Analysis
- max time kernel
95s - max time network
157s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
02/08/2026, 19:10
General
- Target 2026-08-02_2db5aa347148b1af9954d93071516527_elex_floxif_wannacry.exe
- Size 27.6MB
- Sample260802-xvt7hswtbs
- SHA256 d5a53ac5a001b56135f003bafca76e6923b201d1bc5229bd68f27535b5d41613
Malware Config
Signatures
- Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
- Detects Floxif payload 1 IoCs
- UPX dump on OEP (original entry point) 64 IoCs
- Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 64 IoCs
- Adds Run key to start application 2 TTPs 7 IoCs
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 64 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 7 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 10 IoCs
- Drops file in Windows directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 13 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Program crash 3 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 44 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 21 IoCs
- Modifies registry class 64 IoCs
- Modifies registry key 1 TTPs 61 IoCs
- Suspicious behavior: EnumeratesProcesses 45 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 19 IoCs
- Suspicious use of SetWindowsHookEx 11 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_2db5aa347148b1af9954d93071516527_elex_floxif_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_2db5aa347148b1af9954d93071516527_elex_floxif_wannacry.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Installer.cmd" /auto"2⤵
- Loads dropped DLL
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ver"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\findstr.exefindstr /c:" 5."3⤵
-
-
C:\Windows\system32\reg.exereg query "HKU\S-1-5-19"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ver3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "reg query "hklm\software\microsoft\Windows NT\currentversion" /v productname" 2>nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query "hklm\software\microsoft\Windows NT\currentversion" /v productname4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "reg query "hklm\software\microsoft\Windows NT\currentversion" /v UBR" 2>nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query "hklm\software\microsoft\Windows NT\currentversion" /v UBR4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg query "hklm\software\microsoft\Windows NT\currentversion" /v buildlabex3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query "hklm\software\microsoft\Windows NT\currentversion" /v buildlabex4⤵
-
-
-
C:\Windows\system32\reg.exereg query "HKCU\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled3⤵
-
-
C:\Windows\system32\find.exefind /i "0x0"3⤵
-
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled3⤵
-
-
C:\Windows\system32\find.exefind /i "0x0"3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2012 Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2013 Preview Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2013 RC Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2013 Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 14 CTP Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2015 Preview Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2015 CTP Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2015 RC Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2015 Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2017 RC Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2017 Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2019 Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2022 Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2015-2019 Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2015-2022 Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\wix.txt"3⤵
-
-
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe"C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /uninstall /passive /norestart3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe"C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{BA7E20FB-303D-4C1A-9464-39A540F29FDB} {F6E07EFF-CF21-41CA-84F0-E96A625D71B9} 56684⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Windows\system32\reg.exereg delete hklm\software\wow6432node\microsoft\windows\currentversion\uninstall\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f} /f3⤵
- Modifies registry key
-
-
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /uninstall /passive /norestart3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{F36AA66D-3CD3-4708-BD37-2CA1B576A440} {A778B1BE-799F-42C3-9EDF-9FA6CA5D9AB7} 52684⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Windows\system32\reg.exereg delete hklm\software\wow6432node\microsoft\windows\currentversion\uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6} /f3⤵
- Modifies registry key
-
-
C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe"C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /uninstall /passive /norestart3⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe"C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{B5CD4E5D-7D0B-47F2-B3D2-4094653CCB5F} {A1FF2253-26C0-4457-84D4-DE4E3F92339D} 49124⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Windows\system32\reg.exereg delete hklm\software\wow6432node\microsoft\windows\currentversion\uninstall\{61087a79-ac85-455c-934d-1fa22cc64f36} /f3⤵
- Modifies registry key
-
-
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /uninstall /passive /norestart3⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{567F5B9B-F2D4-4A5F-9455-12C668F780D4} {F5B34E2D-A057-4EC2-8EC2-7F913A5C1319} 35284⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Windows\system32\reg.exereg delete hklm\software\wow6432node\microsoft\windows\currentversion\uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412} /f3⤵
- Modifies registry key
-
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\vc_redist.x86.exe" /uninstall /passive /norestart3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=564 -burn.filehandle.self=584 /uninstall /passive /norestart4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{73D12542-1F02-400C-A85D-0F85B7D50F7F} {5F30C8B5-5322-4C23-A779-23EC9F024ACB} 16485⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 10725⤵
- Loads dropped DLL
- Program crash
-
-
-
-
C:\Windows\system32\reg.exereg delete hklm\software\wow6432node\microsoft\windows\currentversion\uninstall\{4d8dcf8c-a72a-43e1-9833-c12724db736e} /f3⤵
- Modifies registry key
-
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\vc_redist.x64.exe" /uninstall /passive /norestart3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=564 -burn.filehandle.self=584 /uninstall /passive /norestart4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{CEB3C583-09D9-42C8-8852-136A6FB8EDD5} {4C871C3B-60ED-4D61-92E3-958A3338F46C} 58085⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5808 -s 10205⤵
- Loads dropped DLL
- Program crash
-
-
-
-
C:\Windows\system32\reg.exereg delete hklm\software\wow6432node\microsoft\windows\currentversion\uninstall\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13} /f3⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cscript //nologo filever.vbs "C:\Windows\SysWOW64\msvcp100.dll"3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\cscript.execscript //nologo filever.vbs "C:\Windows\SysWOW64\msvcp100.dll"4⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cscript //nologo filever.vbs "C:\Windows\SysWOW64\msvcp110.dll"3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\cscript.execscript //nologo filever.vbs "C:\Windows\SysWOW64\msvcp110.dll"4⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cscript //nologo filever.vbs "C:\Windows\SysWOW64\msvcp120.dll"3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\cscript.execscript //nologo filever.vbs "C:\Windows\SysWOW64\msvcp120.dll"4⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cscript //nologo filever.vbs "C:\Windows\SysWOW64\msvcp140.dll"3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\cscript.execscript //nologo filever.vbs "C:\Windows\SysWOW64\msvcp140.dll"4⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2005 Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i /v {710f4c1c-cc18-4c49-8cbf-51240c89a1a2}3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2008 Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i /v {9BE518E6-ECC6-35A9-88E4-87755C07200F}3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2010 x86 Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i /v {F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2010 x86 Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2012 x86 Additional Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i /v {B175520C-86A2-35A7-8619-86DC379688B9}3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2012 x86 Minimum Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i /v {BD95A8CD-1D9F-35AD-981A-3E7925026EBB}3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2013 x86 Additional Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i /v {D401961D-3A20-3AC7-943B-6139D5BD490A}3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2013 x86 Minimum Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i /v {8122DAB1-ED4D-3676-BB0A-CA368196543E}3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2022 x86 Additional Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i /v {5720EC03-F26F-40B7-980C-50B5D420B5DE}3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2022 x86 Minimum Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i /v {799E3FFF-705C-461F-B400-6DE27398B3E5}3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 14 x86 Additional Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 14 x86 Minimum Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2015 x86 Additional Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2015 x86 Minimum Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2017 x86 Additional Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2017 x86 Minimum Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2019 x86 Additional Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2019 x86 Minimum Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\msi.txt"3⤵
-
-
C:\Windows\system32\msiexec.exemsiexec /X{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /passive /norestart3⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\reg.exereg delete hklm\software\wow6432node\microsoft\windows\currentversion\uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /f3⤵
- Modifies registry key
-
-
C:\Windows\system32\msiexec.exemsiexec /X{E30D8B21-D82D-3211-82CC-0F0A5D1495E8} /passive /norestart3⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\reg.exereg delete hklm\software\wow6432node\microsoft\windows\currentversion\uninstall\{E30D8B21-D82D-3211-82CC-0F0A5D1495E8} /f3⤵
- Modifies registry key
-
-
C:\Windows\system32\msiexec.exemsiexec /X{F6080405-9FA8-4CAA-9982-14E95D1A3DAC} /passive /norestart3⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\reg.exereg delete hklm\software\wow6432node\microsoft\windows\currentversion\uninstall\{F6080405-9FA8-4CAA-9982-14E95D1A3DAC} /f3⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cscript //nologo filever.vbs "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\vstoee.dll"3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\cscript.execscript //nologo filever.vbs "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\vstoee.dll"4⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cscript //nologo filever.vbs "C:\Windows\System32\msvcp100.dll"3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\cscript.execscript //nologo filever.vbs "C:\Windows\System32\msvcp100.dll"4⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cscript //nologo filever.vbs "C:\Windows\System32\msvcp110.dll"3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\cscript.execscript //nologo filever.vbs "C:\Windows\System32\msvcp110.dll"4⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
C:\Windows\system32\reg.exereg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2005 Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i /v {ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2008 Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i /v {5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2010 x64 Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i /v {1D8E6291-B0D5-35EC-8441-6616F567A0F7}3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2010 x64 Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2012 x64 Additional Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i /v {37B8F9C7-03FB-3253-8781-2517C99D7C00}3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2012 x64 Minimum Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i /v {CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2013 x64 Additional Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i /v {010792BA-551A-3AC0-A7EF-0FAB4156C382}3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2013 x64 Minimum Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i /v {53CF6934-A98D-3D84-9146-FC4EDF3D5641}3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2022 x64 Additional Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i /v {A977984B-9244-49E3-BD24-43F0A8009667}3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2022 x64 Minimum Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i /v {A181A302-3F6D-4BAD-97A8-A426A6499D78}3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 14 x64 Additional Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 14 x64 Minimum Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2015 x64 Additional Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2015 x64 Minimum Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2017 x64 Additional Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2017 x64 Minimum Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2019 x64 Additional Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\reg.exereg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2019 x64 Minimum Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\msi.txt"3⤵
-
-
C:\Windows\system32\msiexec.exemsiexec /X{1D8E6291-B0D5-35EC-8441-6616F567A0F7} /passive /norestart3⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\reg.exereg delete hklm\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7} /f3⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2005\x64\vcredist.msi" /qb3⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2008\x64\vc_red.msi" /qb3⤵
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2010\x64\vc_red.msi" /qb3⤵
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x64\vc_runtimeMinimum_x64.msi" /qb3⤵
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x64\vc_runtimeAdditional_x64.msi" /qb3⤵
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x64\vc_runtimeMinimum_x64.msi" /qb3⤵
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x64\vc_runtimeAdditional_x64.msi" /qb3⤵
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2022\x64\vc_runtimeMinimum_x64.msi" /qb3⤵
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2022\x64\vc_runtimeAdditional_x64.msi" /qb3⤵
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2005\x86\vcredist.msi" /qb3⤵
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2008\x86\vc_red.msi" /qb3⤵
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2010\x86\vc_red.msi" /qb3⤵
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x86\vc_runtimeMinimum_x86.msi" /qb3⤵
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x86\vc_runtimeAdditional_x86.msi" /qb3⤵
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x86\vc_runtimeMinimum_x86.msi" /qb3⤵
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x86\vc_runtimeAdditional_x86.msi" /qb3⤵
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:31⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
\??\c:\Windows\syswow64\MsiExec.exec:\Windows\syswow64\MsiExec.exe -Embedding C7682FEDB93CFD0FBB5E6947B8E0C3F32⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A91754D9D82C13AD9471838F5FD5EC7B2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0647C35AFE9CB09F6A9EDFDCB19934E12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
\??\c:\Windows\System32\MsiExec.exec:\Windows\System32\MsiExec.exe -Embedding 35026EB5AB112CBE36BFBF64BB48798C2⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 470600019E97F887B90BF9B1808F19442⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D899A219E1D3F539444BBCD4158640FC2⤵
-
-
C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe"C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /burn.runonce1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe"C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260802201153.log"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe"C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260802201153.log" -burn.unelevated BurnPipe.{5F71704D-BADC-44E9-B2EB-DFB4F37047A6} {FF9BF42B-03CE-43FD-88D5-BC788DBA5862} 10923⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
-
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /burn.runonce1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260802201156.log"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260802201156.log" -burn.unelevated BurnPipe.{736463E0-85D8-4848-87B6-5E7956BDCB96} {C7FC5277-BFC5-4A21-A89E-8DD8808F1E94} 43083⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
-
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" /burn.runonce1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1648 -ip 16481⤵
- Loads dropped DLL
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" /burn.runonce1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260802201203.log"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=576 -burn.filehandle.self=596 /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260802201203.log"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{6E180A65-4F10-460C-BDDF-7C79FA4B9BB7} {37112114-1EF9-4CF5-8867-4F3082183DE1} 47244⤵
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4724 -s 10324⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 5808 -ip 58081⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4724 -ip 47241⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Visual Basic
1Windows Command Shell
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1AppInit DLLs
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1AppInit DLLs
1Replay Monitor
Loading Replay Monitor...
Downloads
e59efb9.rbs
e59efca.rbs
e59efd2.rbs
e59efe3.rbs
e59eff4.rbs
e59f00b.rbs
e59f02f.rbf
e59f032.rbs
e59f037.rbs
e59f047.rbs
e59f075.rbs
e59f07b.rbs
e59f07e.rbs
e59f082.rbs
e59f087.rbs
e59f08c.rbs
e59f091.rbs
e59f09c.rbs
e59f0a2.rbs
e59f0a5.rbs
e59f0a9.rbs
tiptsf.dll.tmp
tiptsf.dll.tmp
symsrv.dll
symsrv.dll.000
vcredist_x86.exe.tmp
VC_redist.x86.exe.tmp
state.rsm
vcredist_x86.exe.tmp
vc_red.msi
vc_runtimeAdditional_x86.msi
Installer.cmd
ucrtbase.dll
ucrtbase.dll
Microsoft.Office.Tools.v9.0.dll
Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll
Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll
Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll
Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll
Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll
Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll
dd_vcredist_amd64_20260802201156.log
dd_vcredist_amd64_20260802201156_000_vcRuntimeAdditional_x64.log
dd_vcredist_amd64_20260802201156_001_vcRuntimeMinimum_x64.log
dd_vcredist_amd64_20260802201203_000_vcRuntimeAdditional_x64.log
dd_vcredist_x86_20260802201153.log
dd_vcredist_x86_20260802201153_000_vcRuntimeAdditional_x86.log
dd_vcredist_x86_20260802201159_000_vcRuntimeAdditional_x86.log
msi.txt
msi.txt
wix.txt
wix.txt
logo.png
wixstdba.dll
wixstdba.dll.tmp
thm.wxl
thm.xml
wixstdba.dll
license.rtf
MSI3022.tmp
MSI4E3B.tmp
wixstdba.dll
license.rtf
thm.xml
memory/120-2114-0x0000000010000000-0x0000000010030000-memory.dmp
memory/120-2291-0x0000000010000000-0x0000000010030000-memory.dmp
memory/120-2289-0x0000000010000000-0x0000000010030000-memory.dmp
memory/120-2270-0x0000000010000000-0x0000000010030000-memory.dmp
memory/756-2580-0x0000000010000000-0x0000000010030000-memory.dmp
memory/756-2610-0x0000000010000000-0x0000000010030000-memory.dmp
memory/928-2713-0x0000000010000000-0x0000000010030000-memory.dmp
memory/928-2680-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1092-1851-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1092-2200-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1092-2111-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1092-2110-0x0000000000C10000-0x0000000000C75000-memory.dmp
memory/1092-2196-0x0000000000C10000-0x0000000000C75000-memory.dmp
memory/1092-1948-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1112-1850-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1112-1847-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1156-2304-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1156-2271-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1648-2025-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1648-1949-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1648-2024-0x0000000000F30000-0x0000000000FA7000-memory.dmp
memory/1668-1946-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1668-2026-0x0000000000F30000-0x0000000000FA7000-memory.dmp
memory/1668-2030-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1812-1940-0x0000000000F20000-0x0000000000F85000-memory.dmp
memory/1812-1943-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1812-1872-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2040-2027-0x0000000000F30000-0x0000000000FA7000-memory.dmp
memory/2040-1818-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2040-2029-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2040-1821-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2040-1796-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2040-1996-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2204-2164-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2204-1899-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2204-2081-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2204-2162-0x0000000000F20000-0x0000000000F85000-memory.dmp
memory/2244-2218-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2244-2259-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2572-2311-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2572-2307-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2584-1895-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2584-1893-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2908-2519-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2908-2499-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2944-2711-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2944-2599-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2944-2369-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2944-2377-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2944-1994-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2944-1761-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2944-1719-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2944-1814-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2944-2208-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3104-2082-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3104-2191-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3200-2550-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3200-2520-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3304-2378-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3304-2370-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3304-2436-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3400-2760-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3528-1870-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3528-1941-0x0000000000F20000-0x0000000000F85000-memory.dmp
memory/3528-1944-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3592-2288-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3592-2275-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3600-2486-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3600-2475-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4164-2103-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4164-2108-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4252-1760-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4252-2424-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4252-4-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4252-1780-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4252-1108-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4252-1101-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4308-1897-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4308-2034-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4308-2163-0x0000000000F20000-0x0000000000F85000-memory.dmp
memory/4308-2165-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4440-1825-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4440-2032-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4440-1866-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4440-2183-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4724-2116-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4724-2290-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4724-2274-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4912-1868-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4912-1823-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5076-2619-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5076-2673-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5228-2434-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5228-2382-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5228-2374-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5268-1815-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5268-1820-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5268-1794-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5404-2676-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5404-2679-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5600-2441-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5600-2437-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5648-2487-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5648-2498-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5660-2759-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5660-2474-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5660-2443-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5668-1789-0x0000000000290000-0x00000000002EE000-memory.dmp
memory/5668-1764-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5668-1782-0x0000000000290000-0x00000000002EE000-memory.dmp
memory/5668-1791-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5668-1740-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5688-2739-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5688-2727-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5716-2113-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5716-2198-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5716-1853-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5716-1995-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5716-2112-0x0000000000C10000-0x0000000000C75000-memory.dmp
memory/5716-2195-0x0000000000C10000-0x0000000000C75000-memory.dmp
memory/5808-2035-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5808-2182-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5944-1742-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5944-1784-0x0000000000290000-0x00000000002EE000-memory.dmp
memory/5944-1767-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5944-1790-0x0000000000290000-0x00000000002EE000-memory.dmp
memory/5944-1786-0x0000000073150000-0x0000000073174000-memory.dmp
memory/5944-1792-0x0000000010000000-0x0000000010030000-memory.dmp
memory/6044-2579-0x0000000010000000-0x0000000010030000-memory.dmp
memory/6044-2551-0x0000000010000000-0x0000000010030000-memory.dmp
memory/6060-2726-0x0000000010000000-0x0000000010030000-memory.dmp
memory/6060-2714-0x0000000010000000-0x0000000010030000-memory.dmp
memory/6096-2611-0x0000000010000000-0x0000000010030000-memory.dmp
memory/6096-2675-0x0000000010000000-0x0000000010030000-memory.dmp
memory/6096-2617-0x0000000010000000-0x0000000010030000-memory.dmp