netsupport | 28e4442eabab185845bd627573008026c021389c0475d27b5dfcfdeada8f7454

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\nskbfltr\ImagePath = "\\SystemRoot\\system32\\drivers\\nskbfltr.sys"	MSI37E6.tmp

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 41 IoCs

pid	Process
904	NetSupport School 14.00.0002.exe
4948	NetSupport School 14.00.0002.exe
2956	MSI2078.tmp
3628	MSI2115.tmp
5852	MSI288F.tmp
5860	checkdvd.exe
3908	MSI30A1.tmp
5572	MSI3630.tmp
5940	MSI37E6.tmp
4068	winst64.exe
6116	pcicfgui_setup.exe
2296	pcicfgui_setup.exe
2648	MSI5CFA.tmp
1156	client32.exe
536	client32.exe
5396	runplugin.exe
5616	runplugin64.exe
5444	runplugin.exe
5424	runplugin64.exe
6612	pcicfgui.exe
4204	client32.exe
6708	client32.exe
6748	runplugin.exe
6780	runplugin64.exe
6800	runplugin.exe
6840	runplugin64.exe
1268	pcicfgui.exe
3648	client32.exe
5428	client32.exe
536	runplugin.exe
6616	runplugin64.exe
5280	runplugin.exe
6948	runplugin64.exe
316	Process not Found
1348	pcicfgui.exe
6256	client32.exe
4444	client32.exe
5012	runplugin.exe
5628	runplugin64.exe
1956	runplugin.exe
5672	runplugin64.exe

Loads dropped DLL 64 IoCs

pid	Process
5992	MsiExec.exe
5992	MsiExec.exe
5992	MsiExec.exe
5992	MsiExec.exe
5992	MsiExec.exe
5992	MsiExec.exe
5992	MsiExec.exe
5992	MsiExec.exe
5992	MsiExec.exe
5992	MsiExec.exe
5992	MsiExec.exe
5992	MsiExec.exe
5992	MsiExec.exe
5992	MsiExec.exe
5992	MsiExec.exe
5992	MsiExec.exe
5992	MsiExec.exe
5992	MsiExec.exe
5992	MsiExec.exe
5992	MsiExec.exe
5992	MsiExec.exe
5992	MsiExec.exe
5992	MsiExec.exe
5992	MsiExec.exe
5992	MsiExec.exe
5992	MsiExec.exe
5992	MsiExec.exe
4272	MsiExec.exe
4272	MsiExec.exe
4272	MsiExec.exe
4272	MsiExec.exe
4272	MsiExec.exe
4272	MsiExec.exe
4272	MsiExec.exe
4272	MsiExec.exe
4272	MsiExec.exe
4272	MsiExec.exe
4272	MsiExec.exe
4272	MsiExec.exe
3480	MsiExec.exe
3480	MsiExec.exe
3480	MsiExec.exe
3480	MsiExec.exe
3480	MsiExec.exe
4068	winst64.exe
5940	MSI37E6.tmp
3480	MsiExec.exe
4272	MsiExec.exe
6116	pcicfgui_setup.exe
6116	pcicfgui_setup.exe
6116	pcicfgui_setup.exe
6116	pcicfgui_setup.exe
6116	pcicfgui_setup.exe
4272	MsiExec.exe
5992	MsiExec.exe
5992	MsiExec.exe
5992	MsiExec.exe
1156	client32.exe
1156	client32.exe
1156	client32.exe
1156	client32.exe
1156	client32.exe
1156	client32.exe
1156	client32.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\N:	runplugin64.exe
File opened (read-only)	\??\H:	runplugin.exe
File opened (read-only)	\??\J:	runplugin.exe
File opened (read-only)	\??\O:	runplugin64.exe
File opened (read-only)	\??\L:	runplugin.exe
File opened (read-only)	\??\M:	MSIEXEC.EXE
File opened (read-only)	\??\R:	MSIEXEC.EXE
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	MSIEXEC.EXE
File opened (read-only)	\??\F:	runplugin.exe
File opened (read-only)	\??\U:	runplugin64.exe
File opened (read-only)	\??\Y:	runplugin.exe
File opened (read-only)	\??\J:	runplugin.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\K:	runplugin.exe
File opened (read-only)	\??\Y:	runplugin64.exe
File opened (read-only)	\??\Q:	runplugin64.exe
File opened (read-only)	\??\J:	runplugin.exe
File opened (read-only)	\??\X:	runplugin.exe
File opened (read-only)	\??\S:	runplugin.exe
File opened (read-only)	\??\E:	runplugin64.exe
File opened (read-only)	\??\T:	runplugin64.exe
File opened (read-only)	\??\H:	runplugin.exe
File opened (read-only)	\??\N:	runplugin.exe
File opened (read-only)	\??\N:	runplugin64.exe
File opened (read-only)	\??\N:	runplugin.exe
File opened (read-only)	\??\U:	runplugin.exe
File opened (read-only)	\??\G:	runplugin.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\E:	runplugin.exe
File opened (read-only)	\??\V:	runplugin64.exe
File opened (read-only)	\??\G:	runplugin64.exe
File opened (read-only)	\??\X:	runplugin64.exe
File opened (read-only)	\??\H:	runplugin64.exe
File opened (read-only)	\??\S:	runplugin64.exe
File opened (read-only)	\??\B:	runplugin.exe
File opened (read-only)	\??\V:	runplugin.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Q:	runplugin.exe
File opened (read-only)	\??\U:	runplugin.exe
File opened (read-only)	\??\A:	runplugin64.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\T:	runplugin.exe
File opened (read-only)	\??\K:	runplugin64.exe
File opened (read-only)	\??\P:	runplugin64.exe
File opened (read-only)	\??\M:	runplugin.exe
File opened (read-only)	\??\K:	runplugin.exe
File opened (read-only)	\??\R:	runplugin.exe
File opened (read-only)	\??\T:	runplugin.exe
File opened (read-only)	\??\I:	runplugin64.exe
File opened (read-only)	\??\A:	runplugin.exe
File opened (read-only)	\??\R:	runplugin.exe
File opened (read-only)	\??\Z:	runplugin64.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\W:	runplugin.exe
File opened (read-only)	\??\L:	runplugin64.exe
File opened (read-only)	\??\H:	MSIEXEC.EXE
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\B:	runplugin.exe
File opened (read-only)	\??\X:	MSIEXEC.EXE

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
145	0.tcp.in.ngrok.io

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AllowMultipleTSSessions = "0"	MSI37E6.tmp

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\system32\client32provider.dll	winst64.exe
File created	C:\Windows\system32\DRVSTORE\NSWebFilte_D742346B53ADF242321CF56FFEA569542B0E0288\NSWebFilterDriver.cat	MSI30A1.tmp
File created	C:\Windows\system32\DRVSTORE\NSWebFilte_D742346B53ADF242321CF56FFEA569542B0E0288\NSWebFilterDriver.sys	MSI30A1.tmp
File opened for modification	C:\Windows\system32\DRVSTORE\NSWebFilte_D742346B53ADF242321CF56FFEA569542B0E0288\NSWebFilterDriver.inf	MSI30A1.tmp
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	MSI30A1.tmp
File created	C:\Windows\SysWOW64\pcimsg.dll	MSI37E6.tmp
File opened for modification	C:\Windows\SysWOW64\pcimsg.dll	MSI37E6.tmp
File opened for modification	C:\Windows\system32\client32provider.dll	winst64.exe
File opened for modification	C:\Windows\system32\DRVSTORE	MSI30A1.tmp
File created	C:\Windows\system32\DRVSTORE\NSWebFilte_D742346B53ADF242321CF56FFEA569542B0E0288\NSWebFilterDriver.inf	MSI30A1.tmp

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
6116	pcicfgui_setup.exe
6116	pcicfgui_setup.exe
536	client32.exe
6708	client32.exe
5428	client32.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\NetSupport\NetSupport School\Control.kbd	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport School\PciHooks64.dll	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport School\nss_lock_image.jpg	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport School\keyShow64.exe	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport School\remcmdstub.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\NetSupport\NetSupport School\client32u.ini	pcicfgui.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport School\PCICTL.DLL	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport School\DBI.EXE	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport School\nskbfltr.inf	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport School\PluginSoftwareModule64.dll	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport School\clhook4.dll	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport School\product.dat	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport School\Runplugin64.exe	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport School\Sounds\TimeWarning.wav	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport School\ActApp.exe	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport School\gdiplus.dll	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport School\PCIAPPCTRL.DLL	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport School\VolumeControlWXP.DLL	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport School\AudioCapture.dll	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport School\NSSecurity.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\NetSupport\NetSupport School\Client32.ini	pcicfgui_setup.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport School\url_list.gif	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport School\setroom.exe	msiexec.exe
File created	C:\Program Files (x86)\Common Files\NSL\nswebfilterdriver.cat	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport School\LoopbackUnblocker.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\NetSupport\NetSupport School\client32u.ini	pcicfgui.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport School\pluginsoftwaremodule.DLL	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport School\Sounds\StudentPicked.wav	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport School\PlaySound.exe	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport School\runplugin.exe	msiexec.exe
File created	C:\Program Files (x86)\Common Files\NSL\NSCommonHook.dll	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport School\Sounds\StudentSelected.wav	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport School\icudt51.dll	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport School\pcicfgui_setup.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\NetSupport\NetSupport School\_Shared Data.lnk	MSI37E6.tmp
File created	C:\Program Files (x86)\NetSupport\NetSupport School\Support\runplugin64.1_2025_02_07_015927.dmp	runplugin64.exe
File opened for modification	C:\Program Files (x86)\NetSupport\NetSupport School\client32.ini	pcicfgui.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport School\NSS.ini	msiexec.exe
File created	C:\Program Files (x86)\Common Files\NSL\NSWebFilterDriver.inf	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport School\wxpdf.dll	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport School\Client32.upd	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport School\weblock.jpg	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport School\pluginprintmanmodule.dll	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport School\StoreSoftwareCtl.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\NetSupport\NetSupport School\client32u.ini	pcicfgui.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport School\mfc100u.dll	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport School\PCINSSCD.EXE	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport School\Sounds\StudentCorrect.wav	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport School\toastImageAndText.png	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport School\icule51.dll	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport School\PCIMSG.DLL	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport School\PluginDevicesModule.dll	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport School\client32.exe	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport School\Client32Provider.dll	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport School\Sounds\StudentIncorrect.wav	msiexec.exe
File opened for modification	C:\Program Files (x86)\NetSupport\NetSupport School\_Data.lnk	MSI37E6.tmp
File created	C:\Program Files (x86)\NetSupport\NetSupport School\Dummy.Lic	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport School\pcicapi.DLL	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport School\ReportDb.htf	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport School\pcisys.sys	msiexec.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport School\gdihook5.INF	msiexec.exe
File opened for modification	C:\Program Files (x86)\NetSupport\NetSupport School\sec.log	SecEdit.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport School\client32u.ini	pcicfgui_setup.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport School\nskbfltr2.sys	msiexec.exe

Drops file in Windows directory 59 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI18CE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI197B.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{61CE15E5-7685-4649-ACDE-E7318D42EF6A}	msiexec.exe
File created	C:\Windows\Installer\{61CE15E5-7685-4649-ACDE-E7318D42EF6A}\schdesigner.exe_5E9E1DA4475445BE9255D1E30AFF412C.exe	msiexec.exe
File created	C:\Windows\Installer\{61CE15E5-7685-4649-ACDE-E7318D42EF6A}\NewShortcut1_1045CC3CC07549BB86C478A6B724F98D.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3023.tmp	msiexec.exe
File created	C:\Windows\Installer\e59167e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4073.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI25FC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI417D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2078.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2484.tmp	msiexec.exe
File created	C:\Windows\Installer\{61CE15E5-7685-4649-ACDE-E7318D42EF6A}\VideoShortcutWin7Abo_484D413D0D3342A2A692F037061C1AA9.exe	msiexec.exe
File opened for modification	C:\Windows\setuperr.log	MSI37E6.tmp
File opened for modification	C:\Windows\Installer\MSI1D57.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{61CE15E5-7685-4649-ACDE-E7318D42EF6A}\pcideply.exe_5E9E1DA4475445BE9255D1E30AFF412C.exe	msiexec.exe
File created	C:\Windows\Installer\{61CE15E5-7685-4649-ACDE-E7318D42EF6A}\NewShortcut4_28874BA5F8594ADCBE8AB571ECB4C1AB.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1F5D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI265C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{61CE15E5-7685-4649-ACDE-E7318D42EF6A}\NewShortcut8_134A4E1756504D7CA2A1E16C4AA879D9.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI23A8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI265B.tmp	msiexec.exe
File created	C:\Windows\Installer\{61CE15E5-7685-4649-ACDE-E7318D42EF6A}\ARPPRODUCTICON.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{61CE15E5-7685-4649-ACDE-E7318D42EF6A}\pcinssui.exe1_28874BA5F8594ADCBE8AB571ECB4C1AB.exe	msiexec.exe
File created	C:\Windows\Installer\{61CE15E5-7685-4649-ACDE-E7318D42EF6A}\NewShortcut5_0CEE40B1A09F47C29DE0582B6A44A9EC_1.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{61CE15E5-7685-4649-ACDE-E7318D42EF6A}\VideoShortcutWin7Abo_484D413D0D3342A2A692F037061C1AA9.exe	msiexec.exe
File opened for modification	C:\Windows\setupact.log	MSI37E6.tmp
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Installer\MSI2019.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{61CE15E5-7685-4649-ACDE-E7318D42EF6A}\schdesigner.exe_5E9E1DA4475445BE9255D1E30AFF412C.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{61CE15E5-7685-4649-ACDE-E7318D42EF6A}\NewShortcut3_80D45F4DD8E3472CB2C7080AAA34AB2A.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{61CE15E5-7685-4649-ACDE-E7318D42EF6A}\NewShortcut5_0CEE40B1A09F47C29DE0582B6A44A9EC_1.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI30A1.tmp	msiexec.exe
File created	C:\Windows\Installer\e59167c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59167c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI19FA.tmp	msiexec.exe
File created	C:\Windows\Installer\{61CE15E5-7685-4649-ACDE-E7318D42EF6A}\pcinssui.exe_5E9E1DA4475445BE9255D1E30AFF412C.exe	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI198B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2369.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2AC3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{61CE15E5-7685-4649-ACDE-E7318D42EF6A}\NewShortcut4_28874BA5F8594ADCBE8AB571ECB4C1AB.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI288F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3630.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1A58.tmp	msiexec.exe
File created	C:\Windows\Installer\{61CE15E5-7685-4649-ACDE-E7318D42EF6A}\pcinssui.exe1_28874BA5F8594ADCBE8AB571ECB4C1AB.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI37E6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1F3C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2115.tmp	msiexec.exe
File created	C:\Windows\Installer\{61CE15E5-7685-4649-ACDE-E7318D42EF6A}\pcideply.exe_5E9E1DA4475445BE9255D1E30AFF412C.exe	msiexec.exe
File created	C:\Windows\Installer\{61CE15E5-7685-4649-ACDE-E7318D42EF6A}\NewShortcut8_134A4E1756504D7CA2A1E16C4AA879D9.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2358.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{61CE15E5-7685-4649-ACDE-E7318D42EF6A}\pcinssui.exe_5E9E1DA4475445BE9255D1E30AFF412C.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{61CE15E5-7685-4649-ACDE-E7318D42EF6A}\ARPPRODUCTICON.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4651.tmp	msiexec.exe
File created	C:\Windows\Installer\{61CE15E5-7685-4649-ACDE-E7318D42EF6A}\NewShortcut3_80D45F4DD8E3472CB2C7080AAA34AB2A.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{61CE15E5-7685-4649-ACDE-E7318D42EF6A}\NewShortcut1_1045CC3CC07549BB86C478A6B724F98D.exe	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 35 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSI3630.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pcicfgui_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	client32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	client32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	runplugin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	runplugin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSI2115.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	checkdvd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pcicfgui.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pcicfgui.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	runplugin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSI288F.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSI5CFA.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	client32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pcicfgui.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIEXEC.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	client32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	client32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	runplugin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	runplugin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	client32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	runplugin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	runplugin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetSupport School 14.00.0002.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	client32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	runplugin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSI37E6.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecEdit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	client32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NetSupport School 14.00.0002.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000453bf937353af4350000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000453bf9370000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900453bf937000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d453bf937000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000453bf93700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 11 IoCs

adware spyware

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Isolation_old_student = "PMEM"	client32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Isolation = "PMIL"	client32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Isolation = "PMIL"	client32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Isolation = "PMEM"	client32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Isolation_old_student = "PMEM"	client32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Isolation_old_student = "PMEM"	client32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Isolation = "PMIL"	client32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Isolation = "PMEM"	client32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Isolation = "PMEM"	client32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Isolation_old_student = "PMEM"	client32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Isolation = "PMIL"	client32.exe

Modifies data under HKEY_USERS 52 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MSI30A1.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MSI30A1.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MSI30A1.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MSI30A1.tmp
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\FirewallControlPanel.dll,-12122 = "Windows Defender Firewall"	client32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MSI30A1.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MSI30A1.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MSI30A1.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MSI30A1.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MSI30A1.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MSI30A1.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MSI30A1.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MSI30A1.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MSI30A1.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MSI30A1.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MSI30A1.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MSI30A1.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MSI30A1.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\JITDebug = "0"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	client32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\powrprof.dll,-13 = "High performance"	client32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\powrprof.dll,-11 = "Power saver"	client32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MSI30A1.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MSI30A1.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MSI30A1.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MSI30A1.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MSI30A1.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MSI30A1.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MSI30A1.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MSI30A1.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MSI30A1.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MSI30A1.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MSI30A1.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MSI30A1.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MSI30A1.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MSI30A1.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	MSI30A1.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MSI30A1.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MSI30A1.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MSI30A1.tmp
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\powrprof.dll,-15 = "Balanced"	client32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MSI30A1.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MSI30A1.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MSI30A1.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MSI30A1.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MSI30A1.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MSI30A1.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MSI30A1.tmp

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71C5A887-11E0-4c5a-9B9B-D4A074555692}	winst64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Nd0adc7e1	MSI37E6.tmp
Key created	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ASFFile	MSI37E6.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\shell	MSI37E6.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\shell\show\ = "&Show with NetSupport School"	MSI37E6.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\movfile\shell\show\command	MSI37E6.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mpegfile\shell\show	MSI37E6.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5E51EC1658679464CAED7E13D824FEA6\DesktopTCShortcut = "\x06TechConsole"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mpegfile\shell\show\ = "&Show with NetSupport School"	MSI37E6.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\943C1EEA70369E845B409AAF32BEB8CD\5E51EC1658679464CAED7E13D824FEA6	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E51EC1658679464CAED7E13D824FEA6\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E51EC1658679464CAED7E13D824FEA6\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71C5A887-11E0-4c5a-9B9B-D4A074555692}\InProcServer32\ThreadingModel = "Apartment"	winst64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5E51EC1658679464CAED7E13D824FEA6\ConfiguratorShortcut = "Configurator"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\NSReplayFile\EditFlags = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.rpf	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rpf\ = "NSReplayFile"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\NSReplayFile\Shell\Play\Command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\shell\show	MSI37E6.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mpegfile\shell\show\command\ = "\"C:\\Program Files (x86)\\NetSupport\\NetSupport School\\pcinssui.exe\" /ShowVideo \"%L\""	MSI37E6.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5E51EC1658679464CAED7E13D824FEA6\DesktopShortcutFeature = "\x06Tutor"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E51EC1658679464CAED7E13D824FEA6\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E51EC1658679464CAED7E13D824FEA6\Version = "234881026"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E51EC1658679464CAED7E13D824FEA6\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\943C1EEA70369E845B409AAF32BEB8CD	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E51EC1658679464CAED7E13D824FEA6\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\{6FE3A09B-55EE-461E-8D7E-53EBD2EDC495}\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\movfile\shell\show	MSI37E6.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\movfile	MSI37E6.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WMVFile\shell\show\command	MSI37E6.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5E51EC1658679464CAED7E13D824FEA6\ReplayConversion = "\x06NSS"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E51EC1658679464CAED7E13D824FEA6\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NSReplayFile\DefaultIcon\ = "C:\\Program Files (x86)\\NetSupport\\NetSupport School\\PCIVideo.exe,1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\shell\show\command	MSI37E6.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\movfile\shell\show\command\ = "\"C:\\Program Files (x86)\\NetSupport\\NetSupport School\\pcinssui.exe\" /ShowVideo \"%L\""	MSI37E6.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mpegfile\shell\show\command	MSI37E6.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5E51EC1658679464CAED7E13D824FEA6\Student = "NSS"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E51EC1658679464CAED7E13D824FEA6	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5E51EC1658679464CAED7E13D824FEA6\NSS	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5E51EC1658679464CAED7E13D824FEA6\Common = "NSS"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NSReplayFile\ = "NetSupport School Replay File"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NSReplayFile\Shell\Play\Command\ = "\"C:\\Program Files (x86)\\NetSupport\\NetSupport School\\client32.exe\" /r\"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ASFFile\shell\show\ = "&Show with NetSupport School"	MSI37E6.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ASFFile\shell\show\command	MSI37E6.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WMVFile\shell\show	MSI37E6.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WMVFile\shell\show\ = "&Show with NetSupport School"	MSI37E6.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5E51EC1658679464CAED7E13D824FEA6\TestDesigner = "\x06NSS"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile	MSI37E6.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\shell\show\command\ = "\"C:\\Program Files (x86)\\NetSupport\\NetSupport School\\pcinssui.exe\" /ShowVideo \"%L\""	MSI37E6.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WMVFile	MSI37E6.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71C5A887-11E0-4c5a-9B9B-D4A074555692}\InProcServer32\ = "Client32Provider.dll"	winst64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Nd0adc7e1\a = "S"	MSI37E6.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5E51EC1658679464CAED7E13D824FEA6\NetSupport_TC_Templates = "\x06TechConsole"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WMVFile\shell	MSI37E6.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mpegfile	MSI37E6.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WMVFile\shell\show\command\ = "\"C:\\Program Files (x86)\\NetSupport\\NetSupport School\\pcinssui.exe\" /ShowVideo \"%L\""	MSI37E6.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5E51EC1658679464CAED7E13D824FEA6\NameServer = "\x06NSS"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5E51EC1658679464CAED7E13D824FEA6\RemoteDeploy2 = "\x06TechConsole"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5E51EC1658679464CAED7E13D824FEA6\TutorStudentUpgradeFiles = "\x06TechConsole"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E51EC1658679464CAED7E13D824FEA6\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NSReplayFile\Shell\ = "Play"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\NSReplayFile	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ASFFile\shell	MSI37E6.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E51EC1658679464CAED7E13D824FEA6\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe

NTFS ADS 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 121453.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 280420.crdownload:SmartScreen	msedge.exe
File created	C:\Users\Admin\AppData\Local\Temp\{6FE3A09B-55EE-461E-8D7E-53EBD2EDC495}\NetSupport School 14.00.0002.exe\:SmartScreen:$DATA	NetSupport School 14.00.0002.exe
File created	C:\Users\Admin\AppData\Local\Temp\{61CE15E5-7685-4649-ACDE-E7318D42EF6A}\Setup.exe\:SmartScreen:$DATA	MsiExec.exe

Runs net.exe

Suspicious behavior: AddClipboardFormatListener 4 IoCs

pid	Process
536	client32.exe
6708	client32.exe
5428	client32.exe
4444	client32.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
3028	mspaint.exe
3028	mspaint.exe
4024	msedge.exe
4024	msedge.exe
680	msedge.exe
680	msedge.exe
4552	identity_helper.exe
4552	identity_helper.exe
5412	msedge.exe
5412	msedge.exe
5544	msedge.exe
5544	msedge.exe
5808	msedge.exe
5808	msedge.exe
5992	MsiExec.exe
5992	MsiExec.exe
4140	msiexec.exe
4140	msiexec.exe
5940	MSI37E6.tmp
5940	MSI37E6.tmp
5940	MSI37E6.tmp
5940	MSI37E6.tmp
1156	client32.exe
1156	client32.exe
536	client32.exe
536	client32.exe
5616	runplugin64.exe
5616	runplugin64.exe
6340	msedge.exe
6340	msedge.exe
6340	msedge.exe
6340	msedge.exe
536	client32.exe
536	client32.exe
4204	client32.exe
4204	client32.exe
6708	client32.exe
6708	client32.exe
6780	runplugin64.exe
6780	runplugin64.exe
6708	client32.exe
6708	client32.exe
3648	client32.exe
3648	client32.exe
5428	client32.exe
5428	client32.exe
6616	runplugin64.exe
6616	runplugin64.exe
5428	client32.exe
5428	client32.exe
6616	runplugin64.exe
6616	runplugin64.exe
6256	client32.exe
6256	client32.exe
4444	client32.exe
4444	client32.exe
5628	runplugin64.exe
5628	runplugin64.exe

Suspicious behavior: GetForegroundWindowSpam 7 IoCs

pid	Process
5396	runplugin.exe
6748	runplugin.exe
6780	runplugin64.exe
1268	pcicfgui.exe
536	runplugin.exe
5012	runplugin.exe
5628	runplugin64.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5392	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	5392	MSIEXEC.EXE
Token: SeSecurityPrivilege	4140	msiexec.exe
Token: SeCreateTokenPrivilege	5392	MSIEXEC.EXE
Token: SeAssignPrimaryTokenPrivilege	5392	MSIEXEC.EXE
Token: SeLockMemoryPrivilege	5392	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	5392	MSIEXEC.EXE
Token: SeMachineAccountPrivilege	5392	MSIEXEC.EXE
Token: SeTcbPrivilege	5392	MSIEXEC.EXE
Token: SeSecurityPrivilege	5392	MSIEXEC.EXE
Token: SeTakeOwnershipPrivilege	5392	MSIEXEC.EXE
Token: SeLoadDriverPrivilege	5392	MSIEXEC.EXE
Token: SeSystemProfilePrivilege	5392	MSIEXEC.EXE
Token: SeSystemtimePrivilege	5392	MSIEXEC.EXE
Token: SeProfSingleProcessPrivilege	5392	MSIEXEC.EXE
Token: SeIncBasePriorityPrivilege	5392	MSIEXEC.EXE
Token: SeCreatePagefilePrivilege	5392	MSIEXEC.EXE
Token: SeCreatePermanentPrivilege	5392	MSIEXEC.EXE
Token: SeBackupPrivilege	5392	MSIEXEC.EXE
Token: SeRestorePrivilege	5392	MSIEXEC.EXE
Token: SeShutdownPrivilege	5392	MSIEXEC.EXE
Token: SeDebugPrivilege	5392	MSIEXEC.EXE
Token: SeAuditPrivilege	5392	MSIEXEC.EXE
Token: SeSystemEnvironmentPrivilege	5392	MSIEXEC.EXE
Token: SeChangeNotifyPrivilege	5392	MSIEXEC.EXE
Token: SeRemoteShutdownPrivilege	5392	MSIEXEC.EXE
Token: SeUndockPrivilege	5392	MSIEXEC.EXE
Token: SeSyncAgentPrivilege	5392	MSIEXEC.EXE
Token: SeEnableDelegationPrivilege	5392	MSIEXEC.EXE
Token: SeManageVolumePrivilege	5392	MSIEXEC.EXE
Token: SeImpersonatePrivilege	5392	MSIEXEC.EXE
Token: SeCreateGlobalPrivilege	5392	MSIEXEC.EXE
Token: SeCreateTokenPrivilege	5392	MSIEXEC.EXE
Token: SeAssignPrimaryTokenPrivilege	5392	MSIEXEC.EXE
Token: SeLockMemoryPrivilege	5392	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	5392	MSIEXEC.EXE
Token: SeMachineAccountPrivilege	5392	MSIEXEC.EXE
Token: SeTcbPrivilege	5392	MSIEXEC.EXE
Token: SeSecurityPrivilege	5392	MSIEXEC.EXE
Token: SeTakeOwnershipPrivilege	5392	MSIEXEC.EXE
Token: SeLoadDriverPrivilege	5392	MSIEXEC.EXE
Token: SeSystemProfilePrivilege	5392	MSIEXEC.EXE
Token: SeSystemtimePrivilege	5392	MSIEXEC.EXE
Token: SeProfSingleProcessPrivilege	5392	MSIEXEC.EXE
Token: SeIncBasePriorityPrivilege	5392	MSIEXEC.EXE
Token: SeCreatePagefilePrivilege	5392	MSIEXEC.EXE
Token: SeCreatePermanentPrivilege	5392	MSIEXEC.EXE
Token: SeBackupPrivilege	5392	MSIEXEC.EXE
Token: SeRestorePrivilege	5392	MSIEXEC.EXE
Token: SeShutdownPrivilege	5392	MSIEXEC.EXE
Token: SeDebugPrivilege	5392	MSIEXEC.EXE
Token: SeAuditPrivilege	5392	MSIEXEC.EXE
Token: SeSystemEnvironmentPrivilege	5392	MSIEXEC.EXE
Token: SeChangeNotifyPrivilege	5392	MSIEXEC.EXE
Token: SeRemoteShutdownPrivilege	5392	MSIEXEC.EXE
Token: SeUndockPrivilege	5392	MSIEXEC.EXE
Token: SeSyncAgentPrivilege	5392	MSIEXEC.EXE
Token: SeEnableDelegationPrivilege	5392	MSIEXEC.EXE
Token: SeManageVolumePrivilege	5392	MSIEXEC.EXE
Token: SeImpersonatePrivilege	5392	MSIEXEC.EXE
Token: SeCreateGlobalPrivilege	5392	MSIEXEC.EXE
Token: SeCreateTokenPrivilege	5392	MSIEXEC.EXE
Token: SeAssignPrimaryTokenPrivilege	5392	MSIEXEC.EXE
Token: SeLockMemoryPrivilege	5392	MSIEXEC.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
536	client32.exe
536	client32.exe
536	client32.exe
6708	client32.exe
6708	client32.exe
6708	client32.exe
6708	client32.exe
6708	client32.exe
6708	client32.exe
6708	client32.exe
6708	client32.exe
6708	client32.exe
6708	client32.exe
6708	client32.exe
6708	client32.exe
6708	client32.exe
6708	client32.exe
6708	client32.exe
6708	client32.exe
5428	client32.exe
5428	client32.exe
5428	client32.exe
4444	client32.exe
4444	client32.exe

Suspicious use of SetWindowsHookEx 23 IoCs

pid	Process
3028	mspaint.exe
3028	mspaint.exe
3028	mspaint.exe
3028	mspaint.exe
904	NetSupport School 14.00.0002.exe
4948	NetSupport School 14.00.0002.exe
5396	runplugin.exe
5396	runplugin.exe
5616	runplugin64.exe
5616	runplugin64.exe
6612	pcicfgui.exe
6748	runplugin.exe
6748	runplugin.exe
6780	runplugin64.exe
6780	runplugin64.exe
536	runplugin.exe
536	runplugin.exe
6616	runplugin64.exe
6616	runplugin64.exe
5012	runplugin.exe
5012	runplugin.exe
5628	runplugin64.exe
5628	runplugin64.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 680 wrote to memory of 2248	680	msedge.exe	93
PID 680 wrote to memory of 2248	680	msedge.exe	93
PID 680 wrote to memory of 3580	680	msedge.exe	94
PID 680 wrote to memory of 3580	680	msedge.exe	94
PID 680 wrote to memory of 3580	680	msedge.exe	94
PID 680 wrote to memory of 3580	680	msedge.exe	94
PID 680 wrote to memory of 3580	680	msedge.exe	94
PID 680 wrote to memory of 3580	680	msedge.exe	94
PID 680 wrote to memory of 3580	680	msedge.exe	94
PID 680 wrote to memory of 3580	680	msedge.exe	94
PID 680 wrote to memory of 3580	680	msedge.exe	94
PID 680 wrote to memory of 3580	680	msedge.exe	94
PID 680 wrote to memory of 3580	680	msedge.exe	94
PID 680 wrote to memory of 3580	680	msedge.exe	94
PID 680 wrote to memory of 3580	680	msedge.exe	94
PID 680 wrote to memory of 3580	680	msedge.exe	94
PID 680 wrote to memory of 3580	680	msedge.exe	94
PID 680 wrote to memory of 3580	680	msedge.exe	94
PID 680 wrote to memory of 3580	680	msedge.exe	94
PID 680 wrote to memory of 3580	680	msedge.exe	94
PID 680 wrote to memory of 3580	680	msedge.exe	94
PID 680 wrote to memory of 3580	680	msedge.exe	94
PID 680 wrote to memory of 3580	680	msedge.exe	94
PID 680 wrote to memory of 3580	680	msedge.exe	94
PID 680 wrote to memory of 3580	680	msedge.exe	94
PID 680 wrote to memory of 3580	680	msedge.exe	94
PID 680 wrote to memory of 3580	680	msedge.exe	94
PID 680 wrote to memory of 3580	680	msedge.exe	94
PID 680 wrote to memory of 3580	680	msedge.exe	94
PID 680 wrote to memory of 3580	680	msedge.exe	94
PID 680 wrote to memory of 3580	680	msedge.exe	94
PID 680 wrote to memory of 3580	680	msedge.exe	94
PID 680 wrote to memory of 3580	680	msedge.exe	94
PID 680 wrote to memory of 3580	680	msedge.exe	94
PID 680 wrote to memory of 3580	680	msedge.exe	94
PID 680 wrote to memory of 3580	680	msedge.exe	94
PID 680 wrote to memory of 3580	680	msedge.exe	94
PID 680 wrote to memory of 3580	680	msedge.exe	94
PID 680 wrote to memory of 3580	680	msedge.exe	94
PID 680 wrote to memory of 3580	680	msedge.exe	94
PID 680 wrote to memory of 3580	680	msedge.exe	94
PID 680 wrote to memory of 3580	680	msedge.exe	94
PID 680 wrote to memory of 4024	680	msedge.exe	95
PID 680 wrote to memory of 4024	680	msedge.exe	95
PID 680 wrote to memory of 2928	680	msedge.exe	96
PID 680 wrote to memory of 2928	680	msedge.exe	96
PID 680 wrote to memory of 2928	680	msedge.exe	96
PID 680 wrote to memory of 2928	680	msedge.exe	96
PID 680 wrote to memory of 2928	680	msedge.exe	96
PID 680 wrote to memory of 2928	680	msedge.exe	96
PID 680 wrote to memory of 2928	680	msedge.exe	96
PID 680 wrote to memory of 2928	680	msedge.exe	96
PID 680 wrote to memory of 2928	680	msedge.exe	96
PID 680 wrote to memory of 2928	680	msedge.exe	96
PID 680 wrote to memory of 2928	680	msedge.exe	96
PID 680 wrote to memory of 2928	680	msedge.exe	96
PID 680 wrote to memory of 2928	680	msedge.exe	96
PID 680 wrote to memory of 2928	680	msedge.exe	96
PID 680 wrote to memory of 2928	680	msedge.exe	96
PID 680 wrote to memory of 2928	680	msedge.exe	96
PID 680 wrote to memory of 2928	680	msedge.exe	96
PID 680 wrote to memory of 2928	680	msedge.exe	96
PID 680 wrote to memory of 2928	680	msedge.exe	96
PID 680 wrote to memory of 2928	680	msedge.exe	96

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5376	attrib.exe

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\lss.png"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:4972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc681f46f8,0x7ffc681f4708,0x7ffc681f4718
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,1821273882681299286,16472808766344341147,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,1821273882681299286,16472808766344341147,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - Suspicious behavior: EnumeratesProcesses
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,1821273882681299286,16472808766344341147,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1821273882681299286,16472808766344341147,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1821273882681299286,16472808766344341147,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1821273882681299286,16472808766344341147,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4400 /prefetch:1
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1821273882681299286,16472808766344341147,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3888 /prefetch:1
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,1821273882681299286,16472808766344341147,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3520 /prefetch:8
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,1821273882681299286,16472808766344341147,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3520 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1821273882681299286,16472808766344341147,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1821273882681299286,16472808766344341147,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1821273882681299286,16472808766344341147,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:5532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1821273882681299286,16472808766344341147,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1821273882681299286,16472808766344341147,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:5696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1821273882681299286,16472808766344341147,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:5704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1821273882681299286,16472808766344341147,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:6020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1821273882681299286,16472808766344341147,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:6128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1821273882681299286,16472808766344341147,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1821273882681299286,16472808766344341147,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2060,1821273882681299286,16472808766344341147,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2060,1821273882681299286,16472808766344341147,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2060,1821273882681299286,16472808766344341147,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6320 /prefetch:8
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2060,1821273882681299286,16472808766344341147,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6536 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2060,1821273882681299286,16472808766344341147,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3084 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1821273882681299286,16472808766344341147,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2060,1821273882681299286,16472808766344341147,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,1821273882681299286,16472808766344341147,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3232 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6340

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:372

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1404

C:\Users\Admin\Downloads\NetSupport School 14.00.0002.exe
"C:\Users\Admin\Downloads\NetSupport School 14.00.0002.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:904
- C:\Users\Admin\AppData\Local\Temp\{6FE3A09B-55EE-461E-8D7E-53EBD2EDC495}\NetSupport School 14.00.0002.exe
  "C:\Users\Admin\AppData\Local\Temp\{6FE3A09B-55EE-461E-8D7E-53EBD2EDC495}\NetSupport School 14.00.0002.exe" /q"C:\Users\Admin\Downloads\NetSupport School 14.00.0002.exe" /tempdisk1folder"C:\Users\Admin\AppData\Local\Temp\{6FE3A09B-55EE-461E-8D7E-53EBD2EDC495}" /IS_temp
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4948
- - C:\Windows\SysWOW64\MSIEXEC.EXE
    "C:\Windows\system32\MSIEXEC.EXE" /i "C:\Users\Admin\AppData\Local\Temp\{6FE3A09B-55EE-461E-8D7E-53EBD2EDC495}\NetSupport School.msi" SETUPEXEDIR="C:\Users\Admin\Downloads" SETUPEXENAME="NetSupport School 14.00.0002.exe"
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5392
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c ATTRIB -R "C:\Users\Admin\AppData\Local\Temp\{61CE15E5-7685-4649-ACDE-E7318D42EF6A}\\nsm.lic"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4888
    - - C:\Windows\SysWOW64\attrib.exe
        
        ATTRIB -R "C:\Users\Admin\AppData\Local\Temp\{61CE15E5-7685-4649-ACDE-E7318D42EF6A}\\nsm.lic"
        5⤵
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:5376
  - - C:\Users\Admin\AppData\Local\Temp\MSI5CFA.tmp
      "C:\Users\Admin\AppData\Local\Temp\MSI5CFA.tmp" /G"C:\Program Files (x86)\NetSupport\NetSupport School\" /EI
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2648
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\system32\explorer.exe
    3⤵
    PID:5848

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4140
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B3171626F30702B1AD385993A57BA743 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5992
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4080
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7AE3AB39A6867BED3CD68B52B9FBE4EF
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  PID:4272
- C:\Windows\Installer\MSI2078.tmp
  "C:\Windows\Installer\MSI2078.tmp" /p "C:\Users\Admin\AppData\Local\Temp\{61CE15E5-7685-4649-ACDE-E7318D42EF6A}\\Detect64LSP.txt"
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\Installer\MSI2115.tmp
  "C:\Windows\Installer\MSI2115.tmp" /G"C:\Program Files (x86)\NetSupport\NetSupport School\" /EU
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3628
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 36D38C3F99498EEF3A16D45717F5896A E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:3480
- C:\Windows\system32\Net.exe
  Net Stop NSWebFilterDriver
  2⤵
  PID:1716
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 Stop NSWebFilterDriver
    3⤵
    PID:2864
- C:\Windows\Installer\MSI288F.tmp
  "C:\Windows\Installer\MSI288F.tmp" /G"C:\Program Files (x86)\NetSupport\NetSupport School\" /EU
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5852
- C:\Program Files (x86)\NetSupport\NetSupport School\checkdvd.exe
  "C:\Program Files (x86)\NetSupport\NetSupport School\checkdvd.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5860
- C:\Windows\Installer\MSI30A1.tmp
  "C:\Windows\Installer\MSI30A1.tmp" /i "C:\Program Files (x86)\Common Files\NSL\NSWebFilterDriver.inf"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:3908
- C:\Windows\system32\Net.exe
  Net Start NSWebFilterDriver
  2⤵
  PID:2608
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 Start NSWebFilterDriver
    3⤵
    PID:3436
- C:\Windows\Installer\MSI3630.tmp
  "C:\Windows\Installer\MSI3630.tmp" /G"C:\Program Files (x86)\NetSupport\NetSupport School\" /EC /Q /Q /C
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5572
- C:\Windows\Installer\MSI37E6.tmp
  "C:\Windows\Installer\MSI37E6.tmp" /G"C:\Program Files (x86)\NetSupport\NetSupport School\" /EV"NetSupport School" /EC /Q /Q /I *
  2⤵
  - Sets service image path in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5940
- - C:\Program Files (x86)\NetSupport\NetSupport School\winst64.exe
    winst64.exe /q /q /i
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Modifies registry class
    PID:4068
- C:\Windows\system32\cmd.exe
  cmd.exe /c secedit /configure /areas SECURITYPOLICY /db hisecws.sdb /cfg "C:\Users\Admin\AppData\Local\Temp\{61CE15E5-7685-4649-ACDE-E7318D42EF6A}\NS.inf" /log "C:\Program Files (x86)\NetSupport\NetSupport School\sec.log" /overwrite /quiet
  2⤵
  PID:1520
- - C:\Windows\SysWOW64\SecEdit.exe
    secedit /configure /areas SECURITYPOLICY /db hisecws.sdb /cfg "C:\Users\Admin\AppData\Local\Temp\{61CE15E5-7685-4649-ACDE-E7318D42EF6A}\NS.inf" /log "C:\Program Files (x86)\NetSupport\NetSupport School\sec.log" /overwrite /quiet
    3⤵
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    PID:5048
- C:\Program Files (x86)\NetSupport\NetSupport School\pcicfgui_setup.exe
  "C:\Program Files (x86)\NetSupport\NetSupport School\pcicfgui_setup.exe" /Q "C:\Program Files (x86)\NetSupport\NetSupport School\Client32.ini"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:6116
- - C:\Program Files (x86)\NetSupport\NetSupport School\pcicfgui_setup.exe
    "C:\Program Files (x86)\NetSupport\NetSupport School\pcicfgui_setup.exe"
    3⤵
    - Executes dropped EXE
    PID:2296

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4944

C:\Program Files (x86)\NetSupport\NetSupport School\client32.exe
"C:\Program Files (x86)\NetSupport\NetSupport School\client32.exe" /* *
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1156
- C:\Program Files (x86)\NetSupport\NetSupport School\client32.exe
  "C:\Program Files (x86)\NetSupport\NetSupport School\client32.exe" * /VistaUI
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SendNotifyMessage
  PID:536
- - C:\Program Files (x86)\NetSupport\NetSupport School\runplugin.exe
    "C:\Program Files (x86)\NetSupport\NetSupport School\runplugin.exe" /USER=SYSTEM
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:5396
- - C:\Program Files (x86)\NetSupport\NetSupport School\runplugin64.exe
    "C:\Program Files (x86)\NetSupport\NetSupport School\runplugin64.exe" /USER=SYSTEM
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:5616
- - C:\Program Files (x86)\NetSupport\NetSupport School\runplugin.exe
    "C:\Program Files (x86)\NetSupport\NetSupport School\runplugin.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5444
- - C:\Program Files (x86)\NetSupport\NetSupport School\runplugin64.exe
    "C:\Program Files (x86)\NetSupport\NetSupport School\runplugin64.exe"
    3⤵
    - Executes dropped EXE
    PID:5424

C:\Program Files (x86)\NetSupport\NetSupport School\pcicfgui.exe
"C:\Program Files (x86)\NetSupport\NetSupport School\pcicfgui.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:6612

C:\Program Files (x86)\NetSupport\NetSupport School\client32.exe
"C:\Program Files (x86)\NetSupport\NetSupport School\client32.exe" /* *
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4204
- C:\Program Files (x86)\NetSupport\NetSupport School\client32.exe
  "C:\Program Files (x86)\NetSupport\NetSupport School\client32.exe" * /VistaUI
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SendNotifyMessage
  PID:6708
- - C:\Program Files (x86)\NetSupport\NetSupport School\runplugin.exe
    "C:\Program Files (x86)\NetSupport\NetSupport School\runplugin.exe" /USER=SYSTEM
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:6748
- - C:\Program Files (x86)\NetSupport\NetSupport School\runplugin64.exe
    "C:\Program Files (x86)\NetSupport\NetSupport School\runplugin64.exe" /USER=SYSTEM
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:6780
- - C:\Program Files (x86)\NetSupport\NetSupport School\runplugin.exe
    "C:\Program Files (x86)\NetSupport\NetSupport School\runplugin.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6800
- - C:\Program Files (x86)\NetSupport\NetSupport School\runplugin64.exe
    "C:\Program Files (x86)\NetSupport\NetSupport School\runplugin64.exe"
    3⤵
    - Executes dropped EXE
    PID:6840

C:\Program Files (x86)\NetSupport\NetSupport School\pcicfgui.exe
"C:\Program Files (x86)\NetSupport\NetSupport School\pcicfgui.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:1268

C:\Program Files (x86)\NetSupport\NetSupport School\client32.exe
"C:\Program Files (x86)\NetSupport\NetSupport School\client32.exe" /* *
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3648
- C:\Program Files (x86)\NetSupport\NetSupport School\client32.exe
  "C:\Program Files (x86)\NetSupport\NetSupport School\client32.exe" * /VistaUI
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SendNotifyMessage
  PID:5428
- - C:\Program Files (x86)\NetSupport\NetSupport School\runplugin.exe
    "C:\Program Files (x86)\NetSupport\NetSupport School\runplugin.exe" /USER=SYSTEM
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:536
- - C:\Program Files (x86)\NetSupport\NetSupport School\runplugin64.exe
    "C:\Program Files (x86)\NetSupport\NetSupport School\runplugin64.exe" /USER=SYSTEM
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:6616
- - C:\Program Files (x86)\NetSupport\NetSupport School\runplugin.exe
    "C:\Program Files (x86)\NetSupport\NetSupport School\runplugin.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5280
- - C:\Program Files (x86)\NetSupport\NetSupport School\runplugin64.exe
    "C:\Program Files (x86)\NetSupport\NetSupport School\runplugin64.exe"
    3⤵
    - Executes dropped EXE
    PID:6948

C:\Program Files (x86)\NetSupport\NetSupport School\pcicfgui.exe
"C:\Program Files (x86)\NetSupport\NetSupport School\pcicfgui.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1348

C:\Program Files (x86)\NetSupport\NetSupport School\client32.exe
"C:\Program Files (x86)\NetSupport\NetSupport School\client32.exe" /* *
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:6256
- C:\Program Files (x86)\NetSupport\NetSupport School\client32.exe
  "C:\Program Files (x86)\NetSupport\NetSupport School\client32.exe" * /VistaUI
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SendNotifyMessage
  PID:4444
- - C:\Program Files (x86)\NetSupport\NetSupport School\runplugin.exe
    "C:\Program Files (x86)\NetSupport\NetSupport School\runplugin.exe" /USER=SYSTEM
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:5012
- - C:\Program Files (x86)\NetSupport\NetSupport School\runplugin64.exe
    "C:\Program Files (x86)\NetSupport\NetSupport School\runplugin64.exe" /USER=SYSTEM
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:5628
- - C:\Program Files (x86)\NetSupport\NetSupport School\runplugin.exe
    "C:\Program Files (x86)\NetSupport\NetSupport School\runplugin.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1956
- - C:\Program Files (x86)\NetSupport\NetSupport School\runplugin64.exe
    "C:\Program Files (x86)\NetSupport\NetSupport School\runplugin64.exe"
    3⤵
    - Executes dropped EXE
    PID:5672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery