrivilege	3260	msiexec.exe
Token: SeCreateGlobalPrivilege	3260	msiexec.exe
Token: SeBackupPrivilege	2392	vssvc.exe
Token: SeRestorePrivilege	2392	vssvc.exe
Token: SeAuditPrivilege	2392	vssvc.exe
Token: SeBackupPrivilege	3804	msiexec.exe
Token: SeRestorePrivilege	3804	msiexec.exe
Token: SeRestorePrivilege	3804	msiexec.exe
Token: SeTakeOwnershipPrivilege	3804	msiexec.exe
Token: SeRestorePrivilege	3804	msiexec.exe
Token: SeTakeOwnershipPrivilege	3804	msiexec.exe
Token: SeRestorePrivilege	3804	msiexec.exe
Token: SeTakeOwnershipPrivilege	3804	msiexec.exe
Token: SeRestorePrivilege	3804	msiexec.exe
Token: SeTakeOwnershipPrivilege	3804	msiexec.exe
Token: SeRestorePrivilege	3804	msiexec.exe
Token: SeTakeOwnershipPrivilege	3804	msiexec.exe
Token: SeRestorePrivilege	3804	msiexec.exe
Token: SeTakeOwnershipPrivilege	3804	msiexec.exe
Token: SeRestorePrivilege	3804	msiexec.exe
Token: SeTakeOwnershipPrivilege	3804	msiexec.exe
Token: SeRestorePrivilege	3804	msiexec.exe
Token: SeTakeOwnershipPrivilege	3804	msiexec.exe
Token: SeRestorePrivilege	3804	msiexec.exe
Token: SeTakeOwnershipPrivilege	3804	msiexec.exe
Token: SeRestorePrivilege	3804	msiexec.exe
Token: SeTakeOwnershipPrivilege	3804	msiexec.exe
Token: SeRestorePrivilege	3804	msiexec.exe
Token: SeTakeOwnershipPrivilege	3804	msiexec.exe
Token: SeRestorePrivilege	3804	msiexec.exe
Token: SeTakeOwnershipPrivilege	3804	msiexec.exe
Token: SeRestorePrivilege	3804	msiexec.exe
Token: SeTakeOwnershipPrivilege	3804	msiexec.exe
Token: SeRestorePrivilege	3804	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

3260 msiexec.exe
3260 msiexec.exe

pid	process
3260	msiexec.exe
3260	msiexec.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

msiexec.exe

description	pid	process	target process
PID 3804 wrote to memory of 1496	3804	msiexec.exe	srtasks.exe
PID 3804 wrote to memory of 1496	3804	msiexec.exe	srtasks.exe
PID 3804 wrote to memory of 4632	3804	msiexec.exe	DXSETUP.exe
PID 3804 wrote to memory of 4632	3804	msiexec.exe	DXSETUP.exe
PID 3804 wrote to memory of 4632	3804	msiexec.exe	DXSETUP.exe
PID 3804 wrote to memory of 1016	3804	msiexec.exe	MsiExec.exe
PID 3804 wrote to memory of 1016	3804	msiexec.exe	MsiExec.exe
PID 3804 wrote to memory of 1016	3804	msiexec.exe	MsiExec.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\WorldBox.God.Simulator.v0.22.9.558\Game\_Redist\xnafx40_redist.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3260

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3804
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:4
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\DXSETUP.exe
  "C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\DXSETUP.exe" /silent
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Modifies registry class
  PID:4632
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Microsoft Shared\XNA\Framework\Shared\xnavisualizer.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:1016

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e58411c.rbs

Filesize
17KB

MD5
23a0c661e9ec53e3d426157209ff391b

SHA1
c5d49647e6bfefc75e2c5a438b95cee4aaeb14ec

SHA256
25cd53a31cd28203612dd10a596dc51a7b4e0faf3c23b107ef02c4037e9fb308

SHA512
c90b80b7f4b8172014a49c01583fa7eee79efffb19c4177aeff58d91d2ec2994237174c85eafb1fe0615f160d1504b6fb6054b88ab20bb091a6203a6fbcfd3f3

Download Submit
C:\Config.Msi\e58411e.rbs

Filesize
596B

MD5
9d060318a5c140f65a241c2c05f4db2e

SHA1
a1a72a670e74612c30e7464b6c0f1942ac21562d

SHA256
d6dad488777a528d2709bb767c76943715f9c01af2b77ab2f22b827d1c6db03e

SHA512
63273290bfb3604a30e4579d6594c428338c8b28146109030d505fa7b706c007baffd77f45cb05d11a499092be5f2e1a06a141639e2671a733533321a5f2bf25

Download Submit
C:\PROGRA~2\MICROS~2\XNAGAM~1\v4.0\Redist\DXREDI~1\Apr2007_d3dx9_33_x86.cab

Filesize
1.5MB

MD5
3676d740157493e80e7b8641289c003c

SHA1
8135aeeab67151dd4e2418d4907077f646e72873

SHA256
219441f975c200352a12dc3d8f82811fc7b53ed28d63761327933afbb660f876

SHA512
abfc5ea36a7368a34193c8f3771ae4e36c0d570ae0a20b11892184cd4e384d6abe6542769e3c890293b4e640faecf6392f84f5733017d8d86c65456caa24c6f7

Download Submit
C:\PROGRA~2\MICROS~2\XNAGAM~1\v4.0\Redist\DXREDI~1\Apr2007_xinput_x86.cab

Filesize
55KB

MD5
f83f54f45ac15a32dc17614c4f6882d4

SHA1
fc8542fcd33bb9e669806409f677edec9bfb64fb

SHA256
5ab7bb15394e4ece850da5453413ab1de2ea97d5c93f86482b75073aaa05da9c

SHA512
e4dcccc3a4299d262b94b24ff4b29394bed71e211b80a8a457acc4ab89325500082e6a9b597bc7b1dbc35746d01a9aa038a9c3a401aa42a426fcc3d15f410c9a

Download Submit
C:\PROGRA~2\MICROS~2\XNAGAM~1\v4.0\Redist\DXREDI~1\Feb2010_X3DAudio_x86.cab

Filesize
20KB

MD5
ed093ce20bddc7c42ede4daf772ed5aa

SHA1
21beb0ef8130be1c62b8467dfb67bf3f7548cea1

SHA256
7fbf09682fd15d721ff2c5cb110b5ffcf5982cd2dd8d72b708cf3cd0bc4fa250

SHA512
734e397f4ed2554944e1d1f6f799794c4027792a06e9da25bab58e6e4ff58146058d8b45ff0cb9c861f77989cad029164945f22ffcb459432e1d3a2c7172525c

Download Submit
C:\PROGRA~2\MICROS~2\XNAGAM~1\v4.0\Redist\DXREDI~1\Feb2010_XACT_x86.cab

Filesize
90KB

MD5
5cf3585c99a59319ac10e18cc92f0024

SHA1
c48c25e6b7094eaf337fa986960f9895e5f465ba

SHA256
0ba00c41443639dea9b816fa2608088ccef5dbe850531dff4c1e7993804b0b60

SHA512
26b8213a5105b37912632c8abc1a07381210836e620f8f70d77b3b412a406e2e38df7af037001fe27f2da874e143c59aa7dbff90a9183e7619a8e5af0a23b158

Download Submit
C:\PROGRA~2\MICROS~2\XNAGAM~1\v4.0\Redist\DXREDI~1\Feb2010_XAudio_x86.cab

Filesize
270KB

MD5
5da6e4a80fa53568d2fdde31cbff2979

SHA1
9606fda70427cd9f4eb8e67b625417e2775e6876

SHA256
281bb0e12f617e9ae7fe3301a7d4a08201b377caa0311a886e8cddc2526f734a

SHA512
649fc2578388064267ebe8e55daada29d2e51ae6422b10088b6bfacd229bc0439aafdc4f9af7b3b5e187df179c72b4d85f70839a8c91505d17da06d53a40cf3b

Download Submit
C:\PROGRA~2\MICROS~2\XNAGAM~1\v4.0\Redist\DXREDI~1\Mar2009_d3dx9_41_x86.cab

Filesize
1.5MB

MD5
0fdd6e4e5dfc5d913261355746402214

SHA1
a80c28755c9d3ca163bd377d1bd951a1c111733c

SHA256
5146e15d4c65590704286bfcfbbcc31e98a6832f8a7cc3bfdcb1e7fa5a647bb1

SHA512
9eb85c4507881fc1004c906ee954273bfbea8979d70b2321f197a3cf82121734225103e4239a9bfb591a980b70400a5d19b93482abc108c46614a20476a81f90

Download Submit
C:\PROGRA~2\MICROS~2\XNAGAM~1\v4.0\Redist\DXREDI~1\dxupdate.cab

Filesize
93KB

MD5
c187448c8104d30087f3f25a9d112014

SHA1
b64ac3e44f2f38a3bf8400f11a40a39039fc9caa

SHA256
54d68f154058433865708ee0dbf3ecf2d609ffbd618e84a1056440379494d9fd

SHA512
9148cece409557444eeaf66dee58e2a6043a64d7b76b91e6c4074a5ba0d066cd1ebb2c60d44e1c7a40ca1dc63d72aa7afcc410202901d5afbf2116e3ba8b0f11

Download Submit
C:\Program Files (x86)\Common Files\Microsoft Shared\XNA\Framework\Shared\xnavisualizer.dll

Filesize
46KB

MD5
ba187b4db5dae1bee29e6f18b7775b8b

SHA1
efce87100c26165cfd7eb627534e42cb72ddb5b7

SHA256
11bcc9f47d9b0397f6d78c08e7208ee812cbef54bb02a8c3a681608879471c8c

SHA512
c9c2c3760e495c611a925bb5ae162d4c4ac90f53e2c0a9d20f68085ab43cc0f0a7ad1d201564649e4cf67ef4402d874626c6911f01f8a055da0b993730afc12c

Download Submit
C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\DSETUP32.DLL

Filesize
1.6MB

MD5
7c7cc9feb1026678c48bbabe84ea57c2

SHA1
4fe9c466fc65cf07af0e1440743b1822ab65849b

SHA256
a5c6df12f9fe2edab2a22fe7abf3cb17eac110a6fd469f2570ba04afc88ad767

SHA512
d9cca6dfd5966d45342b87afb6091bc8ad3beff039f9bc9c523f8118dc6723337c279cd652c19624250ed3934d8f4a2b15670652867c0114b7e785bbab4212e0

Download Submit
C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\DXSETUP.exe

Filesize
512KB

MD5
11dd6e8ab9759d1ac91ffe0d0e4949cb

SHA1
2a86774d0c87050d5c7aa9738cc3975303a40d0e

SHA256
16953a202265db5655b3dd972b855619728da76545a2f94bcbb6c43262f48d5b

SHA512
06828f51b3866f7c2b29861707bf8552b742e366783115b3062f08a9c0005c96507ecf1fff92ad41dc0318ad715176c39c84ff0424372b080bf7c031e4f307de

Download Submit
C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\dsetup.dll

Filesize
91KB

MD5
4d48dbe4d3a06c497435014e5c583f34

SHA1
159cbc37080b7ea3ceae8d25125b99f9f4948341

SHA256
9d47b4fa2dcce6a02a51324cfb97f5e153086c2eb8832b211e175cbe5fb850b3

SHA512
b8029bde36e4d6581916c131ec51d74f4a2b03abf5a238c503e1c7b19980d0946606375f0b4c3bd10b9c514e084368c356be8536b282bee887037d7d7f139732

Download Submit
C:\Users\Admin\AppData\Local\Temp\DX4745.tmp\FEB2010_X3DAudio_x86.inf

Filesize
1KB

MD5
e84adf38d499ae39090ad60fd76d76e3

SHA1
6af4d58bc04aac2723e8b97649f1b35fb1aca84c

SHA256
d4da3e530982812d1e2a31570b80af541fac1b13c72997d2aad7ea3bfeaf4a4a

SHA512
6714992e7aee7bd0798fbec68f92c97ee502127580e21e1b6693ed6737312b44dbc9fd9ef579fe552590e9e5a4904df94e4116334265a34699a04aa76ab87c24

Download Submit
C:\Users\Admin\AppData\Local\Temp\DX4745.tmp\FEB2010_XACT_x86.inf

Filesize
1KB

MD5
82c10b720e33be099f69e4010d44ecd2

SHA1
e95a2eb23db3fd610d71089500aad523f93c9469

SHA256
e850fdb84bcac0f667927e53fee943efd3f43be6c6a0ae1e17f3fff83ddb2635

SHA512
853261c439b26cdc8991ac289b9f9925976452ed613481b0cf09e75444882805ffa15633eba441d8e1a04641f5f6378b68e2270a6a48d3911d7f9c2c0b1235bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\DX4745.tmp\FEB2010_XAudio_x86.inf

Filesize
1KB

MD5
e6e942a2cfbb587bfcc4203b5bb34fd4

SHA1
2e0172ea1936911a98e11a6e98990703e24172c0

SHA256
74c827ef94881099761e04397ef8f162fd0ccaf4876a5503c4b53a5216d2acca

SHA512
3d70d76e6f459819a1703c5019a2e10fe518ee6e8eb5d3313fe57d3d1b6313b52c4904398a26841c78a9ecf9d715e1201e834ab3df47265e070ec94417a78e4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\DX4745.tmp\Mar2009_d3dx9_41_x86.inf

Filesize
1KB

MD5
b37a5ff044eb65521a290c79ba1a3e00

SHA1
ed505464894bd3e52654834487f3821ae117edfe

SHA256
bd29711cc2ecd924990167ffa95f48842e24aeed3acef1023717040240b4bbb6

SHA512
eae4408cfa7f9c39b101489688cc570a184b8a57f3d20d3b0452a581fb80c4f485dc2f512a39669a92a5bde81fbf474e1585f566ff482e87610780c23126c21e

Download Submit
C:\Users\Admin\AppData\Local\Temp\DX4745.tmp\X3DAudio1_7.dll

Filesize
21KB

MD5
c811e70c8804cfff719038250a43b464

SHA1
ec48da45888ccea388da1425d5322f5ee9285282

SHA256
288c701bdedf1d45c63dd0b7d424a752f8819f90feb5088c582f76bc98970ba3

SHA512
09f2f4d412485ef69aceacc90637c90fad25874f534433811c5ed88225285559db1d981a3ab7bc3a20336e96fb43b4801b4b48a3668c64c21436ee3ea3c32f45

Download Submit
C:\Users\Admin\AppData\Local\Temp\DX4745.tmp\XAPOFX1_4.dll

Filesize
72KB

MD5
e4ce2af32f501a7f7dddd908704a0ee6

SHA1
9dc2976efb15b6fba08bebdeb98929b6961063a5

SHA256
0aee44b12913a95840ee6431d90518b0d72c54a27392e21ee6995e2151554a06

SHA512
ec14a58414d595a36c6b575cdae690f11481cd3f0b35fd2f4c6a6d162a6272882cfe03da865e09a34972775790529f51c80b69056a2fcb909f25b549ed2f7f01

Download Submit
C:\Users\Admin\AppData\Local\Temp\DX4745.tmp\XAudio2_6.dll

Filesize
515KB

MD5
4976243bd70fae3d1d24e49739ab2710

SHA1
6ef27b10bcf4e697fe77c3e964b326be11e4444f

SHA256
61b57170f7c6365714396072d22cb98746718c0f44c9f0d5c62fdb1b218639c7

SHA512
af2d6aaad44bed880a1a2ee947618b142c76a5eca42d4608196b74df9108a9649059d8207e84a58b76ad43aefe9b66ffcc519f8126667177011cf4199f163e83

Download Submit
C:\Users\Admin\AppData\Local\Temp\DX4745.tmp\apr2007_d3dx9_33_x86.inf

Filesize
1KB

MD5
044cae9c30c88bda73727243f5e5206d

SHA1
de744e349cf4ea458b10657d510966d21ad08d67

SHA256
349a09a2791d697bffffc61410a536cdcf258f0d7c86dda44a297e8aec4bdf00

SHA512
18e501142004afbcd28b41bdd3a9b19e2eebc047d7858ee11a9135f19759cfd8c643ff074a51e937bbcab7162888fd95effc146be21fe63dfc300ef03ed44056

Download Submit
C:\Users\Admin\AppData\Local\Temp\DX4745.tmp\apr2007_xinput_x86.inf

Filesize
1KB

MD5
e188f534500688cec2e894d3533997b4

SHA1
f073f8515b94cb23b703ab5cdb3a5cfcc10b3333

SHA256
1c798cb80e9e46ce03356ea7316e1eff5d3a88ccdd7cbfbfcdce73cded23b4e5

SHA512
332ccb25c5ed92ae48c5805a330534d985d6b41f9220af0844d407b2019396fcefea7076b409439f5ab8a9ca6819b65c07ada7bd3aa1222429966dc5a440d4f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\DX4745.tmp\d3dx9_33.dll

Filesize
3.3MB

MD5
cdb1cd22baff21f48606b3c1a18b000b

SHA1
9315b5db975a34dbebdb4dcae652ba1db01c482c

SHA256
c6b7b2ad7742dde5dd8d1a35fdc1c185e586e551ad9c74d3fb21759cd8ca4da8

SHA512
c5fb24de8f1ee6fc1ed6e74580b5d22599ea4eb6c3589645fff0b15dc8dca051c4917e60fbc00ca86542dd63a8f5e40da92ea77e24826c0c6bdba9b58c36d4db

Download Submit
C:\Users\Admin\AppData\Local\Temp\DX4745.tmp\d3dx9_41.dll

Filesize
4.0MB

MD5
3fa06cf5079b84155d18b05c08f7131b

SHA1
fafe52876151a08f39dbb6b4aa137dd85558ba5f

SHA256
6ac4df203af419d3f3b7d9a99e14a3490ea3ad307c474bfe36baea642b1421f6

SHA512
24d29c3ffb6532da860fef4dd93e61f7532cea3af94928495a3af0231e7dff6db5cad25713451a2e722c076462b94818cd6969a1c7d8905585b0f64e12174d1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\DX4745.tmp\dxupdate.dll

Filesize
169KB

MD5
c4842e139fca422e265c91c44a1341d6

SHA1
299a5ab4644fe7302b515aa10ef0f1715046275c

SHA256
b1f954cd75dc3c9d5bc57f1a4c28720ee3639aa8a4306f3da7b27d3c361ff8f5

SHA512
e85a35164e0feafa73a676dacf67d275b8e8aa5be40d861743662a7d1ac8135625c2d59a73e5c77fe1e3e8bd8523d9c823c89137aa4cb1b32d392cd9a1b59989

Download Submit
C:\Users\Admin\AppData\Local\Temp\DX4745.tmp\dxupdate.inf

Filesize
12KB

MD5
8c281fcb5546d1ed3cdaf6e3f7303139

SHA1
de342a17f2df0386f6584e2f55ae43c558ceb6c4

SHA256
7530c6e18dbb522c5f4fbf6714962c185ea318f9eab7aeb833b0cc07cd2fe656

SHA512
344ea0a375c8851fcf413f441a1cac3013b3748d1630a4d677da72e98f41823bf9427d896de7e1fe35bf868279538cf3b8322aa6ef20025bff48a6bb7f8c42d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\DX4745.tmp\xactengine3_6.dll

Filesize
233KB

MD5
f81c4678a55ffee585ac75825faf5582

SHA1
8fb2e6cf2a022eaed2ff5e3e225b3ca1e453d1cc

SHA256
8a7e7c5ac2e6230f0249d46751522e7ecf85e7490cf7491ab73bf2e7e59e4c0f

SHA512
8c8071bc2640d5c0fcf140ad68d4788cbb0706d17313c3cb74e25624a748b282acbf77eda678cf0d5fecf2ec3d583508c6f4eaf5c84073909b616f59b4f4e5fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\DX4745.tmp\xinput1_3.dll

Filesize
79KB

MD5
77f595dee5ffacea72b135b1fce1312e

SHA1
d2a710b332de3ef7a576e0aed27b0ae66892b7e9

SHA256
8d540d484ea41e374fd0107d55d253f87ded4ce780d515d8fd59bbe8c98970a7

SHA512
a8683050d7758c248052c11ac6a46c9a0b3b3773902cca478c1961b6d9d2d57c75a8c925ba5af4499989c0f44b34eaf57abafafa26506c31e5e4769fb3439746

Download Submit
C:\Windows\Installer\e58411d.msi

Filesize
6.7MB

MD5
97c2eebb30c5a88c68c8f24f37183f1d

SHA1
49efdc29f65fc8263c196338552c7009fc96c5de

SHA256
e6c41d692ebcba854dad4b1c52bb7ddd05926bad3105595d6596b8bab01c25e7

SHA512
c9d1017b274ceb1b4ee624cf7e628787c32a727c64f715fbce1f1ae929d9114f8fe1291e34583cec615619b0128c01206b07efc878e7a5c57b792453f73fd0da

Download Submit
C:\Windows\Logs\DirectX.log

Filesize
10KB

MD5
1dc0827f2ed1aed1358b4211378f16d1

SHA1
21cad22b8c7899b0dc203ce00d6ddf247f1b2f82

SHA256
e3b15d8d9e2b5dae80c956b4d10e0277d864ccbdaa81c1ee77d2cbf02766c450

SHA512
2996530ba93c8964e270ded1900a8465646c79f29c3b1af1e2b841658e003f42a3798b5adee364e0c7de6711f2ad172ca38843b4bba2e82963d59fae99151de5

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.9MB

MD5
927d45cf4924e50a6e88dd3aa855a72a

SHA1
04360a19327f31ac12195a5dfd19c9c658af8a04

SHA256
49386282907fdbbfae88337ebfb71b470695f26c1a74f5fcc82a6af7060777fe

SHA512
eb9f33d8ec12a38c557bc5995a3644e16bbcacad115762e3b063fb5b58130d31d9c67e7e94cd7c048bb40928cc1aeedf84a0048fae4ddf5fdff1f29026aa4ab3

Download Submit
\??\Volume{8fc2d019-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{3a36d672-92e3-4163-9113-e4a34ee66d75}_OnDiskSnapshotProp

Filesize
6KB

MD5
91f669c7cd60c803b98c6e20b9ca9add

SHA1
980c636da7e26e8d6b711fc2c65ce16babcb6b83

SHA256
0ced5672cf476b0933eacad2fb2948b5b8700e437b81a8b04baf80f44d7b71d0

SHA512
fe14b212dcc252d6feb3fe7b446b0d532689bf8320a5d1650cba2f28b7f50bc87c13215368945cfb37fb2473e6793de7a5f0231d145df9c2bc58607bce456de8

Download Submit
memory/3804-48-0x0000000000E20000-0x0000000000E36000-memory.dmp

Filesize
88KB

Download
memory/3804-39-0x0000014569280000-0x0000014569294000-memory.dmp

Filesize
80KB

Download
memory/3804-21-0x00000145691F0000-0x00000145691FC000-memory.dmp

Filesize
48KB

Download
memory/3804-36-0x0000014569200000-0x000001456920C000-memory.dmp

Filesize
48KB

Download
memory/3804-33-0x0000000000DB0000-0x0000000000E1C000-memory.dmp

Filesize
432KB

Download
memory/3804-30-0x0000014569260000-0x0000014569278000-memory.dmp

Filesize
96KB

Download
memory/3804-27-0x0000014569240000-0x0000014569258000-memory.dmp

Filesize
96KB

Download
memory/3804-24-0x0000000000D00000-0x0000000000DAA000-memory.dmp

Filesize
680KB

Download
memory/3804-42-0x0000014569210000-0x000001456921C000-memory.dmp

Filesize
48KB

Download
memory/3804-45-0x0000014569220000-0x000001456922A000-memory.dmp

Filesize
40KB

Download