bc002c287bb05794c29ea723082e03f0508231e6f47c0a0050b7ab80dd1add59

Analysis

max time kernel
146s
max time network
137s
platform
windows7_x64
resource
win7
submitted
25-09-2020 23:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sorttable.js.download.js
Size

6KB
MD5

5df8ca6561930c664aadfcd9173f9a6f
SHA1

9025e4033e1a824cad7f13eddb3b5a7dfe54c3c2
SHA256

bc002c287bb05794c29ea723082e03f0508231e6f47c0a0050b7ab80dd1add59
SHA512

9aef08446911246e219415a51252ab2361a6c560e22adc49590ea812995b3bf9d02c7a9fa386ab270500a0a55af2e2d116640f84b51a4549ee8497764eed81a6

Score

10^/10

persistence stealer adware discovery

Malware Config

Signatures

Registers COM server for autorun 1 TTPs
persistence

Registry Run Keys / Startup Folder
T1060
Executes dropped EXE 6 IoCs

Processes:

MSIC92F.tmpuninstaller.exeUn_A.exedefault-browser-agent.exeUn_B.exeUn_A.exe

pid process

1660 MSIC92F.tmp
1316 uninstaller.exe
1116 Un_A.exe
880 default-browser-agent.exe
1992 Un_B.exe
1060 Un_A.exe

pid	process
1660	MSIC92F.tmp
1316	uninstaller.exe
1116	Un_A.exe
880	default-browser-agent.exe
1992	Un_B.exe
1060	Un_A.exe

Loads dropped DLL 41 IoCs

Processes:

MsiExec.exemsiexec.exerundll32.exehelper.exeuninstaller.exeUn_A.exeregsvr32.exeuninstall.exeUn_B.exeuninstall.exeUn_A.exe

pid	process
1096	MsiExec.exe
1096	MsiExec.exe
2000	msiexec.exe
1096	MsiExec.exe
556	rundll32.exe
556	rundll32.exe
556	rundll32.exe
556	rundll32.exe
556	rundll32.exe
556	rundll32.exe
1684	helper.exe
1684	helper.exe
1684	helper.exe
1684	helper.exe
1316	uninstaller.exe
1116	Un_A.exe
1116	Un_A.exe
1116	Un_A.exe
1116	Un_A.exe
1116	Un_A.exe
1116	Un_A.exe
1116	Un_A.exe
1116	Un_A.exe
1116	Un_A.exe
1116	Un_A.exe
1116	Un_A.exe
1116	Un_A.exe
1116	Un_A.exe
1116	Un_A.exe
1116	Un_A.exe
1116	Un_A.exe
1116	Un_A.exe
1540	regsvr32.exe
1116	Un_A.exe
1116	Un_A.exe
2012	uninstall.exe
1992	Un_B.exe
724	uninstall.exe
1060	Un_A.exe
1060	Un_A.exe
1060	Un_A.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemstsc.exe

description	ioc	process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	mstsc.exe
File opened (read-only)	\??\T:	mstsc.exe
File opened (read-only)	\??\Q:	mstsc.exe
File opened (read-only)	\??\U:	mstsc.exe
File opened (read-only)	\??\Z:	mstsc.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	mstsc.exe
File opened (read-only)	\??\H:	mstsc.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\K:	mstsc.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	mstsc.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	mstsc.exe
File opened (read-only)	\??\S:	mstsc.exe
File opened (read-only)	\??\F:	mstsc.exe
File opened (read-only)	\??\R:	mstsc.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	mstsc.exe
File opened (read-only)	\??\B:	mstsc.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	mstsc.exe
File opened (read-only)	\??\N:	mstsc.exe
File opened (read-only)	\??\V:	mstsc.exe
File opened (read-only)	\??\Y:	mstsc.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	mstsc.exe
File opened (read-only)	\??\L:	mstsc.exe
File opened (read-only)	\??\X:	mstsc.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\J:	mstsc.exe
File opened (read-only)	\??\P:	mstsc.exe

Installs/modifies Browser Helper Object 2 TTPs
BHOs are DLL modules which act as plugins for Internet Explorer.
stealer adware

