6df36c8d6d21519ac003ebbf299f0a9cd02087e6baca2d957861b2b2f086ad8d

Analysis

max time kernel
148s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SPGlobalRtdServerSetup64.msi
Size 8.5MB
Sample260802-wt91xayeqe
SHA256 6df36c8d6d21519ac003ebbf299f0a9cd02087e6baca2d957861b2b2f086ad8d
MD5 f29dd4529a6c590414c7817a286e64c4
SHA1 2e9aea157e96b29718667ccb149071cc247fc65f
SHA512 f8b1b1570fa1f54e2c56cca56e1ebcac967c481463e9b97cd5489301fe2b44314781bb19e781d2c1869073af51b3ad38ddfc92ab53fbe47611756dd4558bbfe4
SSDEEP 196608:46txSbUXvyX2u0VAlT0MOBQphlYmCegIuxhj6WbTfV6I:4rbUXPCTxFhlLCQu7ZLV6I
TLSH
T17E962300B565CE2FC693A234A9FDE77089192D023565431C7AF43D973BB0B90F6A6E39
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery persistence privilege_escalation ransomware spyware trojan

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 1 IoCs

pid	Process
2608	adxregistrator.exe

Loads dropped DLL 19 IoCs

pid	Process
1180	MsiExec.exe
3372	rundll32.exe
3372	rundll32.exe
3372	rundll32.exe
3372	rundll32.exe
3372	rundll32.exe
2608	adxregistrator.exe
2608	adxregistrator.exe
2608	adxregistrator.exe
2608	adxregistrator.exe
2608	adxregistrator.exe
2608	adxregistrator.exe
2608	adxregistrator.exe
2608	adxregistrator.exe
2608	adxregistrator.exe
2608	adxregistrator.exe
2608	adxregistrator.exe
2608	adxregistrator.exe
2448	regsvr32.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	adxregistrator.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe

Drops file in Program Files directory 49 IoCs

description	ioc	Process
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\SPGMISFToolkitRtdServer.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\NSpring.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\DundasWebChart.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\IHSMarkitToolkitDiagnosticTools.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\SPGMISFToolkitUninstaller.exe.config	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\addin_config.xml	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\SPGMISFToolkitComAddin.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\adxregistrator.exe	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\adxloader.dll.manifest	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\sp_global_logo.ico	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\edtFTPnetPRO.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\Interop.Office.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\Newtonsoft.Json.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\MSFRtdShim.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\extensibility.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\RegisterShim.vbs	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\AddinExpress.XL.2005.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\SPGlobal.com.url	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\Images\markit_logo.ico	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\adxloader64.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\DxlApiCommon.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\Interop.Excel.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\ICSharpCode.SharpZipLib.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\Images\sp_global_logo.ico	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\field_config.bin	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\IHSMarkitAddin.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\DxlClientCommon.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\UnregisterShim.vbs	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\DxlClientCommon.dll.config	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\Microsoft.Office.Interop.Excel.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\SPGMISFToolkitUninstaller.exe	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\Installer.ico	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\adxloader.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\AddinExpress.MSO.2005.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\Office.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\log4net.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\SPGMISFToolkitAdminTool64.exe	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\DxlApiClient.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\Utilities.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\SpreadsheetGear.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\sp_global_installer_banner.jpg	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\FTPCom.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\SPGMISFToolkitAdminTool64.exe.config	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\Images\RefEdit.bmp	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\Markit.ShellHandler.exe	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\Interop.VBIDE.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\stdole.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\rtdlocal_config.xml	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\Images\InternalField.bmp	msiexec.exe

Drops file in Windows directory 41 IoCs

description	ioc	Process
File created	C:\Windows\Installer\$PatchCache$\Managed\2B6AB29170146ED468E2BF0A869012C1\10.0.1\vcruntime140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\2B6AB29170146ED468E2BF0A869012C1\10.0.1\msvcp140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\2B6AB29170146ED468E2BF0A869012C1\10.0.1\vccorlib140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a01c6.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{192BA6B2-4107-4DE6-862E-FBA06809211C}	msiexec.exe
File opened for modification	C:\Windows\Installer\{192BA6B2-4107-4DE6-862E-FBA06809211C}\_MSF_ICN_300	msiexec.exe
File created	C:\Windows\SystemTemp\~DFACB345F75B4D3E75.TMP	msiexec.exe
File created	C:\Windows\Installer\e5a01c6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI11E4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2B6AB29170146ED468E2BF0A869012C1\10.0.1\concrt140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2B6AB29170146ED468E2BF0A869012C1\10.0.1\vcruntime140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\{192BA6B2-4107-4DE6-862E-FBA06809211C}\_MSF_ICN_400	msiexec.exe
File created	C:\Windows\Installer\e5a01c8.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB610410FE059EED5.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF1CD3B087B02F263.TMP	msiexec.exe
File created	C:\Windows\assembly\GACLock.dat	msiexec.exe
File created	C:\Windows\Installer\{192BA6B2-4107-4DE6-862E-FBA06809211C}\_MSF_ICN_300	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6F6.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2B6AB29170146ED468E2BF0A869012C1	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2B6AB29170146ED468E2BF0A869012C1\10.0.1	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\2B6AB29170146ED468E2BF0A869012C1\10.0.1\concrt140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2B6AB29170146ED468E2BF0A869012C1\10.0.1\msvcp140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2B6AB29170146ED468E2BF0A869012C1\10.0.1\msvcp140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\2B6AB29170146ED468E2BF0A869012C1\10.0.1\msvcp140_2.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\SystemTemp\~DF29620A9EE2DAC47F.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6F6.tmp-\MSFToolkitCustomAction.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\2B6AB29170146ED468E2BF0A869012C1\10.0.1\msvcp140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2B6AB29170146ED468E2BF0A869012C1\10.0.1\msvcp140_2.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2B6AB29170146ED468E2BF0A869012C1\10.0.1\vccorlib140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\{192BA6B2-4107-4DE6-862E-FBA06809211C}\_MSF_ICN_200	msiexec.exe
File opened for modification	C:\Windows\assembly\tmp\494CQRZE\__AssemblyInfo__.ini	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6F6.tmp	msiexec.exe
File created	C:\Windows\Installer\{192BA6B2-4107-4DE6-862E-FBA06809211C}\_MSF_ICN_100	msiexec.exe
File opened for modification	C:\Windows\Installer\{192BA6B2-4107-4DE6-862E-FBA06809211C}\_MSF_ICN_100	msiexec.exe
File opened for modification	C:\Windows\Installer\{192BA6B2-4107-4DE6-862E-FBA06809211C}\_MSF_ICN_200	msiexec.exe
File opened for modification	C:\Windows\Installer\{192BA6B2-4107-4DE6-862E-FBA06809211C}\_MSF_ICN_400	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6F6.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\assembly\tmp\494CQRZE\Office.dll	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3872	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adxregistrator.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000067831fc6f5c7bf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380167831fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410167831fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e367831fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e667831fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\excel.exe = "11001"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\SPGMISFToolkitAdminTool64.exe = "11001"	msiexec.exe

Modifies data under HKEY_USERS 13 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\Telemetry\msiexec.exe\VBScriptSetScriptStateStarted = "240789031"	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script\Settings\Telemetry\msiexec.exe	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\Telemetry\msiexec.exe	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\JITDebug = "0"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\Telemetry	MsiExec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{69D6E382-F743-39C6-B771-0A52D5D8E20E}\InprocServer32\1.0.0.0\CodeBase = "file:///C:/Program Files/S&P Global/SPGMI Securities Finance Toolkit/SPGMISFToolkitComAddin.DLL"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E05F6F9-C82F-3447-ACD7-DA84FE20D903}\InprocServer32\Assembly = "SPGMISFToolkitComAddin, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A3B03BD6-37B1-35F4-A07E-867B8C620052}	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{69D75AAB-1684-3ACC-A7D7-36F163C07947}\InprocServer32\CodeBase = "file:///C:/Program Files/S&P Global/SPGMI Securities Finance Toolkit/SPGMISFToolkitComAddin.DLL"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1684886F-7C77-3C72-A396-5674D9E36E83}\InprocServer32\1.0.0.0	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{520D0E22-1424-3A5B-B718-10BF93DBBDAE}\InprocServer32\1.0.0.0	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69D75AAB-1684-3ACC-A7D7-36F163C07947}\ = "Sfs.DxlComAddin.Controls.ReferenceButton"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4D2734FC-4164-3D58-8712-C4E6631DD5D0}	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8E05F6F9-C82F-3447-ACD7-DA84FE20D903}\InprocServer32\1.0.0.0	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{91F8320E-3B7C-3073-A812-3A72FAD10B71}\InprocServer32	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4D2734FC-4164-3D58-8712-C4E6631DD5D0}\ProgId\ = "Sfs.DxlComAddin.Forms.OptionsForm"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F650B0D2-9DC0-391E-9332-D78696F11C64}	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1684886F-7C77-3C72-A396-5674D9E36E83}\ = "Sfs.DxlComAddin.DataModel.RssReaderErrorEventArgs"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{52EED5F8-68AC-3215-B012-85BDC5244249}\InprocServer32\CodeBase = "file:///C:/Program Files/S&P Global/SPGMI Securities Finance Toolkit/SPGMISFToolkitComAddin.DLL"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8E05F6F9-C82F-3447-ACD7-DA84FE20D903}\Implemented Categories	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{520D0E22-1424-3A5B-B718-10BF93DBBDAE}	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{520D0E22-1424-3A5B-B718-10BF93DBBDAE}\InprocServer32\RuntimeVersion = "v4.0.30319"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4D2734FC-4164-3D58-8712-C4E6631DD5D0}\Implemented Categories	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F52BFC0-0F0D-3679-A838-DE58D48CA11C}\InprocServer32\1.0.0.0\CodeBase = "file:///C:/Program Files/S&P Global/SPGMI Securities Finance Toolkit/SPGMISFToolkitComAddin.DLL"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Sfs.DxlComAddin.Controls.ImageCombo\ = "Sfs.DxlComAddin.Controls.ImageCombo"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F650B0D2-9DC0-391E-9332-D78696F11C64}\InprocServer32\1.0.0.0\Class = "Sfs.DxlComAddin.AddinConfig"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF906BA0-90C2-3D59-A106-B06AD3BFF17F}\ProgId	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6A60D964-5C0C-342C-8828-A20B2941FC54}\InprocServer32	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{851F3C58-7FF7-3455-B510-6DEEA597521A}\InprocServer32\1.0.0.0	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{851F3C58-7FF7-3455-B510-6DEEA597521A}\InprocServer32\1.0.0.0\RuntimeVersion = "v4.0.30319"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{DCBAE3A2-9F72-40DA-957F-DB7AAF9B8F78}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C7BC93F9-6FDC-435E-BB96-D67E4556FE2F}\InprocServer32\RuntimeVersion = "v4.0.30319"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{91F8320E-3B7C-3073-A812-3A72FAD10B71}\InprocServer32\1.0.0.0\Class = "Sfs.DxlComAddin.DataModel.RssItems"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69D75AAB-1684-3ACC-A7D7-36F163C07947}\InprocServer32	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E9B1AF83-EC6B-3FB7-8A80-4F5332BF4DF1}\InprocServer32\1.0.0.0\RuntimeVersion = "v4.0.30319"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{851F3C58-7FF7-3455-B510-6DEEA597521A}\Implemented Categories	adxregistrator.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B6AB29170146ED468E2BF0A869012C1\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\_SPGMISFToolkitComAddin.AddinModule\CLSID	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C7BC93F9-6FDC-435E-BB96-D67E4556FE2F}\InprocServer32\1.0.0.0\RuntimeVersion = "v4.0.30319"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{520D0E22-1424-3A5B-B718-10BF93DBBDAE}\InprocServer32	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{52EED5F8-68AC-3215-B012-85BDC5244249}\Implemented Categories	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F2180381-9EB5-3488-B6C7-85227C48C4A7}\InprocServer32\Assembly = "SPGMISFToolkitComAddin, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69D6E382-F743-39C6-B771-0A52D5D8E20E}\InprocServer32\Class = "Sfs.DxlComAddin.DataModel.RssHtmlMaker"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E7B479D-0B42-3843-BFB3-B20C36FB2FB8}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69D6E382-F743-39C6-B771-0A52D5D8E20E}\ProgId\ = "Sfs.DxlComAddin.DataModel.RssHtmlMaker"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6A60D964-5C0C-342C-8828-A20B2941FC54}\InprocServer32\Assembly = "SPGMISFToolkitComAddin, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E7B479D-0B42-3843-BFB3-B20C36FB2FB8}\InprocServer32\CodeBase = "file:///C:/Program Files/S&P Global/SPGMI Securities Finance Toolkit/SPGMISFToolkitComAddin.DLL"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E05F6F9-C82F-3447-ACD7-DA84FE20D903}\InprocServer32\1.0.0.0\CodeBase = "file:///C:/Program Files/S&P Global/SPGMI Securities Finance Toolkit/SPGMISFToolkitComAddin.DLL"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BF906BA0-90C2-3D59-A106-B06AD3BFF17F}\InprocServer32\1.0.0.0	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Sfs.DxlComAddin.Controls.ButtonEx	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF906BA0-90C2-3D59-A106-B06AD3BFF17F}\InprocServer32\CodeBase = "file:///C:/Program Files/S&P Global/SPGMI Securities Finance Toolkit/SPGMISFToolkitComAddin.DLL"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69D6E382-F743-39C6-B771-0A52D5D8E20E}\ProgId	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Sfs.DxlComAddin.Controls.ComboIdentifierControl\CLSID\ = "{A3B03BD6-37B1-35F4-A07E-867B8C620052}"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E7B479D-0B42-3843-BFB3-B20C36FB2FB8}\InprocServer32\Assembly = "SPGMISFToolkitComAddin, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6A60D964-5C0C-342C-8828-A20B2941FC54}\InprocServer32\1.0.0.0	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4F52BFC0-0F0D-3679-A838-DE58D48CA11C}\ProgId	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B6AB29170146ED468E2BF0A869012C1\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DCBAE3A2-9F72-40DA-957F-DB7AAF9B8F78}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4F52BFC0-0F0D-3679-A838-DE58D48CA11C}\ = "Sfs.DxlComAddin.Controls.ComboBoxItem"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5D861C57-D326-441E-9D97-4DCE88B6A175}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6A60D964-5C0C-342C-8828-A20B2941FC54}\InprocServer32\Class = "Sfs.DxlComAddin.Controls.CollapsiblePanel"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE196C0B-3B7E-3746-9F7D-2983457E0E8C}\InprocServer32\Assembly = "SPGMISFToolkitComAddin, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E05F6F9-C82F-3447-ACD7-DA84FE20D903}\InprocServer32\ThreadingModel = "Both"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E05F6F9-C82F-3447-ACD7-DA84FE20D903}\InprocServer32\RuntimeVersion = "v4.0.30319"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6A5D03D-D408-3D6F-B5A9-A6ED75797C56}\InprocServer32\1.0.0.0\RuntimeVersion = "v4.0.30319"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Sfs.DxlComAddin.DataModel.RssHtmlMaker	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{69D75AAB-1684-3ACC-A7D7-36F163C07947}\ProgId\ = "Sfs.DxlComAddin.Controls.ReferenceButton"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{91F8320E-3B7C-3073-A812-3A72FAD10B71}\InprocServer32\ = "mscoree.dll"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF906BA0-90C2-3D59-A106-B06AD3BFF17F}\InprocServer32\RuntimeVersion = "v4.0.30319"	adxregistrator.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3372	rundll32.exe
3372	rundll32.exe
4608	msiexec.exe
4608	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3872	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3872	msiexec.exe
Token: SeSecurityPrivilege	4608	msiexec.exe
Token: SeCreateTokenPrivilege	3872	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3872	msiexec.exe
Token: SeLockMemoryPrivilege	3872	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3872	msiexec.exe
Token: SeMachineAccountPrivilege	3872	msiexec.exe
Token: SeTcbPrivilege	3872	msiexec.exe
Token: SeSecurityPrivilege	3872	msiexec.exe
Token: SeTakeOwnershipPrivilege	3872	msiexec.exe
Token: SeLoadDriverPrivilege	3872	msiexec.exe
Token: SeSystemProfilePrivilege	3872	msiexec.exe
Token: SeSystemtimePrivilege	3872	msiexec.exe
Token: SeProfSingleProcessPrivilege	3872	msiexec.exe
Token: SeIncBasePriorityPrivilege	3872	msiexec.exe
Token: SeCreatePagefilePrivilege	3872	msiexec.exe
Token: SeCreatePermanentPrivilege	3872	msiexec.exe
Token: SeBackupPrivilege	3872	msiexec.exe
Token: SeRestorePrivilege	3872	msiexec.exe
Token: SeShutdownPrivilege	3872	msiexec.exe
Token: SeDebugPrivilege	3872	msiexec.exe
Token: SeAuditPrivilege	3872	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3872	msiexec.exe
Token: SeChangeNotifyPrivilege	3872	msiexec.exe
Token: SeRemoteShutdownPrivilege	3872	msiexec.exe
Token: SeUndockPrivilege	3872	msiexec.exe
Token: SeSyncAgentPrivilege	3872	msiexec.exe
Token: SeEnableDelegationPrivilege	3872	msiexec.exe
Token: SeManageVolumePrivilege	3872	msiexec.exe
Token: SeImpersonatePrivilege	3872	msiexec.exe
Token: SeCreateGlobalPrivilege	3872	msiexec.exe
Token: SeBackupPrivilege	4492	vssvc.exe
Token: SeRestorePrivilege	4492	vssvc.exe
Token: SeAuditPrivilege	4492	vssvc.exe
Token: SeBackupPrivilege	4608	msiexec.exe
Token: SeRestorePrivilege	4608	msiexec.exe
Token: SeRestorePrivilege	4608	msiexec.exe
Token: SeTakeOwnershipPrivilege	4608	msiexec.exe
Token: SeRestorePrivilege	4608	msiexec.exe
Token: SeTakeOwnershipPrivilege	4608	msiexec.exe
Token: SeDebugPrivilege	3372	rundll32.exe
Token: SeRestorePrivilege	4608	msiexec.exe
Token: SeTakeOwnershipPrivilege	4608	msiexec.exe
Token: SeRestorePrivilege	4608	msiexec.exe
Token: SeTakeOwnershipPrivilege	4608	msiexec.exe
Token: SeRestorePrivilege	4608	msiexec.exe
Token: SeTakeOwnershipPrivilege	4608	msiexec.exe
Token: SeDebugPrivilege	2608	adxregistrator.exe
Token: SeRestorePrivilege	4608	msiexec.exe
Token: SeTakeOwnershipPrivilege	4608	msiexec.exe
Token: SeRestorePrivilege	4608	msiexec.exe
Token: SeTakeOwnershipPrivilege	4608	msiexec.exe
Token: SeRestorePrivilege	4608	msiexec.exe
Token: SeTakeOwnershipPrivilege	4608	msiexec.exe
Token: SeRestorePrivilege	4608	msiexec.exe
Token: SeTakeOwnershipPrivilege	4608	msiexec.exe
Token: SeRestorePrivilege	4608	msiexec.exe
Token: SeTakeOwnershipPrivilege	4608	msiexec.exe
Token: SeRestorePrivilege	4608	msiexec.exe
Token: SeTakeOwnershipPrivilege	4608	msiexec.exe
Token: SeRestorePrivilege	4608	msiexec.exe
Token: SeTakeOwnershipPrivilege	4608	msiexec.exe
Token: SeRestorePrivilege	4608	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3872	msiexec.exe
3872	msiexec.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3872	msiexec.exe
4608	msiexec.exe
1180	MsiExec.exe
4784	MsiExec.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 1832	4608	msiexec.exe	95
PID 4608 wrote to memory of 1180	4608	msiexec.exe	97
PID 1180 wrote to memory of 3372	1180	MsiExec.exe	98
PID 4608 wrote to memory of 2608	4608	msiexec.exe	99
PID 4608 wrote to memory of 4784	4608	msiexec.exe	100
PID 4784 wrote to memory of 2448	4784	MsiExec.exe	101

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\SPGlobalRtdServerSetup64.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3872

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1832
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8C077D894BC200BB1531741B98AC38C1
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1180
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI6F6.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240781828 2 MSFToolkitCustomAction!MSFToolkitCustomAction.CustomActions.CloseAppPrompt
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3372
- C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\adxregistrator.exe
  "C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\adxregistrator.exe" /install=SPGMISFToolkitComAddin.dll /privileges=admin
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:2608
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 3250C46336A696DF5431DABCB7A83B88 E Global\MSI0000
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4784
- - C:\Windows\System32\regsvr32.exe
    regsvr32 /s "C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\MSFRTDShim.dll"
    3⤵
    - Loads dropped DLL
    - Modifies registry class
    PID:2448

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5a01c7.rbs

Path C:\Config.Msi\e5a01c7.rbs
Size 27KB
SHA256 821d79d0e9358b8287c8ceae956fc57bc7e62dd5bafb3913c5875b913a71ddaf
MD5 eed01108c1007fc7eb39d046ee401f20
SHA1 450dc5311ba0eb2c6451a67e9a0a5b196c5df19e
SHA512 34e8f463d86534076076c088ee903d666a272e9b082fbc33d5092948348469c70d8c1df1566dc7f9a7e04db3d0ed254fb49e17dc5cad0932053a494bf7ecf606
SSDEEP 768:bzKEB0KQ0k49QRPtQclwsrXlZ/MRSzYqZtH8foIGXdNdciaWMGsn+cUv8HYC2x2A:KEB0KQ0k49QRPtQclwsrXb/MRSzYqZt5
TLSH
T18FD21240994981D6F84E06B98E5717072F15D2A8DB0C133B0BBB9635CF9BBC54BE87CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AddinExpress.MSO.2005.dll

Path C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\AddinExpress.MSO.2005.dll
Size 4.1MB
SHA256 2488b3a307a297d6f7b349f625eebf8f44a6c2dedcbe3d316ecc87a4d434f35b
MD5 83ca15331b56ec1ea0817c82dc78e6c7
SHA1 1d20a2d47194235ce03c1fcaebbf6836bb35be9c
SHA512 c0ebb6b304ed2e7f3e4c8c500a5c6a178f4d1c1a12ab0074a3ab269fc499c2f81b8b063ae40070fad429652136a737254f9ceb7aeb4ff22bf737510c681c0be1
SSDEEP 24576:9Jqi5VZVORDmP1KZslAUg3YMzPgq/X3zRlNGUvggoDF/nwUbN:dORDmP4jDoqbpRogolbN
TLSH
T10A1650239BEC7CEAC43957B5773783DAC3ADEC4A5111D24E65C4212A24BE613BA037C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AddinExpress.XL.2005.dll

Path C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\AddinExpress.XL.2005.dll
Size 665KB
SHA256 a2a349ddbed4a413cc6e5b83c736febae5db58bbd4c40bef3628605207a59f80
MD5 7153f189b36ba3e26195b7aaf5fb2dbe
SHA1 beec232734a30f3ce5be8da11f5e6d51f6f827f6
SHA512 b9a469c46fa79c938dbdf72150ecc7548f7dd2c82fb13245a4820b242f21e9fe72a9f49e6f274668a929c9262b86286279b31835a458789c6544778f28103d9b
SSDEEP 12288:Bd0+xw8CWALBBuYeNJOtFF4ovgH2sUbY63XqIljQ/:w5BMJOtFF4ovgH2I63acjQ/
TLSH
T19CE4391217E87DA7D07E57BD63B65382C778ED06A202E31F46D460AA1CBA352BE007D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DxlApiCommon.dll

Path C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\DxlApiCommon.dll
Size 79KB
SHA256 a21af8a38cba0045b039e4bbae927229161b7dd6e8219dd10abc9d8681d37cae
MD5 659756912fafcbe8b9fc2fa3c3afea57
SHA1 b2d2f15f4c61cc0144e17f3f1e6ecb055fce714a
SHA512 1d6c890cf384e1b47a51e2a69cd22a2e4ed6924d87a18335244041b30f6323923e881b906407da285acbce739d90f6394c28a4526466c75ced0f014f29672173
SSDEEP 1536:XnjjKHrxP5q8Bma/iG+wTMl5EXPqF9T8VlIO74e:+88BLiwTM3IPM9Ta
TLSH
T1AD833A6473ECC66DCACE96B9F550866A43B8C3143963F76C4E98F4CE28437468712277
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DxlClientCommon.dll

Path C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\DxlClientCommon.dll
Size 506KB
SHA256 0152f7ab07acfa451615de423f88c6b8fab6b4d339ca13065dc7765d7ddac67b
MD5 fd91fe911a69ec8dedf3c94812b3afa7
SHA1 2e0d5873fc04383db3c76e972651eb87fe640709
SHA512 39410300cabb94d050432b7f296ab2f1ed5b62f6033eac43fa7ebe849cf0d2177737ea0b33a9de9170d386dcb1720b21eb83f02b80c62da22c4ffd6d8c3071fa
SSDEEP 12288:U0lr7MNfAZQq9gqMEUlpDyH4K54ybc7x7:U+YNfA+q9N3wpDyF54yY1
TLSH
T1D4B4CF1837F94A49EAFB8B38AA70A0404BB7BE47A531FB5D055071CD18B2F618D51B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSFRTDShim.dll

Path C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\MSFRTDShim.dll
Size 71KB
SHA256 82bc104d863dd07d7bcc54751a2d22bd9dd8de6c811b0f40ba0b89390a8f31fd
MD5 7c608ce33b09698342dbff8303c5b392
SHA1 cd8c5d371b5e75ac469c7bc276904cdbf6bddc04
SHA512 72b5067683cb0986b22570f5fb3befb3f3f82bd2a5a9c3282e12018f7c80abb3745c1738ba8a42ba0659b7d51c96422bc87b67d04c9560c6059408e440e2e8d2
SSDEEP 1536:X1uOaaIh456Lf/DpOcTi6BB4XvDRayKT56jEjnBs:XskyS6LVRTi6ivNayKT56jEjn
TLSH
T1CD632957779950E8E176C27889A34B42E7F7B4000F2297CF12A1836E2F36BE49D39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SPGMISFToolkitComAddin.dll

Path C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\SPGMISFToolkitComAddin.dll
Size 3.6MB
SHA256 b5adfef200ed80a5cf9c7a29c1adf135c37c539862d586c58bb47e84e290bd5e
MD5 2f0c54fd805dffc4a36c7d1ba13e4ed5
SHA1 a3a83f484730f9596fc8624dc8573856e509d10b
SHA512 e121ad0e9abd28bd7b74476a414fa9bf2721b1491ab5dc4ddc86e450ea8f008ea8ecf38026111dd1d254260e4182b8c004e6d3dadb4210d53674c09c3a545c88
SSDEEP 6144:fERXdGSnVRv7mFJMx6uCCtLj5PQO3arUH0SxCTllyRMzavk2LDxsyXA/EEhuTtWl:fWJcuond3znXR5
TLSH
T1660604007160CB1EC266227894EDEAB48A595E077498831D3DF47D9B37B0B42F58BE7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Utilities.dll

Path C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\Utilities.dll
Size 400KB
SHA256 49825f5112592aa040383b36ede469cb9a8f0b99546c9e4da3d14107c64fa0f1
MD5 fe52a7e42a785174dd4165f27b9d18e4
SHA1 615cbc7260b53818aa46e92ffe79eae3bb6466e8
SHA512 ca49e37bf3954d40dbe54f4d0c1aef85aea8b294ac20fc0b3f56d68bae823e3b747cd856211c9ef19e37c78aab9d4f4ec954cc8b58acddd3ae74d5f47cdb4d55
SSDEEP 12288:w5+3wH1PEdgLOck29POd9d1YK3WDtKUtC:mHp5k29P1K3WDtKmC
TLSH
T1C7942A0173F8831FE2EE1B39F430556947B4E506BABED76E4A88A5AD2C537819C017B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adxloader.dll.manifest

Path C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\adxloader.dll.manifest
Size 334B
SHA256 aab5136411289b4d66460d8b12822a940fe2d8a30db5958333611fd199dacbb1
MD5 abb01bf446f1e221b2c8d7dbb0605b30
SHA1 6d5b85ad038530fa7363c524bb5a1c6c6d45247c
SHA512 eef9801b4a8d140baa858a408a29ddbf17dc03940982685bdeaf48bf4da42dd75fb2d9c99cd8926faa435d18deca60060da53e90bea7db53845156a042e11567
TLSH
T109E0200645599F239612D5DBF8F2800956F827AAD4045405B56DB1365606C690BE3263
MD5 SHA1 SHA512 TLSH

Submit Download

adxregistrator.exe

Path C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\adxregistrator.exe
Size 167KB
SHA256 80e99c9bd8ebf68900d62e076e683b09098c9be4ecbca90e1eb43251046f202f
MD5 1d6be4e749fef9bf18a0082ee05e5344
SHA1 5b89cc6788c741627b1bb1a8326301169ae65ac9
SHA512 685ac60f731e32d64c9b38f57a1ae9c200a38d826651f698874afceef35b2476c17c1230d6777109439df1c2125854b317520980f117b653feb797b89303dc8e
SSDEEP 3072:qJDLZbxrdIYMldkxLn+9bRUjTxfJs2DDg2:qJv5fIYMlmxLnAUjvs2D7
TLSH
T17DF37C607BD6C472E1A2193265F587626A28BB325B33D0CB775C4AA85F307D1BA3D313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rtdlocal_config.xml

Path C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\rtdlocal_config.xml
Size 912B
SHA256 fb63c862bab8ab22be01309c6404288e7d38661137c461541799b92e7c067981
MD5 349645d9cc73a7e7daec1a41fedfc46c
SHA1 798c9a55aefd9dd588bb4203b0f30d5ca2ebeb54
SHA512 1514de8a604372c326e3a20036d030f89fcd22cc46516abca3e6027493f83ac6efe3c50c01b31087893b63c61a77580cef517100bae9a7779e3293d51d55ed15
TLSH
T13411DC256A5332338824C3F2C23760CA1B712FAA163C047C6E8DB22F26D059C3851E77
MD5 SHA1 SHA512 TLSH

Submit Download

MSI6F6.tmp

Path C:\Windows\Installer\MSI6F6.tmp
Size 248KB
SHA256 365b97da5bb15b785f3932db392b01fc551872147497fd31d11ee6aa8d8eef3f
MD5 203dc2f058f4b9d4f4e47668ad6fc412
SHA1 8927e78968410714edd3c71335ff23fc6283289f
SHA512 446f731072990153c04868342f95d25c260692e317c115479ba1ad2ea8540aa3403c3804927497d5e23f30a0bf205aa7a9e179c0f370f833f2673177dfd1258b
SSDEEP 3072:5Arbg5BxgracGnEnRQOl9WGPotlx9uYGi+GtvkW2dWdhYElg5P16vqDyS:5ArbtraBqLlAGCHtvkW2DElMP1AqDf
TLSH
T17644BE01B6D48471F1BF2E380D34A66549BEBE604F71CA9F6748862E4EB46C0DA35B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSFToolkitCustomAction.dll

Path C:\Windows\Installer\MSI6F6.tmp-\MSFToolkitCustomAction.dll
Size 283KB
SHA256 eb2f5d7ea77c39131179cdfada4dbe7a2407cbfc89562eae1e190b9a72543a55
MD5 b278d0d3559b0ff0380f007c41e6dffc
SHA1 891193511d6382a669c414ad9338fa3ebb04c7b6
SHA512 d0697d6426d0340e96a9c1ea67c81985296e083d6ba3e5a8207c1d73f07bbfcf591d64fba0ff640ab95c262e9691bb2b7fd0086044880590774d9e9f0916d06e
SSDEEP 192:ypLrzRqw8/z7B47xPIeBqFPuvkvwKwq6k9grbbbbbbbbbbbbo/1jl:wYw8r7K7xAk0GkvwKwq6uNtjl
TLSH
T1A3549604B120CA1FC763223895EDEA7198595E1674A4832D39F83D8377B1B82F59AF3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Windows\Installer\MSI6F6.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 179KB
SHA256 cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca
MD5 1a5caea6734fdd07caa514c3f3fb75da
SHA1 f070ac0d91bd337d7952abd1ddf19a737b94510c
SHA512 a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1
SSDEEP 3072:BGfZS7hUuK3PcbFeRRLxyR69UgoCaf8+aCnfKlRUjW01KymkO:9zMRLkR6joxfRPW
TLSH
T159046B2953FC473ACAFF4778E261425197B1F2E67117DB0EEC8181AA2522780F792397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a01c8.msi

Path C:\Windows\Installer\e5a01c8.msi
Size 8.5MB
SHA256 6df36c8d6d21519ac003ebbf299f0a9cd02087e6baca2d957861b2b2f086ad8d
MD5 f29dd4529a6c590414c7817a286e64c4
SHA1 2e9aea157e96b29718667ccb149071cc247fc65f
SHA512 f8b1b1570fa1f54e2c56cca56e1ebcac967c481463e9b97cd5489301fe2b44314781bb19e781d2c1869073af51b3ad38ddfc92ab53fbe47611756dd4558bbfe4
SSDEEP 196608:46txSbUXvyX2u0VAlT0MOBQphlYmCegIuxhj6WbTfV6I:4rbUXPCTxFhlLCQu7ZLV6I
TLSH
T17E962300B565CE2FC693A234A9FDE77089192D023565431C7AF43D973BB0B90F6A6E39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_MSF_ICN_200

Path C:\Windows\Installer\{192BA6B2-4107-4DE6-862E-FBA06809211C}\_MSF_ICN_200
Size 273KB
SHA256 d9f90faaa32abb8dbb3d4ed113ad25edad67a84de39dbeaa84b83e268f22bd7e
MD5 222e93becec18f646e306e6ad60c7a07
SHA1 97816b343566048bf36b20c6af3f37a9f377f169
SHA512 0115c1eeb7fc41e03ca014945825dd8877f0f79aba1eebfbe77734391e868a7f836637166717fb202b89bd44f006eac9b1e160616f83cee6ef90e44f1c91dba1
SSDEEP 48:mZrWUWUWUWUWUWUWUWUWUWUWUWUSPrAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAb:2rbbbbbbbbbbbb
TLSH
T1A6548744B121CB1FC763213895EDEA7198495E1674A8832D39F87D8337B4B82F58AE3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Office.dll

Path C:\Windows\assembly\tmp\494CQRZE\Office.dll
Size 413KB
SHA256 c4519e50471fd5b0d495a1eb010ccf9b34a7af97df4e0d409a9f5147aee9f912
MD5 df7cbcd2db89880a8a92ea134611b038
SHA1 9940cedfb3526e12744c6f358ff90fcbf2cd5bba
SHA512 3bbb3b3ee3189e8699acf4ca01f14535725ed844133c9b5a8494e017c1c283c9c9b4626906ff617bfff014e474e02320183cb61ebdbe95ae792a6f22fcc0d072
SSDEEP 12288:e3LuxZNel6lWlCkZOaU2foNM98c3n/YvmcyjlSonPo:e3LuxZNel6lWljsSjn/Yvv
TLSH
T18F94C446BA1E9013EAC5C73E1577BB5453B9F2410FD2EF4A651D822CAF83688DE036B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 a55dedf2e5f3f1e786e4f6ac3f89cb80c5b3065fcd4301da0fc3044b68c5b566
MD5 e0e105417a0e66696bf0b8012b27e843
SHA1 ad5b3ec1c4866ac6af7524611adb4a1a61a2daa0
SHA512 d20aef0db9071ed75376b09e9c0a31a73300cbaceb4fe1cb4f364cb97491658efd35c45223575bcc199f2f0ac48fe4f5c91b8f64ff0ebdcfdb51b99063f98ebf
SSDEEP 24576:KFo3DMPudoO/vvTL/SwyiCFAvre45LFB0vkwN/8qUn8aZ1jS8Ih2ibYDGuo:VHE
TLSH
T18A57B42436F92100EBF7AE3CA8F06A274D397D57AC16DE8D45511B4D0822F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{da6bc6ac-378c-48c7-9ca0-432423bd1eb1}_OnDiskSnapshotProp

Path \??\Volume{c61f8367-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{da6bc6ac-378c-48c7-9ca0-432423bd1eb1}_OnDiskSnapshotProp
Size 6KB
SHA256 fd561e319c70f0c6f5d348e601e4a7fc7a093b3a298c42b6e7fca536971104a7
MD5 e0c8d6a5a57cdba80019bca8fa4bdf89
SHA1 f397dfc904139366c1234a0c751d2f91cfa9e4d6
SHA512 f9cf53fcaddd01487cdd0cda0f9f460b4d71b03c8a51d98a4679243e58dca3e91f313bebe3b81cc56966f0fbe4fdb335a9a0020e582342bf9b439466f5b22720
SSDEEP 96:F8u99uelunvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:eQ9uzbb++uVmN
TLSH
T157D188185AF54711E2B3AB3129F14557A877B911EF33CB8E0198238E2631A10F875F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SPGMISFToolkitAdminTool64.exe.config

Path \??\c:\program files\s&p global\spgmi securities finance toolkit\SPGMISFToolkitAdminTool64.exe.config
Size 283B
SHA256 888e7829792bb583192468acc472f16ac972e47f6305e81750880146818a12f5
MD5 b940a7ae8967f2016c6fa2a1835f36ad
SHA1 14513ca0bfa631f4f31af5cf1b3e81967a73cf07
SHA512 bf477d15f1f8f8b3e556f36f0285e498c07f659d877007f48e808baa22c4e1c0fc49a78093d69216493568e77dce4946b67c518c7c9cb26456086645156f2e44
TLSH
T1FBD02B063298FE3748E74F63E0324550A7B15E29A264701DF0FE7B73460104B3643335
MD5 SHA1 SHA512 TLSH

Submit Download

SPGMISFToolkitUninstaller.exe.config

Path \??\c:\program files\s&p global\spgmi securities finance toolkit\SPGMISFToolkitUninstaller.exe.config
Size 146B
SHA256 fe29ce4150e251a4fc4ca5db321cd0bdc6dbacd34846735ced5113df056ec3b6
MD5 99ca66a5df246c217028be8caf20c154
SHA1 ff0768ce405c2d8c3b9a100c850de4add6fa9e64
SHA512 15abd3756f4bf31ea63c79d1378517f19c2b16a2fe60ca2b6a7a77c15a79e6b0baf3b0beb40b2ca835d0eb56655ef0d9fac0d82b3316a9f21296e313e9d0a721
TLSH
T19BC09B5945787D3BDC234F6355504952FBF54361F464512CE46FA756061015E8306356
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2608-123-0x0000000007720000-0x0000000007ABA000-memory.dmp

Download

memory/2608-120-0x0000000005970000-0x000000000597A000-memory.dmp

Download

memory/2608-117-0x00000000059D0000-0x0000000005DF4000-memory.dmp

Download

memory/2608-139-0x00000000074C0000-0x0000000007528000-memory.dmp

Download

memory/2608-135-0x00000000062E0000-0x00000000062FA000-memory.dmp

Download

memory/2608-131-0x0000000007410000-0x00000000074B8000-memory.dmp

Download

memory/2608-127-0x0000000007380000-0x0000000007404000-memory.dmp

Download

memory/3372-22-0x0000000003A30000-0x0000000003A7E000-memory.dmp

Download

memory/3372-23-0x0000000006140000-0x00000000066FA000-memory.dmp

Download

memory/3372-18-0x00000000039B0000-0x00000000039DE000-memory.dmp

Download

memory/3372-24-0x0000000005B80000-0x0000000005C12000-memory.dmp

Download

memory/4608-35-0x0000020D4B560000-0x0000020D4B5CA000-memory.dmp

Download