6df36c8d6d21519ac003ebbf299f0a9cd02087e6baca2d957861b2b2f086ad8d

Analysis

max time kernel
148s
max time network
118s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 00:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SPGlobalRtdServerSetup64.msi
Size 8.5MB
Sample260711-amdhgabs2z
SHA256 6df36c8d6d21519ac003ebbf299f0a9cd02087e6baca2d957861b2b2f086ad8d
MD5 f29dd4529a6c590414c7817a286e64c4
SHA1 2e9aea157e96b29718667ccb149071cc247fc65f
SHA512 f8b1b1570fa1f54e2c56cca56e1ebcac967c481463e9b97cd5489301fe2b44314781bb19e781d2c1869073af51b3ad38ddfc92ab53fbe47611756dd4558bbfe4
SSDEEP 196608:46txSbUXvyX2u0VAlT0MOBQphlYmCegIuxhj6WbTfV6I:4rbUXPCTxFhlLCQu7ZLV6I
TLSH
T17E962300B565CE2FC693A234A9FDE77089192D023565431C7AF43D973BB0B90F6A6E39
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery persistence privilege_escalation ransomware spyware trojan

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 1 IoCs

pid	Process
2824	adxregistrator.exe

Loads dropped DLL 19 IoCs

pid	Process
2932	MsiExec.exe
2464	rundll32.exe
2464	rundll32.exe
2464	rundll32.exe
2464	rundll32.exe
2464	rundll32.exe
2824	adxregistrator.exe
2824	adxregistrator.exe
2824	adxregistrator.exe
2824	adxregistrator.exe
2824	adxregistrator.exe
2824	adxregistrator.exe
2824	adxregistrator.exe
2824	adxregistrator.exe
2824	adxregistrator.exe
2824	adxregistrator.exe
2824	adxregistrator.exe
2824	adxregistrator.exe
2800	regsvr32.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	adxregistrator.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe

Drops file in Program Files directory 49 IoCs

description	ioc	Process
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\SPGMISFToolkitComAddin.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\SPGMISFToolkitUninstaller.exe	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\Markit.ShellHandler.exe	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\Installer.ico	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\DxlApiClient.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\adxloader.dll.manifest	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\DxlClientCommon.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\Newtonsoft.Json.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\adxloader64.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\DundasWebChart.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\MSFRtdShim.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\Office.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\DxlClientCommon.dll.config	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\RegisterShim.vbs	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\Microsoft.Office.Interop.Excel.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\stdole.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\AddinExpress.XL.2005.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\SPGMISFToolkitAdminTool64.exe	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\Interop.VBIDE.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\UnregisterShim.vbs	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\Utilities.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\sp_global_installer_banner.jpg	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\SPGlobal.com.url	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\ICSharpCode.SharpZipLib.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\edtFTPnetPRO.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\FTPCom.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\Images\markit_logo.ico	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\Images\sp_global_logo.ico	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\field_config.bin	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\SPGMISFToolkitRtdServer.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\IHSMarkitAddin.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\DxlApiCommon.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\sp_global_logo.ico	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\NSpring.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\log4net.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\addin_config.xml	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\adxregistrator.exe	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\SPGMISFToolkitUninstaller.exe.config	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\SPGMISFToolkitAdminTool64.exe.config	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\rtdlocal_config.xml	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\Images\RefEdit.bmp	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\Images\InternalField.bmp	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\SpreadsheetGear.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\adxloader.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\extensibility.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\Interop.Excel.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\Interop.Office.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\AddinExpress.MSO.2005.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\IHSMarkitToolkitDiagnosticTools.dll	msiexec.exe

Drops file in Windows directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIF8AE.tmp-\MSFToolkitCustomAction.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI179.tmp	msiexec.exe
File created	C:\Windows\assembly\GACLock.dat	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\2B6AB29170146ED468E2BF0A869012C1\10.0.1\concrt140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\2B6AB29170146ED468E2BF0A869012C1\10.0.1\msvcp140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\{192BA6B2-4107-4DE6-862E-FBA06809211C}\_MSF_ICN_100	msiexec.exe
File created	C:\Windows\Installer\{192BA6B2-4107-4DE6-862E-FBA06809211C}\_MSF_ICN_300	msiexec.exe
File created	C:\Windows\SystemTemp\~DF94EA77ADE5A6BEBC.TMP	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\2B6AB29170146ED468E2BF0A869012C1\10.0.1\msvcp140_2.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\2B6AB29170146ED468E2BF0A869012C1\10.0.1\vccorlib140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\{192BA6B2-4107-4DE6-862E-FBA06809211C}\_MSF_ICN_300	msiexec.exe
File opened for modification	C:\Windows\assembly\tmp\4Q9DHZ0N\__AssemblyInfo__.ini	msiexec.exe
File created	C:\Windows\Installer\e59f553.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\2B6AB29170146ED468E2BF0A869012C1\10.0.1\msvcp140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\2B6AB29170146ED468E2BF0A869012C1\10.0.1\vcruntime140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\{192BA6B2-4107-4DE6-862E-FBA06809211C}\_MSF_ICN_200	msiexec.exe
File opened for modification	C:\Windows\Installer\{192BA6B2-4107-4DE6-862E-FBA06809211C}\_MSF_ICN_200	msiexec.exe
File created	C:\Windows\Installer\{192BA6B2-4107-4DE6-862E-FBA06809211C}\_MSF_ICN_400	msiexec.exe
File created	C:\Windows\Installer\e59f555.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{192BA6B2-4107-4DE6-862E-FBA06809211C}	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2B6AB29170146ED468E2BF0A869012C1\10.0.1\msvcp140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\SystemTemp\~DFCAE7B63BB00A6F03.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2B6AB29170146ED468E2BF0A869012C1\10.0.1\vccorlib140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\SystemTemp\~DF84EF0099DECBD69A.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF8AE.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2B6AB29170146ED468E2BF0A869012C1\10.0.1\concrt140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2B6AB29170146ED468E2BF0A869012C1\10.0.1\msvcp140_2.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\{192BA6B2-4107-4DE6-862E-FBA06809211C}\_MSF_ICN_100	msiexec.exe
File opened for modification	C:\Windows\Installer\{192BA6B2-4107-4DE6-862E-FBA06809211C}\_MSF_ICN_400	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF8AE.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF4E34CED32B15B2F.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2B6AB29170146ED468E2BF0A869012C1	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2B6AB29170146ED468E2BF0A869012C1\10.0.1\msvcp140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\e59f553.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF8AE.tmp-\CustomAction.config	rundll32.exe
File created	C:\Windows\assembly\tmp\4Q9DHZ0N\Office.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2B6AB29170146ED468E2BF0A869012C1\10.0.1	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2B6AB29170146ED468E2BF0A869012C1\10.0.1\vcruntime140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
1676	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adxregistrator.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ffbf1fc65d8bbf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ffbf1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ffbf1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ffbf1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ffbf1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\excel.exe = "11001"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\SPGMISFToolkitAdminTool64.exe = "11001"	msiexec.exe

Modifies data under HKEY_USERS 13 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\JITDebug = "0"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\Telemetry	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\Telemetry\msiexec.exe\VBScriptSetScriptStateStarted = "240784640"	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script\Settings\Telemetry\msiexec.exe	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\Telemetry\msiexec.exe	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script	MsiExec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{52EED5F8-68AC-3215-B012-85BDC5244249}\InprocServer32\Assembly = "SPGMISFToolkitComAddin, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{91F8320E-3B7C-3073-A812-3A72FAD10B71}\InprocServer32\1.0.0.0\Assembly = "SPGMISFToolkitComAddin, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{52EED5F8-68AC-3215-B012-85BDC5244249}\InprocServer32\1.0.0.0	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Sfs.DxlComAddin.DataModel.RssReaderErrorEventArgs	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69D6E382-F743-39C6-B771-0A52D5D8E20E}\InprocServer32\Class = "Sfs.DxlComAddin.DataModel.RssHtmlMaker"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BF906BA0-90C2-3D59-A106-B06AD3BFF17F}\InprocServer32\1.0.0.0\Class = "Sfs.DxlComAddin.DataModel.RssReader"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F52BFC0-0F0D-3679-A838-DE58D48CA11C}\InprocServer32\1.0.0.0\RuntimeVersion = "v4.0.30319"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{69D75AAB-1684-3ACC-A7D7-36F163C07947}\ = "Sfs.DxlComAddin.Controls.ReferenceButton"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4C5EA226-D268-3F1A-A90C-87731DA02CB8}\ProgId	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F650B0D2-9DC0-391E-9332-D78696F11C64}\InprocServer32\1.0.0.0\CodeBase = "file:///C:/Program Files/S&P Global/SPGMI Securities Finance Toolkit/SPGMISFToolkitComAddin.DLL"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E499A8C7-A35B-30F4-8E1F-647188755DE6}\InprocServer32\1.0.0.0\Class = "Sfs.DxlComAddin.Controls.ButtonEx"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B6AB29170146ED468E2BF0A869012C1\ProductName = "SPGMI Securities Finance Toolkit"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A3B03BD6-37B1-35F4-A07E-867B8C620052}\InprocServer32\ThreadingModel = "Both"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8E05F6F9-C82F-3447-ACD7-DA84FE20D903}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F204194F-97E3-308A-956B-C92325AC191C}	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Sfs.DxlComAddin.Controls.ComboIdentifierControl\CLSID	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Sfs.DxlComAddin.Controls.TreeViewEx\ = "Sfs.DxlComAddin.Controls.TreeViewEx"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F204194F-97E3-308A-956B-C92325AC191C}\InprocServer32\1.0.0.0\Assembly = "SPGMISFToolkitComAddin, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E499A8C7-A35B-30F4-8E1F-647188755DE6}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{851F3C58-7FF7-3455-B510-6DEEA597521A}	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{69D75AAB-1684-3ACC-A7D7-36F163C07947}\InprocServer32\1.0.0.0	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F54575D2-7F24-3B83-A069-95AC3EA743FD}\ProgId\ = "Sfs.DxlComAddin.Controls.TextIdentifierControl"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4BD78693-C09E-3448-ADDF-5D5B589B2317}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D5A12B5-E366-30DE-8F3F-5DAAF2936599}\InprocServer32	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C7BC93F9-6FDC-435E-BB96-D67E4556FE2F}\InprocServer32\1.0.0.0\CodeBase = "file:///C:/Program Files/S&P Global/SPGMI Securities Finance Toolkit/SPGMISFToolkitComAddin.DLL"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4D2734FC-4164-3D58-8712-C4E6631DD5D0}\InprocServer32	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E499A8C7-A35B-30F4-8E1F-647188755DE6}\Implemented Categories	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F650B0D2-9DC0-391E-9332-D78696F11C64}\InprocServer32\Class = "Sfs.DxlComAddin.AddinConfig"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5D861C57-D326-441E-9D97-4DCE88B6A175}\ = "RealTimeDataProxy Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E499A8C7-A35B-30F4-8E1F-647188755DE6}\InprocServer32\Class = "Sfs.DxlComAddin.Controls.ButtonEx"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Sfs.DxlComAddin.Controls.TreeViewEx\CLSID\ = "{851F3C58-7FF7-3455-B510-6DEEA597521A}"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F204194F-97E3-308A-956B-C92325AC191C}\InprocServer32\1.0.0.0	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E9B1AF83-EC6B-3FB7-8A80-4F5332BF4DF1}	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Sfs.DxlComAddin.Controls.CollapsiblePanel	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E7B479D-0B42-3843-BFB3-B20C36FB2FB8}\InprocServer32\1.0.0.0\CodeBase = "file:///C:/Program Files/S&P Global/SPGMI Securities Finance Toolkit/SPGMISFToolkitComAddin.DLL"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C7BC93F9-6FDC-435E-BB96-D67E4556FE2F}\InprocServer32\CodeBase = "file:///C:/Program Files/S&P Global/SPGMI Securities Finance Toolkit/SPGMISFToolkitComAddin.DLL"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE196C0B-3B7E-3746-9F7D-2983457E0E8C}\InprocServer32	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4D2734FC-4164-3D58-8712-C4E6631DD5D0}\InprocServer32\Class = "Sfs.DxlComAddin.Forms.OptionsForm"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F2180381-9EB5-3488-B6C7-85227C48C4A7}\Implemented Categories	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F54575D2-7F24-3B83-A069-95AC3EA743FD}\InprocServer32\RuntimeVersion = "v4.0.30319"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E9B1AF83-EC6B-3FB7-8A80-4F5332BF4DF1}\InprocServer32\ThreadingModel = "Both"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F650B0D2-9DC0-391E-9332-D78696F11C64}\ = "Sfs.DxlComAddin.AddinConfig"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9D5A12B5-E366-30DE-8F3F-5DAAF2936599}\InprocServer32\1.0.0.0	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{69D6E382-F743-39C6-B771-0A52D5D8E20E}\InprocServer32\1.0.0.0	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Sfs.DxlComAddin.Controls.ActionPane\CLSID\ = "{52EED5F8-68AC-3215-B012-85BDC5244249}"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E7B479D-0B42-3843-BFB3-B20C36FB2FB8}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4BD78693-C09E-3448-ADDF-5D5B589B2317}\InprocServer32\1.0.0.0\RuntimeVersion = "v4.0.30319"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D5A12B5-E366-30DE-8F3F-5DAAF2936599}\InprocServer32\ = "mscoree.dll"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C7BC93F9-6FDC-435E-BB96-D67E4556FE2F}\InprocServer32\RuntimeVersion = "v4.0.30319"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{69D6E382-F743-39C6-B771-0A52D5D8E20E}\InprocServer32	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Sfs.DxlComAddin.Controls.ReferenceButton	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Sfs.DxlComAddin.Controls.NumericUpDownControl\CLSID	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4C5EA226-D268-3F1A-A90C-87731DA02CB8}\ = "Sfs.DxlComAddin.Controls.NumericUpDownControl"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D5A12B5-E366-30DE-8F3F-5DAAF2936599}\InprocServer32\1.0.0.0\RuntimeVersion = "v4.0.30319"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1684886F-7C77-3C72-A396-5674D9E36E83}\ = "Sfs.DxlComAddin.DataModel.RssReaderErrorEventArgs"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{520D0E22-1424-3A5B-B718-10BF93DBBDAE}\InprocServer32	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69D75AAB-1684-3ACC-A7D7-36F163C07947}\InprocServer32\1.0.0.0\CodeBase = "file:///C:/Program Files/S&P Global/SPGMI Securities Finance Toolkit/SPGMISFToolkitComAddin.DLL"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F54575D2-7F24-3B83-A069-95AC3EA743FD}\ProgId	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Sfs.DxlComAddin.DataModel.TreeViewState\CLSID\ = "{520D0E22-1424-3A5B-B718-10BF93DBBDAE}"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A3B03BD6-37B1-35F4-A07E-867B8C620052}\InprocServer32\1.0.0.0\CodeBase = "file:///C:/Program Files/S&P Global/SPGMI Securities Finance Toolkit/SPGMISFToolkitComAddin.DLL"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{851F3C58-7FF7-3455-B510-6DEEA597521A}\InprocServer32\Assembly = "SPGMISFToolkitComAddin, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4F52BFC0-0F0D-3679-A838-DE58D48CA11C}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	adxregistrator.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{DCBAE3A2-9F72-40DA-957F-DB7AAF9B8F78}	msiexec.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2464	rundll32.exe
2464	rundll32.exe
3576	msiexec.exe
3576	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1676	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1676	msiexec.exe
Token: SeSecurityPrivilege	3576	msiexec.exe
Token: SeCreateTokenPrivilege	1676	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1676	msiexec.exe
Token: SeLockMemoryPrivilege	1676	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1676	msiexec.exe
Token: SeMachineAccountPrivilege	1676	msiexec.exe
Token: SeTcbPrivilege	1676	msiexec.exe
Token: SeSecurityPrivilege	1676	msiexec.exe
Token: SeTakeOwnershipPrivilege	1676	msiexec.exe
Token: SeLoadDriverPrivilege	1676	msiexec.exe
Token: SeSystemProfilePrivilege	1676	msiexec.exe
Token: SeSystemtimePrivilege	1676	msiexec.exe
Token: SeProfSingleProcessPrivilege	1676	msiexec.exe
Token: SeIncBasePriorityPrivilege	1676	msiexec.exe
Token: SeCreatePagefilePrivilege	1676	msiexec.exe
Token: SeCreatePermanentPrivilege	1676	msiexec.exe
Token: SeBackupPrivilege	1676	msiexec.exe
Token: SeRestorePrivilege	1676	msiexec.exe
Token: SeShutdownPrivilege	1676	msiexec.exe
Token: SeDebugPrivilege	1676	msiexec.exe
Token: SeAuditPrivilege	1676	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1676	msiexec.exe
Token: SeChangeNotifyPrivilege	1676	msiexec.exe
Token: SeRemoteShutdownPrivilege	1676	msiexec.exe
Token: SeUndockPrivilege	1676	msiexec.exe
Token: SeSyncAgentPrivilege	1676	msiexec.exe
Token: SeEnableDelegationPrivilege	1676	msiexec.exe
Token: SeManageVolumePrivilege	1676	msiexec.exe
Token: SeImpersonatePrivilege	1676	msiexec.exe
Token: SeCreateGlobalPrivilege	1676	msiexec.exe
Token: SeBackupPrivilege	2180	vssvc.exe
Token: SeRestorePrivilege	2180	vssvc.exe
Token: SeAuditPrivilege	2180	vssvc.exe
Token: SeBackupPrivilege	3576	msiexec.exe
Token: SeRestorePrivilege	3576	msiexec.exe
Token: SeRestorePrivilege	3576	msiexec.exe
Token: SeTakeOwnershipPrivilege	3576	msiexec.exe
Token: SeRestorePrivilege	3576	msiexec.exe
Token: SeTakeOwnershipPrivilege	3576	msiexec.exe
Token: SeDebugPrivilege	2464	rundll32.exe
Token: SeRestorePrivilege	3576	msiexec.exe
Token: SeTakeOwnershipPrivilege	3576	msiexec.exe
Token: SeRestorePrivilege	3576	msiexec.exe
Token: SeTakeOwnershipPrivilege	3576	msiexec.exe
Token: SeRestorePrivilege	3576	msiexec.exe
Token: SeTakeOwnershipPrivilege	3576	msiexec.exe
Token: SeDebugPrivilege	2824	adxregistrator.exe
Token: SeRestorePrivilege	3576	msiexec.exe
Token: SeTakeOwnershipPrivilege	3576	msiexec.exe
Token: SeRestorePrivilege	3576	msiexec.exe
Token: SeTakeOwnershipPrivilege	3576	msiexec.exe
Token: SeRestorePrivilege	3576	msiexec.exe
Token: SeTakeOwnershipPrivilege	3576	msiexec.exe
Token: SeRestorePrivilege	3576	msiexec.exe
Token: SeTakeOwnershipPrivilege	3576	msiexec.exe
Token: SeRestorePrivilege	3576	msiexec.exe
Token: SeTakeOwnershipPrivilege	3576	msiexec.exe
Token: SeRestorePrivilege	3576	msiexec.exe
Token: SeTakeOwnershipPrivilege	3576	msiexec.exe
Token: SeRestorePrivilege	3576	msiexec.exe
Token: SeTakeOwnershipPrivilege	3576	msiexec.exe
Token: SeRestorePrivilege	3576	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1676	msiexec.exe
1676	msiexec.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1676	msiexec.exe
3576	msiexec.exe
2932	MsiExec.exe
5404	MsiExec.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3576 wrote to memory of 5024	3576	msiexec.exe	94
PID 3576 wrote to memory of 2932	3576	msiexec.exe	96
PID 2932 wrote to memory of 2464	2932	MsiExec.exe	97
PID 3576 wrote to memory of 2824	3576	msiexec.exe	98
PID 3576 wrote to memory of 5404	3576	msiexec.exe	99
PID 5404 wrote to memory of 2800	5404	MsiExec.exe	100

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\SPGlobalRtdServerSetup64.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1676

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3576
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:5024
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3E8D9A9B3259AB57BCEBDC53DC25EFD5
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2932
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIF8AE.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240777968 2 MSFToolkitCustomAction!MSFToolkitCustomAction.CustomActions.CloseAppPrompt
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2464
- C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\adxregistrator.exe
  "C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\adxregistrator.exe" /install=SPGMISFToolkitComAddin.dll /privileges=admin
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:2824
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 0E71A016A642E527A8B37A19FEB0A549 E Global\MSI0000
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5404
- - C:\Windows\System32\regsvr32.exe
    regsvr32 /s "C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\MSFRTDShim.dll"
    3⤵
    - Loads dropped DLL
    - Modifies registry class
    PID:2800

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59f554.rbs

Path C:\Config.Msi\e59f554.rbs
Size 27KB
SHA256 984e5e5c5bdd76ccfe7ff890144ffd416f888923467e312e20ef2bbf0699698a
MD5 a30b62c6249ffedce42c22c97a78c3a1
SHA1 30a6d48bb97e5ea7865989a21c5eb9f48316a34e
SHA512 8a84106d318a5c224c4205318f889e3cf433f49d7e5bf322ac315872f3ca1b02103cb1aaff91477fae293ebb03bcda553861f16ee714eac6488cb16bf1da6cc9
SSDEEP 768:2zKEB0KQ0k49QRPtQclwsrXlZ/MRSzYqZtH8foIGXdNdciaWMGsn+cUv8HYC2x2Z:HEB0KQ0k49QRPtQclwsrXb/MRSzYqZtw
TLSH
T13AD21240994981D6F84A06B98E5717072F15D298DB0C133F0BBB9635CF9BBC54BE87CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AddinExpress.MSO.2005.dll

Path C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\AddinExpress.MSO.2005.dll
Size 4.1MB
SHA256 2488b3a307a297d6f7b349f625eebf8f44a6c2dedcbe3d316ecc87a4d434f35b
MD5 83ca15331b56ec1ea0817c82dc78e6c7
SHA1 1d20a2d47194235ce03c1fcaebbf6836bb35be9c
SHA512 c0ebb6b304ed2e7f3e4c8c500a5c6a178f4d1c1a12ab0074a3ab269fc499c2f81b8b063ae40070fad429652136a737254f9ceb7aeb4ff22bf737510c681c0be1
SSDEEP 24576:9Jqi5VZVORDmP1KZslAUg3YMzPgq/X3zRlNGUvggoDF/nwUbN:dORDmP4jDoqbpRogolbN
TLSH
T10A1650239BEC7CEAC43957B5773783DAC3ADEC4A5111D24E65C4212A24BE613BA037C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AddinExpress.XL.2005.dll

Path C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\AddinExpress.XL.2005.dll
Size 665KB
SHA256 a2a349ddbed4a413cc6e5b83c736febae5db58bbd4c40bef3628605207a59f80
MD5 7153f189b36ba3e26195b7aaf5fb2dbe
SHA1 beec232734a30f3ce5be8da11f5e6d51f6f827f6
SHA512 b9a469c46fa79c938dbdf72150ecc7548f7dd2c82fb13245a4820b242f21e9fe72a9f49e6f274668a929c9262b86286279b31835a458789c6544778f28103d9b
SSDEEP 12288:Bd0+xw8CWALBBuYeNJOtFF4ovgH2sUbY63XqIljQ/:w5BMJOtFF4ovgH2I63acjQ/
TLSH
T19CE4391217E87DA7D07E57BD63B65382C778ED06A202E31F46D460AA1CBA352BE007D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DxlApiCommon.dll

Path C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\DxlApiCommon.dll
Size 79KB
SHA256 a21af8a38cba0045b039e4bbae927229161b7dd6e8219dd10abc9d8681d37cae
MD5 659756912fafcbe8b9fc2fa3c3afea57
SHA1 b2d2f15f4c61cc0144e17f3f1e6ecb055fce714a
SHA512 1d6c890cf384e1b47a51e2a69cd22a2e4ed6924d87a18335244041b30f6323923e881b906407da285acbce739d90f6394c28a4526466c75ced0f014f29672173
SSDEEP 1536:XnjjKHrxP5q8Bma/iG+wTMl5EXPqF9T8VlIO74e:+88BLiwTM3IPM9Ta
TLSH
T1AD833A6473ECC66DCACE96B9F550866A43B8C3143963F76C4E98F4CE28437468712277
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DxlClientCommon.dll