Modify Registry
T1112

Browser Extensions
T1176

Modifies service 2 TTPs 149 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exemsiexec.exeUn_A.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer\VSS_WS_WAITING_FOR_FREEZE (SetCurrentState) = 4800000000000000108bd2be9193d6014c0200001c010000020000000100000001000000000000003dbf52ec825ce042b1933bbb57f5623300000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer\FREEZE (Leave) = 480000000000000070395abf9193d6014c02000040070000eb0300000000000002000000000000003dbf52ec825ce042b1933bbb57f5623300000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher\PREPAREBACKUP (Enter) = 4800000000000000f0b69abd9193d601d007000070030000e90300000100000000000000000000003dbf52ec825ce042b1933bbb57f5623300000000000000000000000000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer\VSS_WS_WAITING_FOR_THAW (SetCurrentState) = 4800000000000000f09217bf9193d6014c02000040070000030000000100000002000000000000003dbf52ec825ce042b1933bbb57f5623300000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}\PROVIDER_PREFINALCOMMIT (Enter) = 48000000000000007065a6bf9193d6014c0200008c070000060400000100000000000000000000003dbf52ec825ce042b1933bbb57f5623300000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer\POSTSNAPSHOT (Leave) = 4800000000000000303ed1bf9193d6014c02000018010000f50300000000000004000000000000003dbf52ec825ce042b1933bbb57f5623300000000000000000000000000000000	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssvcPublisher	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\FREEZE_BACK (Leave) = 4800000000000000d06e10bf9193d6014c0200008c070000ed0300000000000000000000000000003dbf52ec825ce042b1933bbb57f5623300000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace\OPEN_VOLUME_HANDLE (Leave) = 4800000000000000300772bf9193d6014c0200008c070000fd0300000000000000000000000000003dbf52ec825ce042b1933bbb57f5623300000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\THAW (Enter) = 4800000000000000301d98bf9193d6014c02000040070000f20300000100000003000000000000003dbf52ec825ce042b1933bbb57f5623300000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\VSS_WS_WAITING_FOR_BACKUP_COMPLETE (SetCurrentState) = 480000000000000090aae6bf9193d6014c02000018010000050000000100000004000000000000003dbf52ec825ce042b1933bbb57f5623300000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}\PROVIDER_BEGINPREPARE (Leave) = 4800000000000000905598bd9193d6014c020000ac010000010400000000000000000000000000003dbf52ec825ce042b1933bbb57f5623300000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer\PREPARESNAPSHOT (Leave) = 4800000000000000d04dd7be9193d6014c02000040070000ea0300000000000001000000000000003dbf52ec825ce042b1933bbb57f5623300000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\FREEZE (Leave) = 480000000000000050e906bf9193d6014c020000cc060000eb0300000000000002000000000000003dbf52ec825ce042b1933bbb57f5623300000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP\SppCreate (Leave) = 4800000000000000301285bf9193d601d007000008050000d00700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\THAW (Leave) = 4800000000000000301d98bf9193d6014c02000040070000f20300000000000003000000000000003dbf52ec825ce042b1933bbb57f5623300000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer\BKGND_FREEZE_THREAD (Leave) = 4800000000000000301d98bf9193d6014c02000090060000fc0300000000000003000000000000003dbf52ec825ce042b1933bbb57f5623300000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer\THAW (Leave) = 4800000000000000301d98bf9193d6014c02000018010000f20300000000000003000000000000003dbf52ec825ce042b1933bbb57f5623300000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer\IDENTIFY (Leave) = 480000000000000090322ab89193d6014c020000c8060000e80300000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer\PREPAREBACKUP (Leave) = 4800000000000000703ca4bd9193d6014c020000ac010000e90300000000000001000000000000003dbf52ec825ce042b1933bbb57f5623300000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\BACKUPSHUTDOWN (Enter) = 4800000000000000105c3cc09193d6014c02000040070000fb0300000100000005000000000000003dbf52ec825ce042b1933bbb57f5623300000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer\VSS_WS_STABLE (SetCurrentState) = 4800000000000000d09da6bd9193d6014c02000020030000010000000100000001000000000000003dbf52ec825ce042b1933bbb57f5623300000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\FREEZE_RM (Leave) = 480000000000000070395abf9193d6014c0200008c070000ef0300000000000000000000000000003dbf52ec825ce042b1933bbb57f5623300000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\PREPARESNAPSHOT (Leave) = 480000000000000030c5ffbe9193d6014c0200008c070000ea0300000000000000000000000000003dbf52ec825ce042b1933bbb57f5623300000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\FREEZE (Leave) = 480000000000000070395abf9193d6014c0200008c070000eb0300000000000000000000000000003dbf52ec825ce042b1933bbb57f5623300000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}\PROVIDER_PRECOMMIT (Enter) = 480000000000000070395abf9193d6014c0200008c070000030400000100000000000000000000003dbf52ec825ce042b1933bbb57f5623300000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace(__?_Volume{a2da1a04-afea-11ea-ab7e-806e6f6e6963}_)\OPEN_VOLUME_HANDLE (Enter) = 480000000000000070395abf9193d6014c0200003c050000fd0300000100000000000000000000003dbf52ec825ce042b1933bbb57f5623300000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer\THAW (Enter) = 4800000000000000301d98bf9193d6014c02000040070000f20300000100000003000000000000003dbf52ec825ce042b1933bbb57f5623300000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP\SppCreate (Enter) = 48000000000000001081d4b79193d601d007000008050000d00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer\IDENTIFY (Enter) = 480000000000000030d127b89193d6014c020000c8060000e80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer\VSS_WS_WAITING_FOR_POST_SNAPSHOT (SetCurrentState) = 4800000000000000301d98bf9193d6014c02000018010000040000000100000003000000000000003dbf52ec825ce042b1933bbb57f5623300000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}\PROVIDER_COMMIT (Leave) = 480000000000000010ee7dbf9193d6014c02000008070000040400000000000000000000000000003dbf52ec825ce042b1933bbb57f5623300000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}\PROVIDER_POSTCOMMIT (Enter) = 480000000000000010ee7dbf9193d6014c0200008c070000050400000100000000000000000000003dbf52ec825ce042b1933bbb57f5623300000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\FREEZE_FRONT (Leave) = 4800000000000000b04a09bf9193d6014c0200008c070000ec0300000000000000000000000000003dbf52ec825ce042b1933bbb57f5623300000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}\PROVIDER_POSTFINALCOMMIT (Enter) = 4800000000000000f00be9bf9193d6014c0200008c070000070400000100000000000000000000003dbf52ec825ce042b1933bbb57f5623300000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer\BACKUPSHUTDOWN (Enter) = 4800000000000000105c3cc09193d6014c020000cc060000fb0300000100000005000000000000003dbf52ec825ce042b1933bbb57f5623300000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\BACKUPSHUTDOWN (Leave) = 4800000000000000105c3cc09193d6014c0200008c070000fb0300000000000000000000000000003dbf52ec825ce042b1933bbb57f5623300000000000000000000000000000000	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}\PROVIDER_BEGINPREPARE (Enter) = 4800000000000000905598bd9193d6014c020000ac010000010400000100000000000000000000003dbf52ec825ce042b1933bbb57f5623300000000000000000000000000000000	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}\PROVIDER_PRECOMMIT (Leave) = 480000000000000070395abf9193d6014c0200008c070000030400000000000000000000000000003dbf52ec825ce042b1933bbb57f5623300000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace\IOCTL_FLUSH_AND_HOLD (Enter) = 4800000000000000300772bf9193d6014c0200008c070000fe0300000100000000000000000000003dbf52ec825ce042b1933bbb57f5623300000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher\DOSNAPSHOT (Leave) = 4800000000000000704f80bf9193d601d0070000bc0700000a0400000000000000000000000000003dbf52ec825ce042b1933bbb57f5623300000000000000000000000000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\IDENTIFY (Leave) = 480000000000000090322ab89193d6014c02000020030000e80300000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer\BKGND_FREEZE_THREAD (Enter) = 4800000000000000f09217bf9193d6014c020000b4070000fc0300000100000003000000000000003dbf52ec825ce042b1933bbb57f5623300000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer\THAW (Enter) = 4800000000000000301d98bf9193d6014c02000018010000f20300000100000003000000000000003dbf52ec825ce042b1933bbb57f5623300000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssvcPublisher\THAW (Leave) = 48000000000000007065a6bf9193d6014c0200008c070000f20300000000000000000000000000003dbf52ec825ce042b1933bbb57f5623300000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer\IDENTIFY (Enter) = 480000000000000030d127b89193d6014c020000d4010000e80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP\SppAddInterestingComponents (Leave) = 4800000000000000b06379bd9193d601d007000008050000d40700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher\PREPAREBACKUP (Leave) = 48000000000000007047b7bd9193d601d007000070030000e90300000000000000000000000000003dbf52ec825ce042b1933bbb57f5623300000000000000000000000000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\GETSTATE (Leave) = 4800000000000000906bbebd9193d6014c020000ac010000f90300000000000001000000000000003dbf52ec825ce042b1933bbb57f5623300000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer\BKGND_FREEZE_THREAD (Leave) = 4800000000000000301d98bf9193d6014c020000b4070000fc0300000000000003000000000000003dbf52ec825ce042b1933bbb57f5623300000000000000000000000000000000	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\PREPAREBACKUP (Leave) = 480000000000000010dba1bd9193d6014c020000c8060000e90300000000000001000000000000003dbf52ec825ce042b1933bbb57f5623300000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP\SppGatherWriterMetadata (Leave) = 480000000000000050f763bd9193d601d007000008050000d30700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Lovelace(__?_Volume{a2da1a04-afea-11ea-ab7e-806e6f6e6963}_)\IOCTL_FLUSH_AND_HOLD (Enter) = 4800000000000000300772bf9193d6014c0200003c050000fe0300000100000000000000000000003dbf52ec825ce042b1933bbb57f5623300000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer\VSS_WS_WAITING_FOR_BACKUP_COMPLETE (SetCurrentState) = 4800000000000000909fd3bf9193d6014c020000a8030000050000000100000004000000000000003dbf52ec825ce042b1933bbb57f5623300000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore\SrCreateRp (Enter) = 48000000000000001081d4b79193d601d007000008050000d50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Lovelace	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\AppId_Catalog\1F97E3EE	Un_A.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer\VSS_WS_WAITING_FOR_BACKUP_COMPLETE (SetCurrentState) = 4800000000000000303ed1bf9193d6014c02000018010000050000000100000004000000000000003dbf52ec825ce042b1933bbb57f5623300000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer\BKGND_FREEZE_THREAD (Leave) = 4800000000000000301d98bf9193d6014c0200005c040000fc0300000000000003000000000000003dbf52ec825ce042b1933bbb57f5623300000000000000000000000000000000	vssvc.exe

