netsupport | d933149df4213449714cf63a0d63d04cb632caa97845579eae269bf16b5badcf

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\CiCStudent\ImagePath = "\"C:\\Program Files (x86)\\NetSupport\\classroom.cloud\\cicStudent.exe\" /* *"	WINSTALL.EXE
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\nskbfltr\ImagePath = "\\SystemRoot\\system32\\drivers\\nskbfltr.sys"	WINSTALL.EXE

Blocklisted process makes network request 2 IoCs

flow	pid	Process
2	4260	msiexec.exe
3	4260	msiexec.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\K:	CICPlugin.exe
File opened (read-only)	\??\V:	CICPlugin.exe
File opened (read-only)	\??\W:	CICPlugin.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	CICPlugin64.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	CICPlugin.exe
File opened (read-only)	\??\Z:	CICPlugin.exe
File opened (read-only)	\??\I:	CICPlugin64.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	CICPlugin64.exe
File opened (read-only)	\??\P:	CICPlugin64.exe
File opened (read-only)	\??\H:	CICPlugin.exe
File opened (read-only)	\??\L:	CICPlugin.exe
File opened (read-only)	\??\X:	CICPlugin.exe
File opened (read-only)	\??\F:	CICPlugin.exe
File opened (read-only)	\??\M:	CICPlugin64.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\I:	CICPlugin.exe
File opened (read-only)	\??\T:	CICPlugin.exe
File opened (read-only)	\??\X:	CICPlugin64.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\B:	CICPlugin64.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\J:	CICPlugin.exe
File opened (read-only)	\??\A:	CICPlugin64.exe
File opened (read-only)	\??\H:	CICPlugin64.exe
File opened (read-only)	\??\S:	CICPlugin64.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	CICPlugin64.exe
File opened (read-only)	\??\Y:	CICPlugin.exe
File opened (read-only)	\??\E:	CICPlugin64.exe
File opened (read-only)	\??\G:	CICPlugin64.exe
File opened (read-only)	\??\O:	CICPlugin64.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\J:	CICPlugin64.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	CICPlugin.exe
File opened (read-only)	\??\U:	CICPlugin.exe
File opened (read-only)	\??\Q:	CICPlugin64.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	CICPlugin.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

persistence privilege_escalation

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AllowMultipleTSSessions = "0"	WINSTALL.EXE

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\setupapi.pdb	cicStudent.exe
File opened for modification	C:\Windows\SysWOW64\msctf.pdb	cicStudent.exe
File opened for modification	C:\Windows\SysWOW64\MMDevAPI.pdb	cicStudent.exe
File opened for modification	C:\Windows\SysWOW64\audioses.pdb	cicStudent.exe
File opened for modification	C:\Windows\SysWOW64\wwin32u.pdb	cicStudent.exe
File opened for modification	C:\Windows\SysWOW64\winspool.pdb	cicStudent.exe
File opened for modification	C:\Windows\SysWOW64\msvcrt.pdb	cicStudent.exe
File opened for modification	C:\Windows\SysWOW64\srvcli.pdb	cicStudent.exe
File opened for modification	C:\Windows\SysWOW64\dnsapi.pdb	cicStudent.exe
File opened for modification	C:\Windows\SysWOW64\wkernel32.pdb	cicStudent.exe
File opened for modification	C:\Windows\SysWOW64\wkernelbase.pdb	cicStudent.exe
File created	C:\Windows\system32\cicclient32provider.dll	winst64.exe
File opened for modification	C:\Windows\SysWOW64\psapi.pdb	cicStudent.exe
File opened for modification	C:\Windows\SysWOW64\winhttp.pdb	cicStudent.exe
File opened for modification	C:\Windows\SysWOW64\wkscli.pdb	cicStudent.exe
File opened for modification	C:\Windows\SysWOW64\fastprox.pdb	cicStudent.exe
File opened for modification	C:\Windows\SysWOW64\dhcpcsvc6.pdb	cicStudent.exe
File opened for modification	C:\Windows\SysWOW64\dhcpcsvc.pdb	cicStudent.exe
File created	C:\Windows\SysWOW64\DnaMsg.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\wntdll.pdb	cicStudent.exe
File opened for modification	C:\Windows\SysWOW64\combase.pdb	cicStudent.exe
File opened for modification	C:\Windows\SysWOW64\ole32.pdb	cicStudent.exe
File opened for modification	C:\Windows\SysWOW64\iphlpapi.pdb	cicStudent.exe
File opened for modification	C:\Windows\SysWOW64\wrpcrt4.pdb	cicStudent.exe
File opened for modification	C:\Windows\SysWOW64\wsock32.pdb	cicStudent.exe
File opened for modification	C:\Windows\SysWOW64\netapi32.pdb	cicStudent.exe
File opened for modification	C:\Windows\SysWOW64\cicStudent.pdb	cicStudent.exe
File opened for modification	C:\Windows\SysWOW64\userenv.pdb	cicStudent.exe
File opened for modification	C:\Windows\SysWOW64\wsspicli.pdb	cicStudent.exe
File created	C:\Windows\SysWOW64\pcimsg.dll	WINSTALL.EXE
File opened for modification	C:\Windows\SysWOW64\msvcr100.i386.pdb	cicStudent.exe
File opened for modification	C:\Windows\SysWOW64\WinTypes.pdb	cicStudent.exe
File opened for modification	C:\Windows\system32\cicclient32provider.dll	winst64.exe
File opened for modification	C:\Windows\SysWOW64\winmm.pdb	cicStudent.exe
File opened for modification	C:\Windows\SysWOW64\crypt32.pdb	cicStudent.exe
File opened for modification	C:\Windows\SysWOW64\wimm32.pdb	cicStudent.exe
File opened for modification	C:\Windows\SysWOW64\dbgcore.pdb	cicStudent.exe
File opened for modification	C:\Windows\SysWOW64\wtsapi32.pdb	cicStudent.exe
File opened for modification	C:\Windows\SysWOW64\advapi32.pdb	cicStudent.exe
File opened for modification	C:\Windows\SysWOW64\wgdi32full.pdb	cicStudent.exe
File opened for modification	C:\Windows\SysWOW64\wininet.pdb	cicStudent.exe
File opened for modification	C:\Windows\SysWOW64\dbghelp.pdb	cicStudent.exe
File opened for modification	C:\Windows\SysWOW64\bcryptprimitives.pdb	cicStudent.exe
File opened for modification	C:\Windows\SysWOW64\sechost.pdb	cicStudent.exe
File opened for modification	C:\Windows\SysWOW64\shlwapi.pdb	cicStudent.exe
File opened for modification	C:\Windows\SysWOW64\nsi.pdb	cicStudent.exe
File opened for modification	C:\Windows\SysWOW64\ws2_32.pdb	cicStudent.exe
File opened for modification	C:\Windows\SysWOW64\samcli.pdb	cicStudent.exe
File opened for modification	C:\Windows\SysWOW64\wldap32.pdb	cicStudent.exe
File opened for modification	C:\Windows\SysWOW64\devobj.pdb	cicStudent.exe
File opened for modification	C:\Windows\SysWOW64\SHFOLDER.pdb	cicStudent.exe
File opened for modification	C:\Windows\SysWOW64\adsldpc.pdb	cicStudent.exe
File opened for modification	C:\Windows\SysWOW64\msvcp_win.pdb	cicStudent.exe
File opened for modification	C:\Windows\SysWOW64\version.pdb	cicStudent.exe
File opened for modification	C:\Windows\SysWOW64\shcore.pdb	cicStudent.exe
File opened for modification	C:\Windows\SysWOW64\oleaut32.pdb	cicStudent.exe
File opened for modification	C:\Windows\SysWOW64\activeds.pdb	cicStudent.exe
File opened for modification	C:\Windows\SysWOW64\profapi.pdb	cicStudent.exe
File opened for modification	C:\Windows\SysWOW64\wuser32.pdb	cicStudent.exe
File opened for modification	C:\Windows\SysWOW64\secur32.pdb	cicStudent.exe
File opened for modification	C:\Windows\SysWOW64\dwmapi.pdb	cicStudent.exe
File opened for modification	C:\Windows\SysWOW64\Amsi.pdb	cicStudent.exe
File opened for modification	C:\Windows\SysWOW64\msasn1.pdb	cicStudent.exe
File opened for modification	C:\Windows\SysWOW64\wuxtheme.pdb	cicStudent.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\NetSupport\classroom.cloud\cicToolbar.exe	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\classroom.cloud\Locales\1043\ManageADAccount_res.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\NetSupport\classroom.cloud\symbols\dll\wsock32.pdb	cicStudent.exe
File opened for modification	C:\Program Files (x86)\NetSupport\classroom.cloud\devobj.pdb	cicStudent.exe
File created	C:\Program Files (x86)\NetSupport\classroom.cloud\Locales\1031\cicToolbar_res.dll	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\classroom.cloud\pluginiemodule.DLL	msiexec.exe
File opened for modification	C:\Program Files (x86)\NetSupport\classroom.cloud\dll\crypt32.pdb	cicStudent.exe
File opened for modification	C:\Program Files (x86)\NetSupport\classroom.cloud\symbols\dll\cfgmgr32.pdb	cicStudent.exe
File created	C:\Program Files (x86)\NetSupport\classroom.cloud\Locales\2052\pcicl32_RES.dll	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\classroom.cloud\Locales\1028\cicToolbar_res.dll	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\classroom.cloud\Locales\1031\PluginSoftwareModule64_res.dll	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\classroom.cloud\Locales\1040\ManageADAccount_res.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\NetSupport\classroom.cloud\dll\msvcr100.i386.pdb	cicStudent.exe
File created	C:\Program Files (x86)\NetSupport\classroom.cloud\Safeguarding\Components\HookAppCIC64.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\NetSupport\classroom.cloud\dll\shcore.pdb	cicStudent.exe
File created	C:\Program Files (x86)\NetSupport\classroom.cloud\Sounds\StudentCorrect.wav	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\classroom.cloud\boost_date_time-vc140-mt-x32-1_67.dll	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\classroom.cloud\Safeguarding\CICSafeguardingAgent.exe	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\classroom.cloud\unzdll.dll	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\classroom.cloud\Safeguarding\Components\ApplicationMonitorCIC.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\NetSupport\classroom.cloud\winsta.pdb	cicStudent.exe
File created	C:\Program Files (x86)\Common Files\NSL\winstHooks64.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\NetSupport\classroom.cloud\symbols\dll\wbemsvc.pdb	cicStudent.exe
File opened for modification	C:\Program Files (x86)\NetSupport\classroom.cloud\wintrust.pdb	cicStudent.exe
File created	C:\Program Files (x86)\NetSupport\classroom.cloud\product.dat	msiexec.exe
File created	C:\Program Files (x86)\Common Files\NSL\winstHooks.dll	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\classroom.cloud\Locales\1028\pcicl32_RES.dll	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\classroom.cloud\Locales\22538\cicToolbar_res.dll	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\classroom.cloud\Locales\1042\ManageADAccount_res.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\NetSupport\classroom.cloud\dll\pcicapi.pdb	cicStudent.exe
File opened for modification	C:\Program Files (x86)\NetSupport\classroom.cloud\winmm.pdb	cicStudent.exe
File created	C:\Program Files (x86)\NetSupport\classroom.cloud\Locales\1036\pluginsoftwaremodule_RES.dll	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\classroom.cloud\Locales\1044\cicToolbar_res.dll	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\classroom.cloud\Locales\2074\pluginsoftwaremodule_RES.dll	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\classroom.cloud\api-ms-win-core-file-l2-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\classroom.cloud\api-ms-win-core-debug-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\classroom.cloud\Safeguarding\cpprest140_2_9.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\NetSupport\classroom.cloud\symbols\DLL\wkernel32.pdb	cicStudent.exe
File opened for modification	C:\Program Files (x86)\NetSupport\classroom.cloud\symbols\DLL\netutils.pdb	cicStudent.exe
File opened for modification	C:\Program Files (x86)\NetSupport\classroom.cloud\Kernel.Appcore.pdb	cicStudent.exe
File created	C:\Program Files (x86)\NetSupport\classroom.cloud\Locales\1043\PluginSoftwareModule64_res.dll	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\classroom.cloud\api-ms-win-crt-convert-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\classroom.cloud\CloudConfig.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\NetSupport\classroom.cloud\dll\secur32.pdb	cicStudent.exe
File opened for modification	C:\Program Files (x86)\NetSupport\classroom.cloud\symbols\DLL\dhcpcsvc.pdb	cicStudent.exe
File opened for modification	C:\Program Files (x86)\NetSupport\classroom.cloud\dll\VolumeControlWVI.pdb	cicStudent.exe
File opened for modification	C:\Program Files (x86)\NetSupport\classroom.cloud\symbols\DLL\psapi.pdb	cicStudent.exe
File created	C:\Program Files (x86)\NetSupport\classroom.cloud\image_name.jpg	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\classroom.cloud\cicClient32Provider.dll	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\classroom.cloud\libssl-1_1.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\NetSupport\classroom.cloud\pcichek.pdb	cicStudent.exe
File opened for modification	C:\Program Files (x86)\NetSupport\classroom.cloud\pcicapi.pdb	cicStudent.exe
File opened for modification	C:\Program Files (x86)\NetSupport\classroom.cloud\wrpcrt4.pdb	cicStudent.exe
File opened for modification	C:\Program Files (x86)\NetSupport\classroom.cloud\dll\comctl32.pdb	cicStudent.exe
File created	C:\Program Files (x86)\NetSupport\classroom.cloud\Locales\1036\cicToolbar_res.dll	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\classroom.cloud\Safeguarding\Components\StoreSoftwareCtlCIC.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\NetSupport\classroom.cloud\symbols\dll\version.pdb	cicStudent.exe
File created	C:\Program Files (x86)\NetSupport\classroom.cloud\mfc100.dll	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\classroom.cloud\Locales\1042\cicToolbar_res.dll	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\classroom.cloud\api-ms-win-core-string-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\classroom.cloud\api-ms-win-core-processenvironment-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\classroom.cloud\Locales\1026\ManageADAccount_res.dll	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\classroom.cloud\cicPlugin.exe	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\classroom.cloud\api-ms-win-crt-runtime-l1-1-0.dll	msiexec.exe

Drops file in Windows directory 37 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DF53DC774087BD1E28.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIECF2.tmp	msiexec.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File created	C:\Windows\Installer\SourceHash{EF96010C-AD62-4A87-A456-C1F250DAD9B7}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0EF3BD7B5991D1A2.TMP	msiexec.exe
File created	C:\Windows\Installer\e57e541.msi	msiexec.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEA32.tmp	msiexec.exe
File opened for modification	C:\Windows\setuperr.log	WINSTALL.EXE
File created	C:\Windows\SystemTemp\~DF4A7F782398B17609.TMP	msiexec.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Installer\e57e53f.msi	msiexec.exe
File created	C:\Windows\Installer\CloseHookApp64.exe	MsiExec.exe
File opened for modification	C:\Windows\setupact.log	WINSTALL.EXE
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\C01069FE26DA78A44A651C2F05AD9D7B\1.98.1	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\C01069FE26DA78A44A651C2F05AD9D7B\1.98.1\mfc140.dll.5840D246_3D34_3071_9C86_D071F20CB55F	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\C01069FE26DA78A44A651C2F05AD9D7B\1.98.1\mfc140.dll.5840D246_3D34_3071_9C86_D071F20CB55F	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\C01069FE26DA78A44A651C2F05AD9D7B\1.98.1\mfcm140.dll.5840D246_3D34_3071_9C86_D071F20CB55F	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\C01069FE26DA78A44A651C2F05AD9D7B\1.98.1\mfcm140.dll.5840D246_3D34_3071_9C86_D071F20CB55F	msiexec.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File created	C:\Windows\Installer\{EF96010C-AD62-4A87-A456-C1F250DAD9B7}\ARPPRODUCTICON.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{EF96010C-AD62-4A87-A456-C1F250DAD9B7}\ARPPRODUCTICON.exe	msiexec.exe
File created	C:\Windows\Installer\e57e53f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE88B.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\C01069FE26DA78A44A651C2F05AD9D7B\1.98.1\mfc140u.dll.5840D246_3D34_3071_9C86_D071F20CB55F	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\C01069FE26DA78A44A651C2F05AD9D7B\1.98.1\mfcm140u.dll.5840D246_3D34_3071_9C86_D071F20CB55F	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\C01069FE26DA78A44A651C2F05AD9D7B\1.98.1\mfcm140u.dll.5840D246_3D34_3071_9C86_D071F20CB55F	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\C01069FE26DA78A44A651C2F05AD9D7B	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\C01069FE26DA78A44A651C2F05AD9D7B\1.98.1\mfc140u.dll.5840D246_3D34_3071_9C86_D071F20CB55F	msiexec.exe
File created	C:\Windows\SystemTemp\~DF55FE90897756B4C0.TMP	msiexec.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe

Executes dropped EXE 16 IoCs

pid	Process
4904	WINSTALL.EXE
3948	winst64.exe
2792	cicStudent.exe
1484	GetUserLang.exe
3096	cicStudent.exe
1728	GetUserLang.exe
2348	winst64.exe
460	Process not Found
3336	Process not Found
4560	GetUserLang.exe
4740	CICPlugin.exe
3920	CICPlugin64.exe
3476	CICPlugin.exe
1112	CICPlugin64.exe
3464	Process not Found
3060	Process not Found

Loads dropped DLL 64 IoCs

pid	Process
3704	MsiExec.exe
3704	MsiExec.exe
3704	MsiExec.exe
2684	MsiExec.exe
5020	MsiExec.exe
4904	WINSTALL.EXE
3948	winst64.exe
4904	WINSTALL.EXE
2792	cicStudent.exe
2792	cicStudent.exe
2792	cicStudent.exe
2792	cicStudent.exe
2792	cicStudent.exe
1484	GetUserLang.exe
2792	cicStudent.exe
2792	cicStudent.exe
2792	cicStudent.exe
2792	cicStudent.exe
2792	cicStudent.exe
2792	cicStudent.exe
2792	cicStudent.exe
3096	cicStudent.exe
3096	cicStudent.exe
3096	cicStudent.exe
3096	cicStudent.exe
3096	cicStudent.exe
1728	GetUserLang.exe
3704	MsiExec.exe
3096	cicStudent.exe
2792	cicStudent.exe
3096	cicStudent.exe
2348	winst64.exe
3096	cicStudent.exe
3096	cicStudent.exe
4260	msiexec.exe
4560	GetUserLang.exe
3920	CICPlugin64.exe
1112	CICPlugin64.exe
4740	CICPlugin.exe
4740	CICPlugin.exe
4740	CICPlugin.exe
3920	CICPlugin64.exe
3920	CICPlugin64.exe
3920	CICPlugin64.exe
4740	CICPlugin.exe
3920	CICPlugin64.exe
3096	cicStudent.exe
3476	CICPlugin.exe
1112	CICPlugin64.exe
4260	msiexec.exe
4260	msiexec.exe
3336	Process not Found
3336	Process not Found
3336	Process not Found
3704	MsiExec.exe
3704	MsiExec.exe
3704	MsiExec.exe
460	Process not Found
460	Process not Found
2756	Process not Found
2756	Process not Found
2756	Process not Found
3464	Process not Found
3060	Process not Found

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4260	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cicStudent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CICPlugin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINSTALL.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cicStudent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GetUserLang.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GetUserLang.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GetUserLang.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CICPlugin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000004c79797f2efc73ee0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800004c79797f0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809004c79797f000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d4c79797f000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000004c79797f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Software\Microsoft\Internet Explorer\Main\Isolation_old_student = "PMEM"	cicStudent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Software\Microsoft\Internet Explorer\Main\Isolation = "PMIL"	cicStudent.exe

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\powrprof.dll,-15 = "Balanced"	cicStudent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\powrprof.dll,-13 = "High performance"	cicStudent.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\powrprof.dll,-11 = "Power saver"	cicStudent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\JITDebug = "0"	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rpf\ = "NSReplayFile"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mpegfile\shell\show	WINSTALL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WMVFile\shell\show\ = "&Show with classroom.cloud Student"	WINSTALL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C01069FE26DA78A44A651C2F05AD9D7B\Spanish = "Student"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7F2E59DC-D6DD-43E1-AF7B-C27AB2277498}\ = "cicClient32Provider"	winst64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C01069FE26DA78A44A651C2F05AD9D7B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C01069FE26DA78A44A651C2F05AD9D7B\French = "Student"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C01069FE26DA78A44A651C2F05AD9D7B\Brazilian = "Student"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C01069FE26DA78A44A651C2F05AD9D7B\MexicanSpanish = "Student"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C01069FE26DA78A44A651C2F05AD9D7B\ProductName = "classroom.cloud Student"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\NSReplayFile\Shell\Play\Command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\shell	WINSTALL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WMVFile\shell\show	WINSTALL.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C01069FE26DA78A44A651C2F05AD9D7B\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NSReplayFile\ = "classroom.cloud Student Replay File"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\movfile\shell\show\command\ = "\"C:\\Program Files (x86)\\NetSupport\\classroom.cloud\\pcinssui.exe\" /ShowVideo \"%L\""	WINSTALL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mpegfile\shell\show\ = "&Show with classroom.cloud Student"	WINSTALL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C01069FE26DA78A44A651C2F05AD9D7B\Bulgarian = "Student"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mpegfile\shell\show\command	WINSTALL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WMVFile\shell\show\command	WINSTALL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7F2E59DC-D6DD-43E1-AF7B-C27AB2277498}\InProcServer32	winst64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\NSReplayFile\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NSReplayFile\DefaultIcon\ = "C:\\Program Files (x86)\\NetSupport\\classroom.cloud\\PCIVideo.exe,1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C01069FE26DA78A44A651C2F05AD9D7B\Korean = "Student"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C01069FE26DA78A44A651C2F05AD9D7B\Polish = "Student"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C01069FE26DA78A44A651C2F05AD9D7B\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NSReplayFile	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\movfile	WINSTALL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\movfile\shell\show\command	WINSTALL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C01069FE26DA78A44A651C2F05AD9D7B\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\NSReplayFile\BrowserFlags = "8"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ASFFile\shell\show\command\ = "\"C:\\Program Files (x86)\\NetSupport\\classroom.cloud\\pcinssui.exe\" /ShowVideo \"%L\""	WINSTALL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C01069FE26DA78A44A651C2F05AD9D7B\Norwegian = "Student"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NSReplayFile\Shell\Play\Command	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C01069FE26DA78A44A651C2F05AD9D7B	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\NSReplayFile\EditFlags = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C01069FE26DA78A44A651C2F05AD9D7B\Arabic = "Student"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C01069FE26DA78A44A651C2F05AD9D7B\Finnish = "Student"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NSReplayFile\Shell\Play\Command\ = "\"C:\\Program Files (x86)\\NetSupport\\classroom.cloud\\cicStudent.exe\" /r\"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\shell\show\ = "&Show with classroom.cloud Student"	WINSTALL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C01069FE26DA78A44A651C2F05AD9D7B\LatinAmerican = "Student"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C01069FE26DA78A44A651C2F05AD9D7B\InstalledByMSI = "Student"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NSReplayFile\Shell\Play	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mpegfile	WINSTALL.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C01069FE26DA78A44A651C2F05AD9D7B\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C01069FE26DA78A44A651C2F05AD9D7B\SourceList\PackageName = "classroom.cloud.1.1e32ad54-8afb-4c05-a1c5-6e3e40e93fe4.uksouth(2).msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C01069FE26DA78A44A651C2F05AD9D7B\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WMVFile\shell\show\command\ = "\"C:\\Program Files (x86)\\NetSupport\\classroom.cloud\\pcinssui.exe\" /ShowVideo \"%L\""	WINSTALL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C01069FE26DA78A44A651C2F05AD9D7B\Serbian = "Student"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C01069FE26DA78A44A651C2F05AD9D7B\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C01069FE26DA78A44A651C2F05AD9D7B\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.rpf	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WMVFile\shell	WINSTALL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C01069FE26DA78A44A651C2F05AD9D7B\Czech = "Student"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\shell\show	WINSTALL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\movfile\shell	WINSTALL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C01069FE26DA78A44A651C2F05AD9D7B\Italian = "Student"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NSReplayFile\Shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NSReplayFile\Shell\ = "Play"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7F2E59DC-D6DD-43E1-AF7B-C27AB2277498}\InProcServer32\ThreadingModel = "Apartment"	winst64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C01069FE26DA78A44A651C2F05AD9D7B\Chinese = "Student"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C01069FE26DA78A44A651C2F05AD9D7B\Russian = "Student"	msiexec.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3096	cicStudent.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
3704	MsiExec.exe
3704	MsiExec.exe
3364	msiexec.exe
3364	msiexec.exe
5020	MsiExec.exe
5020	MsiExec.exe
4904	WINSTALL.EXE
4904	WINSTALL.EXE
4904	WINSTALL.EXE
4904	WINSTALL.EXE
4904	WINSTALL.EXE
4904	WINSTALL.EXE
2792	cicStudent.exe
2792	cicStudent.exe
3096	cicStudent.exe
3096	cicStudent.exe
3920	CICPlugin64.exe
3920	CICPlugin64.exe
3288	msedge.exe
3288	msedge.exe
960	msedge.exe
960	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4740	CICPlugin.exe
3920	CICPlugin64.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3288	msedge.exe
3288	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4260	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4260	msiexec.exe
Token: SeSecurityPrivilege	3364	msiexec.exe
Token: SeCreateTokenPrivilege	4260	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4260	msiexec.exe
Token: SeLockMemoryPrivilege	4260	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4260	msiexec.exe
Token: SeMachineAccountPrivilege	4260	msiexec.exe
Token: SeTcbPrivilege	4260	msiexec.exe
Token: SeSecurityPrivilege	4260	msiexec.exe
Token: SeTakeOwnershipPrivilege	4260	msiexec.exe
Token: SeLoadDriverPrivilege	4260	msiexec.exe
Token: SeSystemProfilePrivilege	4260	msiexec.exe
Token: SeSystemtimePrivilege	4260	msiexec.exe
Token: SeProfSingleProcessPrivilege	4260	msiexec.exe
Token: SeIncBasePriorityPrivilege	4260	msiexec.exe
Token: SeCreatePagefilePrivilege	4260	msiexec.exe
Token: SeCreatePermanentPrivilege	4260	msiexec.exe
Token: SeBackupPrivilege	4260	msiexec.exe
Token: SeRestorePrivilege	4260	msiexec.exe
Token: SeShutdownPrivilege	4260	msiexec.exe
Token: SeDebugPrivilege	4260	msiexec.exe
Token: SeAuditPrivilege	4260	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4260	msiexec.exe
Token: SeChangeNotifyPrivilege	4260	msiexec.exe
Token: SeRemoteShutdownPrivilege	4260	msiexec.exe
Token: SeUndockPrivilege	4260	msiexec.exe
Token: SeSyncAgentPrivilege	4260	msiexec.exe
Token: SeEnableDelegationPrivilege	4260	msiexec.exe
Token: SeManageVolumePrivilege	4260	msiexec.exe
Token: SeImpersonatePrivilege	4260	msiexec.exe
Token: SeCreateGlobalPrivilege	4260	msiexec.exe
Token: SeCreateTokenPrivilege	4260	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4260	msiexec.exe
Token: SeLockMemoryPrivilege	4260	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4260	msiexec.exe
Token: SeMachineAccountPrivilege	4260	msiexec.exe
Token: SeTcbPrivilege	4260	msiexec.exe
Token: SeSecurityPrivilege	4260	msiexec.exe
Token: SeTakeOwnershipPrivilege	4260	msiexec.exe
Token: SeLoadDriverPrivilege	4260	msiexec.exe
Token: SeSystemProfilePrivilege	4260	msiexec.exe
Token: SeSystemtimePrivilege	4260	msiexec.exe
Token: SeProfSingleProcessPrivilege	4260	msiexec.exe
Token: SeIncBasePriorityPrivilege	4260	msiexec.exe
Token: SeCreatePagefilePrivilege	4260	msiexec.exe
Token: SeCreatePermanentPrivilege	4260	msiexec.exe
Token: SeBackupPrivilege	4260	msiexec.exe
Token: SeRestorePrivilege	4260	msiexec.exe
Token: SeShutdownPrivilege	4260	msiexec.exe
Token: SeDebugPrivilege	4260	msiexec.exe
Token: SeAuditPrivilege	4260	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4260	msiexec.exe
Token: SeChangeNotifyPrivilege	4260	msiexec.exe
Token: SeRemoteShutdownPrivilege	4260	msiexec.exe
Token: SeUndockPrivilege	4260	msiexec.exe
Token: SeSyncAgentPrivilege	4260	msiexec.exe
Token: SeEnableDelegationPrivilege	4260	msiexec.exe
Token: SeManageVolumePrivilege	4260	msiexec.exe
Token: SeImpersonatePrivilege	4260	msiexec.exe
Token: SeCreateGlobalPrivilege	4260	msiexec.exe
Token: SeCreateTokenPrivilege	4260	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4260	msiexec.exe
Token: SeLockMemoryPrivilege	4260	msiexec.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
4260	msiexec.exe
3096	cicStudent.exe
3096	cicStudent.exe
3096	cicStudent.exe
3096	cicStudent.exe
4260	msiexec.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
5972	firefox.exe
5972	firefox.exe
5972	firefox.exe
5972	firefox.exe
5972	firefox.exe
5972	firefox.exe
5972	firefox.exe
5972	firefox.exe
5972	firefox.exe
5972	firefox.exe
5972	firefox.exe
5972	firefox.exe
5972	firefox.exe
5972	firefox.exe
5972	firefox.exe
5972	firefox.exe
5972	firefox.exe
5972	firefox.exe
5972	firefox.exe
5972	firefox.exe
5972	firefox.exe

Suspicious use of SendNotifyMessage 14 IoCs

pid	Process
3096	cicStudent.exe
3096	cicStudent.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2348	winst64.exe
4740	CICPlugin.exe
3920	CICPlugin64.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3364 wrote to memory of 3704	3364	msiexec.exe	80
PID 3364 wrote to memory of 3704	3364	msiexec.exe	80
PID 3364 wrote to memory of 3704	3364	msiexec.exe	80
PID 3364 wrote to memory of 2056	3364	msiexec.exe	84
PID 3364 wrote to memory of 2056	3364	msiexec.exe	84
PID 3364 wrote to memory of 2684	3364	msiexec.exe	86
PID 3364 wrote to memory of 2684	3364	msiexec.exe	86
PID 3364 wrote to memory of 2684	3364	msiexec.exe	86
PID 3364 wrote to memory of 5020	3364	msiexec.exe	88
PID 3364 wrote to memory of 5020	3364	msiexec.exe	88
PID 3364 wrote to memory of 5020	3364	msiexec.exe	88
PID 3364 wrote to memory of 4904	3364	msiexec.exe	89
PID 3364 wrote to memory of 4904	3364	msiexec.exe	89
PID 3364 wrote to memory of 4904	3364	msiexec.exe	89
PID 4904 wrote to memory of 3948	4904	WINSTALL.EXE	90
PID 4904 wrote to memory of 3948	4904	WINSTALL.EXE	90
PID 2792 wrote to memory of 1484	2792	cicStudent.exe	92
PID 2792 wrote to memory of 1484	2792	cicStudent.exe	92
PID 2792 wrote to memory of 1484	2792	cicStudent.exe	92
PID 2792 wrote to memory of 3096	2792	cicStudent.exe	93
PID 2792 wrote to memory of 3096	2792	cicStudent.exe	93
PID 2792 wrote to memory of 3096	2792	cicStudent.exe	93
PID 3096 wrote to memory of 1728	3096	cicStudent.exe	94
PID 3096 wrote to memory of 1728	3096	cicStudent.exe	94
PID 3096 wrote to memory of 1728	3096	cicStudent.exe	94
PID 3096 wrote to memory of 2348	3096	cicStudent.exe	95
PID 3096 wrote to memory of 2348	3096	cicStudent.exe	95
PID 3096 wrote to memory of 4560	3096	cicStudent.exe	96
PID 3096 wrote to memory of 4560	3096	cicStudent.exe	96
PID 3096 wrote to memory of 4560	3096	cicStudent.exe	96
PID 3096 wrote to memory of 4740	3096	cicStudent.exe	97
PID 3096 wrote to memory of 4740	3096	cicStudent.exe	97
PID 3096 wrote to memory of 4740	3096	cicStudent.exe	97
PID 3096 wrote to memory of 3920	3096	cicStudent.exe	98
PID 3096 wrote to memory of 3920	3096	cicStudent.exe	98
PID 3096 wrote to memory of 3476	3096	cicStudent.exe	99
PID 3096 wrote to memory of 3476	3096	cicStudent.exe	99
PID 3096 wrote to memory of 3476	3096	cicStudent.exe	99
PID 3096 wrote to memory of 1112	3096	cicStudent.exe	100
PID 3096 wrote to memory of 1112	3096	cicStudent.exe	100
PID 3288 wrote to memory of 4932	3288	msedge.exe	118
PID 3288 wrote to memory of 4932	3288	msedge.exe	118
PID 3288 wrote to memory of 3412	3288	msedge.exe	119
PID 3288 wrote to memory of 3412	3288	msedge.exe	119
PID 3288 wrote to memory of 3412	3288	msedge.exe	119
PID 3288 wrote to memory of 3412	3288	msedge.exe	119
PID 3288 wrote to memory of 3412	3288	msedge.exe	119
PID 3288 wrote to memory of 3412	3288	msedge.exe	119
PID 3288 wrote to memory of 3412	3288	msedge.exe	119
PID 3288 wrote to memory of 3412	3288	msedge.exe	119
PID 3288 wrote to memory of 3412	3288	msedge.exe	119
PID 3288 wrote to memory of 3412	3288	msedge.exe	119
PID 3288 wrote to memory of 3412	3288	msedge.exe	119
PID 3288 wrote to memory of 3412	3288	msedge.exe	119
PID 3288 wrote to memory of 3412	3288	msedge.exe	119
PID 3288 wrote to memory of 3412	3288	msedge.exe	119
PID 3288 wrote to memory of 3412	3288	msedge.exe	119
PID 3288 wrote to memory of 3412	3288	msedge.exe	119
PID 3288 wrote to memory of 3412	3288	msedge.exe	119
PID 3288 wrote to memory of 3412	3288	msedge.exe	119
PID 3288 wrote to memory of 3412	3288	msedge.exe	119
PID 3288 wrote to memory of 3412	3288	msedge.exe	119
PID 3288 wrote to memory of 3412	3288	msedge.exe	119
PID 3288 wrote to memory of 3412	3288	msedge.exe	119

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\classroom.cloud.1.1e32ad54-8afb-4c05-a1c5-6e3e40e93fe4.uksouth(2).msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Loads dropped DLL
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4260

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 405D4A1E4261009DBF86F959E833E6E7 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3704
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2056
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D84A5CED95B4C963B0B3E5B9D40BED3C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2684
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding AD6CD214F55F992B8E828052A9D70437 E Global\MSI0000
  2⤵
  - Drops file in Windows directory
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5020
- C:\Program Files (x86)\NetSupport\classroom.cloud\WINSTALL.EXE
  "C:\Program Files (x86)\NetSupport\classroom.cloud\WINSTALL.EXE" /EV"classroom.cloud Student" /EC /Q /Q /I *
  2⤵
  - Sets service image path in registry
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4904
- - C:\Program Files (x86)\NetSupport\classroom.cloud\winst64.exe
    winst64.exe /q /q /i
    3⤵
    - Drops file in Drivers directory
    - Drops file in System32 directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies registry class
    PID:3948

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:3788

C:\Program Files (x86)\NetSupport\classroom.cloud\cicStudent.exe
"C:\Program Files (x86)\NetSupport\classroom.cloud\cicStudent.exe" /* *
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Program Files (x86)\NetSupport\classroom.cloud\GetUserLang.exe
  "C:\Program Files (x86)\NetSupport\classroom.cloud\GetUserLang.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1484
- C:\Program Files (x86)\NetSupport\classroom.cloud\cicStudent.exe
  "C:\Program Files (x86)\NetSupport\classroom.cloud\cicStudent.exe" * /VistaUI
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3096
- - C:\Program Files (x86)\NetSupport\classroom.cloud\GetUserLang.exe
    "C:\Program Files (x86)\NetSupport\classroom.cloud\GetUserLang.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:1728
- - C:\Program Files (x86)\NetSupport\classroom.cloud\winst64.exe
    "C:\Program Files (x86)\NetSupport\classroom.cloud\winst64.exe" /Q /Q /EBc02e6,1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2348
- - C:\Program Files (x86)\NetSupport\classroom.cloud\GetUserLang.exe
    "C:\Program Files (x86)\NetSupport\classroom.cloud\GetUserLang.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4560
- - C:\Program Files (x86)\NetSupport\classroom.cloud\CICPlugin.exe
    "C:\Program Files (x86)\NetSupport\classroom.cloud\CICPlugin.exe" /USER=SYSTEM
    3⤵
    - Enumerates connected drives
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:4740
- - C:\Program Files (x86)\NetSupport\classroom.cloud\CICPlugin64.exe
    "C:\Program Files (x86)\NetSupport\classroom.cloud\CICPlugin64.exe" /USER=SYSTEM
    3⤵
    - Enumerates connected drives
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:3920
- - C:\Program Files (x86)\NetSupport\classroom.cloud\CICPlugin.exe
    "C:\Program Files (x86)\NetSupport\classroom.cloud\CICPlugin.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:3476
- - C:\Program Files (x86)\NetSupport\classroom.cloud\CICPlugin64.exe
    "C:\Program Files (x86)\NetSupport\classroom.cloud\CICPlugin64.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:2108

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:4544

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:4156

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:5420

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd916d3cb8,0x7ffd916d3cc8,0x7ffd916d3cd8
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,15034739297058086329,16486292933313131176,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,15034739297058086329,16486292933313131176,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,15034739297058086329,16486292933313131176,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,15034739297058086329,16486292933313131176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,15034739297058086329,16486292933313131176,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3728

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2092

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
PID:4420

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:2092
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  PID:5972
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2000 -parentBuildID 20240401114208 -prefsHandle 1932 -prefMapHandle 1924 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3f8846a6-fcba-4b6e-836b-5c4a9dcfd173} 5972 "\\.\pipe\gecko-crash-server-pipe.5972" gpu
    3⤵
    PID:4212
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2404 -parentBuildID 20240401114208 -prefsHandle 2384 -prefMapHandle 2396 -prefsLen 23714 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2e750fcc-f52f-4cb4-b46d-a58ef754c608} 5972 "\\.\pipe\gecko-crash-server-pipe.5972" socket
    3⤵
    - Checks processor information in registry
    PID:2352
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3040 -childID 1 -isForBrowser -prefsHandle 2996 -prefMapHandle 3068 -prefsLen 23855 -prefMapSize 244658 -jsInitHandle 1368 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fce3fde2-f915-464c-b5d7-642102c47511} 5972 "\\.\pipe\gecko-crash-server-pipe.5972" tab
    3⤵
    PID:6124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4044 -childID 2 -isForBrowser -prefsHandle 3560 -prefMapHandle 3204 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 1368 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b1eff19-8f97-4bf8-943c-c1db55835e43} 5972 "\\.\pipe\gecko-crash-server-pipe.5972" tab
    3⤵
    PID:4176
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4852 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4868 -prefMapHandle 4864 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1987f29e-4756-4d09-99f7-0e55775321c8} 5972 "\\.\pipe\gecko-crash-server-pipe.5972" utility
    3⤵
    - Checks processor information in registry
    PID:4800
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5636 -childID 3 -isForBrowser -prefsHandle 5620 -prefMapHandle 5596 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1368 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d6d1b162-2ce8-4d72-bc29-bc7103b3538f} 5972 "\\.\pipe\gecko-crash-server-pipe.5972" tab
    3⤵
    PID:744
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5788 -childID 4 -isForBrowser -prefsHandle 5804 -prefMapHandle 5748 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1368 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7e3cc2c0-2fd6-4f01-b467-e6c233d028b7} 5972 "\\.\pipe\gecko-crash-server-pipe.5972" tab
    3⤵
    PID:3500
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5976 -childID 5 -isForBrowser -prefsHandle 6052 -prefMapHandle 6048 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1368 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {298a261a-b71d-4b58-809f-0473c6a6a2db} 5972 "\\.\pipe\gecko-crash-server-pipe.5972" tab
    3⤵
    PID:5788
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6324 -childID 6 -isForBrowser -prefsHandle 6276 -prefMapHandle 6316 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1368 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {baf5b80e-b9ca-4ba8-92d8-18b71a7c8160} 5972 "\\.\pipe\gecko-crash-server-pipe.5972" tab
    3⤵
    PID:2876
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6752 -childID 7 -isForBrowser -prefsHandle 7176 -prefMapHandle 7152 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1368 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {600e0b91-9733-4b3e-bbf6-e65bae8d2413} 5972 "\\.\pipe\gecko-crash-server-pipe.5972" tab
    3⤵
    PID:2188
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7396 -childID 8 -isForBrowser -prefsHandle 7316 -prefMapHandle 7324 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1368 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9b7a414e-9631-42b3-8c97-9d87c8dd47b8} 5972 "\\.\pipe\gecko-crash-server-pipe.5972" tab
    3⤵
    PID:5864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5016 -childID 9 -isForBrowser -prefsHandle 3620 -prefMapHandle 2780 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1368 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c8428de5-a343-4e20-9da0-5dbcdda3e45b} 5972 "\\.\pipe\gecko-crash-server-pipe.5972" tab
    3⤵
    PID:6656
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5160 -childID 10 -isForBrowser -prefsHandle 7644 -prefMapHandle 7648 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1368 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e5f19026-4b68-4a32-b62f-806ae91552e1} 5972 "\\.\pipe\gecko-crash-server-pipe.5972" tab
    3⤵
    PID:6844
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3620 -childID 11 -isForBrowser -prefsHandle 7576 -prefMapHandle 7636 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1368 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {61e40c04-7980-4676-ac6f-c4b7ea2a0659} 5972 "\\.\pipe\gecko-crash-server-pipe.5972" tab
    3⤵
    PID:6852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7976 -childID 12 -isForBrowser -prefsHandle 7864 -prefMapHandle 7872 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1368 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4068deb5-5cfa-4827-abaa-e243aacc613c} 5972 "\\.\pipe\gecko-crash-server-pipe.5972" tab
    3⤵
    PID:6868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2776 -childID 13 -isForBrowser -prefsHandle 8172 -prefMapHandle 6724 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1368 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1fdab120-3ce5-4482-9fbe-455cd249961e} 5972 "\\.\pipe\gecko-crash-server-pipe.5972" tab
    3⤵
    PID:4768
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7904 -childID 14 -isForBrowser -prefsHandle 7988 -prefMapHandle 7768 -prefsLen 27919 -prefMapSize 244658 -jsInitHandle 1368 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8d329a29-6c5e-4b00-89e0-167d11de4fa9} 5972 "\\.\pipe\gecko-crash-server-pipe.5972" tab
    3⤵
    PID:6540
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4284 -childID 15 -isForBrowser -prefsHandle 4816 -prefMapHandle 4640 -prefsLen 27919 -prefMapSize 244658 -jsInitHandle 1368 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1f91c625-e58d-4caf-a0bc-f9fa318fda0f} 5972 "\\.\pipe\gecko-crash-server-pipe.5972" tab
    3⤵
    PID:6444

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:200

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:6464

C:\Windows\System32\ATBroker.exe
C:\Windows\System32\ATBroker.exe /start osk
1⤵
PID:5204
- C:\Windows\System32\osk.exe
  "C:\Windows\System32\osk.exe"
  2⤵
  PID:6644

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004F8 0x00000000000004F0
1⤵
PID:5544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Defense Evasion

Modify Registry

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery