Analysis
- user interaction
yes - max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
27/05/2026, 13:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
CompeteClientInstall.msi
Resource
win11-20260513-en
windows11-21h2-x64
17 signatures
150 seconds
General
- Target CompeteClientInstall.msi
- Size 112.2MB
- Sample260527-qf96vset5m
- SHA256 3e4b2b2896756df7d1087b7839b6a80b528ecd63d71fa101ba666648a9f0f2f3
- MD5 55b560a0d1a1d07c51be6e5a13dd9e41
- SHA1 c6315797c72a049103c182e3a2420a387117dc9a
- SHA512 5b875b96f0baefd9855375fc0e83d98d4fb571b852a4613dd8fb4ef96b774424f6836124cf0737bc270eaf6e28d292dc37f3f78546abbb03b93df657a0bbd067
- SSDEEP 3145728:7433CHXG73Cg4/C+YFM88qwUtgVD4DEgeT7nqHdcC3:qc/l8+UtgVD4IgeTrGdc
- TLSH T187483321798ECC22F75F11B16939DEAB463DBE220B7201D7B3D4BC6A18746C16339A53
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
pid Process 3456 updater.exe 3908 updater.exe 4760 Front Desk.exe - Loads dropped DLL 56 IoCs
pid Process 1356 MsiExec.exe 1356 MsiExec.exe 1356 MsiExec.exe 1356 MsiExec.exe 1356 MsiExec.exe 1356 MsiExec.exe 1356 MsiExec.exe 1356 MsiExec.exe 1356 MsiExec.exe 1356 MsiExec.exe 1356 MsiExec.exe 1356 MsiExec.exe 1076 MsiExec.exe 1076 MsiExec.exe 1076 MsiExec.exe 1076 MsiExec.exe 1076 MsiExec.exe 1076 MsiExec.exe 1076 MsiExec.exe 1076 MsiExec.exe 924 MsiExec.exe 1076 MsiExec.exe 2880 MsiExec.exe 924 MsiExec.exe 924 MsiExec.exe 1076 MsiExec.exe 4760 Front Desk.exe 4760 Front Desk.exe 4760 Front Desk.exe 4760 Front Desk.exe 4760 Front Desk.exe 4760 Front Desk.exe 4760 Front Desk.exe 4760 Front Desk.exe 4760 Front Desk.exe 4760 Front Desk.exe 4760 Front Desk.exe 4760 Front Desk.exe 4760 Front Desk.exe 4760 Front Desk.exe 4760 Front Desk.exe 4760 Front Desk.exe 4760 Front Desk.exe 4760 Front Desk.exe 4760 Front Desk.exe 4760 Front Desk.exe 4760 Front Desk.exe 4760 Front Desk.exe 4760 Front Desk.exe 4760 Front Desk.exe 4760 Front Desk.exe 4760 Front Desk.exe 4760 Front Desk.exe 4760 Front Desk.exe 4760 Front Desk.exe 4760 Front Desk.exe - Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 3700 msiexec.exe 3 3700 msiexec.exe 4 3700 msiexec.exe 5 3700 msiexec.exe 7 4336 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\JonasFitness\Compete\DPFPShrNET.dll msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\CompeteUpdaterInstall.exe msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\GAT.CardReaders.dll msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\GdPicture.NET.10.filters.64.dll msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\CheckInCommonUI.dll msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\JFI.PaymentCard.Models.Common.dll msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\DevExpress.Office.v24.1.Core.dll msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\BackOfficeLogic.dll msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\Infragistics4.Shared.v21.1.dll msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\Infragistics4.Win.UltraWinToolbars.v21.1.dll msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\DevExpress.Data.v24.1.dll msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\GdPicture.NET.10.filters.dll msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\CheckFree.HF.ClubSoftware.AdminToolShell.exe msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\HFSecurity.dll msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\Microsoft.Practices.EnterpriseLibrary.ExceptionHandling.Logging.dll msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\Microsoft.Practices.EnterpriseLibrary.Logging.dll msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\PosLogic.dll msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\Interop.SIGPLUSLib.dll msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\Devices.dll msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\GdPicture.NET.10.twain.client.64.dll msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\Microsoft.ReportViewer.Common.dll msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\Infragistics4.Win.UltraWinGrid.DocumentExport.v21.1.dll msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\DevExpress.Printing.v24.1.Core.dll msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\Microsoft.Practices.EnterpriseLibrary.ExceptionHandling.dll msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\EasyQuery.dll msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\Microsoft.Office.Interop.Word.dll msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\DevExpress.Pdf.v24.1.Core.dll msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\SalesProspectUI.dll msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\GAT.Comms.FunLine.Manager.dll msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\AMD64\sqlceer35EN.dll msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\TanningUI.dll msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\Microsoft.ReportViewer.WinForms.dll msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\CheckFree.HF.ClubSoftware.UI.SalesProspectingModule.dll msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\CheckFree.HF.ClubSoftware.UI.BackOffice.Navigation.dll msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\ContractUI.dll msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\icon_fd_m.ico msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\CheckFree.HF.ClubSoftware.UI.SalesModule.dll msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\ChangeRequestUI.dll msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\AMD64\sqlceoledb35.dll msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\BackOfficeShell.exe msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\StarComm.dll msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\NurseryMonitorUI.dll msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\x86\sqlceoledb35.dll msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\CheckInCommonLogic.dll msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\JFI.PaymentCard.Models.WorldPay.dll msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\CheckFree.HF.ClubSoftware.UI.BackOfficeHelpModule.dll msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\CheckFree.HF.ClubSoftware.AdHocReportModule.dll msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\DPFPGuiNET.dll msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\Infragistics4.Documents.Core.v21.1.dll msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\BackOfficeShell.exe.config msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\Microsoft.Bcl.AsyncInterfaces.dll msiexec.exe File opened for modification C:\Program Files (x86)\JonasFitness\updater.exe msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\FieldValidation.dll msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\PiiCom.dll msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\Resources\flat-ui.css msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\Infragistics4.Win.UltraWinDataSource.v21.1.dll msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\Infragistics4.Win.UltraWinExplorerBar.v21.1.dll msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\Microsoft.Practices.ObjectBuilder.dll msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\CheckFree.HF.ClubSoftware.UI.ConfigurationModule.dll msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\CourtReservationUI.dll msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\AMD64\sqlceqp35.dll msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\ChannelAdam.Core.dll msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\WebView2Loader.dll msiexec.exe File created C:\Program Files (x86)\JonasFitness\Compete\WLStarComm.dll msiexec.exe - Drops file in Windows directory 38 IoCs
description ioc Process File created C:\Windows\SystemTemp\~DF8BD3A9EC8658F5A7.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIE4D6.tmp msiexec.exe File created C:\Windows\assembly\tmp\M9AI3C0Y\Microsoft.ReportViewer.WinForms.dll msiexec.exe File opened for modification C:\Windows\Installer\{C558D6EF-91B9-46A0-8B52-8F80A7B63444}\BackOfficeShell.exe msiexec.exe File created C:\Windows\Installer\{C558D6EF-91B9-46A0-8B52-8F80A7B63444}\Front_Desk_1.exe msiexec.exe File created C:\Windows\Installer\SourceHash{C558D6EF-91B9-46A0-8B52-8F80A7B63444} msiexec.exe File opened for modification C:\Windows\Installer\MSIE2C0.tmp msiexec.exe File created C:\Windows\Installer\{C558D6EF-91B9-46A0-8B52-8F80A7B63444}\BackOfficeShell.exe msiexec.exe File created C:\Windows\Installer\{C558D6EF-91B9-46A0-8B52-8F80A7B63444}\CheckFree.HF.ClubSoftware.AdminToolShell.exe msiexec.exe File opened for modification C:\Windows\Installer\{C558D6EF-91B9-46A0-8B52-8F80A7B63444}\CheckFree.HF.ClubSoftware.AdminToolShell.exe msiexec.exe File created C:\Windows\SystemTemp\AiFilesRemoveNoImpers_C558D6EF_91B9_46A0_8B52_8F80A7B63444.bak MsiExec.exe File created C:\Windows\assembly\tmp\6OO0FCCK\Microsoft.ReportViewer.ProcessingObjectModel.dll msiexec.exe File opened for modification C:\Windows\Installer\MSIF2E3.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF322.tmp msiexec.exe File opened for modification C:\Windows\Installer\e58b561.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\assembly\tmp\13PUMHSO\Microsoft.ReportViewer.DataVisualization.dll msiexec.exe File opened for modification C:\Windows\Installer\{C558D6EF-91B9-46A0-8B52-8F80A7B63444}\Front_Desk_1.exe msiexec.exe File opened for modification C:\Windows\Installer\MSIF333.tmp msiexec.exe File created C:\Windows\Installer\e58b561.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIDF71.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE2FF.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE310.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF2E94FE5E25F412E8.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIDF01.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIDF50.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIDFA2.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF19A.tmp msiexec.exe File created C:\Windows\SystemTemp\~DFE638D52102CC945E.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIDF61.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DF3DBCAEDAF7B678B4.TMP msiexec.exe File created C:\Windows\assembly\GACLock.dat msiexec.exe File created C:\Windows\Installer\e58b564.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIDF91.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE506.tmp msiexec.exe File created C:\Windows\assembly\tmp\MHL0CIK4\Microsoft.ReportViewer.Common.dll msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 3700 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Front Desk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language updater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language updater.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000b7671573c6f2ce060000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000b76715730000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900b7671573000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ab7671573000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1db7671573000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Front Desk.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Front Desk.exe - Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29 msiexec.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{4DDC737E-B426-4FB7-AD48-7448F53E5CB6}\TypeLib msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FE6D855C9B190A64B825F8087A6B4344\GateConfigAWSProdBoarding = "\x06AutomatedGateService" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FE6D855C9B190A64B825F8087A6B4344\AWSDevQa = "\x06" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FE6D855C9B190A64B825F8087A6B4344\AWSStageIntegratorPreview = "\x06" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|JonasFitness|Compete|ContractUI.dll msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|JonasFitness|Compete|CheckFree.HF.ClubSoftware.UI.BackOfficeHelpModule.dll msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|JonasFitness|Compete|DPFPGuiNET.dll\DPFPGuiNET,Version="1.6.1.0",processorArchitecture="MSIL",RuntimeVersion="v2.0.50727",Culture="neutral",PublicKeyToken="d4f4a0bd9c559145",GUI = 6300660041004c0068005a0075004e0064003d006c005b002c00430051005400460042007700390043006f006d0070006c006500740065003e005e004800250046006100640064002b0077003f006600660036002700330026005600690076003f0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|JonasFitness|Compete|Microsoft.Practices.EnterpriseLibrary.Common.dll msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\Microsoft.Build.Framework,Version="3.5.0.0",processorArchitecture="MSIL",RuntimeVersion="v2.0.50727",Culture="neutral",PublicKeyToken="b03f5f7f11d50a3a",GUID="D8A9BA71-4724-481d-9CA7-0DA23A1D61 = 6300660041004c0068005a0075004e0064003d006c005b002c00430051005400460042007700390043006f006d0070006c006500740065003e0079006400210066004d005800730058004a003d006c0062007a007d005a007500520033004b00540000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|JonasFitness|Compete|CheckInReportsUI.dll\CheckInReportsUI,Version="5.4.4671.11132",processorArchitecture="MSIL",RuntimeVersion="v2.0.50727",Culture="neutral",PublicKeyToken="nu = 6300660041004c0068005a0075004e0064003d006c005b002c00430051005400460042007700390043006f006d0070006c006500740065003e00590060002500730030006e007b002c002c00390054006b006d00520078006800530035003000790000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|JonasFitness|Compete|SalesProspectUI.dll\SalesProspectUI,Version="5.4.4671.11138",processorArchitecture="MSIL",RuntimeVersion="v2.0.50727",Culture="neutral",PublicKeyToken="null = 6300660041004c0068005a0075004e0064003d006c005b002c00430051005400460042007700390043006f006d0070006c006500740065003e007d004e005a00700042007900670059003f003f0035002d006f0034006a004b00510053006900610000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FE6D855C9B190A64B825F8087A6B4344\SourceList\PackageName = "CompeteClientInstall.msi" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|JonasFitness|Compete|DPFPVerNET.dll\DPFPVerNET,Version="1.6.1.0",processorArchitecture="MSIL",RuntimeVersion="v2.0.50727",Culture="neutral",PublicKeyToken="4de0a9c4dcc83984",GUI = 6300660041004c0068005a0075004e0064003d006c005b002c00430051005400460042007700390043006f006d0070006c006500740065003e00700063006b004a002e0048003400550041003f002a003d007a0021006c007a003500270039003f0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FE6D855C9B190A64B825F8087A6B4344\AWSDevRelease = "\x06" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|JonasFitness|Compete|AddGuestUI.dll\AddGuestUI,Version="5.4.4671.11127",processorArchitecture="MSIL",RuntimeVersion="v2.0.50727",Culture="neutral",PublicKeyToken="null",GUID="73 = 6300660041004c0068005a0075004e0064003d006c005b002c00430051005400460042007700390043006f006d0070006c006500740065003e004f0035005a007e0029005f0048005d0041003f005b00620034007b005500400044002d002a00470000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|JonasFitness|Compete|CheckInUI.dll\CheckInUI,Version="5.4.4671.11133",processorArchitecture="MSIL",RuntimeVersion="v2.0.50727",Culture="neutral",PublicKeyToken="null",GUID="59e6 = 6300660041004c0068005a0075004e0064003d006c005b002c00430051005400460042007700390043006f006d0070006c006500740065003e002600660065002900430030007200430034004000430076004300720033004e00620066004400690000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FE6D855C9B190A64B825F8087A6B4344\GateConfigAWSStageHotfix = "\x06AutomatedGateService" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|JonasFitness|Compete|AddGuestUI.dll msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|JonasFitness|Compete|SchedulingUI.dll\SchedulingUI,Version="5.4.4671.11131",processorArchitecture="MSIL",RuntimeVersion="v2.0.50727",Culture="neutral",PublicKeyToken="null",GUID = 6300660041004c0068005a0075004e0064003d006c005b002c00430051005400460042007700390043006f006d0070006c006500740065003e00210060005d005000380024005100360033003d002b007e007100700074002900580072003900650000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FE6D855C9B190A64B825F8087A6B4344\Complete msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0B5F2CC8-5E1E-44F9-899B-3B789705AFCA}\VersionIndependentProgID\ = "WIA.VideoPreview" MsiExec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|JonasFitness|Compete|Microsoft.Practices.EnterpriseLibrary.Logging.dll\Microsoft.Practices.EnterpriseLibrary.Logging,Version="2.0.0.0",processorArchitecture="MSIL",RuntimeVersio = 6300660041004c0068005a0075004e0064003d006c005b002c00430051005400460042007700390043006f006d0070006c006500740065003e006b0049004500750044006d005a007a002c00400041005500780051005d005700260063007800510000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|JonasFitness|Compete|TimeClockUI.dll\TimeClockUI,Version="1.0.0.0",processorArchitecture="MSIL",RuntimeVersion="v2.0.50727",Culture="neutral",PublicKeyToken="null",GUID="0b8d0f6 = 6300660041004c0068005a0075004e0064003d006c005b002c00430051005400460042007700390043006f006d0070006c006500740065003e005a004d00430064005f005f004e00780061003f00260072003500690041004b00630049005500560000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FE6D855C9B190A64B825F8087A6B4344\DoNotInstall = "\x06" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|JonasFitness|Compete|Microsoft.Practices.EnterpriseLibrary.ExceptionHandling.Logging.dll msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4DDC737E-B426-4FB7-AD48-7448F53E5CB6}\TypeLib\Version = "1.0" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|JonasFitness|Compete|DPFPShrNET.dll msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|JonasFitness|Compete|Interop.SIGPLUSLib.dll msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|JonasFitness|Compete|Microsoft.Practices.EnterpriseLibrary.ExceptionHandling.dll\Microsoft.Practices.EnterpriseLibrary.ExceptionHandling,Version="2.0.0.0",processorArchitecture= = 6300660041004c0068005a0075004e0064003d006c005b002c00430051005400460042007700390043006f006d0070006c006500740065003e005e0065006b005600680064004f006c004e003d00490045005500460034004b00480044002100470000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|JonasFitness|Compete|DPFPVerNET.dll msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FE6D855C9B190A64B825F8087A6B4344\InstanceType = "0" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FE6D855C9B190A64B825F8087A6B4344\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0B5F2CC8-5E1E-44F9-899B-3B789705AFCA}\Programmable MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4DDC737E-B426-4FB7-AD48-7448F53E5CB6}\ProxyStubClsid32 MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|JonasFitness|Compete|CheckFree.HF.ClubSoftware.UI.ConfigurationModule.dll msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|JonasFitness|Compete|DPFPShrNET.dll\DPFPShrNET,Version="1.6.1.0",processorArchitecture="MSIL",RuntimeVersion="v2.0.50727",Culture="neutral",PublicKeyToken="d902fe275a8d6cf2",GUI = 6300660041004c0068005a0075004e0064003d006c005b002c00430051005400460042007700390043006f006d0070006c006500740065003e003300250029003500720075005100290068003f006a0079002b005300730059003400770037002b0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|JonasFitness|Compete|Microsoft.Practices.EnterpriseLibrary.ExceptionHandling.dll msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|JonasFitness|Compete|ClientTransmissionSecurity.dll msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|JonasFitness|Compete|HFSecurity.dll msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|JonasFitness|Compete|MultiDatabaseToolsModule.dll msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|JonasFitness|Compete|CheckFree.HF.ClubSoftware.AdHocReportModule.dll msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FE6D855C9B190A64B825F8087A6B4344\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WIA.VideoPreview.1\CLSID MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WIA.VideoPreview MsiExec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\Microsoft.ReportViewer.Common,Version="10.0.0.0",processorArchitecture="MSIL",RuntimeVersion="v2.0.50727",Culture="neutral",PublicKeyToken="b03f5f7f11d50a3a" = 6300660041004c0068005a0075004e0064003d006c005b002c00430051005400460042007700390043006f006d0070006c006500740065003e00420053006c00360057002b005f004500770038003100710031006f0070006f003900610032005b0000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|JonasFitness|Compete|SecurityLogic.dll\SecurityLogic,Version="5.4.4671.11056",processorArchitecture="MSIL",RuntimeVersion="v2.0.50727",Culture="neutral",PublicKeyToken="null",GU = 6300660041004c0068005a0075004e0064003d006c005b002c00430051005400460042007700390043006f006d0070006c006500740065003e0067005f0066002a00690052005e0060004b003d0061002a004b002100760040005a00460038005f0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|JonasFitness|Compete|StarComm.dll msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FE6D855C9B190A64B825F8087A6B4344\GateConfigAWSProdBeta = "\x06AutomatedGateService" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|JonasFitness|Compete|Microsoft.Practices.ObjectBuilder.dll\Microsoft.Practices.ObjectBuilder,Version="1.0.51205.0",processorArchitecture="MSIL",RuntimeVersion="v2.0.50727",Cultu = 6300660041004c0068005a0075004e0064003d006c005b002c00430051005400460042007700390043006f006d0070006c006500740065003e0072006c0078007800210053007d007d0049003d006c00520026003700520041002e0033004800700000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|JonasFitness|Compete|PointOfSaleUI.dll msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|JonasFitness|Compete|CheckFree.HF.ClubSoftware.UI.SalesProspectingModule.dll msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0B5F2CC8-5E1E-44F9-899B-3B789705AFCA}\MiscStatus\1\ = "131473" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|JonasFitness|Compete|CheckFree.HF.ClubSoftware.UI.BackOffice.Navigation.dll msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|JonasFitness|Compete|CheckInReportsUI.dll msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|JonasFitness|Compete|LockerUI.dll msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|JonasFitness|Compete|Microsoft.Practices.CompositeUI.WinForms.dll msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FE6D855C9B190A64B825F8087A6B4344\AWSDevSmoke = "\x06" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|JonasFitness|Compete|CheckFree.HF.ClubSoftware.UI.ReportsModule.dll msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|JonasFitness|Compete|TimeClockUI.dll msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0B5F2CC8-5E1E-44F9-899B-3B789705AFCA}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4DDC737E-B426-4FB7-AD48-7448F53E5CB6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MsiExec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files (x86)|JonasFitness|Compete|FieldValidation.dll\FieldValidation,Version="5.4.4671.11096",processorArchitecture="MSIL",RuntimeVersion="v2.0.50727",Culture="neutral",PublicKeyToken="null = 6300660041004c0068005a0075004e0064003d006c005b002c00430051005400460042007700390043006f006d0070006c006500740065003e007100760033006c0035003f007800530053003d00740036007d006d0060005d005200620027005e0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FE6D855C9B190A64B825F8087A6B4344 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D661110A6A06120449535B825F99CBCE msiexec.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1356 MsiExec.exe 1356 MsiExec.exe 1356 MsiExec.exe 1356 MsiExec.exe 1076 MsiExec.exe 1076 MsiExec.exe 1076 MsiExec.exe 1076 MsiExec.exe 4336 msiexec.exe 4336 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3700 msiexec.exe Token: SeIncreaseQuotaPrivilege 3700 msiexec.exe Token: SeSecurityPrivilege 4336 msiexec.exe Token: SeCreateTokenPrivilege 3700 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3700 msiexec.exe Token: SeLockMemoryPrivilege 3700 msiexec.exe Token: SeIncreaseQuotaPrivilege 3700 msiexec.exe Token: SeMachineAccountPrivilege 3700 msiexec.exe Token: SeTcbPrivilege 3700 msiexec.exe Token: SeSecurityPrivilege 3700 msiexec.exe Token: SeTakeOwnershipPrivilege 3700 msiexec.exe Token: SeLoadDriverPrivilege 3700 msiexec.exe Token: SeSystemProfilePrivilege 3700 msiexec.exe Token: SeSystemtimePrivilege 3700 msiexec.exe Token: SeProfSingleProcessPrivilege 3700 msiexec.exe Token: SeIncBasePriorityPrivilege 3700 msiexec.exe Token: SeCreatePagefilePrivilege 3700 msiexec.exe Token: SeCreatePermanentPrivilege 3700 msiexec.exe Token: SeBackupPrivilege 3700 msiexec.exe Token: SeRestorePrivilege 3700 msiexec.exe Token: SeShutdownPrivilege 3700 msiexec.exe Token: SeDebugPrivilege 3700 msiexec.exe Token: SeAuditPrivilege 3700 msiexec.exe Token: SeSystemEnvironmentPrivilege 3700 msiexec.exe Token: SeChangeNotifyPrivilege 3700 msiexec.exe Token: SeRemoteShutdownPrivilege 3700 msiexec.exe Token: SeUndockPrivilege 3700 msiexec.exe Token: SeSyncAgentPrivilege 3700 msiexec.exe Token: SeEnableDelegationPrivilege 3700 msiexec.exe Token: SeManageVolumePrivilege 3700 msiexec.exe Token: SeImpersonatePrivilege 3700 msiexec.exe Token: SeCreateGlobalPrivilege 3700 msiexec.exe Token: SeCreateTokenPrivilege 3700 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3700 msiexec.exe Token: SeLockMemoryPrivilege 3700 msiexec.exe Token: SeIncreaseQuotaPrivilege 3700 msiexec.exe Token: SeMachineAccountPrivilege 3700 msiexec.exe Token: SeTcbPrivilege 3700 msiexec.exe Token: SeSecurityPrivilege 3700 msiexec.exe Token: SeTakeOwnershipPrivilege 3700 msiexec.exe Token: SeLoadDriverPrivilege 3700 msiexec.exe Token: SeSystemProfilePrivilege 3700 msiexec.exe Token: SeSystemtimePrivilege 3700 msiexec.exe Token: SeProfSingleProcessPrivilege 3700 msiexec.exe Token: SeIncBasePriorityPrivilege 3700 msiexec.exe Token: SeCreatePagefilePrivilege 3700 msiexec.exe Token: SeCreatePermanentPrivilege 3700 msiexec.exe Token: SeBackupPrivilege 3700 msiexec.exe Token: SeRestorePrivilege 3700 msiexec.exe Token: SeShutdownPrivilege 3700 msiexec.exe Token: SeDebugPrivilege 3700 msiexec.exe Token: SeAuditPrivilege 3700 msiexec.exe Token: SeSystemEnvironmentPrivilege 3700 msiexec.exe Token: SeChangeNotifyPrivilege 3700 msiexec.exe Token: SeRemoteShutdownPrivilege 3700 msiexec.exe Token: SeUndockPrivilege 3700 msiexec.exe Token: SeSyncAgentPrivilege 3700 msiexec.exe Token: SeEnableDelegationPrivilege 3700 msiexec.exe Token: SeManageVolumePrivilege 3700 msiexec.exe Token: SeImpersonatePrivilege 3700 msiexec.exe Token: SeCreateGlobalPrivilege 3700 msiexec.exe Token: SeCreateTokenPrivilege 3700 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3700 msiexec.exe Token: SeLockMemoryPrivilege 3700 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3700 msiexec.exe 3700 msiexec.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4336 wrote to memory of 1356 4336 msiexec.exe 81 PID 4336 wrote to memory of 5824 4336 msiexec.exe 85 PID 4336 wrote to memory of 1076 4336 msiexec.exe 87 PID 4336 wrote to memory of 924 4336 msiexec.exe 88 PID 4336 wrote to memory of 2880 4336 msiexec.exe 89 PID 4336 wrote to memory of 3456 4336 msiexec.exe 90 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\CompeteClientInstall.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3700
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6E0940C67EE0E3BE27BEB18090DBB8E4 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1356
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:5824
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0C9D1F03B910A5AD8E8692F9EFE48A992⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1076
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 62C2ECEA031241968C9AEE6D3E1CF634 E Global\MSI00002⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:924
-
-
C:\Windows\syswow64\MsiExec.exe"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\JonasFitness\Compete\wiaaut.dll"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2880
-
-
C:\Program Files (x86)\JonasFitness\updater.exe"C:\Program Files (x86)\JonasFitness\updater.exe" /configservice -name updater.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3456
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:2324
-
C:\Program Files (x86)\JonasFitness\updater.exe"C:\Program Files (x86)\JonasFitness\updater.exe" /runservice1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3908
-
C:\Program Files (x86)\JonasFitness\Compete\Front Desk.exe"C:\Program Files (x86)\JonasFitness\Compete\Front Desk.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
PID:4760
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58b562.rbs
- Size 5.7MB
- SHA256 13f9b4fa064512feceec798595a6165770d02190f65024c5899943bcac8a2b6b
- MD5 0c8ac700c8cf61f667582577b59d18b7
- SHA1 3a89f173a15d702e9c7461fe2a727e2979d2486a
- SHA512 a3e1cabbe4d473141e65264e1705bf4df21707381d11581bd9a7d4c8df8dae2f9dcef5d37c17ee58ce9801e483ba96e2963b8ba147374b4c198886b8860fb1d8
- SSDEEP 49152:5wmRxkXHzgQOybcJemf/4oSvPmpC+tCo7pM2DJ0xg2SV4OyMoneqpM2DJ0xg2SVL:5wmfkXTgQOD7+H+b+5+K+xU3
- TLSH T18E568C60258FC036F76E01B02A7EDBFAA12D7E710BA148DB93C8AD6A65344C15B35F17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e58b565.rbs
- Size 410B
- SHA256 8dd0541c2020ba97c9cb095614bf6073e272bd76a47f3615e24580d917e412f8
- MD5 55ac127910e9d359a2f00019b276a3e0
- SHA1 eecc2e00bf0798a0f66063d818722d8cb1476f3d
- SHA512 80fdb5e0b7802eea9939cf91f0e11f9c77b538a47add115f5bce11237b70395aeb76908cba79b8a6e9f80cdd67f0585bd1bb97fb01df2a137ee17c27c0095606
- TLSH T101E0D81BE79889E4D4C99AF34702A703099FD13887151F515C68412A7D39769AFF8485
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\JonasFitness\Compete\BackOfficeShell.exe
- Size 517KB
- SHA256 a160437fc8ebe2f8cc471b06f15e7e8c3567aba634fc55dea5976d6cc8c480ce
- MD5 8dc39ca263e2a9c41d68bb259c36a4b9
- SHA1 49e076f3f0705512bf15ee190b1dda49cd3f36db
- SHA512 474c89774eab6e8e6002e053d645d318acab6a53449ba4b37ac9edaaf75ed1c8cea1b299a854f5a466fe9457199d30fb3f83fc5386cfbc8e5b063df0e2ce7f42
- SSDEEP 6144:hepJLa7gahfInSsgie/e+lH9EURAI2Jw+J2JwT2Jw32Jw9WxhU+TZLuj6INqm3qn:hWJMOnSx3Jj2v2s2E2xbELPr29
- TLSH T109B49E6936059A81C5284B71C4ABC6F103B2AF96F673C61F2DC9369D1D327638F1239B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\JonasFitness\Compete\Front Desk.exe
- Size 1.3MB
- SHA256 d8b7aafd68578ccbb44d3ad60489f8459a02b04ca42bc72c96e3521355b2498a
- MD5 3c111a50b09e2b085f4c23e26b034f47
- SHA1 8f8d29a046af7d245e45b0727bfe4a046c367850
- SHA512 63ada1387bb3f3268161f562e7261727713b8581a787e31b8001c7c3733abdf705f6bc35034b273bdb347792c9869ca3100300a0c6be9534a52c6f8e9c0549da
- SSDEEP 24576:4ob5JIZ6hvc4ngY7gUezC2ldrJm9hIzda1n/f0ss:4UJIohvZ8UeW2lJJmzIzsnX0ss
- TLSH T18F55F02677578A65C7558A71C0D3840413B6D682FF73CA4A3DAA12DE0D127ABAF4338F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\JonasFitness\Compete\wiaaut.dll
- Size 316KB
- SHA256 dc7b0f6719c497af690d2b4880e593fd6940c5e60069ae6c6439401c4d64f54f
- MD5 c0a3045a7878a5c34f73fdd5a832c77e
- SHA1 9071f8fe70add4a1cad2871f15ba5bfc5ed1cd3d
- SHA512 dd92a0eeb5c28621d326b29f9a6743be552e626dd85d774446e74414fff4caf29e17d1ec834e22e29126c9def548ae361d5429ddc5d1338459bd89479c2ceb9b
- SSDEEP 6144:LEvvGHOuWNMeH8q4qCHBgYJ9o3QUi4oMqwgkqxpldfz:iGHOTNMeHf4qCH+cHfz
- TLSH T17D644B0237E5C132D2B762315EA6A7F5A2BBB5629D70C2173280274D2FB2780DD6D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\JonasFitness\updater.exe
- Size 1.8MB
- SHA256 d953e8c5102c3da9a88c4501aad41a2c24bbcf32847e91eeda6f7a5d9c7215dc
- MD5 ac15d0aa8ee409ef725d6afebda8d488
- SHA1 82e14e375518abe41e8386fac674095ea7a15120
- SHA512 6f278c32a57192f27692d826efe7d31ee0c84894cb9cfd86ae48e6e51a00569886c8a931d42bbb7a148aaa0ff8904269facca1f936dc321ebba474b05e384936
- SSDEEP 49152:WVIiYtxmyxhagbxvcG0o6IRHwlS/k7B7zL640vUBpY:mnYjmyxjkG0wRHw
- TLSH T1DF956B70358BC03AE53604B2662DEAABD01DAE360FA154E773DC7D2D1B789C25636F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\JonasFitness\updater.exe
- Size 1.8MB
- SHA256 b265dc6dc02aa0c157a2a0c9a4a238eb34e36c1c6c8d8249c8443b26b3032412
- MD5 0d4f2ec146088d44069366845ead8ac2
- SHA1 ada7bb4f4c2946927e2658e74bbaade2f5a27a63
- SHA512 e2bd481ce90ce1a579eb0fc5a93dad20abf520a43b6e186adc0a7333ddb23d72d6aea547b96637a5febf8914821d7ffbbf418590541fff36c7b642dc264d1a99
- SSDEEP 49152:GVIiYtxmyxhagbxvcG0o6IRHwlSSk7B7zL640vUBpY:2nYjmyxjkG0wRHw
- TLSH T1A4956B70358BC03AE53604B2662DEAABD41DAE360FA154E773DC7D291B789C25732F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\JonasFitness\updater.ini
- Size 445B
- SHA256 11e3254cc3244ef36fc8d3c97c5afc1d60db380e27e8992697d7377c00059dc6
- MD5 08e58006decda78f67574863712419c0
- SHA1 3f2a58425e8f04f987b599d589692e367b6aa242
- SHA512 ff51d5e2a0e056128d74eec1c1bd6fbabce87487487cc1913045f93c1f29a77ab47049f0593858343c2cb3182c63be6281154f918df67549dfce6afd49f5287f
- TLSH T106F0A39394C6E6E1D643D8A7675AC0B01661C61C4F76127497C4144F5BECD16193F501
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\515195B826B230146D00BC66A056A7F8
- Size 2KB
- SHA256 7031daba5a7cb21d0c0064a973d78d8892053bb368bc36b07536117f5a8233a4
- MD5 1932aae625a4ff0dac1034a67ab853dd
- SHA1 e12883a8c91149e85d79e81ab65889cd83f17e6c
- SHA512 7e1bc092396d25c86c36a1502c6b1622f733bfa93eee6c4720d3dd30039dbbb8d5dab014b26849ec69e84e4f44855997a59b808fc0a923e9726048fb80fbde5b
- TLSH T1F35120BC355DA993D5E46A71CAD7AF8ACDF545B132D0E60F46765FC80028F83CA87282
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50
- Size 2KB
- SHA256 4c16f83229f489f97fdc8920bbded9deda9f170771abc66b518debd64499cd21
- MD5 24b1be6f2e46fd93f2f0e7e9bb93b3d6
- SHA1 d71d0730b67352dc1606af9341145f0721aa4374
- SHA512 896f47d5c3cf7ad37aa496fc715173f3432c30b79b648c643c0597ffa2ea0757a1005aea656836db8aca51fe418a276f087ec0a81e3685f56d6f303912fffc09
- TLSH T1A8410B0349382051EE82BAB2E5C9D67E38F4DF131D00167B557AE290282F3A6FB0915E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\515195B826B230146D00BC66A056A7F8
- Size 290B
- SHA256 63f35f86e2b70f504b8626b7d7744fd939869339a3f24eaaa689b1c1c7a1d05e
- MD5 e0a24a16111d0c83c3ad870987055f7d
- SHA1 b8b1e5929b2416d355781afde134274e66c6a1b2
- SHA512 87a0e7dbb33445844b2e9a6b76823b0f59e82e1b2a648b10e7d21e15a0f404c5dd5c3274bce730a4d40a17744414d5650437279c9e2a46852627e1e01bc50dfb
- TLSH T191D0970CABF84302E0B4C07E58D04473B934BE214840830402F0C3043030E02BD70703
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50
- Size 556B
- SHA256 7084841424e48fb15ab830ad2d85022ca8538409de08786a237d5e380a5e88f1
- MD5 f159894ff6a994f288cbf23b95f50bc3
- SHA1 1f89fe6c62063656b8664938c7122b8013cf4227
- SHA512 1328c4487d7cecce870ec600daa25bde92a42edbbf6a3aa906c94ac8cd55c9c6596a703bf6191e764d79c9977cdc5a4c675a8c0493ec15ddeb069fc223cc9ccc
- TLSH T1E0F0C9381CFED23AE372A93687E956AF5937F60334081552639402444C4AF028DA0313
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI4764.tmp
- Size 1.2MB
- SHA256 e9f952466bf5aee424fde7b563373b9a9b6d7479d3bfdd1859b96dc8239b97c6
- MD5 a233d9737b8c8c2db29ca391814b50f2
- SHA1 4ac8520217c1b69f1d01f865528c154336c7efc2
- SHA512 2880b25cbfa57c6495d5915bd110dc4d8509c1d41ce919b2bf4745244bf3ae1aae064c40f4701a7dc8115813b8cdf670299c7e6e622e4a7ed7b7b410ef0ada89
- SSDEEP 24576:5MVmRxyxXH0iIjnnhotRPOybcJOxnh0lhSMXlPn/4oSvPmpC+tCoz:5wmRxkXHzgQOybcJemf/4oSvPmpC+tCa
- TLSH T106456C21369EC027E75E16F06A3DC65E922EBD750BA246C7A3C8BD9A54305C31B39F13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI49FB.tmp
- Size 1.0MB
- SHA256 be037a00ed2cd85c5d8d86b04795de1ddeb9e7abd24130f000ab98c649cb6baf
- MD5 fe7064518e497d2505da86b88c6aca08
- SHA1 a3ce6eaecbb3b9ac57cdd6a40bfa7beae225c640
- SHA512 a1f777d503f07f5cedf3dcbcc4ece60f57a7cee112898d87d6b034b41645fcb16bc8a63da4f0e7c27473a4a43f5f82902df2b38912122906ed5f6e9d5cac6b1d
- SSDEEP 24576:kmJFy9k3u7GIL1hxxQW1hnAVFwNFah0lhSMXlRCSgXPYAIoEYil+:kmw1hxiWzAVFwv3YSgXPYAIoNil+
- TLSH T1ED357D20798AC035E52E11F12A7DDBABD57DBDB10BB290D763D0BD6A18704C2523AF27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI81b92.LOG
- Size 77KB
- SHA256 06e6fa378c7c6c98ed734f5293a05a4ff10bc69c73f7db4de85a02a97134e1fd
- MD5 b322b4d068da9e9f40eda770d997123a
- SHA1 fc6ac2d02b63d0ba48db6fdb652434dcb7924daf
- SHA512 4c7df8f6a9bd3a3b29438d63ea41305b72807b7178c40464b924038405018f5d621931b9ee26ddab6e48b12cf02518d9494feb65780ffed863939bb96691a8b9
- SSDEEP 1536:4wr3eivOqljGTS2ZtqI+lkKjmV2wkfD6zkYx9OY1oO2IxBhNU8Ph5+bRhChN/sgc:qV2T8ulk6fnk35Uw3MK3f03JEYt
- TLSH T15E7327212FF8010AF2B7AA438EF74925AB77BD556935D94D2081C21D04F2D08A9BC7BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIE310.tmp
- Size 895KB
- SHA256 f3738b23e5e3782abe915d0758949cafb018cfa1c34661fede4fb02ee206e499
- MD5 fe93ca9a7e313c01ea95af48d869f553
- SHA1 e4d6acf49d401a0735a8d17dbdcf177bab2ffd70
- SHA512 636b2ebbec40a6c4637da6acca2f7e20550f43b9066784cfcab35da991e4b2b257b0c8dd5889adee11febbda64c4d91e10125177e63dcd63a655234251c9b58d
- SSDEEP 24576:ldp9ULh2UMJyBx5h0lhSMXlmSzR4OyMonet:PpM2DJ0xg2SV4OyMonet
- TLSH T106157C70258FC036F76E01B02B7EDFFA911D2E710BA058EB93D46D6A66384C15B35A1B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC_MSIL\Microsoft.ReportViewer.ProcessingObjectModel\10.0.0.0__b03f5f7f11d50a3a\Microsoft.ReportViewer.ProcessingObjectModel.dll
- Size 89KB
- SHA256 fa25f35ad640e4bcb47d9b256ed6440a04d76c785b0ad3d334885b5b7b37501c
- MD5 7182075ac8b6aec868b867199fec109b
- SHA1 a9671c49e0c91d98d28462a4770ccea600a601d2
- SHA512 464a24fa023ea3d988d22b2c2eecc3d337493beb74f33b3a8bd09cd77282fa107b4cf39b0c3dc58b2961732741254ef032729629955e1e59d3d61e0f040d2074
- SSDEEP 1536:Xm+zBQpB7dJg+wqtelIlpQi+IcKDjrMr9YqwsgJ0u6F5R:2MB+BRSBqta8pmxUqtq0zF5R
- TLSH T11B93E925527B573FD6A90A7BA4F409A2BE3173723526862B354C370D0507BFBAC2163B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC_MSIL\Microsoft.ReportViewer.WinForms\10.0.0.0__b03f5f7f11d50a3a\Microsoft.ReportViewer.WinForms.dll
- Size 535KB
- SHA256 addbe3da6701db54561adc13224a75b7d7b0e1d5db566d056a758936c166528f
- MD5 e52c5ccd622f2a275088063bf9dc3895
- SHA1 ec7b363378356cf0646b946ed1e8adb3640058ea
- SHA512 2465ad95b05877f8be11614af3d47d78f2c4c08c7cc34ee84ffb51711180b31e0d2f1796fec50946e80756304689ac7cf54706d2b407a74ec84e643ae528a4ce
- SSDEEP 6144:njRzVOuWKe7MV5r4EZ0yZ94D6q/ocK+QB/UbIh+KGXH/BagTFGID0dBOWHQq752e:BVO7nqpJB9huhGjE865g
- TLSH T1EBC45A2077E9A71ED4BF0BB5A476404097B9B703A695EB5E8C50532D2CE7B86CE013B3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.6MB
- SHA256 c34678b3ee56fb28abfcd9340923f93d43289e69a4d868d406b486b0d95be1c1
- MD5 a4e20608ce99faa7b2201fb7853276b2
- SHA1 527e3ef374172688d5589f074b82c8fdaa491968
- SHA512 c4994ef24ef8db70a3f2bb011be607f8b055a8bd585d949ee308744a835fe8afa670e9222a8f96834a46bf47d8bcc5b9df562c9555a84c63fd70234e14151f80
- SSDEEP 24576:B2gmSp1HdoO/vvTL5GSOh0nq/6p5Q4242WhdXJkC7J6oEeGHI5TVrPI1h:P
- TLSH T1E847A42436F92100E7F79E3D78F06A27493A7D5B9C15DE8D45411B8E0921BB0E8B2F6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{731567b7-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{2a2cb27d-c0c8-4a89-9eeb-e69ebad1db45}_OnDiskSnapshotProp
- Size 6KB
- SHA256 ad87805fd7c4d12fe949165fb0a934dbc6402e638857419c323ec43feae0ed03
- MD5 a76000b688f3e7f6dca93d6333e37d17
- SHA1 bbb58fc409b45dc24a0b57f3b67d340dbcaff6e0
- SHA512 f0caf7f7c36d44b6ec2dbf88ad63be3bc53fce5c034475cf9bc34fa3fd97a469ca5a5d5df0b85e3472d7be5d3472f70afc6e914701432e645599d1b65b28b495
- SSDEEP 96:FDd7H/vc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:fZb++ZVm
- TLSH T1CDD188085AF54711E2B3AB7129F18557A477B911EF33CB8E0198638E2670A10F875F6F
- MD5 SHA1 SHA512 SSDEEP TLSH