Drops file in Program Files directory 1684 IoCs

Processes:

Un_A.exemsiexec.exeUn_A.exe7zG.exe

description	ioc	process
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libhds_plugin.dll	Un_A.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\intf\telnet.luac	Un_A.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\nb\	Un_A.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Australia\Melbourne	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\GMT	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Ojinaga	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\bin\jsoundds.dll	msiexec.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-crt-time-l1-1-0.dll	Un_A.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Africa\Nairobi	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Tallinn	msiexec.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libjpeg_plugin.dll	Un_A.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\images\Video-48.png	Un_A.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\uk\	Un_A.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\SystemV\CST6	msiexec.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\keystore\libmemory_keystore_plugin.dll	Un_A.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_avi_plugin.dll	Un_A.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Karachi	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Minsk	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Vevay	msiexec.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\vlc.mo	Un_A.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffffff_256x240.png	Un_A.exe
File created	C:\Program Files\Windows Sidebar\sidebar\.rsrc\TYPELIB\1	7zG.exe
File opened for modification	C:\Program Files\Mozilla Firefox\	Un_A.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Anchorage	msiexec.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\control\libwin_hotkeys_plugin.dll	Un_A.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\liberase_plugin.dll	Un_A.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\	Un_A.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fy\	Un_A.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Godthab	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Baku	msiexec.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\af\	Un_A.exe
File opened for modification	C:\Program Files\Java\jre7\lib\deploy\messages_it.properties	msiexec.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libudp_plugin.dll	Un_A.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\	Un_A.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\packetizer\	Un_A.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Baghdad	msiexec.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-core-processthreads-l1-1-1.dll	Un_A.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libtransform_plugin.dll	Un_A.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\requests\vlm.xml	Un_A.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Guam	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Ashgabat	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\bin\j2pcsc.dll	msiexec.exe
File created	C:\Program Files\Mozilla Firefox\IA2Marshal.dll	Un_A.exe
File created	C:\Program Files\Windows Sidebar\sidebar\.text	7zG.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html	Un_A.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\playlist\soundcloud.luac	Un_A.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\playlist\twitch.luac	Un_A.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libvdr_plugin.dll	Un_A.exe
File opened for modification	C:\Program Files\Java\jre7\bin\dcpr.dll	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\bin\eula.dll	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\bin\fxplugins.dll	msiexec.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\	Un_A.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_standard_plugin.dll	Un_A.exe
File created	C:\Program Files\Mozilla Firefox\updater.exe	Un_A.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\skins\default.vlt	Un_A.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\requests\README.txt	Un_A.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Yerevan	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\bin\jaas_nt.dll	msiexec.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\text_renderer\libsapi_plugin.dll	Un_A.exe
File opened for modification	C:\Program Files\Java\jre7\lib\tzmappings	msiexec.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\liboldmovie_plugin.dll	Un_A.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Africa\Casablanca	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Belize	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Tahiti	msiexec.exe

Drops file in Windows directory 14 IoCs

Processes:

msiexec.exeDrvInst.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSICBFD.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI58F9.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIC92F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f7556aa.ipi	msiexec.exe
File created	C:\Windows\Installer\f755699.ipi	msiexec.exe
File created	C:\Windows\Installer\f7556aa.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\f755699.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIAE5C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAE5D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC8EF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

adobe air updater.exemsiexec.exeAdobe AIR Updater.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	adobe air updater.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msiexec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msiexec.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Adobe AIR Updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Adobe AIR Updater.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	adobe air updater.exe

Modifies Internet Explorer settings 1 TTPs 7 IoCs

adware spyware

Modify Registry

T1112

Processes:

rundll32.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4B5F-9EE6-34795C46E7E7}	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppName	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppPath	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\Policy = "19"	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}	rundll32.exe

Modifies data under HKEY_USERS 56 IoCs

Processes:

DrvInst.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\24\52C64B7E	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\24	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\qagentrt.dll,-10 = "System Health Authentication"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\p2pcollab.dll,-8042 = "Peer to Peer Trust"	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe

Modifies registry class 5369 IoCs

Processes:

rundll32.exeUn_A.exeregsvr32.exeUn_A.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0030-ABCDEFFEDCBC}	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.tp\shell\PlayWithVLC	Un_A.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.xa\shell	Un_A.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mpe\shell	Un_A.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9BE31822-FDAD-461B-AD51-BE1D1C159921}\CONTROL	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0021-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBC}	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0080-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0048-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0058-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.aiff\shell\AddToPlaylistVLC\command	Un_A.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0033-ABCDEFFEDCBB}	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0076-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0041-ABCDEFFEDCBC}	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0063-ABCDEFFEDCBC}	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0082-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\CLSID\{CAFEEFAC-0014-0002-FFFF-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0045-ABCDEFFEDCBB}	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0030-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BC97469F-CB11-4037-8DCE-5FC9F5F85307}\TypeLib	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0076-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0040-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\firefox.exe\shell\open\COMMAND	Un_A.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.wtv\shell\Open	Un_A.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\TypeLib	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBA}	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0070-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0071-ABCDEFFEDCBC}	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.tp\shell\AddToPlaylistVLC\command	Un_A.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.pls\shell\Open\command	Un_A.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0059-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.m4a\ = "WMP11.AssocFile.M4A"	Un_A.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0045-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0046-ABCDEFFEDCBC}	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0052-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0079-ABCDEFFEDCBC}	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0071-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0080-ABCDEFFEDCBC}	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBC}	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0060-ABCDEFFEDCBA}	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\MiscStatus\1\ = "384"	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\CLSID\{CAFEEFAC-0014-0002-0031-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mxf\shell\AddToPlaylistVLC	Un_A.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.asx\shell\Open\command	Un_A.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0045-ABCDEFFEDCBC}	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0036-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0083-ABCDEFFEDCBC}	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0029-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.dv\shell\PlayWithVLC\command	Un_A.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.dvr-ms\shell\PlayWithVLC	Un_A.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.caf\shell\Open	Un_A.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0072-ABCDEFFEDCBC}	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.xspf\DefaultIcon	Un_A.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9BE31822-FDAD-461B-AD51-BE1D1C159921}\VersionIndependentProgID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.drc\shell\Open	Un_A.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.rec\shell\Open\command	Un_A.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0044-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

msiexec.exeMSIC92F.tmp

pid	process
2000	msiexec.exe
2000	msiexec.exe
2000	msiexec.exe
2000	msiexec.exe
2000	msiexec.exe
2000	msiexec.exe
2000	msiexec.exe
2000	msiexec.exe
2000	msiexec.exe
2000	msiexec.exe
1660	MSIC92F.tmp

Suspicious use of AdjustPrivilegeToken 1342 IoCs

Processes:

7zG.exeAUDIODG.EXEadobe air updater.exemsiexec.exe

description	pid	process
Token: SeRestorePrivilege	1948	7zG.exe
Token: 35	1948	7zG.exe
Token: SeSecurityPrivilege	1948	7zG.exe
Token: SeSecurityPrivilege	1948	7zG.exe
Token: 33	268	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	268	AUDIODG.EXE
Token: 33	268	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	268	AUDIODG.EXE
Token: SeShutdownPrivilege	1800	adobe air updater.exe
Token: SeIncreaseQuotaPrivilege	1800	adobe air updater.exe
Token: SeRestorePrivilege	2000	msiexec.exe
Token: SeTakeOwnershipPrivilege	2000	msiexec.exe
Token: SeSecurityPrivilege	2000	msiexec.exe
Token: SeCreateTokenPrivilege	1800	adobe air updater.exe
Token: SeAssignPrimaryTokenPrivilege	1800	adobe air updater.exe
Token: SeLockMemoryPrivilege	1800	adobe air updater.exe
Token: SeIncreaseQuotaPrivilege	1800	adobe air updater.exe
Token: SeMachineAccountPrivilege	1800	adobe air updater.exe
Token: SeTcbPrivilege	1800	adobe air updater.exe
Token: SeSecurityPrivilege	1800	adobe air updater.exe
Token: SeTakeOwnershipPrivilege	1800	adobe air updater.exe
Token: SeLoadDriverPrivilege	1800	adobe air updater.exe
Token: SeSystemProfilePrivilege	1800	adobe air updater.exe
Token: SeSystemtimePrivilege	1800	adobe air updater.exe
Token: SeProfSingleProcessPrivilege	1800	adobe air updater.exe
Token: SeIncBasePriorityPrivilege	1800	adobe air updater.exe
Token: SeCreatePagefilePrivilege	1800	adobe air updater.exe
Token: SeCreatePermanentPrivilege	1800	adobe air updater.exe
Token: SeBackupPrivilege	1800	adobe air updater.exe
Token: SeRestorePrivilege	1800	adobe air updater.exe
Token: SeShutdownPrivilege	1800	adobe air updater.exe
Token: SeDebugPrivilege	1800	adobe air updater.exe
Token: SeAuditPrivilege	1800	adobe air updater.exe
Token: SeSystemEnvironmentPrivilege	1800	adobe air updater.exe
Token: SeChangeNotifyPrivilege	1800	adobe air updater.exe
Token: SeRemoteShutdownPrivilege	1800	adobe air updater.exe
Token: SeUndockPrivilege	1800	adobe air updater.exe
Token: SeSyncAgentPrivilege	1800	adobe air updater.exe
Token: SeEnableDelegationPrivilege	1800	adobe air updater.exe
Token: SeManageVolumePrivilege	1800	adobe air updater.exe
Token: SeImpersonatePrivilege	1800	adobe air updater.exe
Token: SeCreateGlobalPrivilege	1800	adobe air updater.exe
Token: SeRestorePrivilege	2000	msiexec.exe
Token: SeTakeOwnershipPrivilege	2000	msiexec.exe
Token: SeRestorePrivilege	2000	msiexec.exe
Token: SeTakeOwnershipPrivilege	2000	msiexec.exe
Token: SeRestorePrivilege	2000	msiexec.exe
Token: SeTakeOwnershipPrivilege	2000	msiexec.exe
Token: SeRestorePrivilege	2000	msiexec.exe
Token: SeTakeOwnershipPrivilege	2000	msiexec.exe
Token: SeRestorePrivilege	2000	msiexec.exe
Token: SeTakeOwnershipPrivilege	2000	msiexec.exe
Token: SeRestorePrivilege	2000	msiexec.exe
Token: SeTakeOwnershipPrivilege	2000	msiexec.exe
Token: SeRestorePrivilege	2000	msiexec.exe
Token: SeTakeOwnershipPrivilege	2000	msiexec.exe
Token: SeRestorePrivilege	2000	msiexec.exe
Token: SeTakeOwnershipPrivilege	2000	msiexec.exe
Token: SeRestorePrivilege	2000	msiexec.exe
Token: SeTakeOwnershipPrivilege	2000	msiexec.exe
Token: SeRestorePrivilege	2000	msiexec.exe
Token: SeTakeOwnershipPrivilege	2000	msiexec.exe
Token: SeRestorePrivilege	2000	msiexec.exe
Token: SeTakeOwnershipPrivilege	2000	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

7zG.exe

pid process

1948 7zG.exe

pid	process
1948	7zG.exe

Suspicious use of WriteProcessMemory 83 IoCs

Processes:

DllHost.exeAdobe AIR Updater.exemsiexec.exehelper.exeuninstaller.exeUn_A.exeuninstall.exeUn_B.exe

description	pid	process	target process
PID 1672 wrote to memory of 1072	1672	DllHost.exe	Adobe AIR Updater.exe
PID 1672 wrote to memory of 1072	1672	DllHost.exe	Adobe AIR Updater.exe
PID 1672 wrote to memory of 1072	1672	DllHost.exe	Adobe AIR Updater.exe
PID 1672 wrote to memory of 1072	1672	DllHost.exe	Adobe AIR Updater.exe
PID 1672 wrote to memory of 1072	1672	DllHost.exe	Adobe AIR Updater.exe
PID 1672 wrote to memory of 1072	1672	DllHost.exe	Adobe AIR Updater.exe
PID 1672 wrote to memory of 1072	1672	DllHost.exe	Adobe AIR Updater.exe
PID 1072 wrote to memory of 1800	1072	Adobe AIR Updater.exe	adobe air updater.exe
PID 1072 wrote to memory of 1800	1072	Adobe AIR Updater.exe	adobe air updater.exe
PID 1072 wrote to memory of 1800	1072	Adobe AIR Updater.exe	adobe air updater.exe
PID 1072 wrote to memory of 1800	1072	Adobe AIR Updater.exe	adobe air updater.exe
PID 1072 wrote to memory of 1800	1072	Adobe AIR Updater.exe	adobe air updater.exe
PID 1072 wrote to memory of 1800	1072	Adobe AIR Updater.exe	adobe air updater.exe
PID 1072 wrote to memory of 1800	1072	Adobe AIR Updater.exe	adobe air updater.exe
PID 2000 wrote to memory of 1096	2000	msiexec.exe	MsiExec.exe
PID 2000 wrote to memory of 1096	2000	msiexec.exe	MsiExec.exe
PID 2000 wrote to memory of 1096	2000	msiexec.exe	MsiExec.exe
PID 2000 wrote to memory of 1096	2000	msiexec.exe	MsiExec.exe
PID 2000 wrote to memory of 1096	2000	msiexec.exe	MsiExec.exe
PID 2000 wrote to memory of 1660	2000	msiexec.exe	MSIC92F.tmp
PID 2000 wrote to memory of 1660	2000	msiexec.exe	MSIC92F.tmp
PID 2000 wrote to memory of 1660	2000	msiexec.exe	MSIC92F.tmp
PID 2000 wrote to memory of 556	2000	msiexec.exe	rundll32.exe
PID 2000 wrote to memory of 556	2000	msiexec.exe	rundll32.exe
PID 2000 wrote to memory of 556	2000	msiexec.exe	rundll32.exe
PID 1684 wrote to memory of 1316	1684	helper.exe	uninstaller.exe
PID 1684 wrote to memory of 1316	1684	helper.exe	uninstaller.exe
PID 1684 wrote to memory of 1316	1684	helper.exe	uninstaller.exe
PID 1684 wrote to memory of 1316	1684	helper.exe	uninstaller.exe
PID 1684 wrote to memory of 1316	1684	helper.exe	uninstaller.exe
PID 1684 wrote to memory of 1316	1684	helper.exe	uninstaller.exe
PID 1684 wrote to memory of 1316	1684	helper.exe	uninstaller.exe
PID 1316 wrote to memory of 1116	1316	uninstaller.exe	Un_A.exe
PID 1316 wrote to memory of 1116	1316	uninstaller.exe	Un_A.exe
PID 1316 wrote to memory of 1116	1316	uninstaller.exe	Un_A.exe
PID 1316 wrote to memory of 1116	1316	uninstaller.exe	Un_A.exe
PID 1116 wrote to memory of 1540	1116	Un_A.exe	regsvr32.exe
PID 1116 wrote to memory of 1540	1116	Un_A.exe	regsvr32.exe
PID 1116 wrote to memory of 1540	1116	Un_A.exe	regsvr32.exe
PID 1116 wrote to memory of 1540	1116	Un_A.exe	regsvr32.exe
PID 1116 wrote to memory of 1540	1116	Un_A.exe	regsvr32.exe
PID 1116 wrote to memory of 1540	1116	Un_A.exe	regsvr32.exe
PID 1116 wrote to memory of 1540	1116	Un_A.exe	regsvr32.exe
PID 1116 wrote to memory of 880	1116	Un_A.exe	default-browser-agent.exe
PID 1116 wrote to memory of 880	1116	Un_A.exe	default-browser-agent.exe
PID 1116 wrote to memory of 880	1116	Un_A.exe	default-browser-agent.exe
PID 1116 wrote to memory of 880	1116	Un_A.exe	default-browser-agent.exe
PID 1116 wrote to memory of 2012	1116	Un_A.exe	uninstall.exe
PID 1116 wrote to memory of 2012	1116	Un_A.exe	uninstall.exe
PID 1116 wrote to memory of 2012	1116	Un_A.exe	uninstall.exe
PID 1116 wrote to memory of 2012	1116	Un_A.exe	uninstall.exe
PID 1116 wrote to memory of 2012	1116	Un_A.exe	uninstall.exe
PID 1116 wrote to memory of 2012	1116	Un_A.exe	uninstall.exe
PID 1116 wrote to memory of 2012	1116	Un_A.exe	uninstall.exe
PID 2012 wrote to memory of 1992	2012	uninstall.exe	Un_B.exe
PID 2012 wrote to memory of 1992	2012	uninstall.exe	Un_B.exe
PID 2012 wrote to memory of 1992	2012	uninstall.exe	Un_B.exe
PID 2012 wrote to memory of 1992	2012	uninstall.exe	Un_B.exe
PID 2012 wrote to memory of 1992	2012	uninstall.exe	Un_B.exe
PID 2012 wrote to memory of 1992	2012	uninstall.exe	Un_B.exe
PID 2012 wrote to memory of 1992	2012	uninstall.exe	Un_B.exe
PID 1992 wrote to memory of 1068	1992	Un_B.exe	maintenanceservice.exe
PID 1992 wrote to memory of 1068	1992	Un_B.exe	maintenanceservice.exe
PID 1992 wrote to memory of 1068	1992	Un_B.exe	maintenanceservice.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\sorttable.js.download.js
1⤵
PID:1456

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Program Files\Windows Sidebar\sidebar\" -ad -an -ai#7zMap1680:92:7zEvent4547
1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1948

C:\Windows\system32\mstsc.exe
"C:\Windows\system32\mstsc.exe"
1⤵
- Enumerates connected drives
PID:2028

C:\Windows\system32\control.exe
"C:\Windows\system32\control.exe" /name Microsoft.DefaultPrograms
1⤵
PID:2016

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:1896

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:832

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x558
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:268

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{FCC74B77-EC3E-4DD8-A80B-008A702075A9}
1⤵
- Suspicious use of WriteProcessMemory
PID:1672

C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe
"C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe" -arp:uninstall
2⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:1072

C:\program files (x86)\common files\adobe air\versions\1.0\adobe air updater.exe
"C:\program files (x86)\common files\adobe air\versions\1.0\adobe air updater.exe" -stdio \\.\pipe\AIR_1072_0 -uninstall
3⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1800

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Modifies service
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2000

C:\Windows\system32\MsiExec.exe
C:\Windows\system32\MsiExec.exe -Embedding 89C2DE05B2A8A7F38581DC20278CE4AD
2⤵
- Loads dropped DLL
PID:1096

C:\Windows\Installer\MSIC92F.tmp
"C:\Windows\Installer\MSIC92F.tmp" C:\Program Files\Java\jre7\;C;3
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1660

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Program Files\Java\jre7\bin\\installer.dll",UninstallJREEntryPoint
2⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
PID:556

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Modifies service
PID:588

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot12" "" "" "6d110b0a3" "0000000000000000" "000000000000054C" "00000000000003A8"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1996

C:\Program Files\Mozilla Firefox\uninstall\helper.exe
"C:\Program Files\Mozilla Firefox\uninstall\helper.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1684

C:\Program Files\Mozilla Firefox\uninstall\uninstaller.exe
"C:\Program Files\Mozilla Firefox\uninstall\uninstaller.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1316

C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
"C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Program Files\Mozilla Firefox\uninstall\
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies service
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1116

C:\Windows\system32\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" /s /u "C:\Program Files\Mozilla Firefox\AccessibleHandler.dll"
4⤵
- Loads dropped DLL
PID:1540

C:\Program Files\Mozilla Firefox\default-browser-agent.exe
"C:\Program Files\Mozilla Firefox\default-browser-agent.exe" unregister-task 308046B0AF4A39CB
4⤵
- Executes dropped EXE
PID:880

C:\Program Files (x86)\Mozilla Maintenance Service\uninstall.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\uninstall.exe" /S
4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2012

C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_B.exe
"C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_B.exe" /S _?=C:\Program Files (x86)\Mozilla Maintenance Service\
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1992

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe" uninstall
6⤵
PID:1068

C:\Program Files\VideoLAN\VLC\uninstall.exe
"C:\Program Files\VideoLAN\VLC\uninstall.exe"
1⤵
- Loads dropped DLL
PID:724

C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
"C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Program Files\VideoLAN\VLC\
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
PID:1060

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s /u "C:\Program Files\VideoLAN\VLC\axvlc.dll"
3⤵
PID:948

C:\Windows\system32\regsvr32.exe
/s /u "C:\Program Files\VideoLAN\VLC\axvlc.dll"
4⤵
- Modifies registry class
PID:832

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Browser Extensions

T1176

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice-uninstall.log

Download Submit
C:\Program Files\Mozilla Firefox\AccessibleHandler.dll

Download Submit
C:\Program Files\Mozilla Firefox\default-browser-agent.exe

Download Submit
C:\Program Files\Mozilla Firefox\uninstall\uninstaller.exe

Download Submit
C:\Program Files\Mozilla Firefox\uninstall\uninstaller.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_B.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_B.exe

Download Submit
C:\Windows\Installer\MSIAE5D.tmp

Download Submit
C:\Windows\Installer\MSIC8EF.tmp

Download Submit
C:\Windows\Installer\MSIC92F.tmp

Download Submit
C:\Windows\Installer\MSICBFD.tmp

Download Submit
\Program Files\Java\jre7\bin\deploy.dll

Download Submit
\Program Files\Java\jre7\bin\installer.dll

Download Submit
\Program Files\Java\jre7\bin\installer.dll

Download Submit
\Program Files\Java\jre7\bin\installer.dll

Download Submit
\Program Files\Java\jre7\bin\installer.dll

Download Submit
\Program Files\Java\jre7\bin\wsdetect.dll

Download Submit
\Program Files\Mozilla Firefox\AccessibleHandler.dll

Download Submit
\Program Files\Mozilla Firefox\uninstall\uninstaller.exe

Download Submit
\Users\Admin\AppData\Local\Temp\nsi20AC.tmp\LangDLL.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsi20AC.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsi20AC.tmp\nsDialogs.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsiF9F9.tmp\ApplicationID.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsiF9F9.tmp\Banner.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsiF9F9.tmp\BitsUtils.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsiF9F9.tmp\CityHash.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsiF9F9.tmp\InstallOptions.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsiF9F9.tmp\InstallOptions.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsiF9F9.tmp\ServicesHelper.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsiF9F9.tmp\ShellLink.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsiF9F9.tmp\ShellLink.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsiF9F9.tmp\ShellLink.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsiF9F9.tmp\ShellLink.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsiF9F9.tmp\ShellLink.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsiF9F9.tmp\ShellLink.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsiF9F9.tmp\ShellLink.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsiF9F9.tmp\ShellLink.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsiF9F9.tmp\ShellLink.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsiF9F9.tmp\ShellLink.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsiF9F9.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsiF9F9.tmp\nsExec.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsoF893.tmp\CityHash.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsoF893.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nsoF893.tmp\UAC.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nstC80.tmp\System.dll

Download Submit
\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe

Download Submit
\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe

Download Submit
\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_B.exe

Download Submit
\Windows\Installer\MSIAE5D.tmp

Download Submit
\Windows\Installer\MSIC8EF.tmp

Download Submit
\Windows\Installer\MSIC92F.tmp

Download Submit
\Windows\Installer\MSICBFD.tmp

Download Submit
memory/556-89-0x0000000000000000-mapping.dmp

Download
memory/832-160-0x0000000000000000-mapping.dmp

Download
memory/880-137-0x0000000000000000-mapping.dmp

Download
memory/948-159-0x0000000000000000-mapping.dmp

Download
memory/1060-155-0x0000000000000000-mapping.dmp

Download
memory/1068-150-0x0000000000000000-mapping.dmp

Download
memory/1072-10-0x00000000074D7000-0x00000000074DB000-memory.dmp

Filesize
16KB

Download
memory/1072-9-0x00000000074B9000-0x00000000074BD000-memory.dmp

Filesize
16KB

Download
memory/1072-12-0x00000000074EF000-0x00000000074F3000-memory.dmp

Filesize
16KB

Download
memory/1072-11-0x00000000074E2000-0x00000000074E6000-memory.dmp

Filesize
16KB

Download
memory/1072-1-0x0000000000000000-mapping.dmp

Download
memory/1072-13-0x0000000007532000-0x0000000007536000-memory.dmp

Filesize
16KB

Download
memory/1072-8-0x000000000723C000-0x0000000007240000-memory.dmp

Filesize
16KB

Download
memory/1096-46-0x0000000000000000-mapping.dmp

Download
memory/1116-142-0x0000000003CA0000-0x0000000003CA1000-memory.dmp

Filesize
4KB

Download
memory/1116-141-0x0000000003CA0000-0x0000000003CA1000-memory.dmp

Filesize
4KB

Download
memory/1116-152-0x0000000002C20000-0x0000000002C24000-memory.dmp

Filesize
16KB

Download
memory/1116-153-0x0000000002820000-0x0000000002824000-memory.dmp

Filesize
16KB

Download
memory/1116-116-0x0000000002460000-0x0000000002561000-memory.dmp

Filesize
1.0MB

Download
memory/1116-111-0x0000000000000000-mapping.dmp

Download
memory/1316-107-0x0000000000000000-mapping.dmp

Download
memory/1456-0-0x00000000025C0000-0x00000000025C4000-memory.dmp

Filesize
16KB

Download
memory/1540-134-0x0000000000000000-mapping.dmp

Download
memory/1660-67-0x0000000002310000-0x0000000002321000-memory.dmp

Filesize
68KB

Download
memory/1660-80-0x0000000002310000-0x0000000002321000-memory.dmp

Filesize
68KB

Download
memory/1660-64-0x0000000002310000-0x0000000002321000-memory.dmp

Filesize
68KB

Download
memory/1660-63-0x0000000002310000-0x0000000002321000-memory.dmp

Filesize
68KB

Download
memory/1660-71-0x0000000002310000-0x0000000002321000-memory.dmp

Filesize
68KB

Download
memory/1660-66-0x0000000002310000-0x0000000002321000-memory.dmp

Filesize
68KB

Download
memory/1660-62-0x0000000002310000-0x0000000002321000-memory.dmp

Filesize
68KB

Download
memory/1660-61-0x0000000002310000-0x0000000002321000-memory.dmp

Filesize
68KB

Download
memory/1660-60-0x0000000002310000-0x0000000002321000-memory.dmp

Filesize
68KB

Download
memory/1660-75-0x0000000002310000-0x0000000002321000-memory.dmp

Filesize
68KB

Download
memory/1660-59-0x0000000002310000-0x0000000002321000-memory.dmp

Filesize
68KB

Download
memory/1660-58-0x0000000002310000-0x0000000002321000-memory.dmp

Filesize
68KB

Download
memory/1660-57-0x0000000002310000-0x0000000002321000-memory.dmp

Filesize
68KB

Download
memory/1660-56-0x0000000002310000-0x0000000002321000-memory.dmp

Filesize
68KB

Download
memory/1660-65-0x0000000002310000-0x0000000002321000-memory.dmp

Filesize
68KB

Download
memory/1660-54-0x0000000000000000-mapping.dmp

Download
memory/1660-76-0x0000000002310000-0x0000000002321000-memory.dmp

Filesize
68KB

Download
memory/1660-74-0x0000000002310000-0x0000000002321000-memory.dmp

Filesize
68KB

Download
memory/1660-77-0x0000000002310000-0x0000000002321000-memory.dmp

Filesize
68KB

Download
memory/1660-78-0x0000000002310000-0x0000000002321000-memory.dmp

Filesize
68KB

Download
memory/1660-79-0x0000000002310000-0x0000000002321000-memory.dmp

Filesize
68KB

Download
memory/1660-70-0x0000000002310000-0x0000000002321000-memory.dmp

Filesize
68KB

Download
memory/1660-81-0x0000000002310000-0x0000000002321000-memory.dmp

Filesize
68KB

Download
memory/1660-82-0x0000000002310000-0x0000000002321000-memory.dmp

Filesize
68KB

Download
memory/1660-83-0x0000000002310000-0x0000000002321000-memory.dmp

Filesize
68KB

Download
memory/1660-84-0x0000000002310000-0x0000000002321000-memory.dmp

Filesize
68KB

Download
memory/1660-85-0x0000000002310000-0x0000000002321000-memory.dmp

Filesize
68KB

Download
memory/1660-73-0x0000000002310000-0x0000000002321000-memory.dmp

Filesize
68KB

Download
memory/1660-72-0x0000000002310000-0x0000000002321000-memory.dmp

Filesize
68KB

Download
memory/1660-69-0x0000000002310000-0x0000000002321000-memory.dmp

Filesize
68KB

Download
memory/1660-68-0x0000000002310000-0x0000000002321000-memory.dmp

Filesize
68KB

Download
memory/1684-104-0x0000000002590000-0x00000000025A2000-memory.dmp

Filesize
72KB

Download
memory/1800-19-0x0000000007570000-0x0000000007574000-memory.dmp

Filesize
16KB

Download
memory/1800-27-0x0000000007970000-0x0000000007974000-memory.dmp

Filesize
16KB

Download
memory/1800-14-0x0000000000000000-mapping.dmp

Download
memory/1800-26-0x000000000796C000-0x000000000796D000-memory.dmp

Filesize
4KB

Download
memory/1800-25-0x00000000059D2000-0x00000000059D6000-memory.dmp

Filesize
16KB

Download
memory/1800-24-0x0000000007929000-0x000000000792A000-memory.dmp

Filesize
4KB

Download
memory/1800-22-0x0000000005DD5000-0x0000000005DD9000-memory.dmp

Filesize
16KB

Download
memory/1800-23-0x000000000725F000-0x0000000007263000-memory.dmp

Filesize
16KB

Download
memory/1992-146-0x0000000000000000-mapping.dmp

Download
memory/2000-97-0x00000000039B0000-0x00000000039B4000-memory.dmp

Filesize
16KB

Download
memory/2000-38-0x00000000007E0000-0x00000000007E2000-memory.dmp

Filesize
8KB

Download
memory/2000-28-0x0000000001100000-0x0000000001104000-memory.dmp

Filesize
16KB

Download
memory/2000-29-0x00000000007D0000-0x00000000007D4000-memory.dmp

Filesize
16KB

Download
memory/2000-30-0x0000000001DE0000-0x0000000001DE4000-memory.dmp

Filesize
16KB

Download
memory/2000-32-0x00000000007D0000-0x00000000007D4000-memory.dmp

Filesize
16KB

Download
memory/2000-33-0x0000000001DE0000-0x0000000001DE4000-memory.dmp

Filesize
16KB

Download
memory/2000-34-0x0000000001DE0000-0x0000000001DE4000-memory.dmp

Filesize
16KB

Download
memory/2000-35-0x00000000007E0000-0x00000000007E2000-memory.dmp

Filesize
8KB

Download
memory/2000-99-0x0000000001DE0000-0x0000000001DE4000-memory.dmp

Filesize
16KB

Download
memory/2000-40-0x00000000039B0000-0x00000000039B4000-memory.dmp

Filesize
16KB

Download
memory/2000-41-0x00000000007E0000-0x00000000007E2000-memory.dmp

Filesize
8KB

Download
memory/2000-42-0x00000000007E0000-0x00000000007E2000-memory.dmp

Filesize
8KB

Download
memory/2000-43-0x00000000007E0000-0x00000000007E2000-memory.dmp

Filesize
8KB

Download
memory/2000-44-0x00000000007E0000-0x00000000007E2000-memory.dmp

Filesize
8KB

Download
memory/2000-96-0x0000000006270000-0x0000000006274000-memory.dmp

Filesize
16KB

Download
memory/2012-144-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads