5720d23a5b11b93fc43be8041e3c51fd5255bdcebf9839a87275c7c032d1e69c

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup.exe
Size 421KB
Sample260802-wtyb4sdh52
SHA256 5720d23a5b11b93fc43be8041e3c51fd5255bdcebf9839a87275c7c032d1e69c
MD5 1e596d5b073234478d79746d0e8cb00c
SHA1 b265d3e383217eb2505e7dbabe283a7aeada3a85
SHA512 d0c222cc87f71e3a5487d93740f900b56727bebbc1a409ec01513937c2784e8776e576f3d264fe09dd8653afd7d334bae768c35d36e98a1b73691aabae381e28
SSDEEP 6144:YDYWR5J+Wnp8JZt1u3s+++yPmhbyonmqZ2TLdwMpvXVQF4WaobRu:YDtPJKQ7v5yamCmwj1R
TLSH
T161942812A7E89035F1B34770AB7693A04BBEBC715D36CA1F63C4490E59B5982FD20B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery persistence privilege_escalation ransomware spyware trojan

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	setup.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 1 IoCs

pid	Process
1584	adxregistrator.exe

Loads dropped DLL 19 IoCs

pid	Process
4480	MsiExec.exe
2280	rundll32.exe
2280	rundll32.exe
2280	rundll32.exe
2280	rundll32.exe
2280	rundll32.exe
1584	adxregistrator.exe
1584	adxregistrator.exe
1584	adxregistrator.exe
1584	adxregistrator.exe
1584	adxregistrator.exe
1584	adxregistrator.exe
1584	adxregistrator.exe
1584	adxregistrator.exe
1584	adxregistrator.exe
1584	adxregistrator.exe
1584	adxregistrator.exe
1584	adxregistrator.exe
1044	regsvr32.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	adxregistrator.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Drops file in Program Files directory 49 IoCs

description	ioc	Process
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\SPGMISFToolkitRtdServer.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\adxloader64.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\Installer.ico	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\edtFTPnetPRO.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\NSpring.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\Interop.Office.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\sp_global_installer_banner.jpg	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\adxregistrator.exe	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\adxloader.dll.manifest	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\UnregisterShim.vbs	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\AddinExpress.XL.2005.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\DundasWebChart.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\Images\sp_global_logo.ico	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\SPGMISFToolkitComAddin.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\Markit.ShellHandler.exe	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\sp_global_logo.ico	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\Newtonsoft.Json.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\DxlClientCommon.dll.config	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\Images\InternalField.bmp	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\SPGMISFToolkitUninstaller.exe.config	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\addin_config.xml	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\SPGMISFToolkitUninstaller.exe	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\extensibility.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\RegisterShim.vbs	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\MSFRtdShim.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\Office.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\rtdlocal_config.xml	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\IHSMarkitAddin.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\SPGMISFToolkitAdminTool64.exe	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\Interop.Excel.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\Utilities.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\ICSharpCode.SharpZipLib.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\stdole.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\log4net.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\SPGMISFToolkitAdminTool64.exe.config	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\adxloader.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\DxlApiCommon.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\SpreadsheetGear.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\AddinExpress.MSO.2005.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\SPGlobal.com.url	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\IHSMarkitToolkitDiagnosticTools.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\FTPCom.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\field_config.bin	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\DxlApiClient.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\DxlClientCommon.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\Interop.VBIDE.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\Microsoft.Office.Interop.Excel.dll	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\Images\RefEdit.bmp	msiexec.exe
File created	C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\Images\markit_logo.ico	msiexec.exe

Drops file in Windows directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIC6A6.tmp-\CustomAction.config	rundll32.exe
File created	C:\Windows\assembly\GACLock.dat	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\2B6AB29170146ED468E2BF0A869012C1\10.0.1\concrt140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2B6AB29170146ED468E2BF0A869012C1\10.0.1\msvcp140_2.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\{192BA6B2-4107-4DE6-862E-FBA06809211C}\_MSF_ICN_100	msiexec.exe
File created	C:\Windows\Installer\{192BA6B2-4107-4DE6-862E-FBA06809211C}\_MSF_ICN_300	msiexec.exe
File created	C:\Windows\Installer\e58c5bc.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2B6AB29170146ED468E2BF0A869012C1\10.0.1\concrt140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\2B6AB29170146ED468E2BF0A869012C1\10.0.1\vccorlib140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\2B6AB29170146ED468E2BF0A869012C1\10.0.1\vcruntime140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\e58c5bc.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC6A6.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSICDDB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2B6AB29170146ED468E2BF0A869012C1\10.0.1	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2B6AB29170146ED468E2BF0A869012C1\10.0.1\msvcp140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2B6AB29170146ED468E2BF0A869012C1\10.0.1\vccorlib140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2B6AB29170146ED468E2BF0A869012C1\10.0.1\vcruntime140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\{192BA6B2-4107-4DE6-862E-FBA06809211C}\_MSF_ICN_200	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC6A6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\assembly\tmp\AUOYHD4Q\Office.dll	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\2B6AB29170146ED468E2BF0A869012C1\10.0.1\msvcp140_2.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC6A6.tmp-\MSFToolkitCustomAction.dll	rundll32.exe
File created	C:\Windows\Installer\SourceHash{192BA6B2-4107-4DE6-862E-FBA06809211C}	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2B6AB29170146ED468E2BF0A869012C1	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2B6AB29170146ED468E2BF0A869012C1\10.0.1\msvcp140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\{192BA6B2-4107-4DE6-862E-FBA06809211C}\_MSF_ICN_400	msiexec.exe
File created	C:\Windows\Installer\e58c5be.msi	msiexec.exe
File opened for modification	C:\Windows\assembly\tmp\AUOYHD4Q\__AssemblyInfo__.ini	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\{192BA6B2-4107-4DE6-862E-FBA06809211C}\_MSF_ICN_200	msiexec.exe
File created	C:\Windows\Installer\{192BA6B2-4107-4DE6-862E-FBA06809211C}\_MSF_ICN_100	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\2B6AB29170146ED468E2BF0A869012C1\10.0.1\msvcp140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\2B6AB29170146ED468E2BF0A869012C1\10.0.1\msvcp140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\{192BA6B2-4107-4DE6-862E-FBA06809211C}\_MSF_ICN_300	msiexec.exe
File created	C:\Windows\Installer\{192BA6B2-4107-4DE6-862E-FBA06809211C}\_MSF_ICN_400	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adxregistrator.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ee28096e8f31db0b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000ee28096e0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900ee28096e000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aee28096e000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dee28096e000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\excel.exe = "11001"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\SPGMISFToolkitAdminTool64.exe = "11001"	msiexec.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\JITDebug = "0"	MsiExec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Sfs.DxlComAddin.Forms.OptionsForm\ = "Sfs.DxlComAddin.Forms.OptionsForm"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F650B0D2-9DC0-391E-9332-D78696F11C64}\InprocServer32\1.0.0.0\CodeBase = "file:///C:/Program Files/S&P Global/SPGMI Securities Finance Toolkit/SPGMISFToolkitComAddin.DLL"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{52EED5F8-68AC-3215-B012-85BDC5244249}\InprocServer32\ThreadingModel = "Both"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4D2734FC-4164-3D58-8712-C4E6631DD5D0}\InprocServer32\1.0.0.0\Class = "Sfs.DxlComAddin.Forms.OptionsForm"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1684886F-7C77-3C72-A396-5674D9E36E83}\InprocServer32	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E6A5D03D-D408-3D6F-B5A9-A6ED75797C56}\InprocServer32\RuntimeVersion = "v4.0.30319"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{91F8320E-3B7C-3073-A812-3A72FAD10B71}\ProgId	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4F52BFC0-0F0D-3679-A838-DE58D48CA11C}	adxregistrator.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B6AB29170146ED468E2BF0A869012C1\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4BD78693-C09E-3448-ADDF-5D5B589B2317}\InprocServer32\1.0.0.0\RuntimeVersion = "v4.0.30319"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9D5A12B5-E366-30DE-8F3F-5DAAF2936599}\ProgId\ = "Sfs.DxlComAddin.DataModel.FeedItem"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BF906BA0-90C2-3D59-A106-B06AD3BFF17F}\InprocServer32\Class = "Sfs.DxlComAddin.DataModel.RssReader"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E499A8C7-A35B-30F4-8E1F-647188755DE6}\InprocServer32\ = "mscoree.dll"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{520D0E22-1424-3A5B-B718-10BF93DBBDAE}\InprocServer32\1.0.0.0\Class = "Sfs.DxlComAddin.DataModel.TreeViewState"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4F52BFC0-0F0D-3679-A838-DE58D48CA11C}\InprocServer32\1.0.0.0\Assembly = "SPGMISFToolkitComAddin, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4D2734FC-4164-3D58-8712-C4E6631DD5D0}\ = "Sfs.DxlComAddin.Forms.OptionsForm"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{69D75AAB-1684-3ACC-A7D7-36F163C07947}\InprocServer32\1.0.0.0\RuntimeVersion = "v4.0.30319"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Sfs.DxlComAddin.DxlFormulaParams\CLSID	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E05F6F9-C82F-3447-ACD7-DA84FE20D903}\InprocServer32\1.0.0.0\Assembly = "SPGMISFToolkitComAddin, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BF906BA0-90C2-3D59-A106-B06AD3BFF17F}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{91F8320E-3B7C-3073-A812-3A72FAD10B71}\InprocServer32\1.0.0.0\Class = "Sfs.DxlComAddin.DataModel.RssItems"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Sfs.DxlComAddin.Controls.SplitButton	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E9B1AF83-EC6B-3FB7-8A80-4F5332BF4DF1}\ = "Sfs.DxlComAddin.Controls.StatusBar"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{91F8320E-3B7C-3073-A812-3A72FAD10B71}\InprocServer32\1.0.0.0\Assembly = "SPGMISFToolkitComAddin, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{851F3C58-7FF7-3455-B510-6DEEA597521A}\InprocServer32\1.0.0.0	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6A5D03D-D408-3D6F-B5A9-A6ED75797C56}\ProgId	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1684886F-7C77-3C72-A396-5674D9E36E83}\InprocServer32\RuntimeVersion = "v4.0.30319"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E9B1AF83-EC6B-3FB7-8A80-4F5332BF4DF1}\InprocServer32\1.0.0.0\RuntimeVersion = "v4.0.30319"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F54575D2-7F24-3B83-A069-95AC3EA743FD}\InprocServer32\1.0.0.0\Assembly = "SPGMISFToolkitComAddin, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{52EED5F8-68AC-3215-B012-85BDC5244249}\InprocServer32	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{52EED5F8-68AC-3215-B012-85BDC5244249}\ProgId	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F204194F-97E3-308A-956B-C92325AC191C}\InprocServer32\ThreadingModel = "Both"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4D2734FC-4164-3D58-8712-C4E6631DD5D0}\InprocServer32\ = "mscoree.dll"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF906BA0-90C2-3D59-A106-B06AD3BFF17F}\InprocServer32\CodeBase = "file:///C:/Program Files/S&P Global/SPGMI Securities Finance Toolkit/SPGMISFToolkitComAddin.DLL"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{851F3C58-7FF7-3455-B510-6DEEA597521A}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4F52BFC0-0F0D-3679-A838-DE58D48CA11C}\InprocServer32\CodeBase = "file:///C:/Program Files/S&P Global/SPGMI Securities Finance Toolkit/SPGMISFToolkitComAddin.DLL"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BF906BA0-90C2-3D59-A106-B06AD3BFF17F}\InprocServer32\RuntimeVersion = "v4.0.30319"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D5A12B5-E366-30DE-8F3F-5DAAF2936599}\InprocServer32\RuntimeVersion = "v4.0.30319"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF906BA0-90C2-3D59-A106-B06AD3BFF17F}\InprocServer32\RuntimeVersion = "v4.0.30319"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4C5EA226-D268-3F1A-A90C-87731DA02CB8}\InprocServer32\Class = "Sfs.DxlComAddin.Controls.NumericUpDownControl"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E7B479D-0B42-3843-BFB3-B20C36FB2FB8}\InprocServer32\Class = "Sfs.DxlComAddin.Controls.ImageComboItem"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{DCBAE3A2-9F72-40DA-957F-DB7AAF9B8F78}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{69D75AAB-1684-3ACC-A7D7-36F163C07947}\InprocServer32\ThreadingModel = "Both"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4BD78693-C09E-3448-ADDF-5D5B589B2317}\InprocServer32	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2B6AB29170146ED468E2BF0A869012C1\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE196C0B-3B7E-3746-9F7D-2983457E0E8C}\InprocServer32\1.0.0.0\Class = "Sfs.DxlComAddin.Wrappers.XLLModule"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4D2734FC-4164-3D58-8712-C4E6631DD5D0}\InprocServer32\1.0.0.0\CodeBase = "file:///C:/Program Files/S&P Global/SPGMI Securities Finance Toolkit/SPGMISFToolkitComAddin.DLL"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F2180381-9EB5-3488-B6C7-85227C48C4A7}\Implemented Categories	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A3B03BD6-37B1-35F4-A07E-867B8C620052}\InprocServer32\RuntimeVersion = "v4.0.30319"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Sfs.DxlComAddin.Controls.NumericUpDownControl\CLSID\ = "{4C5EA226-D268-3F1A-A90C-87731DA02CB8}"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F2180381-9EB5-3488-B6C7-85227C48C4A7}\InprocServer32\ = "mscoree.dll"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E9B1AF83-EC6B-3FB7-8A80-4F5332BF4DF1}\InprocServer32\Assembly = "SPGMISFToolkitComAddin, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8E05F6F9-C82F-3447-ACD7-DA84FE20D903}\InprocServer32\1.0.0.0\Assembly = "SPGMISFToolkitComAddin, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D5A12B5-E366-30DE-8F3F-5DAAF2936599}	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A3B03BD6-37B1-35F4-A07E-867B8C620052}\InprocServer32\Assembly = "SPGMISFToolkitComAddin, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F2180381-9EB5-3488-B6C7-85227C48C4A7}\InprocServer32\CodeBase = "file:///C:/Program Files/S&P Global/SPGMI Securities Finance Toolkit/SPGMISFToolkitComAddin.DLL"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F2180381-9EB5-3488-B6C7-85227C48C4A7}\InprocServer32\Class = "Sfs.DxlComAddin.Controls.SplitButton"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D5A12B5-E366-30DE-8F3F-5DAAF2936599}\InprocServer32\Assembly = "SPGMISFToolkitComAddin, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E499A8C7-A35B-30F4-8E1F-647188755DE6}\InprocServer32\1.0.0.0\CodeBase = "file:///C:/Program Files/S&P Global/SPGMI Securities Finance Toolkit/SPGMISFToolkitComAddin.DLL"	adxregistrator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E9B1AF83-EC6B-3FB7-8A80-4F5332BF4DF1}\InprocServer32	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DCBAE3A2-9F72-40DA-957F-DB7AAF9B8F78}\ProgID\ = "MSFRTD.UpdateEvent"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4BD78693-C09E-3448-ADDF-5D5B589B2317}\ProgId\ = "Sfs.DxlComAddin.DxlFormulaParams"	adxregistrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{91F8320E-3B7C-3073-A812-3A72FAD10B71}\ = "Sfs.DxlComAddin.DataModel.RssItems"	adxregistrator.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2280	rundll32.exe
1712	msiexec.exe
1712	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	8	msiexec.exe
Token: SeIncreaseQuotaPrivilege	8	msiexec.exe
Token: SeSecurityPrivilege	1712	msiexec.exe
Token: SeCreateTokenPrivilege	8	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	8	msiexec.exe
Token: SeLockMemoryPrivilege	8	msiexec.exe
Token: SeIncreaseQuotaPrivilege	8	msiexec.exe
Token: SeMachineAccountPrivilege	8	msiexec.exe
Token: SeTcbPrivilege	8	msiexec.exe
Token: SeSecurityPrivilege	8	msiexec.exe
Token: SeTakeOwnershipPrivilege	8	msiexec.exe
Token: SeLoadDriverPrivilege	8	msiexec.exe
Token: SeSystemProfilePrivilege	8	msiexec.exe
Token: SeSystemtimePrivilege	8	msiexec.exe
Token: SeProfSingleProcessPrivilege	8	msiexec.exe
Token: SeIncBasePriorityPrivilege	8	msiexec.exe
Token: SeCreatePagefilePrivilege	8	msiexec.exe
Token: SeCreatePermanentPrivilege	8	msiexec.exe
Token: SeBackupPrivilege	8	msiexec.exe
Token: SeRestorePrivilege	8	msiexec.exe
Token: SeShutdownPrivilege	8	msiexec.exe
Token: SeDebugPrivilege	8	msiexec.exe
Token: SeAuditPrivilege	8	msiexec.exe
Token: SeSystemEnvironmentPrivilege	8	msiexec.exe
Token: SeChangeNotifyPrivilege	8	msiexec.exe
Token: SeRemoteShutdownPrivilege	8	msiexec.exe
Token: SeUndockPrivilege	8	msiexec.exe
Token: SeSyncAgentPrivilege	8	msiexec.exe
Token: SeEnableDelegationPrivilege	8	msiexec.exe
Token: SeManageVolumePrivilege	8	msiexec.exe
Token: SeImpersonatePrivilege	8	msiexec.exe
Token: SeCreateGlobalPrivilege	8	msiexec.exe
Token: SeBackupPrivilege	832	vssvc.exe
Token: SeRestorePrivilege	832	vssvc.exe
Token: SeAuditPrivilege	832	vssvc.exe
Token: SeBackupPrivilege	1712	msiexec.exe
Token: SeRestorePrivilege	1712	msiexec.exe
Token: SeRestorePrivilege	1712	msiexec.exe
Token: SeTakeOwnershipPrivilege	1712	msiexec.exe
Token: SeRestorePrivilege	1712	msiexec.exe
Token: SeTakeOwnershipPrivilege	1712	msiexec.exe
Token: SeDebugPrivilege	2280	rundll32.exe
Token: SeRestorePrivilege	1712	msiexec.exe
Token: SeTakeOwnershipPrivilege	1712	msiexec.exe
Token: SeRestorePrivilege	1712	msiexec.exe
Token: SeTakeOwnershipPrivilege	1712	msiexec.exe
Token: SeRestorePrivilege	1712	msiexec.exe
Token: SeTakeOwnershipPrivilege	1712	msiexec.exe
Token: SeDebugPrivilege	1584	adxregistrator.exe
Token: SeRestorePrivilege	1712	msiexec.exe
Token: SeTakeOwnershipPrivilege	1712	msiexec.exe
Token: SeRestorePrivilege	1712	msiexec.exe
Token: SeTakeOwnershipPrivilege	1712	msiexec.exe
Token: SeRestorePrivilege	1712	msiexec.exe
Token: SeTakeOwnershipPrivilege	1712	msiexec.exe
Token: SeRestorePrivilege	1712	msiexec.exe
Token: SeTakeOwnershipPrivilege	1712	msiexec.exe
Token: SeRestorePrivilege	1712	msiexec.exe
Token: SeTakeOwnershipPrivilege	1712	msiexec.exe
Token: SeRestorePrivilege	1712	msiexec.exe
Token: SeTakeOwnershipPrivilege	1712	msiexec.exe
Token: SeRestorePrivilege	1712	msiexec.exe
Token: SeTakeOwnershipPrivilege	1712	msiexec.exe
Token: SeRestorePrivilege	1712	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
8	msiexec.exe
8	msiexec.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4124 wrote to memory of 8	4124	setup.exe	84
PID 1712 wrote to memory of 4720	1712	msiexec.exe	93
PID 1712 wrote to memory of 4480	1712	msiexec.exe	95
PID 4480 wrote to memory of 2280	4480	MsiExec.exe	96
PID 1712 wrote to memory of 1584	1712	msiexec.exe	97
PID 1712 wrote to memory of 3700	1712	msiexec.exe	98
PID 3700 wrote to memory of 1044	3700	MsiExec.exe	99

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4124
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe" -I "C:\Users\Admin\AppData\Local\Temp\SPGlobalRtdServerSetup64.msi"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:8

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4720
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8E68ED8AB3E763B57CE74DEBF9501ECC
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4480
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIC6A6.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240699250 2 MSFToolkitCustomAction!MSFToolkitCustomAction.CustomActions.CloseAppPrompt
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2280
- C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\adxregistrator.exe
  "C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\adxregistrator.exe" /install=SPGMISFToolkitComAddin.dll /privileges=admin
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:1584
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 20F7B4D7C468DA657D735E5F10C405B0 E Global\MSI0000
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:3700
- - C:\Windows\System32\regsvr32.exe
    regsvr32 /s "C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\MSFRTDShim.dll"
    3⤵
    - Loads dropped DLL
    PID:1044

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58c5bd.rbs

Path C:\Config.Msi\e58c5bd.rbs
Size 27KB
SHA256 3da34e9af25e2faed54754479c8e727e1f58163c4cd65daedf08fee46a0f85f4
MD5 28ea5302946970a9d8016f13b77f76e3
SHA1 c5b665ae54d07a5b9981f778dc5c330b5c7170ed
SHA512 54d6117490f4524a83496809b1f815c7fcc2c4ba519c3bd05b161ca534c3de73d8e99a6acbdf643c9019e342ec977418b564c3b8b0afd9eb867fa31bf34a0e83
SSDEEP 768:LzzEB0KQ0k49QRPtQclwsrXlZ/MRSzYqZtH8foIGXdNdciaWMGsn+cUv8HYC2x2G:jEB0KQ0k49QRPtQclwsrXb/MRSzYqZtr
TLSH
T190D21240994981D6F84E06B98E5717072F15D298DB0C133B0BBB9635CF9BBC54BE87CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AddinExpress.MSO.2005.dll

Path C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\AddinExpress.MSO.2005.dll
Size 4.1MB
SHA256 2488b3a307a297d6f7b349f625eebf8f44a6c2dedcbe3d316ecc87a4d434f35b
MD5 83ca15331b56ec1ea0817c82dc78e6c7
SHA1 1d20a2d47194235ce03c1fcaebbf6836bb35be9c
SHA512 c0ebb6b304ed2e7f3e4c8c500a5c6a178f4d1c1a12ab0074a3ab269fc499c2f81b8b063ae40070fad429652136a737254f9ceb7aeb4ff22bf737510c681c0be1
SSDEEP 24576:9Jqi5VZVORDmP1KZslAUg3YMzPgq/X3zRlNGUvggoDF/nwUbN:dORDmP4jDoqbpRogolbN
TLSH
T10A1650239BEC7CEAC43957B5773783DAC3ADEC4A5111D24E65C4212A24BE613BA037C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AddinExpress.XL.2005.dll

Path C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\AddinExpress.XL.2005.dll
Size 665KB
SHA256 a2a349ddbed4a413cc6e5b83c736febae5db58bbd4c40bef3628605207a59f80
MD5 7153f189b36ba3e26195b7aaf5fb2dbe
SHA1 beec232734a30f3ce5be8da11f5e6d51f6f827f6
SHA512 b9a469c46fa79c938dbdf72150ecc7548f7dd2c82fb13245a4820b242f21e9fe72a9f49e6f274668a929c9262b86286279b31835a458789c6544778f28103d9b
SSDEEP 12288:Bd0+xw8CWALBBuYeNJOtFF4ovgH2sUbY63XqIljQ/:w5BMJOtFF4ovgH2I63acjQ/
TLSH
T19CE4391217E87DA7D07E57BD63B65382C778ED06A202E31F46D460AA1CBA352BE007D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DxlApiCommon.dll

Path C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\DxlApiCommon.dll
Size 79KB
SHA256 a21af8a38cba0045b039e4bbae927229161b7dd6e8219dd10abc9d8681d37cae
MD5 659756912fafcbe8b9fc2fa3c3afea57
SHA1 b2d2f15f4c61cc0144e17f3f1e6ecb055fce714a
SHA512 1d6c890cf384e1b47a51e2a69cd22a2e4ed6924d87a18335244041b30f6323923e881b906407da285acbce739d90f6394c28a4526466c75ced0f014f29672173
SSDEEP 1536:XnjjKHrxP5q8Bma/iG+wTMl5EXPqF9T8VlIO74e:+88BLiwTM3IPM9Ta
TLSH
T1AD833A6473ECC66DCACE96B9F550866A43B8C3143963F76C4E98F4CE28437468712277
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DxlClientCommon.dll

Path C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\DxlClientCommon.dll
Size 506KB
SHA256 0152f7ab07acfa451615de423f88c6b8fab6b4d339ca13065dc7765d7ddac67b
MD5 fd91fe911a69ec8dedf3c94812b3afa7
SHA1 2e0d5873fc04383db3c76e972651eb87fe640709
SHA512 39410300cabb94d050432b7f296ab2f1ed5b62f6033eac43fa7ebe849cf0d2177737ea0b33a9de9170d386dcb1720b21eb83f02b80c62da22c4ffd6d8c3071fa
SSDEEP 12288:U0lr7MNfAZQq9gqMEUlpDyH4K54ybc7x7:U+YNfA+q9N3wpDyF54yY1
TLSH
T1D4B4CF1837F94A49EAFB8B38AA70A0404BB7BE47A531FB5D055071CD18B2F618D51B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSFRtdShim.dll

Path C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\MSFRtdShim.dll
Size 71KB
SHA256 82bc104d863dd07d7bcc54751a2d22bd9dd8de6c811b0f40ba0b89390a8f31fd
MD5 7c608ce33b09698342dbff8303c5b392
SHA1 cd8c5d371b5e75ac469c7bc276904cdbf6bddc04
SHA512 72b5067683cb0986b22570f5fb3befb3f3f82bd2a5a9c3282e12018f7c80abb3745c1738ba8a42ba0659b7d51c96422bc87b67d04c9560c6059408e440e2e8d2
SSDEEP 1536:X1uOaaIh456Lf/DpOcTi6BB4XvDRayKT56jEjnBs:XskyS6LVRTi6ivNayKT56jEjn
TLSH
T1CD632957779950E8E176C27889A34B42E7F7B4000F2297CF12A1836E2F36BE49D39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SPGMISFToolkitComAddin.dll

Path C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\SPGMISFToolkitComAddin.dll
Size 3.6MB
SHA256 b5adfef200ed80a5cf9c7a29c1adf135c37c539862d586c58bb47e84e290bd5e
MD5 2f0c54fd805dffc4a36c7d1ba13e4ed5
SHA1 a3a83f484730f9596fc8624dc8573856e509d10b
SHA512 e121ad0e9abd28bd7b74476a414fa9bf2721b1491ab5dc4ddc86e450ea8f008ea8ecf38026111dd1d254260e4182b8c004e6d3dadb4210d53674c09c3a545c88
SSDEEP 6144:fERXdGSnVRv7mFJMx6uCCtLj5PQO3arUH0SxCTllyRMzavk2LDxsyXA/EEhuTtWl:fWJcuond3znXR5
TLSH
T1660604007160CB1EC266227894EDEAB48A595E077498831D3DF47D9B37B0B42F58BE7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Utilities.dll

Path C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\Utilities.dll
Size 400KB
SHA256 49825f5112592aa040383b36ede469cb9a8f0b99546c9e4da3d14107c64fa0f1
MD5 fe52a7e42a785174dd4165f27b9d18e4
SHA1 615cbc7260b53818aa46e92ffe79eae3bb6466e8
SHA512 ca49e37bf3954d40dbe54f4d0c1aef85aea8b294ac20fc0b3f56d68bae823e3b747cd856211c9ef19e37c78aab9d4f4ec954cc8b58acddd3ae74d5f47cdb4d55
SSDEEP 12288:w5+3wH1PEdgLOck29POd9d1YK3WDtKUtC:mHp5k29P1K3WDtKmC
TLSH
T1C7942A0173F8831FE2EE1B39F430556947B4E506BABED76E4A88A5AD2C537819C017B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adxloader.dll.manifest

Path C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\adxloader.dll.manifest
Size 334B
SHA256 aab5136411289b4d66460d8b12822a940fe2d8a30db5958333611fd199dacbb1
MD5 abb01bf446f1e221b2c8d7dbb0605b30
SHA1 6d5b85ad038530fa7363c524bb5a1c6c6d45247c
SHA512 eef9801b4a8d140baa858a408a29ddbf17dc03940982685bdeaf48bf4da42dd75fb2d9c99cd8926faa435d18deca60060da53e90bea7db53845156a042e11567
TLSH
T109E0200645599F239612D5DBF8F2800956F827AAD4045405B56DB1365606C690BE3263
MD5 SHA1 SHA512 TLSH

Submit Download

adxregistrator.exe

Path C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\adxregistrator.exe
Size 167KB
SHA256 80e99c9bd8ebf68900d62e076e683b09098c9be4ecbca90e1eb43251046f202f
MD5 1d6be4e749fef9bf18a0082ee05e5344
SHA1 5b89cc6788c741627b1bb1a8326301169ae65ac9
SHA512 685ac60f731e32d64c9b38f57a1ae9c200a38d826651f698874afceef35b2476c17c1230d6777109439df1c2125854b317520980f117b653feb797b89303dc8e
SSDEEP 3072:qJDLZbxrdIYMldkxLn+9bRUjTxfJs2DDg2:qJv5fIYMlmxLnAUjvs2D7
TLSH
T17DF37C607BD6C472E1A2193265F587626A28BB325B33D0CB775C4AA85F307D1BA3D313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rtdlocal_config.xml

Path C:\Program Files\S&P Global\SPGMI Securities Finance Toolkit\rtdlocal_config.xml
Size 912B
SHA256 fb63c862bab8ab22be01309c6404288e7d38661137c461541799b92e7c067981
MD5 349645d9cc73a7e7daec1a41fedfc46c
SHA1 798c9a55aefd9dd588bb4203b0f30d5ca2ebeb54
SHA512 1514de8a604372c326e3a20036d030f89fcd22cc46516abca3e6027493f83ac6efe3c50c01b31087893b63c61a77580cef517100bae9a7779e3293d51d55ed15
TLSH
T13411DC256A5332338824C3F2C23760CA1B712FAA163C047C6E8DB22F26D059C3851E77
MD5 SHA1 SHA512 TLSH

Submit Download

MSIC6A6.tmp

Path C:\Windows\Installer\MSIC6A6.tmp
Size 248KB
SHA256 365b97da5bb15b785f3932db392b01fc551872147497fd31d11ee6aa8d8eef3f
MD5 203dc2f058f4b9d4f4e47668ad6fc412
SHA1 8927e78968410714edd3c71335ff23fc6283289f
SHA512 446f731072990153c04868342f95d25c260692e317c115479ba1ad2ea8540aa3403c3804927497d5e23f30a0bf205aa7a9e179c0f370f833f2673177dfd1258b
SSDEEP 3072:5Arbg5BxgracGnEnRQOl9WGPotlx9uYGi+GtvkW2dWdhYElg5P16vqDyS:5ArbtraBqLlAGCHtvkW2DElMP1AqDf
TLSH
T17644BE01B6D48471F1BF2E380D34A66549BEBE604F71CA9F6748862E4EB46C0DA35B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSFToolkitCustomAction.dll

Path C:\Windows\Installer\MSIC6A6.tmp-\MSFToolkitCustomAction.dll
Size 283KB
SHA256 eb2f5d7ea77c39131179cdfada4dbe7a2407cbfc89562eae1e190b9a72543a55
MD5 b278d0d3559b0ff0380f007c41e6dffc
SHA1 891193511d6382a669c414ad9338fa3ebb04c7b6
SHA512 d0697d6426d0340e96a9c1ea67c81985296e083d6ba3e5a8207c1d73f07bbfcf591d64fba0ff640ab95c262e9691bb2b7fd0086044880590774d9e9f0916d06e
SSDEEP 192:ypLrzRqw8/z7B47xPIeBqFPuvkvwKwq6k9grbbbbbbbbbbbbo/1jl:wYw8r7K7xAk0GkvwKwq6uNtjl
TLSH
T1A3549604B120CA1FC763223895EDEA7198595E1674A4832D39F83D8377B1B82F59AF3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Windows\Installer\MSIC6A6.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 179KB
SHA256 cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca
MD5 1a5caea6734fdd07caa514c3f3fb75da
SHA1 f070ac0d91bd337d7952abd1ddf19a737b94510c
SHA512 a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1
SSDEEP 3072:BGfZS7hUuK3PcbFeRRLxyR69UgoCaf8+aCnfKlRUjW01KymkO:9zMRLkR6joxfRPW
TLSH
T159046B2953FC473ACAFF4778E261425197B1F2E67117DB0EEC8181AA2522780F792397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c5be.msi

Path C:\Windows\Installer\e58c5be.msi
Size 8.5MB
SHA256 6df36c8d6d21519ac003ebbf299f0a9cd02087e6baca2d957861b2b2f086ad8d
MD5 f29dd4529a6c590414c7817a286e64c4
SHA1 2e9aea157e96b29718667ccb149071cc247fc65f
SHA512 f8b1b1570fa1f54e2c56cca56e1ebcac967c481463e9b97cd5489301fe2b44314781bb19e781d2c1869073af51b3ad38ddfc92ab53fbe47611756dd4558bbfe4
SSDEEP 196608:46txSbUXvyX2u0VAlT0MOBQphlYmCegIuxhj6WbTfV6I:4rbUXPCTxFhlLCQu7ZLV6I
TLSH
T17E962300B565CE2FC693A234A9FDE77089192D023565431C7AF43D973BB0B90F6A6E39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_MSF_ICN_200

Path C:\Windows\Installer\{192BA6B2-4107-4DE6-862E-FBA06809211C}\_MSF_ICN_200
Size 273KB
SHA256 d9f90faaa32abb8dbb3d4ed113ad25edad67a84de39dbeaa84b83e268f22bd7e
MD5 222e93becec18f646e306e6ad60c7a07
SHA1 97816b343566048bf36b20c6af3f37a9f377f169
SHA512 0115c1eeb7fc41e03ca014945825dd8877f0f79aba1eebfbe77734391e868a7f836637166717fb202b89bd44f006eac9b1e160616f83cee6ef90e44f1c91dba1
SSDEEP 48:mZrWUWUWUWUWUWUWUWUWUWUWUWUSPrAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAb:2rbbbbbbbbbbbb
TLSH
T1A6548744B121CB1FC763213895EDEA7198495E1674A8832D39F87D8337B4B82F58AE3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Office.dll

Path C:\Windows\assembly\tmp\AUOYHD4Q\Office.dll
Size 413KB
SHA256 c4519e50471fd5b0d495a1eb010ccf9b34a7af97df4e0d409a9f5147aee9f912
MD5 df7cbcd2db89880a8a92ea134611b038
SHA1 9940cedfb3526e12744c6f358ff90fcbf2cd5bba
SHA512 3bbb3b3ee3189e8699acf4ca01f14535725ed844133c9b5a8494e017c1c283c9c9b4626906ff617bfff014e474e02320183cb61ebdbe95ae792a6f22fcc0d072
SSDEEP 12288:e3LuxZNel6lWlCkZOaU2foNM98c3n/YvmcyjlSonPo:e3LuxZNel6lWljsSjn/Yvv
TLSH
T18F94C446BA1E9013EAC5C73E1577BB5453B9F2410FD2EF4A651D822CAF83688DE036B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 cf54936d821fb03f7592bf8cfa3d1b5aae942152253bd8c5fc7e02f24551270f
MD5 3633483ce7c92d057bd07e944ffbe580
SHA1 060bb33e40ab749acde10a5172aaa7d1b23420d4
SHA512 9d3f3facbbf55e9789affd7b4b75e9c44933c79fe9549bd287ee9d2fc32379e3341d2734c806d328a0219849103146526dcca5175524162978ff80858bc953a3
SSDEEP 24576:wu8m+1zKdoO/vvTLrWNOoWaZsEEjF1dSBbGNPic1FUaMeK0wo/lEFb2RY:l
TLSH
T19947F52437F92510E7F39E3DACF06A2349397D9B9C199E8D05811F4E0921BB1E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{1c91741e-cc28-4f47-a990-bea1f1373033}_OnDiskSnapshotProp

Path \??\Volume{6e0928ee-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{1c91741e-cc28-4f47-a990-bea1f1373033}_OnDiskSnapshotProp
Size 6KB
SHA256 0ed5b5b95ea5a55051bcff0dd6f896deee605926d4992c9f2cbb4ec18e328537
MD5 582437477362a466ef1077289ab79bf9
SHA1 5d5d52d1661cdd0f5f35795eed8211f198ef051d
SHA512 1b7204fbc858b1c16b43c6d82b93133cf9c4a92e6a88bf85f605e5c99481228f1c1572501f753c1cebd69608a7c684fb54913f957909a5279f2832b01ed42333
SSDEEP 96:FoOeCgefFVvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:YhkNb++ZVmN
TLSH
T14FD19A085AF54711E2B3AB3129F14557A877B911EF33CB8E0198238E6670A14F836F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SPGMISFToolkitAdminTool64.exe.config

Path \??\c:\program files\s&p global\spgmi securities finance toolkit\SPGMISFToolkitAdminTool64.exe.config
Size 283B
SHA256 888e7829792bb583192468acc472f16ac972e47f6305e81750880146818a12f5
MD5 b940a7ae8967f2016c6fa2a1835f36ad
SHA1 14513ca0bfa631f4f31af5cf1b3e81967a73cf07
SHA512 bf477d15f1f8f8b3e556f36f0285e498c07f659d877007f48e808baa22c4e1c0fc49a78093d69216493568e77dce4946b67c518c7c9cb26456086645156f2e44
TLSH
T1FBD02B063298FE3748E74F63E0324550A7B15E29A264701DF0FE7B73460104B3643335
MD5 SHA1 SHA512 TLSH

Submit Download

SPGMISFToolkitUninstaller.exe.config

Path \??\c:\program files\s&p global\spgmi securities finance toolkit\SPGMISFToolkitUninstaller.exe.config
Size 146B
SHA256 fe29ce4150e251a4fc4ca5db321cd0bdc6dbacd34846735ced5113df056ec3b6
MD5 99ca66a5df246c217028be8caf20c154
SHA1 ff0768ce405c2d8c3b9a100c850de4add6fa9e64
SHA512 15abd3756f4bf31ea63c79d1378517f19c2b16a2fe60ca2b6a7a77c15a79e6b0baf3b0beb40b2ca835d0eb56655ef0d9fac0d82b3316a9f21296e313e9d0a721
TLSH
T19BC09B5945787D3BDC234F6355504952FBF54361F464512CE46FA756061015E8306356
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1584-129-0x0000000006C70000-0x0000000006D18000-memory.dmp

Download

memory/1584-137-0x00000000065B0000-0x0000000006618000-memory.dmp

Download

memory/1584-125-0x0000000006BE0000-0x0000000006C64000-memory.dmp

Download

memory/1584-133-0x0000000006520000-0x000000000653A000-memory.dmp

Download

memory/1584-121-0x0000000006F80000-0x000000000731A000-memory.dmp

Download

memory/1584-118-0x0000000006130000-0x000000000613A000-memory.dmp

Download

memory/1584-117-0x0000000005C50000-0x0000000006074000-memory.dmp

Download

memory/1712-36-0x0000023B8D440000-0x0000023B8D4AA000-memory.dmp

Download

memory/2280-18-0x0000000002290000-0x00000000022BE000-memory.dmp

Download

memory/2280-22-0x0000000004670000-0x00000000046BE000-memory.dmp

Download

memory/2280-23-0x0000000004C70000-0x0000000005214000-memory.dmp

Download

memory/2280-24-0x0000000004770000-0x0000000004802000-memory.dmp

Download