Path C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\DxlClientCommon.dll
Size 506KB
SHA256 0152f7ab07acfa451615de423f88c6b8fab6b4d339ca13065dc7765d7ddac67b
MD5 fd91fe911a69ec8dedf3c94812b3afa7
SHA1 2e0d5873fc04383db3c76e972651eb87fe640709
SHA512 39410300cabb94d050432b7f296ab2f1ed5b62f6033eac43fa7ebe849cf0d2177737ea0b33a9de9170d386dcb1720b21eb83f02b80c62da22c4ffd6d8c3071fa
SSDEEP 12288:U0lr7MNfAZQq9gqMEUlpDyH4K54ybc7x7:U+YNfA+q9N3wpDyF54yY1
TLSH
T1D4B4CF1837F94A49EAFB8B38AA70A0404BB7BE47A531FB5D055071CD18B2F618D51B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSFRTDShim.dll

Path C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\MSFRTDShim.dll
Size 71KB
SHA256 82bc104d863dd07d7bcc54751a2d22bd9dd8de6c811b0f40ba0b89390a8f31fd
MD5 7c608ce33b09698342dbff8303c5b392
SHA1 cd8c5d371b5e75ac469c7bc276904cdbf6bddc04
SHA512 72b5067683cb0986b22570f5fb3befb3f3f82bd2a5a9c3282e12018f7c80abb3745c1738ba8a42ba0659b7d51c96422bc87b67d04c9560c6059408e440e2e8d2
SSDEEP 1536:X1uOaaIh456Lf/DpOcTi6BB4XvDRayKT56jEjnBs:XskyS6LVRTi6ivNayKT56jEjn
TLSH
T1CD632957779950E8E176C27889A34B42E7F7B4000F2297CF12A1836E2F36BE49D39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SPGMISFToolkitComAddin.dll

Path C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\SPGMISFToolkitComAddin.dll
Size 3.6MB
SHA256 b5adfef200ed80a5cf9c7a29c1adf135c37c539862d586c58bb47e84e290bd5e
MD5 2f0c54fd805dffc4a36c7d1ba13e4ed5
SHA1 a3a83f484730f9596fc8624dc8573856e509d10b
SHA512 e121ad0e9abd28bd7b74476a414fa9bf2721b1491ab5dc4ddc86e450ea8f008ea8ecf38026111dd1d254260e4182b8c004e6d3dadb4210d53674c09c3a545c88
SSDEEP 6144:fERXdGSnVRv7mFJMx6uCCtLj5PQO3arUH0SxCTllyRMzavk2LDxsyXA/EEhuTtWl:fWJcuond3znXR5
TLSH
T1660604007160CB1EC266227894EDEAB48A595E077498831D3DF47D9B37B0B42F58BE7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Utilities.dll

Path C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\Utilities.dll
Size 400KB
SHA256 49825f5112592aa040383b36ede469cb9a8f0b99546c9e4da3d14107c64fa0f1
MD5 fe52a7e42a785174dd4165f27b9d18e4
SHA1 615cbc7260b53818aa46e92ffe79eae3bb6466e8
SHA512 ca49e37bf3954d40dbe54f4d0c1aef85aea8b294ac20fc0b3f56d68bae823e3b747cd856211c9ef19e37c78aab9d4f4ec954cc8b58acddd3ae74d5f47cdb4d55
SSDEEP 12288:w5+3wH1PEdgLOck29POd9d1YK3WDtKUtC:mHp5k29P1K3WDtKmC
TLSH
T1C7942A0173F8831FE2EE1B39F430556947B4E506BABED76E4A88A5AD2C537819C017B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adxloader.dll.manifest

Path C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\adxloader.dll.manifest
Size 334B
SHA256 aab5136411289b4d66460d8b12822a940fe2d8a30db5958333611fd199dacbb1
MD5 abb01bf446f1e221b2c8d7dbb0605b30
SHA1 6d5b85ad038530fa7363c524bb5a1c6c6d45247c
SHA512 eef9801b4a8d140baa858a408a29ddbf17dc03940982685bdeaf48bf4da42dd75fb2d9c99cd8926faa435d18deca60060da53e90bea7db53845156a042e11567
TLSH
T109E0200645599F239612D5DBF8F2800956F827AAD4045405B56DB1365606C690BE3263
MD5 SHA1 SHA512 TLSH

Submit Download

adxregistrator.exe

Path C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\adxregistrator.exe
Size 167KB
SHA256 80e99c9bd8ebf68900d62e076e683b09098c9be4ecbca90e1eb43251046f202f
MD5 1d6be4e749fef9bf18a0082ee05e5344
SHA1 5b89cc6788c741627b1bb1a8326301169ae65ac9
SHA512 685ac60f731e32d64c9b38f57a1ae9c200a38d826651f698874afceef35b2476c17c1230d6777109439df1c2125854b317520980f117b653feb797b89303dc8e
SSDEEP 3072:qJDLZbxrdIYMldkxLn+9bRUjTxfJs2DDg2:qJv5fIYMlmxLnAUjvs2D7
TLSH
T17DF37C607BD6C472E1A2193265F587626A28BB325B33D0CB775C4AA85F307D1BA3D313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rtdlocal_config.xml

Path C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\rtdlocal_config.xml
Size 912B
SHA256 fb63c862bab8ab22be01309c6404288e7d38661137c461541799b92e7c067981
MD5 349645d9cc73a7e7daec1a41fedfc46c
SHA1 798c9a55aefd9dd588bb4203b0f30d5ca2ebeb54
SHA512 1514de8a604372c326e3a20036d030f89fcd22cc46516abca3e6027493f83ac6efe3c50c01b31087893b63c61a77580cef517100bae9a7779e3293d51d55ed15
TLSH
T13411DC256A5332338824C3F2C23760CA1B712FAA163C047C6E8DB22F26D059C3851E77
MD5 SHA1 SHA512 TLSH

Submit Download

MSIF8AE.tmp

Path C:\Windows\Installer\MSIF8AE.tmp
Size 248KB
SHA256 365b97da5bb15b785f3932db392b01fc551872147497fd31d11ee6aa8d8eef3f
MD5 203dc2f058f4b9d4f4e47668ad6fc412
SHA1 8927e78968410714edd3c71335ff23fc6283289f
SHA512 446f731072990153c04868342f95d25c260692e317c115479ba1ad2ea8540aa3403c3804927497d5e23f30a0bf205aa7a9e179c0f370f833f2673177dfd1258b
SSDEEP 3072:5Arbg5BxgracGnEnRQOl9WGPotlx9uYGi+GtvkW2dWdhYElg5P16vqDyS:5ArbtraBqLlAGCHtvkW2DElMP1AqDf
TLSH
T17644BE01B6D48471F1BF2E380D34A66549BEBE604F71CA9F6748862E4EB46C0DA35B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSFToolkitCustomAction.dll

Path C:\Windows\Installer\MSIF8AE.tmp-\MSFToolkitCustomAction.dll
Size 283KB
SHA256 eb2f5d7ea77c39131179cdfada4dbe7a2407cbfc89562eae1e190b9a72543a55
MD5 b278d0d3559b0ff0380f007c41e6dffc
SHA1 891193511d6382a669c414ad9338fa3ebb04c7b6
SHA512 d0697d6426d0340e96a9c1ea67c81985296e083d6ba3e5a8207c1d73f07bbfcf591d64fba0ff640ab95c262e9691bb2b7fd0086044880590774d9e9f0916d06e
SSDEEP 192:ypLrzRqw8/z7B47xPIeBqFPuvkvwKwq6k9grbbbbbbbbbbbbo/1jl:wYw8r7K7xAk0GkvwKwq6uNtjl
TLSH
T1A3549604B120CA1FC763223895EDEA7198595E1674A4832D39F83D8377B1B82F59AF3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Windows\Installer\MSIF8AE.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 179KB
SHA256 cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca
MD5 1a5caea6734fdd07caa514c3f3fb75da
SHA1 f070ac0d91bd337d7952abd1ddf19a737b94510c
SHA512 a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1
SSDEEP 3072:BGfZS7hUuK3PcbFeRRLxyR69UgoCaf8+aCnfKlRUjW01KymkO:9zMRLkR6joxfRPW
TLSH
T159046B2953FC473ACAFF4778E261425197B1F2E67117DB0EEC8181AA2522780F792397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f555.msi

Path C:\Windows\Installer\e59f555.msi
Size 8.5MB
SHA256 6df36c8d6d21519ac003ebbf299f0a9cd02087e6baca2d957861b2b2f086ad8d
MD5 f29dd4529a6c590414c7817a286e64c4
SHA1 2e9aea157e96b29718667ccb149071cc247fc65f
SHA512 f8b1b1570fa1f54e2c56cca56e1ebcac967c481463e9b97cd5489301fe2b44314781bb19e781d2c1869073af51b3ad38ddfc92ab53fbe47611756dd4558bbfe4
SSDEEP 196608:46txSbUXvyX2u0VAlT0MOBQphlYmCegIuxhj6WbTfV6I:4rbUXPCTxFhlLCQu7ZLV6I
TLSH
T17E962300B565CE2FC693A234A9FDE77089192D023565431C7AF43D973BB0B90F6A6E39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_MSF_ICN_200

Path C:\Windows\Installer\{192BA6B2-4107-4DE6-862E-FBA06809211C}\_MSF_ICN_200
Size 273KB
SHA256 d9f90faaa32abb8dbb3d4ed113ad25edad67a84de39dbeaa84b83e268f22bd7e
MD5 222e93becec18f646e306e6ad60c7a07
SHA1 97816b343566048bf36b20c6af3f37a9f377f169
SHA512 0115c1eeb7fc41e03ca014945825dd8877f0f79aba1eebfbe77734391e868a7f836637166717fb202b89bd44f006eac9b1e160616f83cee6ef90e44f1c91dba1
SSDEEP 48:mZrWUWUWUWUWUWUWUWUWUWUWUWUSPrAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAb:2rbbbbbbbbbbbb
TLSH
T1A6548744B121CB1FC763213895EDEA7198495E1674A8832D39F87D8337B4B82F58AE3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Office.dll

Path C:\Windows\assembly\tmp\4Q9DHZ0N\Office.dll
Size 413KB
SHA256 c4519e50471fd5b0d495a1eb010ccf9b34a7af97df4e0d409a9f5147aee9f912
MD5 df7cbcd2db89880a8a92ea134611b038
SHA1 9940cedfb3526e12744c6f358ff90fcbf2cd5bba
SHA512 3bbb3b3ee3189e8699acf4ca01f14535725ed844133c9b5a8494e017c1c283c9c9b4626906ff617bfff014e474e02320183cb61ebdbe95ae792a6f22fcc0d072
SSDEEP 12288:e3LuxZNel6lWlCkZOaU2foNM98c3n/YvmcyjlSonPo:e3LuxZNel6lWljsSjn/Yvv
TLSH
T18F94C446BA1E9013EAC5C73E1577BB5453B9F2410FD2EF4A651D822CAF83688DE036B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 292a652d756816cec6861f08b3513777c07027351fa2e0b11044293e50ec64f5
MD5 b2ff4c9ae8b90a404ea80b776170fef6
SHA1 0975cb7d72f1fcb41f031bba80825a09839996bf
SHA512 5033098b5c68db9c17a12da44231674466b8269ecc645872bcf69c30090aa877b19909c2e044031f57f15f9ba031788ea37fe859a7ec3bd359f82f1d4647fe81
SSDEEP 24576:eFo3DMPcdoO/vvTL/yAsMilQPrOWX7rf0R6e9BCE65iqpLNMMoR2s12NoeG:vH4
TLSH
T1A957B51436F92100E7F79E3CA8F06A234D397D5BAC19DE8D45511B8E0922F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{c99349b0-57ef-4108-abd7-11ee60c3d333}_OnDiskSnapshotProp

Path \??\Volume{c61fbfff-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{c99349b0-57ef-4108-abd7-11ee60c3d333}_OnDiskSnapshotProp
Size 6KB
SHA256 9da48e812203707458c476075d625ef85c364207a19a26bfd84db1f903e1ac1e
MD5 eb7514c4543f4910e9e3debe8761daa3
SHA1 d0ea5b56adf7b4e2985c3fd95592738686b19d4a
SHA512 5eff01644c94fd1151b3934c11ee445401346113d1dcf7e3383abc110e1f3b22cdad1b0670500918e3c9b4419aad7f69b07cd3bc09f7b1988cdb44a81648dfa5
SSDEEP 96:Fn/n9ueW5mKlDvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:l/n9uhvl/b++uVmN
TLSH
T138D189085AF54711E2F3AB3229F14557A837B911EF33CB8E0298238E6671910F935F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SPGMISFToolkitAdminTool64.exe.config

Path \??\c:\program files\s&p global\spgmi securities finance toolkit\SPGMISFToolkitAdminTool64.exe.config
Size 283B
SHA256 888e7829792bb583192468acc472f16ac972e47f6305e81750880146818a12f5
MD5 b940a7ae8967f2016c6fa2a1835f36ad
SHA1 14513ca0bfa631f4f31af5cf1b3e81967a73cf07
SHA512 bf477d15f1f8f8b3e556f36f0285e498c07f659d877007f48e808baa22c4e1c0fc49a78093d69216493568e77dce4946b67c518c7c9cb26456086645156f2e44
TLSH
T1FBD02B063298FE3748E74F63E0324550A7B15E29A264701DF0FE7B73460104B3643335
MD5 SHA1 SHA512 TLSH

Submit Download

SPGMISFToolkitUninstaller.exe.config

Path \??\c:\program files\s&p global\spgmi securities finance toolkit\SPGMISFToolkitUninstaller.exe.config
Size 146B
SHA256 fe29ce4150e251a4fc4ca5db321cd0bdc6dbacd34846735ced5113df056ec3b6
MD5 99ca66a5df246c217028be8caf20c154
SHA1 ff0768ce405c2d8c3b9a100c850de4add6fa9e64
SHA512 15abd3756f4bf31ea63c79d1378517f19c2b16a2fe60ca2b6a7a77c15a79e6b0baf3b0beb40b2ca835d0eb56655ef0d9fac0d82b3316a9f21296e313e9d0a721
TLSH
T19BC09B5945787D3BDC234F6355504952FBF54361F464512CE46FA756061015E8306356
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2464-24-0x0000000005570000-0x0000000005602000-memory.dmp

Download

memory/2464-22-0x0000000005460000-0x00000000054AE000-memory.dmp

Download

memory/2464-23-0x0000000005A70000-0x000000000602A000-memory.dmp

Download

memory/2464-18-0x00000000053E0000-0x000000000540E000-memory.dmp

Download

memory/2824-128-0x0000000006510000-0x00000000065B8000-memory.dmp

Download

memory/2824-132-0x0000000006380000-0x000000000639A000-memory.dmp

Download

memory/2824-136-0x0000000007950000-0x00000000079B8000-memory.dmp

Download

memory/2824-124-0x00000000063D0000-0x0000000006454000-memory.dmp

Download

memory/2824-120-0x00000000075B0000-0x000000000794A000-memory.dmp

Download

memory/2824-117-0x0000000005B50000-0x0000000005B5A000-memory.dmp

Download

memory/2824-116-0x0000000005C00000-0x0000000006024000-memory.dmp

Download

memory/3576-35-0x00000285CB910000-0x00000285CB97A000-memory.dmp

Download