860171ce66a498c405451a06c3d79c791fe86208df0dd1d472b077b6321a4668

Windows Service

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static\System	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static	reg.exe

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Mcx2Svc\Parameters\ServiceDll = "%SystemRoot%\\system32\\Mcx2Svc.dll"	reg.exe

Sets service image path in registry 3 TTPs 3 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

Windows Service

persistence privilege_escalation

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ehRecvr\ImagePath = "%systemroot%\\ehome\\ehRecvr.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ehSched\ImagePath = "%systemroot%\\ehome\\ehsched.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Mcx2Svc\ImagePath = "%SystemRoot%\\system32\\svchost.exe -k LocalServiceAndNoImpersonation"	reg.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 22 IoCs

pid	Process
2712	SetACL.exe
6860	SetACL.exe
6772	SetACL.exe
6132	SetACL.exe
4644	ehsched.exe
108	ehrecvr.exe
1116	SetACL.exe
3360	SetACL.exe
3460	ehprivjob.exe
2016	mcupdate.exe
4860	SetACL.exe
4420	SetACL.exe
6552	SetACL.exe
4604	SetACL.exe
3256	mcupdate.exe
6200	ehrec.exe
4672	ehtray.exe
556	windows10.0-kb3106246-x64.exe
3284	ehsched.exe
1080	ehRec.exe
3388	ehPrivJob.exe
6624	ehPrivJob.exe

Loads dropped DLL 46 IoCs

pid	Process
432	MsiExec.exe
432	MsiExec.exe
6704	MsiExec.exe
6704	MsiExec.exe
6884	MsiExec.exe
6884	MsiExec.exe
6884	MsiExec.exe
6884	MsiExec.exe
2492	Process not Found
108	ehrecvr.exe
4400	Process not Found
2016	mcupdate.exe
2016	mcupdate.exe
2016	mcupdate.exe
2016	mcupdate.exe
2016	mcupdate.exe
2016	mcupdate.exe
2016	mcupdate.exe
2016	mcupdate.exe
2016	mcupdate.exe
2016	mcupdate.exe
3256	mcupdate.exe
3256	mcupdate.exe
3256	mcupdate.exe
3256	mcupdate.exe
3256	mcupdate.exe
3256	mcupdate.exe
3256	mcupdate.exe
6200	ehrec.exe
3284	ehsched.exe
3284	ehsched.exe
4672	ehtray.exe
2016	mcupdate.exe
1080	ehRec.exe
1080	ehRec.exe
1080	ehRec.exe
1080	ehRec.exe
1080	ehRec.exe
1080	ehRec.exe
1080	ehRec.exe
3256	mcupdate.exe
3256	mcupdate.exe
3256	mcupdate.exe
3256	mcupdate.exe
1080	ehRec.exe
6624	ehPrivJob.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	6960	msiexec.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File created	C:\Users\Public\Recorded TV\desktop.ini	msiexec.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe

Drops file in System32 directory 18 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sqlcese40.dll	msiexec.exe
File created	C:\Windows\SysWOW64\sqlceoledb40.dll	msiexec.exe
File created	C:\Windows\system32\sqlceoledb40.dll	msiexec.exe
File created	C:\Windows\SysWOW64\iTVData.dll	msiexec.exe
File created	C:\Windows\SysWOW64\sqlceqp40.dll	msiexec.exe
File created	C:\Windows\system32\mcmde.dll	msiexec.exe
File created	C:\Windows\SysWOW64\sqlcecompact40.dll	msiexec.exe
File created	C:\Windows\system32\mspbda.dll	msiexec.exe
File created	C:\Windows\system32\sysprepMCE.dll	msiexec.exe
File created	C:\Windows\system32\sqlcese40.dll	msiexec.exe
File created	C:\Windows\system32\Mcx2Svc.dll	msiexec.exe
File created	C:\Windows\system32\spp\tokens\ppdlic\MCLicense-ppdlic.xrm-ms	msiexec.exe
File created	C:\Windows\system32\mcsrchPH.dll	msiexec.exe
File created	C:\Windows\system32\MsPbdaCoInst.dll	msiexec.exe
File created	C:\Windows\system32\sqlcecompact40.dll	msiexec.exe
File created	C:\Windows\system32\spp\tokens\ppdlic\MediaCenter-ppdlic.xrm-ms	msiexec.exe
File created	C:\Windows\system32\iTVData.dll	msiexec.exe
File created	C:\Windows\system32\sqlceqp40.dll	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Media Center\ehome\ja-JP\ehdrop.dll.mui	msiexec.exe
File created	C:\Program Files\Windows Media Center\ehome\McrMgr.dll	msiexec.exe
File created	C:\Program Files\Windows Media Center\ehome\uk-UA\ehglid.dll.mui	msiexec.exe
File created	C:\Program Files\Windows Media Center\ehome\en-US\ehdrop.dll.mui	msiexec.exe
File created	C:\Program Files\Windows Media Center\ehome\it-IT\mcupdate.exe.mui	msiexec.exe
File created	C:\Program Files\Windows Media Center\tasks\ObjectStoreRecoveryTask.xml	msiexec.exe
File created	C:\Program Files\Windows Media Center\tasks\OCURActivate.xml	msiexec.exe
File created	C:\Program Files\Windows Media Center\ehome\Microsoft.MediaCenter.Mheg.dll	msiexec.exe
File created	C:\Program Files\Windows Media Center\ehome\ehitvhost.dll	msiexec.exe
File created	C:\Program Files\Windows Media Center\ehome\ehvid.exe.manifest	msiexec.exe
File created	C:\Program Files\Windows Media Center\ehome\uk-UA\mcplayer.dll.mui	msiexec.exe
File created	C:\Program Files\Windows Media Center\ehome\es-ES\MSVidCtl.dll.mui	msiexec.exe
File created	C:\Program Files\Windows Media Center\ehome\uk-UA\ehcmres.dll.mui	msiexec.exe
File created	C:\Program Files\Windows Media Center\ehome\ja-JP\WTVConverter.exe.mui	msiexec.exe
File created	C:\Program Files\Windows Media Center\ehome\mcplayer.dll	msiexec.exe
File created	C:\Program Files\Windows Media Center\ehome\wow\ehdebug.dll	msiexec.exe
File created	C:\Program Files\Windows Media Center\ehome\it-IT\MSVidCtl.dll.mui	msiexec.exe
File created	C:\Program Files\Windows Media Center\ehome\en-US\mcupdate.exe.mui	msiexec.exe
File created	C:\Program Files\Windows Media Center\ehome\Microsoft.MediaCenter.ITVVM.dll	msiexec.exe
File opened for modification	C:\Program Files\Windows Media Center\ehome\ehiExtens.dll	cmd.exe
File created	C:\Program Files\Windows Media Center\ehome\ja-JP\mcupdate.exe.mui	msiexec.exe
File created	C:\Program Files\Windows Media Center\ehome\en-US\ehchsime.dll.mui	msiexec.exe
File created	C:\Program Files\Windows Media Center\ehome\MSVidCtl.dll	msiexec.exe
File created	C:\Program Files\Windows Media Center\ehome\ja-JP\ItvRes.dll.mui	msiexec.exe
File created	C:\Program Files\Windows Media Center\ehome\ehReplay.dll	msiexec.exe
File created	C:\Program Files\Windows Media Center\ehome\en-US\ehchhime.dll.mui	msiexec.exe
File created	C:\Program Files\Windows Media Center\ehome\it-IT\playready_eula.txt	msiexec.exe
File created	C:\Program Files\Windows Media Center\ehome\en-US\ehcmres.dll.mui	msiexec.exe
File created	C:\Program Files\Windows Media Center\ehome\Microsoft.Windows.Video.TVDecoder.manifest	msiexec.exe
File created	C:\Program Files\Windows Media Center\tasks\ConfigureInternetTimeService.xml	msiexec.exe
File created	C:\Program Files\Windows Media Center\ehome\mcsrchPH.propdesc	msiexec.exe
File created	C:\Program Files\Windows Media Center\ehome\fr-FR\mcplayer.dll.mui	msiexec.exe
File created	C:\Program Files\Windows Media Center\ehome\de-DE\ehsched.exe.mui	msiexec.exe
File created	C:\Program Files\Windows Media Center\ehome\en-US\ehsched.exe.mui	msiexec.exe
File created	C:\Program Files\Windows Media Center\ehome\es-ES\ehdrop.dll.mui	msiexec.exe
File created	C:\Program Files\Windows Media Center\AclTaskCache	msiexec.exe
File created	C:\Program Files\Windows Media Center\ehome\Mcx2Prov.exe.XB360	msiexec.exe
File created	C:\Program Files\Windows Media Center\ehome\WTVGOTHIC-RB.ttc	msiexec.exe
File created	C:\Program Files\Windows Media Center\ehome\it-IT\WTVConverter.exe.mui	msiexec.exe
File created	C:\Program Files\Windows Media Center\ehome\fr-FR\ehglid.dll.mui	msiexec.exe
File created	C:\Program Files\Windows Media Center\ehome\it-IT\playReady_eula_oem.txt	msiexec.exe
File created	C:\Program Files\Windows Media Center\ehome\markup.dll	msiexec.exe
File created	C:\Program Files\Windows Media Center\tasks\ReindexSearchRoot.xml	msiexec.exe
File created	C:\Program Files\Windows Media Center\ehome\WTVGOTHIC-R.ttc	msiexec.exe
File created	C:\Program Files\Windows Media Center\ehome\fr-FR\MediaCenterWebLauncherRes.dll.mui	msiexec.exe
File created	C:\Program Files\Windows Media Center\ehome\fr-FR\mcupdate.exe.mui	msiexec.exe
File created	C:\Program Files\Windows Media Center\ehome\mcepg.dll	msiexec.exe
File opened for modification	C:\Program Files\Windows Media Center\ehome\Microsoft.MediaCenter.ITVVM.dll	cmd.exe
File created	C:\Program Files\Windows Media Center\ehome\fr-FR\playready_eula.txt	msiexec.exe
File created	C:\Program Files\Windows Media Center\ehome\ehglid.dll	msiexec.exe
File created	C:\Program Files\Windows Media Center\ehome\ehdebug.dll	msiexec.exe
File created	C:\Program Files\Windows Media Center\tasks\PeriodicScanRetry.xml	msiexec.exe
File created	C:\Program Files\Windows Media Center\ehome\Microsoft.MediaCenter.dll	msiexec.exe
File created	C:\Program Files\Windows Media Center\ehome\de-DE\mcplayer.dll.mui	msiexec.exe
File created	C:\Program Files\Windows Media Center\ehome\ja-JP\playready_eula.txt	msiexec.exe
File created	C:\Program Files\Windows Media Center\ehome\it-IT\MediaCenterWebLauncherRes.dll.mui	msiexec.exe
File created	C:\Program Files\Windows Media Center\ehome\MCX\X02\XboxMCX-V.XEX	msiexec.exe
File created	C:\Program Files\Windows Media Center\ehome\uk-UA\ehres.dll.mui	msiexec.exe
File created	C:\Program Files\Windows Media Center\ehome\ehRec.exe.config	msiexec.exe
File opened for modification	C:\Program Files\Windows Media Center\ehome\ehiProxy.dll	cmd.exe
File created	C:\Program Files\Windows Media Center\ehome\mcetuningoverrides.xml	msiexec.exe
File created	C:\Program Files\Windows Media Center\ehome\Mcx2Filter.dll	msiexec.exe
File created	C:\Program Files\Windows Media Center\ehome\ItvRes.dll	msiexec.exe
File created	C:\Program Files\Windows Media Center\tasks\ActivateWindowsSearch.xml	msiexec.exe

Drops file in Windows directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\policy.6.0.Microsoft.MediaCenter\v4.0_6.3.0.0__31bf3856ad364e35\Policy.6.0.Microsoft.MediaCenter.config	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File created	C:\Windows\SystemTemp\MSIa8977.LOG	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a4027.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6531523D-2FCD-4277-B95A-F70FEAF11CE4}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7A16A51D2C4832C5.TMP	msiexec.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\policy.6.0.Microsoft.MediaCenter.UI\v4.0_6.3.0.0__31bf3856ad364e35\Policy.6.0.Microsoft.MediaCenter.UI.config	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI621A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI643D.tmp	msiexec.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\policy.6.0.ehRecObj\v4.0_6.3.0.0__31bf3856ad364e35\Policy.6.0.ehRecObj.config	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI48F1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\{6531523D-2FCD-4277-B95A-F70FEAF11CE4}\_A3CEA083E8EDDECA598404.exe	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File opened for modification	C:\Windows\SystemTemp\MSIa8977.LOG	msiexec.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\policy.6.0.ehRecObj\v4.0_6.3.0.0__31bf3856ad364e35\Policy.6.0.ehRecObj.dll	msiexec.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\policy.6.0.Microsoft.MediaCenter\v4.0_6.3.0.0__31bf3856ad364e35\Policy.6.0.Microsoft.MediaCenter.config	msiexec.exe
File opened for modification	C:\Windows\ehome	cmd.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File created	C:\Windows\Installer\e5a4027.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4A0B.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD2D408A1222AB592.TMP	msiexec.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\policy.6.0.Microsoft.MediaCenter\v4.0_6.3.0.0__31bf3856ad364e35\Policy.6.0.Microsoft.MediaCenter.dll	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\policy.6.0.Microsoft.MediaCenter.UI\v4.0_6.3.0.0__31bf3856ad364e35\Policy.6.0.Microsoft.MediaCenter.UI.config	msiexec.exe
File opened for modification	C:\Windows\Installer\{6531523D-2FCD-4277-B95A-F70FEAF11CE4}\Media Center Tray Applet	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log	ngen.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log	ngen.exe
File opened for modification	C:\Windows\Installer\MSI5036.tmp	msiexec.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\policy.6.0.Microsoft.MediaCenter.UI\v4.0_6.3.0.0__31bf3856ad364e35\Policy.6.0.Microsoft.MediaCenter.UI.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\{6531523D-2FCD-4277-B95A-F70FEAF11CE4}\_9AC780B362ACD3EDD369E2.exe	msiexec.exe
File created	C:\Windows\Installer\e5a402c.msi	msiexec.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File created	C:\Windows\SystemTemp\~DF7BE60B7C80261065.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\{6531523D-2FCD-4277-B95A-F70FEAF11CE4}\_853F67D554F05449430E7E.exe	msiexec.exe
File created	C:\Windows\Installer\{6531523D-2FCD-4277-B95A-F70FEAF11CE4}\_A3CEA083E8EDDECA598404.exe	msiexec.exe
File created	C:\Windows\Installer\{6531523D-2FCD-4277-B95A-F70FEAF11CE4}\Media Center Tray Applet	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log	ngen.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log	ngen.exe
File created	C:\Windows\SystemTemp\~DF9F2D389145360A6C.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\policy.6.0.ehRecObj\v4.0_6.3.0.0__31bf3856ad364e35\Policy.6.0.ehRecObj.config	msiexec.exe
File created	C:\Windows\Installer\{6531523D-2FCD-4277-B95A-F70FEAF11CE4}\_9AC780B362ACD3EDD369E2.exe	msiexec.exe
File created	C:\Windows\Installer\{6531523D-2FCD-4277-B95A-F70FEAF11CE4}\_6BE2A8266D30FB9B3B0AB9.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{6531523D-2FCD-4277-B95A-F70FEAF11CE4}\_6BE2A8266D30FB9B3B0AB9.exe	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log	ngen.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File created	C:\Windows\Installer\{6531523D-2FCD-4277-B95A-F70FEAF11CE4}\_853F67D554F05449430E7E.exe	msiexec.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6024	sc.exe
3160	sc.exe
5864	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
6960	msiexec.exe

Executes a command shell one-liner 1 TTPs 43 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6324	cmd.exe
2764	cmd.exe
1644	cmd.exe
6268	cmd.exe
2604	cmd.exe
6232	cmd.exe
3140	cmd.exe
2464	cmd.exe
6196	cmd.exe
2816	cmd.exe
5040	cmd.exe
2600	cmd.exe
1860	cmd.exe
2436	cmd.exe
4468	cmd.exe
5744	cmd.exe
4868	cmd.exe
5508	cmd.exe
3852	cmd.exe
2736	cmd.exe
3736	cmd.exe
3848	cmd.exe
4808	cmd.exe
4152	cmd.exe
3976	cmd.exe
6528	cmd.exe
1340	cmd.exe
5720	cmd.exe
1568	cmd.exe
1068	cmd.exe
2256	cmd.exe
7152	cmd.exe
4168	cmd.exe
2852	cmd.exe
5560	cmd.exe
7088	cmd.exe
2428	cmd.exe
5076	cmd.exe
3748	cmd.exe
3540	cmd.exe
6836	cmd.exe
3204	cmd.exe
6764	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows10.0-kb3106246-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe

Detects application with GUI, possible interaction required

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000392849c4232396370000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801392849c40000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101392849c4000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3392849c400000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6392849c400000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies Internet Explorer settings 1 TTPs 44 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BEHAVIORS	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_VALIDATE_NAVIGATE_URL	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE\ehExtHost.exe = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SAFE_BINDTOOBJECT\ehExtHost.exe = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_UNC_SAVEDFILECHECK\ehExtHost.exe = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING\ehexthost32.exe = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_OBJECT_CACHING	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_OBJECT_CACHING\ehexthost32.exe = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_VALIDATE_NAVIGATE_URL\ehexthost32.exe = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL\ehExtHost.exe = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_OBJECT_CACHING	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_UNC_SAVEDFILECHECK	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_UNC_SAVEDFILECHECK\ehexthost32.exe = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_OBJECT_CACHING\ehExtHost.exe = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_VALIDATE_NAVIGATE_URL	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL\ehexthost32.exe = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE\ehexthost32.exe = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING\ehexthost32.exe = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SAFE_BINDTOOBJECT	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN\ehExtHost.exe = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BEHAVIORS\ehexthost32.exe = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SAFE_BINDTOOBJECT\ehexthost32.exe = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION\ehexthost32.exe = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BEHAVIORS	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN\ehexthost32.exe = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BEHAVIORS\ehExtHost.exe = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SAFE_BINDTOOBJECT	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_UNC_SAVEDFILECHECK	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_VALIDATE_NAVIGATE_URL\ehExtHost.exe = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING\ehExtHost.exe = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING\ehExtHost.exe = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION\ehExtHost.exe = "1"	reg.exe

Modifies data under HKEY_USERS 52 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Media Center	ehtray.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{917D1F24-F668-4B1F-A8E6-7C426ADD48EC}\NumMethods\ = "4"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4D7A53-D379-4FFD-8445-AF00224D1F88}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CDBD6577-5D63-42FB-9176-8260AC66C862}\ProxyStubClsid32	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-microsoft-com:device:MediaCenterExtender:1\DefaultIcon\ = "%systemroot%\\system32\\McxDriv.dll,-101"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpg\OpenWithList\ehshell.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3630AB4B-C0D2-4C1B-B7E7-73A2CF9A4521}\LocalServer32\ServerExecutable = "C:\\Windows\\ehome\\Mcx2Prov.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7FA3A1C3-3C87-40de-AC16-B6E2815A4CC8}\AppID = "{E1990E85-DFE4-4410-82CE-C74C57BF6E8E}"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\eHome.RecoveryTaskMonitor\CLSID	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MediaCenter.WTVFile\shell\wtv2dvrms\	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0B3F871D-38D9-4677-8853-A247C6366483}\ProgID\ = "eHome.RecoveryTaskDispatchServer.1"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FFDED41-8FC9-497D-BD70-B2E440736273}\InprocServer32\ = "%SystemRoot%\\system32\\sqlcecompact40.dll"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{07461CC0-878C-4C0F-9255-7DDB269B363B}\VersionIndependentProgID	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{478DD7E7-228D-44B7-9854-DFB0E818D8A7}\InprocServer32\ThreadingModel = "Both"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{95142bf8-5f09-452b-b384-44af84a500c6}\LocalServer32\ = "C:\\Windows\\ehome\\ehRec.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ehGLID.GLIDPlugInPAL\CLSID	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ehGLID.PBDASiParser.1\CLSID	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{14CAF068-2A97-4A4E-9056-6CA4FA7E918F}\ProxyStubClsid32	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MediaCenter.DVR\Shell\Play	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.MediaCenter.iTv.CiTvTuning	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{FA018B44-5E9F-4875-B127-5085A1B02ABD}\LocalService = "ehSched"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{76FD18F9-45AC-456d-8449-E1DA59B5E3D2}\InprocServer32\ = "C:\\Windows\\eHome\\wtv2dvrms.dll"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ehGLID.GLIDPlugInISDBSatellite	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5991419D-B243-11DB-8460-00123F76E1F7}\ProxyStubClsid32	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B68E0428-AB08-4FBA-B719-6D7C66B9663D}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.MediaCenter.GlidHost.ScanConfigWrapper\ = "ScanConfigWrapper Class"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{461BF91D-7549-4DF9-A154-EACE5B4484E5}\1.0\FLAGS	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E7F328B1-6095-41B0-94B7-3DD278EADAA1}\InprocServer32\ThreadingModel = "Both"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{07C0A9A9-6308-4C15-B818-225D4F3FBF48}\InprocServer32\RuntimeVersion = "v4.0.30319"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{599141D5-B243-11DB-8460-00123F76E1F7}\InprocServer32\RuntimeVersion = "v4.0.30319"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F88A4455-BEB8-4D91-8C13-6807B0147727}\ = "CHHInputModule Class"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\EhSched.ResourceMgr\CLSID	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ehVid.TVThumb.1	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2DE9DF8D-9987-42DF-8DBC-477C053D2FFD}\ProxyStubClsid32	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{599141A6-B243-11DB-8460-00123F76E1F7}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CA4DEAB8-2C34-42B7-B4A5-78CD28A2D54F}\SynchronousInterface	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpeg\OpenWithList	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{07C0A9A9-6308-4C15-B818-225D4F3FBF48}\InprocServer32\Assembly = "mcGlidHostObj, Version=6.3.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35"	reg.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{88EBC1EE-F90A-484A-B9C5-8F9C0F37A828}\FilterData = 02000000000060000100000000000000307069330200000000000000010000000000000000000000307479330000000038000000480000006c175f45064bce479aef8caef73df7b579859f4af86b92438a6dd2dd09fa7861	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{41DADF7D-609C-11DB-B5B9-000CF179CDD7}\InprocServer32\Assembly = "ehRecObj, Version=6.3.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ehGLID.GLIDPlugInISDBSatellite.1	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\eHome.McxRemoteFilePlayer\CurVer	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{197CF1A5-5533-4AA5-AA55-073F55ED4AB8}\ProxyStubClsid32\ = "{B1C3DB01-7D82-4BA2-AA5D-4F1371302241}"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{599141AC-B243-11DB-8460-00123F76E1F7}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{599141D5-B243-11DB-8460-00123F76E1F7}\InprocServer32\ = "C:\\Windows\\System32\\mscoree.dll"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\eHome.RecoveryTaskMonitor.1\CLSID	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{37BEC31C-370A-4324-8933-50E30B1C9901}\NumMethods	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E2AF9540-FFEC-4e1c-8523-08601F505336}\ = "IEnumRecorderGraph"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.MediaCenter.iTv.CiTvOverlaySurface\CLSID\ = "{599141D6-B243-11DB-8460-00123F76E1F7}"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A5CF917A-0F75-4b29-A0A0-5348E501DA59}\InprocServer32	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED233797-F47D-475e-9FCA-3D549E4DDAA4}\ = "EhTraceProvider Class"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ehRecvr.BackgroundScanner\ = "BackgroundScanner Class"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{576EF3D5-D89E-482E-AD2C-889C8E504983}\ProxyStubClsid32\ = "{B1C3DB01-7D82-4BA2-AA5D-4F1371302241}"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D5C04D19-726D-470F-8637-2AA1D841F7BD}\ProxyStubClsid32	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\McxMdeOutputProfile.OutputProfileMgr\ = "McxMdeOutputProfileMgr Class"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0c98b8bc-273c-464d-938a-b9709607e137}\LocalizedString = "@C:\\Windows\\ehome\\ehres.dll,-15505"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{95142bf8-5f09-452b-b384-44af84a500c6}\VersionIndependentProgID	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD621DE4-2AA5-4468-ADF1-087A05891DA7}\AppID = "{0E11CB54-4C4A-4B37-AE0B-E93CEE60E646}"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ehGLID.AtscPsipParser.1\CLSID\ = "{D88B44DB-6C5C-4501-B7FC-3E7476275C84}"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\eHome.RecoveryTaskDispatchServer\ = "RecoveryTaskDispatchServer Class"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7FA3A1C3-3C87-40de-AC16-B6E2815A4CC8}\InprocServer32\ThreadingModel = "both"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{069501DC-D776-4778-8C76-81D7A3DFFBB7}\LocalServer32\ = "C:\\Windows\\ehome\\ehVid.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\eHome.RecoveryTaskDispatchServer.1\CLSID	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{599141B4-B243-11DB-8460-00123F76E1F7}\ = "IiTvAddIn"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\MFCongestionController.DLL	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 23 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
6528	schtasks.exe
6140	schtasks.exe
2888	schtasks.exe
5380	schtasks.exe
5448	schtasks.exe
1688	schtasks.exe
4888	schtasks.exe
1280	schtasks.exe
6660	schtasks.exe
4516	schtasks.exe
3024	schtasks.exe
3540	schtasks.exe
6652	schtasks.exe
7108	schtasks.exe
2648	schtasks.exe
5812	schtasks.exe
464	schtasks.exe
2464	schtasks.exe
1208	schtasks.exe
4676	schtasks.exe
4236	schtasks.exe
2180	schtasks.exe
5744	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1320	msiexec.exe
1320	msiexec.exe
2016	mcupdate.exe
2016	mcupdate.exe
2016	mcupdate.exe
1080	ehRec.exe
1080	ehRec.exe
3256	mcupdate.exe
3256	mcupdate.exe
3256	mcupdate.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	6960	msiexec.exe
Token: SeIncreaseQuotaPrivilege	6960	msiexec.exe
Token: SeSecurityPrivilege	1320	msiexec.exe
Token: SeCreateTokenPrivilege	6960	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	6960	msiexec.exe
Token: SeLockMemoryPrivilege	6960	msiexec.exe
Token: SeIncreaseQuotaPrivilege	6960	msiexec.exe
Token: SeMachineAccountPrivilege	6960	msiexec.exe
Token: SeTcbPrivilege	6960	msiexec.exe
Token: SeSecurityPrivilege	6960	msiexec.exe
Token: SeTakeOwnershipPrivilege	6960	msiexec.exe
Token: SeLoadDriverPrivilege	6960	msiexec.exe
Token: SeSystemProfilePrivilege	6960	msiexec.exe
Token: SeSystemtimePrivilege	6960	msiexec.exe
Token: SeProfSingleProcessPrivilege	6960	msiexec.exe
Token: SeIncBasePriorityPrivilege	6960	msiexec.exe
Token: SeCreatePagefilePrivilege	6960	msiexec.exe
Token: SeCreatePermanentPrivilege	6960	msiexec.exe
Token: SeBackupPrivilege	6960	msiexec.exe
Token: SeRestorePrivilege	6960	msiexec.exe
Token: SeShutdownPrivilege	6960	msiexec.exe
Token: SeDebugPrivilege	6960	msiexec.exe
Token: SeAuditPrivilege	6960	msiexec.exe
Token: SeSystemEnvironmentPrivilege	6960	msiexec.exe
Token: SeChangeNotifyPrivilege	6960	msiexec.exe
Token: SeRemoteShutdownPrivilege	6960	msiexec.exe
Token: SeUndockPrivilege	6960	msiexec.exe
Token: SeSyncAgentPrivilege	6960	msiexec.exe
Token: SeEnableDelegationPrivilege	6960	msiexec.exe
Token: SeManageVolumePrivilege	6960	msiexec.exe
Token: SeImpersonatePrivilege	6960	msiexec.exe
Token: SeCreateGlobalPrivilege	6960	msiexec.exe
Token: SeCreateTokenPrivilege	6960	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	6960	msiexec.exe
Token: SeLockMemoryPrivilege	6960	msiexec.exe
Token: SeIncreaseQuotaPrivilege	6960	msiexec.exe
Token: SeMachineAccountPrivilege	6960	msiexec.exe
Token: SeTcbPrivilege	6960	msiexec.exe
Token: SeSecurityPrivilege	6960	msiexec.exe
Token: SeTakeOwnershipPrivilege	6960	msiexec.exe
Token: SeLoadDriverPrivilege	6960	msiexec.exe
Token: SeSystemProfilePrivilege	6960	msiexec.exe
Token: SeSystemtimePrivilege	6960	msiexec.exe
Token: SeProfSingleProcessPrivilege	6960	msiexec.exe
Token: SeIncBasePriorityPrivilege	6960	msiexec.exe
Token: SeCreatePagefilePrivilege	6960	msiexec.exe
Token: SeCreatePermanentPrivilege	6960	msiexec.exe
Token: SeBackupPrivilege	6960	msiexec.exe
Token: SeRestorePrivilege	6960	msiexec.exe
Token: SeShutdownPrivilege	6960	msiexec.exe
Token: SeDebugPrivilege	6960	msiexec.exe
Token: SeAuditPrivilege	6960	msiexec.exe
Token: SeSystemEnvironmentPrivilege	6960	msiexec.exe
Token: SeChangeNotifyPrivilege	6960	msiexec.exe
Token: SeRemoteShutdownPrivilege	6960	msiexec.exe
Token: SeUndockPrivilege	6960	msiexec.exe
Token: SeSyncAgentPrivilege	6960	msiexec.exe
Token: SeEnableDelegationPrivilege	6960	msiexec.exe
Token: SeManageVolumePrivilege	6960	msiexec.exe
Token: SeImpersonatePrivilege	6960	msiexec.exe
Token: SeCreateGlobalPrivilege	6960	msiexec.exe
Token: SeCreateTokenPrivilege	6960	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	6960	msiexec.exe
Token: SeLockMemoryPrivilege	6960	msiexec.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
6960	msiexec.exe
6636	msiexec.exe
6960	msiexec.exe
4672	ehtray.exe
4672	ehtray.exe
4672	ehtray.exe
4672	ehtray.exe
4672	ehtray.exe
4672	ehtray.exe
4672	ehtray.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
4672	ehtray.exe
4672	ehtray.exe
4672	ehtray.exe
4672	ehtray.exe
4672	ehtray.exe
4672	ehtray.exe
4672	ehtray.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
6960	msiexec.exe
1320	msiexec.exe
432	MsiExec.exe
6704	MsiExec.exe
6884	MsiExec.exe
6636	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 432	1320	msiexec.exe	91
PID 1320 wrote to memory of 4700	1320	msiexec.exe	97
PID 1320 wrote to memory of 6704	1320	msiexec.exe	99
PID 1320 wrote to memory of 6884	1320	msiexec.exe	100
PID 6884 wrote to memory of 6528	6884	MsiExec.exe	349
PID 6884 wrote to memory of 4868	6884	MsiExec.exe	104
PID 6884 wrote to memory of 5664	6884	MsiExec.exe	106
PID 6884 wrote to memory of 4168	6884	MsiExec.exe	108
PID 6884 wrote to memory of 1404	6884	MsiExec.exe	344
PID 6884 wrote to memory of 1340	6884	MsiExec.exe	112
PID 6884 wrote to memory of 6732	6884	MsiExec.exe	342
PID 6884 wrote to memory of 2852	6884	MsiExec.exe	117
PID 6884 wrote to memory of 2356	6884	MsiExec.exe	119
PID 6884 wrote to memory of 3140	6884	MsiExec.exe	121
PID 6884 wrote to memory of 5336	6884	MsiExec.exe	348
PID 6884 wrote to memory of 1860	6884	MsiExec.exe	125
PID 6884 wrote to memory of 4732	6884	MsiExec.exe	127
PID 6884 wrote to memory of 5720	6884	MsiExec.exe	129
PID 6884 wrote to memory of 4640	6884	MsiExec.exe	131
PID 6884 wrote to memory of 5560	6884	MsiExec.exe	133
PID 6884 wrote to memory of 4668	6884	MsiExec.exe	135
PID 6884 wrote to memory of 6324	6884	MsiExec.exe	350
PID 6884 wrote to memory of 3024	6884	MsiExec.exe	347
PID 6884 wrote to memory of 2464	6884	MsiExec.exe	345
PID 6884 wrote to memory of 2316	6884	MsiExec.exe	143
PID 6884 wrote to memory of 7088	6884	MsiExec.exe	145
PID 6884 wrote to memory of 6720	6884	MsiExec.exe	147
PID 6884 wrote to memory of 3540	6884	MsiExec.exe	351
PID 6884 wrote to memory of 4744	6884	MsiExec.exe	151
PID 6884 wrote to memory of 2764	6884	MsiExec.exe	153
PID 6884 wrote to memory of 2088	6884	MsiExec.exe	155
PID 6884 wrote to memory of 6836	6884	MsiExec.exe	157
PID 6884 wrote to memory of 1644	6884	MsiExec.exe	159
PID 6884 wrote to memory of 6900	6884	MsiExec.exe	161
PID 6884 wrote to memory of 5508	6884	MsiExec.exe	163
PID 6884 wrote to memory of 2932	6884	MsiExec.exe	165
PID 6884 wrote to memory of 3204	6884	MsiExec.exe	167
PID 6884 wrote to memory of 4876	6884	MsiExec.exe	169
PID 6884 wrote to memory of 1568	6884	MsiExec.exe	171
PID 6884 wrote to memory of 6308	6884	MsiExec.exe	173
PID 6884 wrote to memory of 1068	6884	MsiExec.exe	175
PID 6884 wrote to memory of 5140	6884	MsiExec.exe	177
PID 6884 wrote to memory of 6268	6884	MsiExec.exe	179
PID 6884 wrote to memory of 940	6884	MsiExec.exe	181
PID 6884 wrote to memory of 2256	6884	MsiExec.exe	183
PID 6884 wrote to memory of 5960	6884	MsiExec.exe	185
PID 6884 wrote to memory of 3852	6884	MsiExec.exe	187
PID 6884 wrote to memory of 6608	6884	MsiExec.exe	189
PID 6884 wrote to memory of 2736	6884	MsiExec.exe	191
PID 6884 wrote to memory of 6000	6884	MsiExec.exe	193
PID 6884 wrote to memory of 3736	6884	MsiExec.exe	195
PID 6884 wrote to memory of 1944	6884	MsiExec.exe	346
PID 6884 wrote to memory of 2604	6884	MsiExec.exe	199
PID 6884 wrote to memory of 1060	6884	MsiExec.exe	201
PID 6884 wrote to memory of 6196	6884	MsiExec.exe	203
PID 6884 wrote to memory of 6044	6884	MsiExec.exe	205
PID 6884 wrote to memory of 2428	6884	MsiExec.exe	207
PID 6884 wrote to memory of 2872	6884	MsiExec.exe	209
PID 6884 wrote to memory of 2436	6884	MsiExec.exe	211
PID 6884 wrote to memory of 464	6884	MsiExec.exe	343
PID 6884 wrote to memory of 3848	6884	MsiExec.exe	215
PID 6884 wrote to memory of 1520	6884	MsiExec.exe	217
PID 6884 wrote to memory of 2816	6884	MsiExec.exe	219
PID 6884 wrote to memory of 6684	6884	MsiExec.exe	221

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\wmcsetup-x64.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:6960

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 454A08CC2B66596912ECF5C4952E3A83 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:432
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4700
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding BC5091B99D2DDA4263E4C98FD2AF6E90
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:6704
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 126D539892C90793C70A888532EFFDE0 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Modifies data under HKEY_USERS
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:6884
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c mklink /j "C:\Windows\ehome" "C:\Program Files\Windows Media Center\ehome"
    3⤵
    - Drops file in Windows directory
    - Executes a command shell one-liner
    PID:6528
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c mklink /h "C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.MediaCenter.Mheg\v4.0_6.3.0.0__31bf3856ad364e35\Microsoft.MediaCenter.Mheg.dll" "C:\Program Files\Windows Media Center\ehome\Microsoft.MediaCenter.Mheg.dll"
    3⤵
    - Executes a command shell one-liner
    PID:4868
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "Microsoft.MediaCenter.Mheg, Version=6.3.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=amd64" /NoDependencies /queue:1
    3⤵
    PID:5664
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c mklink /h "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ehiwmp\v4.0_6.3.0.0__31bf3856ad364e35\ehiwmp.dll" "C:\Program Files\Windows Media Center\ehome\ehiwmp.dll"
    3⤵
    - Executes a command shell one-liner
    PID:4168
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c mklink /h "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.MediaCenter.Bml\v4.0_6.3.0.0__31bf3856ad364e35\Microsoft.MediaCenter.Bml.dll" "C:\Program Files\Windows Media Center\ehome\Microsoft.MediaCenter.Bml.dll"
    3⤵
    - Executes a command shell one-liner
    PID:1340
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c mklink /h "C:\Windows\Microsoft.NET\assembly\GAC_64\mcstoredb\v4.0_6.3.0.0__31bf3856ad364e35\mcstoredb.dll" "C:\Program Files\Windows Media Center\ehome\mcstoredb.dll"
    3⤵
    - Executes a command shell one-liner
    PID:2852
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "mcstoredb, Version=6.3.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=amd64" /NoDependencies /queue:1
    3⤵
    PID:2356
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c mklink /h "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.MediaCenter.iTv.Hosting\v4.0_6.3.0.0__31bf3856ad364e35\Microsoft.MediaCenter.iTv.Hosting.dll" "C:\Program Files\Windows Media Center\ehome\Microsoft.MediaCenter.iTv.Hosting.dll"
    3⤵
    - Executes a command shell one-liner
    PID:3140
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c mklink /h "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\mcstore\v4.0_6.3.0.0__31bf3856ad364e35\mcstore.dll" "C:\Program Files\Windows Media Center\ehome\mcstore.dll"
    3⤵
    - Executes a command shell one-liner
    PID:1860
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "mcstore, Version=6.3.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:1
    3⤵
    PID:4732
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c mklink /h "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\mcglidhostobj\v4.0_6.3.0.0__31bf3856ad364e35\mcglidhostobj.dll" "C:\Program Files\Windows Media Center\ehome\mcglidhostobj.dll"
    3⤵
    - Executes a command shell one-liner
    PID:5720
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "mcglidhostobj, Version=6.3.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:1
    3⤵
    PID:4640
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c mklink /h "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ehiiTV\v4.0_6.3.0.0__31bf3856ad364e35\ehiiTV.dll" "C:\Program Files\Windows Media Center\ehome\ehiiTV.dll"
    3⤵
    - Executes a command shell one-liner
    PID:5560
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "ehiiTV, Version=6.3.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:1
    3⤵
    PID:4668
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c mklink /h "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\mcepg\v4.0_6.3.0.0__31bf3856ad364e35\mcepg.dll" "C:\Program Files\Windows Media Center\ehome\mcepg.dll"
    3⤵
    - Executes a command shell one-liner
    PID:6324
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c mklink /h "C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.MediaCenter.iTV.Media\v4.0_6.3.0.0__31bf3856ad364e35\Microsoft.MediaCenter.iTV.Media.dll" "C:\Program Files\Windows Media Center\ehome\Microsoft.MediaCenter.iTV.Media.dll"
    3⤵
    - Executes a command shell one-liner
    PID:2464
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "Microsoft.MediaCenter.iTV.Media, Version=6.3.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=amd64" /NoDependencies /queue:1
    3⤵
    PID:2316
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c mklink /h "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ehshell\v4.0_6.3.0.0__31bf3856ad364e35\ehshell.dll" "C:\Program Files\Windows Media Center\ehome\ehshell.dll"
    3⤵
    - Executes a command shell one-liner
    PID:7088
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "ehshell, Version=6.3.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:1
    3⤵
    PID:6720
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c mklink /h "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ehCIR\v4.0_6.3.0.0__31bf3856ad364e35\ehCIR.dll" "C:\Program Files\Windows Media Center\ehome\ehCIR.dll"
    3⤵
    - Executes a command shell one-liner
    PID:3540
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "ehCIR, Version=6.3.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:1
    3⤵
    PID:4744
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c mklink /h "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ehexthost\v4.0_6.3.0.0__31bf3856ad364e35\ehexthost.exe" "C:\Program Files\Windows Media Center\ehome\ehexthost.exe"
    3⤵
    - Executes a command shell one-liner
    PID:2764
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "ehexthost, Version=6.3.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:1
    3⤵
    PID:2088
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c mklink /h "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ehexthost\v4.0_6.3.0.0__31bf3856ad364e35\ehexthost.exe.config" "C:\Program Files\Windows Media Center\ehome\ehexthost.exe.config"
    3⤵
    - Executes a command shell one-liner
    PID:6836
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c mklink /h "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.MediaCenter\v4.0_6.3.0.0__31bf3856ad364e35\Microsoft.MediaCenter.dll" "C:\Program Files\Windows Media Center\ehome\Microsoft.MediaCenter.dll"
    3⤵
    - Executes a command shell one-liner
    PID:1644
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "Microsoft.MediaCenter, Version=6.3.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:1
    3⤵
    PID:6900
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c mklink /h "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.MediaCenter.Playback\v4.0_6.3.0.0__31bf3856ad364e35\Microsoft.MediaCenter.Playback.dll" "C:\Program Files\Windows Media Center\ehome\Microsoft.MediaCenter.Playback.dll"
    3⤵
    - Executes a command shell one-liner
    PID:5508
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "Microsoft.MediaCenter.Playback, Version=6.3.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:1
    3⤵
    PID:2932
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c mklink /h "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ehiVidCtl\v4.0_6.3.0.0__31bf3856ad364e35\ehiVidCtl.dll" "C:\Program Files\Windows Media Center\ehome\ehiVidCtl.dll"
    3⤵
    - Executes a command shell one-liner
    PID:3204
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "ehiVidCtl, Version=6.3.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:1
    3⤵
    PID:4876
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c mklink /h "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ehiUserXp\v4.0_6.3.0.0__31bf3856ad364e35\ehiUserXp.dll" "C:\Program Files\Windows Media Center\ehome\ehiUserXp.dll"
    3⤵
    - Executes a command shell one-liner
    PID:1568
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "ehiUserXp, Version=6.3.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:1
    3⤵
    PID:6308
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c mklink /h "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\loadmxf\v4.0_6.3.0.0__31bf3856ad364e35\loadmxf.exe" "C:\Program Files\Windows Media Center\ehome\loadmxf.exe"
    3⤵
    - Executes a command shell one-liner
    PID:1068
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "loadmxf, Version=6.3.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:1
    3⤵
    PID:5140
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c mklink /h "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ehiActivScp\v4.0_6.3.0.0__31bf3856ad364e35\ehiActivScp.dll" "C:\Program Files\Windows Media Center\ehome\ehiActivScp.dll"
    3⤵
    - Executes a command shell one-liner
    PID:6268
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "ehiActivScp, Version=6.3.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:1
    3⤵
    PID:940
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c mklink /h "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.MediaCenter.Sports\v4.0_6.3.0.0__31bf3856ad364e35\Microsoft.MediaCenter.Sports.dll" "C:\Program Files\Windows Media Center\ehome\Microsoft.MediaCenter.Sports.dll"
    3⤵
    - Executes a command shell one-liner
    PID:2256
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "Microsoft.MediaCenter.Sports, Version=6.3.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:1
    3⤵
    PID:5960
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c mklink /h "C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.MediaCenter.Interop\v4.0_6.3.0.0__31bf3856ad364e35\Microsoft.MediaCenter.Interop.dll" "C:\Program Files\Windows Media Center\ehome\Microsoft.MediaCenter.Interop.dll"
    3⤵
    - Executes a command shell one-liner
    PID:3852
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "Microsoft.MediaCenter.Interop, Version=6.3.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=amd64" /NoDependencies /queue:1
    3⤵
    PID:6608
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c mklink /h "C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.MediaCenter.TV.Tuners.Interop\v4.0_6.3.0.0__31bf3856ad364e35\Microsoft.MediaCenter.TV.Tuners.Interop.dll" "C:\Program Files\Windows Media Center\ehome\Microsoft.MediaCenter.TV.Tuners.Interop.dll"
    3⤵
    - Executes a command shell one-liner
    PID:2736
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "Microsoft.MediaCenter.TV.Tuners.Interop, Version=6.3.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=amd64" /NoDependencies /queue:1
    3⤵
    PID:6000
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c mklink /h "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ehiExtens\v4.0_6.3.0.0__31bf3856ad364e35\ehiExtens.dll" "C:\Program Files\Windows Media Center\ehome\ehiExtens.dll"
    3⤵
    - Drops file in Program Files directory
    - Executes a command shell one-liner
    PID:3736
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c mklink /h "C:\Windows\Microsoft.NET\assembly\GAC_64\mcupdate\v4.0_6.3.0.0__31bf3856ad364e35\mcupdate.exe" "C:\Program Files\Windows Media Center\ehome\mcupdate.exe"
    3⤵
    - Executes a command shell one-liner
    PID:2604
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "mcupdate, Version=6.3.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=amd64" /NoDependencies /queue:1
    3⤵
    PID:1060
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c mklink /h "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ehiWUapi\v4.0_6.3.0.0__31bf3856ad364e35\ehiWUapi.dll" "C:\Program Files\Windows Media Center\ehome\ehiWUapi.dll"
    3⤵
    - Executes a command shell one-liner
    PID:6196
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "ehiWUapi, Version=6.3.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:1
    3⤵
    PID:6044
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c mklink /h "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.MediaCenter.ITVVM\v4.0_6.3.0.0__31bf3856ad364e35\Microsoft.MediaCenter.ITVVM.dll" "C:\Program Files\Windows Media Center\ehome\Microsoft.MediaCenter.ITVVM.dll"
    3⤵
    - Drops file in Program Files directory
    - Executes a command shell one-liner
    PID:2428
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "Microsoft.MediaCenter.ITVVM, Version=6.3.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:1
    3⤵
    PID:2872
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c mklink /h "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ehiTVMSMusic\v4.0_6.3.0.0__31bf3856ad364e35\ehiTVMSMusic.dll" "C:\Program Files\Windows Media Center\ehome\ehiTVMSMusic.dll"
    3⤵
    - Executes a command shell one-liner
    PID:2436
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c mklink /h "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ehiProxy\v4.0_6.3.0.0__31bf3856ad364e35\ehiProxy.dll" "C:\Program Files\Windows Media Center\ehome\ehiProxy.dll"
    3⤵
    - Drops file in Program Files directory
    - Executes a command shell one-liner
    PID:3848
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "ehiProxy, Version=6.3.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:1
    3⤵
    PID:1520
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c mklink /h "C:\Windows\Microsoft.NET\assembly\GAC_64\BDATunePIA\v4.0_6.3.0.0__31bf3856ad364e35\BDATunePIA.dll" "C:\Program Files\Windows Media Center\ehome\BDATunePIA.dll"
    3⤵
    - Executes a command shell one-liner
    PID:2816
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "BDATunePIA, Version=6.3.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=amd64" /NoDependencies /queue:1
    3⤵
    PID:6684
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c mklink /h "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.MediaCenter.Shell\v4.0_6.3.0.0__31bf3856ad364e35\Microsoft.MediaCenter.Shell.dll" "C:\Program Files\Windows Media Center\ehome\Microsoft.MediaCenter.Shell.dll"
    3⤵
    - Executes a command shell one-liner
    PID:5040
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "Microsoft.MediaCenter.Shell, Version=6.3.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:1
    3⤵
    PID:2912
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c mklink /h "C:\Windows\Microsoft.NET\assembly\GAC_64\mcplayerinterop\v4.0_6.3.0.0__31bf3856ad364e35\mcplayerinterop.dll" "C:\Program Files\Windows Media Center\ehome\mcplayerinterop.dll"
    3⤵
    - Executes a command shell one-liner
    PID:4808
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "mcplayerinterop, Version=6.3.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=amd64" /NoDependencies /queue:1
    3⤵
    PID:6724
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c mklink /h "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ehiBmlDataCarousel\v4.0_6.3.0.0__31bf3856ad364e35\ehiBmlDataCarousel.dll" "C:\Program Files\Windows Media Center\ehome\ehiBmlDataCarousel.dll"
    3⤵
    - Executes a command shell one-liner
    PID:7152
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "ehiBmlDataCarousel, Version=6.3.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:1
    3⤵
    PID:7112
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c mklink /h "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ehiUPnP\v4.0_6.3.0.0__31bf3856ad364e35\ehiUPnP.dll" "C:\Program Files\Windows Media Center\ehome\ehiUPnP.dll"
    3⤵
    - Executes a command shell one-liner
    PID:2600
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "ehiUPnP, Version=6.3.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:1
    3⤵
    PID:2412
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c mklink /h "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.MediaCenter.UI\v4.0_6.3.0.0__31bf3856ad364e35\Microsoft.MediaCenter.UI.dll" "C:\Program Files\Windows Media Center\ehome\Microsoft.MediaCenter.UI.dll"
    3⤵
    - Executes a command shell one-liner
    PID:6232
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "Microsoft.MediaCenter.UI, Version=6.3.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:1
    3⤵
    PID:1940
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c mklink /h "C:\Windows\Microsoft.NET\assembly\GAC_64\Mcx2Dvcs\v4.0_6.3.0.0__31bf3856ad364e35\Mcx2Dvcs.dll" "C:\Program Files\Windows Media Center\ehome\Mcx2Dvcs.dll"
    3⤵
    - Executes a command shell one-liner
    PID:3976
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "Mcx2Dvcs, Version=6.3.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=amd64" /NoDependencies /queue:1
    3⤵
    PID:896
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c mklink /h "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.MediaCenter.iTV\v4.0_6.3.0.0__31bf3856ad364e35\Microsoft.MediaCenter.iTV.dll" "C:\Program Files\Windows Media Center\ehome\Microsoft.MediaCenter.iTV.dll"
    3⤵
    - Executes a command shell one-liner
    PID:4468
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "Microsoft.MediaCenter.iTV, Version=6.3.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:1
    3⤵
    PID:3720
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c mklink /h "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ehRecObj\v4.0_6.3.0.0__31bf3856ad364e35\ehRecObj.dll" "C:\Program Files\Windows Media Center\ehome\ehRecObj.dll"
    3⤵
    - Executes a command shell one-liner
    PID:4152
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "ehRecObj, Version=6.3.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:1
    3⤵
    PID:700
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c mklink /h "C:\Windows\Microsoft.NET\assembly\GAC_32\BDATunePIA\v4.0_6.3.0.0__31bf3856ad364e35\BDATunePIA.dll" "C:\Program Files\Windows Media Center\ehome\wow\BDATunePIA.dll"
    3⤵
    - Executes a command shell one-liner
    PID:6764
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe" install "BDATunePIA, Version=6.3.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=x86" /NoDependencies /queue:1
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2136
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c mklink /h "C:\Windows\Microsoft.NET\assembly\GAC_32\mcstoredb\v4.0_6.3.0.0__31bf3856ad364e35\mcstoredb.dll" "C:\Program Files\Windows Media Center\ehome\wow\mcstoredb.dll"
    3⤵
    - Executes a command shell one-liner
    PID:5076
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe" install "mcstoredb, Version=6.3.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=x86" /NoDependencies /queue:1
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:3392
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c mklink /h "C:\Windows\Microsoft.NET\assembly\GAC_32\ehexthost32\v4.0_6.3.0.0__31bf3856ad364e35\ehexthost32.exe" "C:\Program Files\Windows Media Center\ehome\wow\ehexthost32.exe"
    3⤵
    - Executes a command shell one-liner
    PID:3748
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe" install "ehexthost32, Version=6.3.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=x86" /NoDependencies /queue:1
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2996
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c mklink /h "C:\Windows\Microsoft.NET\assembly\GAC_32\ehexthost32\v4.0_6.3.0.0__31bf3856ad364e35\ehexthost32.exe.config" "C:\Program Files\Windows Media Center\ehome\wow\ehexthost32.exe.config"
    3⤵
    - Executes a command shell one-liner
    PID:5744
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe" install "ehiExtens, Version=6.3.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:1
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:1704
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe" install "Microsoft.MediaCenter, Version=6.3.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:1
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4156
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe" install "Microsoft.MediaCenter.UI, Version=6.3.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:1
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:6028
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" create ehRecvr binpath= "C:\Program Files\Windows Media Center\ehome\ehRecvr.exe" error= ignore start= demand type= own DisplayName= "@C:\Program Files\Windows Media Center\ehome\ehRecvr.exe,-101" depend= RPCSS obj= "NT AUTHORITY\NetworkService"
    3⤵
    - Launches sc.exe
    PID:6024
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" create ehSched binpath= "C:\Program Files\Windows Media Center\ehome\ehSched.exe" error= ignore start= demand type= own DisplayName= "@C:\Program Files\Windows Media Center\ehome\ehSched.exe,-101" depend= RPCSS obj= "NT AUTHORITY\NetworkService"
    3⤵
    - Launches sc.exe
    PID:3160
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" create Mcx2Svc binpath= "C:\Windows\System32\svchost.exe -k LocalServiceAndNoImpersonation" error= normal start= demand type= share DisplayName= "@C:\Program Files\Windows Media Center\ehome\ehres.dll,-15501" depend= SSDPSRV/DeviceAssociationService/TermService/fdphost obj= "NT Authority\LocalService"
    3⤵
    - Launches sc.exe
    PID:5864
- - C:\Program Files\Windows Media Center\SetACL.exe
    "C:\Program Files\Windows Media Center\SetACL.exe" -on "HKLM\SYSTEM\CurrentControlSet\Services\ADOVMPPackage" -ot reg -actn setowner -ownr "n:S-1-5-32-544;s:y" -rec yes
    3⤵
    - Executes dropped EXE
    PID:2712
- - C:\Program Files\Windows Media Center\SetACL.exe
    "C:\Program Files\Windows Media Center\SetACL.exe" -on "HKLM\SYSTEM\CurrentControlSet\Services\ADOVMPPackage" -ot reg -actn ace -ace "n:S-1-5-32-544;s:y;p:full" -rec yes
    3⤵
    - Executes dropped EXE
    PID:6860
- - C:\Program Files\Windows Media Center\SetACL.exe
    "C:\Program Files\Windows Media Center\SetACL.exe" -on "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\InboxApp" -ot reg -actn setowner -ownr "n:S-1-5-32-544;s:y" -rec yes
    3⤵
    - Executes dropped EXE
    PID:6772
- - C:\Program Files\Windows Media Center\SetACL.exe
    "C:\Program Files\Windows Media Center\SetACL.exe" -on "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\InboxApp" -ot reg -actn ace -ace "n:S-1-5-32-544;s:y;p:full" -rec yes
    3⤵
    - Executes dropped EXE
    PID:6132
- - C:\Program Files\Windows Media Center\SetACL.exe
    "C:\Program Files\Windows Media Center\SetACL.exe" -on "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\WindowsFeatureCategories" -ot reg -actn setowner -ownr "n:S-1-5-32-544;s:y" -rec yes
    3⤵
    - Executes dropped EXE
    PID:1116
- - C:\Program Files\Windows Media Center\SetACL.exe
    "C:\Program Files\Windows Media Center\SetACL.exe" -on "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\WindowsFeatureCategories" -ot reg -actn ace -ace "n:S-1-5-32-544;s:y;p:full" -rec yes
    3⤵
    - Executes dropped EXE
    PID:3360
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" import "C:\Program Files\Windows Media Center\Install.reg"
    3⤵
    - Modifies firewall policy service
    - Server Software Component: Terminal Services DLL
    - Sets service image path in registry
    - Modifies Internet Explorer settings
    - Modifies registry class
    PID:5116
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" import "C:\Program Files\Windows Media Center\RestoreSqlCe.reg"
    3⤵
    - Modifies registry class
    PID:6632
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /tn "\Microsoft\Windows\Media Center\ActivateWindowsSearch" /xml "C:\Program Files\Windows Media Center\tasks\ActivateWindowsSearch.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6652
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /tn "\Microsoft\Windows\Media Center\ConfigureInternetTimeService" /xml "C:\Program Files\Windows Media Center\tasks\ConfigureInternetTimeService.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7108
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /tn "\Microsoft\Windows\Media Center\DispatchRecoveryTasks" /xml "C:\Program Files\Windows Media Center\tasks\DispatchRecoveryTasks.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1208
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /tn "\Microsoft\Windows\Media Center\ehDRMInit" /xml "C:\Program Files\Windows Media Center\tasks\ehDRMInit.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4676
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /tn "\Microsoft\Windows\Media Center\InstallPlayReady" /xml "C:\Program Files\Windows Media Center\tasks\InstallPlayReady.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4888
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /tn "\Microsoft\Windows\Media Center\mcupdate" /xml "C:\Program Files\Windows Media Center\tasks\mcupdate.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6140
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /tn "\Microsoft\Windows\Media Center\mcupdate_scheduled" /xml "C:\Program Files\Windows Media Center\tasks\mcupdate_scheduled.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1280
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /tn "\Microsoft\Windows\Media Center\MediaCenterRecoveryTask" /xml "C:\Program Files\Windows Media Center\tasks\MediaCenterRecoveryTask.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4236
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /tn "\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask" /xml "C:\Program Files\Windows Media Center\tasks\ObjectStoreRecoveryTask.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6660
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /tn "\Microsoft\Windows\Media Center\OCURActivate" /xml "C:\Program Files\Windows Media Center\tasks\OCURActivate.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2648
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /tn "\Microsoft\Windows\Media Center\OCURDiscovery" /xml "C:\Program Files\Windows Media Center\tasks\OCURDiscovery.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2180
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /tn "\Microsoft\Windows\Media Center\PBDADiscovery" /xml "C:\Program Files\Windows Media Center\tasks\PBDADiscovery.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2888
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /tn "\Microsoft\Windows\Media Center\PBDADiscoveryW1" /xml "C:\Program Files\Windows Media Center\tasks\PBDADiscoveryW1.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5380
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /tn "\Microsoft\Windows\Media Center\PBDADiscoveryW2" /xml "C:\Program Files\Windows Media Center\tasks\PBDADiscoveryW2.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5448
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /tn "\Microsoft\Windows\Media Center\PeriodicScanRetry" /xml "C:\Program Files\Windows Media Center\tasks\PeriodicScanRetry.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5812
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /tn "\Microsoft\Windows\Media Center\PvrRecoveryTask" /xml "C:\Program Files\Windows Media Center\tasks\PvrRecoveryTask.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4516
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /tn "\Microsoft\Windows\Media Center\PvrScheduleTask" /xml "C:\Program Files\Windows Media Center\tasks\PvrScheduleTask.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1688
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /tn "\Microsoft\Windows\Media Center\RecordingRestart" /xml "C:\Program Files\Windows Media Center\tasks\RecordingRestart.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5744
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6732
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /tn "\Microsoft\Windows\Media Center\RegisterSearch" /xml "C:\Program Files\Windows Media Center\tasks\RegisterSearch.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:464
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1404
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /tn "\Microsoft\Windows\Media Center\ReindexSearchRoot" /xml "C:\Program Files\Windows Media Center\tasks\ReindexSearchRoot.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2464
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1944
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /tn "\Microsoft\Windows\Media Center\SqlLiteRecoveryTask" /xml "C:\Program Files\Windows Media Center\tasks\SqlLiteRecoveryTask.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3024
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5336
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /tn "\Microsoft\Windows\Media Center\StartRecording" /xml "C:\Program Files\Windows Media Center\tasks\StartRecording.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6528
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6324
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /tn "\Microsoft\Windows\Media Center\UpdateRecordPath" /xml "C:\Program Files\Windows Media Center\tasks\UpdateRecordPath.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3540
- - C:\Program Files\Windows Media Center\SetACL.exe
    "C:\Program Files\Windows Media Center\SetACL.exe" -on "HKLM\SOFTWARE\Clients\Media\Windows Media Center" -ot reg -actn restore -bckp .\AclSoft
    3⤵
    - Executes dropped EXE
    PID:4860
- - C:\Program Files\Windows Media Center\SetACL.exe
    "C:\Program Files\Windows Media Center\SetACL.exe" -on "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Media Center" -ot reg -actn restore -bckp .\AclSoftWow
    3⤵
    - Executes dropped EXE
    PID:4420
- - C:\Program Files\Windows Media Center\SetACL.exe
    "C:\Program Files\Windows Media Center\SetACL.exe" -on "HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Media Center" -ot reg -actn restore -bckp .\AclSys
    3⤵
    - Executes dropped EXE
    PID:6552
- - C:\Program Files\Windows Media Center\SetACL.exe
    "C:\Program Files\Windows Media Center\SetACL.exe" -on "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Media Center" -ot reg -actn restore -bckp .\AclTaskCache
    3⤵
    - Executes dropped EXE
    PID:4604
- - C:\Program Files\Windows Media Center\ehome\ehtray.exe
    "C:\Program Files\Windows Media Center\ehome\ehtray.exe" /surviveehschedtermination
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies data under HKEY_USERS
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:4672
- C:\Program Files\Windows Media Center\windows10.0-kb3106246-x64.exe
  "C:\Program Files\Windows Media Center\windows10.0-kb3106246-x64.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:556
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec.exe /i C:\Users\Admin\AppData\Local\Temp\MSI8677.tmp
    3⤵
    - Enumerates connected drives
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:6636

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:6360

C:\Program Files\Windows Media Center\ehome\ehsched.exe
"C:\Program Files\Windows Media Center\ehome\ehSched.exe"
1⤵
- Executes dropped EXE
PID:4644

C:\Program Files\Windows Media Center\ehome\ehrecvr.exe
"C:\Program Files\Windows Media Center\ehome\ehRecvr.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:108

C:\Windows\ehome\ehprivjob.exe
C:\Windows\ehome\ehPrivJob.exe
1⤵
- Executes dropped EXE
PID:3460

C:\Windows\ehome\mcupdate.exe
C:\Windows\ehome\mcupdate.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2016

C:\Windows\ehome\mcupdate.exe
C:\Windows\ehome\MCUpdate.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3256

C:\Windows\ehome\ehrec.exe
C:\Windows\ehome\ehrec.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6200

C:\Windows\ehome\ehsched.exe
C:\Windows\ehome\ehsched.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3284

C:\Windows\ehome\ehRec.exe
C:\Windows\ehome\ehRec.exe -Embedding
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1080

C:\Windows\ehome\ehPrivJob.exe
"C:\Windows\ehome\ehPrivJob.exe" /DoUpdateRecordPath /Event:Global\MediaCenter_UpdateRecordPath_6240814875
1⤵
- Executes dropped EXE
PID:3388

C:\Windows\ehome\ehPrivJob.exe
"C:\Windows\ehome\ehPrivJob.exe" /DoRecoveryTasks
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry