Analysis
-
max time kernel
60s -
max time network
61s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
04-04-2021 18:22
Static task
static1
Behavioral task
behavioral1
Sample
Big_Buck_Hunter_Pro_v3_0_10_keygen_by_Inferno.exe
Resource
win10v20201028
Behavioral task
behavioral2
Sample
Big_Buck_Hunter_Pro_v3_0_10_keygen_by_Inferno.exe
Resource
win10v20201028
Behavioral task
behavioral3
Sample
Big_Buck_Hunter_Pro_v3_0_10_keygen_by_Inferno.exe
Resource
win10v20201028
Behavioral task
behavioral4
Sample
Big_Buck_Hunter_Pro_v3_0_10_keygen_by_Inferno.exe
Resource
win10v20201028
Behavioral task
behavioral5
Sample
Big_Buck_Hunter_Pro_v3_0_10_keygen_by_Inferno.exe
Resource
win7v20201028
General
-
Target
Big_Buck_Hunter_Pro_v3_0_10_keygen_by_Inferno.exe
-
Size
5.2MB
-
MD5
c9d0760f5504d9e8ce237543fc4e7562
-
SHA1
12dac9b23d9f95b9647767e15a265a73380ad50b
-
SHA256
2519f6e84956fd35aaf7aa0ac51c2ce4cd8fddc973933936560ddb1efff6a16f
-
SHA512
28e06d8763858601484ec3675b5d0895712b616d69b36d4c584f32dfb56dfe9a7c26ad05dfda27efc2e9512c11d7dedcafd4d69d98baffdda8eb5af9ba99398a
Malware Config
Extracted
azorult
http://kvaka.li/1210776429.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
XMRig Miner Payload 3 IoCs
resource yara_rule behavioral1/memory/4460-147-0x00000001402CA898-mapping.dmp xmrig behavioral1/memory/4460-146-0x0000000140000000-0x000000014070A000-memory.dmp xmrig behavioral1/memory/4460-149-0x0000000140000000-0x000000014070A000-memory.dmp xmrig -
Executes dropped EXE 12 IoCs
pid Process 940 keygen-pr.exe 1584 keygen-step-1.exe 3464 keygen-step-3.exe 3120 keygen-step-4.exe 3612 key.exe 2116 Setup.exe 3964 multitimer.exe 492 setups.exe 2300 askinstall20.exe 2928 setups.tmp 4272 Full_Version.exe 4376 file.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\International\Geo\Nation setups.tmp -
Loads dropped DLL 7 IoCs
pid Process 2928 setups.tmp 2928 setups.tmp 2928 setups.tmp 2928 setups.tmp 2928 setups.tmp 2928 setups.tmp 2928 setups.tmp -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 123 ipinfo.io 126 ipinfo.io -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\unins0000.dat Full_Version.exe File created C:\Program Files\unins0000.dll Full_Version.exe File created C:\Program Files\unins.vbs Full_Version.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 1 IoCs
pid Process 3452 taskkill.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url1 = "https://www.facebook.com/" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url5 = "https://twitter.com/" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\SmartScreenCompletedVersi = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\DatabaseComplete = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\SettingsVersion = "2" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\EnableNegotiate = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming\ChangeUnitGenerationNeeded = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings Full_Version.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows\AllowInPrivate MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheLimit = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\ManagerHistoryComplete = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\FontSize = "3" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 010000005e73be9fa83caa114ccd3fb96b58242d860177293f22ae240d6ceb39d18a3b1f9d3a1313270627d3a310ffea56ad37deb9a30153615c98cc635e3743ead318af59ff07561fd88a5319392a24fd525d37bf52ba943c6ff90aadc552beadbd71dab4e0bb41a4531f7e6167f14763e947aa9a2e784ff5fae199e4c108e617e921b27effc55b49182883e8b919880b116cbda2578e37dd9f848745738e0a58f5a0d7077b251affc57517cb516b538569e43c99ed89be80fde7fb47f96d412382356bb973c1f034fcaf424f4ea69b3d93847df3106f4cebb4c88d91743a5dbe30ea2027092934c35b4dbd02d0a506462e43b0fbe06a459564ba2a04056640b79f60579e5b90c7e9831ae008f77d7ddfd9ee43b27d5be447ad758e63cad573a86fa941088bbd9f38159e22b7e2dc9c30369255a707b9e3162fb146f5e41d166441222391b7d31284af6928ebb3a38d9ae33c39b19ed1f4198afa4cae7386195cb3c398100156f76ef3b85e2d896025d882d904bf62a608505ec7285698cecd2566c3f3cd870196fc7f51304b84525c36b21237e0732b69134b12ab3d1559843c9dbf927e00fa49c290 MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension = "{E8190083-DB14-42E4-88A7-ECC18652DF78}" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites\Order = 0c0000000a000000000000000c0000000100000000000000 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar\WebBrowser MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main\OperationalData = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url2 = "https://login.aliexpress.com/" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\InternetRegistry MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "256000" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DOMStorage MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{FBFA810D-C77B-4B46-BAD0-D823878E4D8B} = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\AllComplete = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\AllComplete = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Zoom MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI MicrosoftEdge.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 askinstall20.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e askinstall20.exe -
Runs ping.exe 1 TTPs 3 IoCs
pid Process 5704 PING.EXE 1924 PING.EXE 4780 PING.EXE -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 125 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 128 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2928 setups.tmp 2928 setups.tmp -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 2116 Setup.exe Token: SeCreateTokenPrivilege 2300 askinstall20.exe Token: SeAssignPrimaryTokenPrivilege 2300 askinstall20.exe Token: SeLockMemoryPrivilege 2300 askinstall20.exe Token: SeIncreaseQuotaPrivilege 2300 askinstall20.exe Token: SeMachineAccountPrivilege 2300 askinstall20.exe Token: SeTcbPrivilege 2300 askinstall20.exe Token: SeSecurityPrivilege 2300 askinstall20.exe Token: SeTakeOwnershipPrivilege 2300 askinstall20.exe Token: SeLoadDriverPrivilege 2300 askinstall20.exe Token: SeSystemProfilePrivilege 2300 askinstall20.exe Token: SeSystemtimePrivilege 2300 askinstall20.exe Token: SeProfSingleProcessPrivilege 2300 askinstall20.exe Token: SeIncBasePriorityPrivilege 2300 askinstall20.exe Token: SeCreatePagefilePrivilege 2300 askinstall20.exe Token: SeCreatePermanentPrivilege 2300 askinstall20.exe Token: SeBackupPrivilege 2300 askinstall20.exe Token: SeRestorePrivilege 2300 askinstall20.exe Token: SeShutdownPrivilege 2300 askinstall20.exe Token: SeDebugPrivilege 2300 askinstall20.exe Token: SeAuditPrivilege 2300 askinstall20.exe Token: SeSystemEnvironmentPrivilege 2300 askinstall20.exe Token: SeChangeNotifyPrivilege 2300 askinstall20.exe Token: SeRemoteShutdownPrivilege 2300 askinstall20.exe Token: SeUndockPrivilege 2300 askinstall20.exe Token: SeSyncAgentPrivilege 2300 askinstall20.exe Token: SeEnableDelegationPrivilege 2300 askinstall20.exe Token: SeManageVolumePrivilege 2300 askinstall20.exe Token: SeImpersonatePrivilege 2300 askinstall20.exe Token: SeCreateGlobalPrivilege 2300 askinstall20.exe Token: 31 2300 askinstall20.exe Token: 32 2300 askinstall20.exe Token: 33 2300 askinstall20.exe Token: 34 2300 askinstall20.exe Token: 35 2300 askinstall20.exe Token: SeDebugPrivilege 3452 taskkill.exe Token: SeDebugPrivilege 3964 multitimer.exe Token: SeDebugPrivilege 2204 MicrosoftEdge.exe Token: SeDebugPrivilege 2204 MicrosoftEdge.exe Token: SeDebugPrivilege 2204 MicrosoftEdge.exe Token: SeDebugPrivilege 2204 MicrosoftEdge.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 492 setups.exe 2928 setups.tmp 2204 MicrosoftEdge.exe -
Suspicious use of WriteProcessMemory 55 IoCs
description pid Process procid_target PID 880 wrote to memory of 856 880 Big_Buck_Hunter_Pro_v3_0_10_keygen_by_Inferno.exe 76 PID 880 wrote to memory of 856 880 Big_Buck_Hunter_Pro_v3_0_10_keygen_by_Inferno.exe 76 PID 880 wrote to memory of 856 880 Big_Buck_Hunter_Pro_v3_0_10_keygen_by_Inferno.exe 76 PID 856 wrote to memory of 940 856 cmd.exe 79 PID 856 wrote to memory of 940 856 cmd.exe 79 PID 856 wrote to memory of 940 856 cmd.exe 79 PID 856 wrote to memory of 1584 856 cmd.exe 80 PID 856 wrote to memory of 1584 856 cmd.exe 80 PID 856 wrote to memory of 1584 856 cmd.exe 80 PID 856 wrote to memory of 3464 856 cmd.exe 81 PID 856 wrote to memory of 3464 856 cmd.exe 81 PID 856 wrote to memory of 3464 856 cmd.exe 81 PID 856 wrote to memory of 3120 856 cmd.exe 82 PID 856 wrote to memory of 3120 856 cmd.exe 82 PID 856 wrote to memory of 3120 856 cmd.exe 82 PID 940 wrote to memory of 3612 940 keygen-pr.exe 83 PID 940 wrote to memory of 3612 940 keygen-pr.exe 83 PID 940 wrote to memory of 3612 940 keygen-pr.exe 83 PID 3120 wrote to memory of 2116 3120 keygen-step-4.exe 84 PID 3120 wrote to memory of 2116 3120 keygen-step-4.exe 84 PID 3464 wrote to memory of 2272 3464 keygen-step-3.exe 85 PID 3464 wrote to memory of 2272 3464 keygen-step-3.exe 85 PID 3464 wrote to memory of 2272 3464 keygen-step-3.exe 85 PID 2272 wrote to memory of 1924 2272 cmd.exe 87 PID 2272 wrote to memory of 1924 2272 cmd.exe 87 PID 2272 wrote to memory of 1924 2272 cmd.exe 87 PID 3612 wrote to memory of 3852 3612 key.exe 88 PID 3612 wrote to memory of 3852 3612 key.exe 88 PID 3612 wrote to memory of 3852 3612 key.exe 88 PID 2116 wrote to memory of 3964 2116 Setup.exe 89 PID 2116 wrote to memory of 3964 2116 Setup.exe 89 PID 2116 wrote to memory of 492 2116 Setup.exe 90 PID 2116 wrote to memory of 492 2116 Setup.exe 90 PID 2116 wrote to memory of 492 2116 Setup.exe 90 PID 3120 wrote to memory of 2300 3120 keygen-step-4.exe 91 PID 3120 wrote to memory of 2300 3120 keygen-step-4.exe 91 PID 3120 wrote to memory of 2300 3120 keygen-step-4.exe 91 PID 492 wrote to memory of 2928 492 setups.exe 92 PID 492 wrote to memory of 2928 492 setups.exe 92 PID 492 wrote to memory of 2928 492 setups.exe 92 PID 2300 wrote to memory of 1064 2300 askinstall20.exe 93 PID 2300 wrote to memory of 1064 2300 askinstall20.exe 93 PID 2300 wrote to memory of 1064 2300 askinstall20.exe 93 PID 1064 wrote to memory of 3452 1064 cmd.exe 95 PID 1064 wrote to memory of 3452 1064 cmd.exe 95 PID 1064 wrote to memory of 3452 1064 cmd.exe 95 PID 3120 wrote to memory of 4272 3120 keygen-step-4.exe 100 PID 3120 wrote to memory of 4272 3120 keygen-step-4.exe 100 PID 3120 wrote to memory of 4272 3120 keygen-step-4.exe 100 PID 4272 wrote to memory of 4356 4272 Full_Version.exe 101 PID 4272 wrote to memory of 4356 4272 Full_Version.exe 101 PID 4272 wrote to memory of 4356 4272 Full_Version.exe 101 PID 3120 wrote to memory of 4376 3120 keygen-step-4.exe 102 PID 3120 wrote to memory of 4376 3120 keygen-step-4.exe 102 PID 3120 wrote to memory of 4376 3120 keygen-step-4.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\Big_Buck_Hunter_Pro_v3_0_10_keygen_by_Inferno.exe"C:\Users\Admin\AppData\Local\Temp\Big_Buck_Hunter_Pro_v3_0_10_keygen_by_Inferno.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exekeygen-pr.exe -p83fsase3Ge3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exeC:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat5⤵PID:3852
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exekeygen-step-1.exe3⤵
- Executes dropped EXE
PID:1584
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exekeygen-step-3.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30005⤵
- Runs ping.exe
PID:1924
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exekeygen-step-4.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\FWFGF1RKEZ\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\FWFGF1RKEZ\multitimer.exe" 0 3060197d33d91c80.94013368 0 1015⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\FWFGF1RKEZ\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\FWFGF1RKEZ\multitimer.exe" 1 3.1617560585.606a0409063e7 1016⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\FWFGF1RKEZ\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\FWFGF1RKEZ\multitimer.exe" 2 3.1617560585.606a0409063e77⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\kpl4tesxbku\30o0rykqt53.exe"C:\Users\Admin\AppData\Local\Temp\kpl4tesxbku\30o0rykqt53.exe" /VERYSILENT8⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\is-IHSFL.tmp\30o0rykqt53.tmp"C:\Users\Admin\AppData\Local\Temp\is-IHSFL.tmp\30o0rykqt53.tmp" /SL5="$302B4,2592217,780800,C:\Users\Admin\AppData\Local\Temp\kpl4tesxbku\30o0rykqt53.exe" /VERYSILENT9⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\is-N1IL6.tmp\winlthsth.exe"C:\Users\Admin\AppData\Local\Temp\is-N1IL6.tmp\winlthsth.exe"10⤵PID:5368
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\gzut21wadmb\cpyrix.exe"C:\Users\Admin\AppData\Local\Temp\gzut21wadmb\cpyrix.exe" /VERYSILENT8⤵PID:4732
-
C:\Users\Admin\AppData\Roaming\1.exeC:\Users\Admin\AppData\Roaming\1.exe9⤵PID:5844
-
-
-
C:\Users\Admin\AppData\Local\Temp\wdaaicfvwkr\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\wdaaicfvwkr\Setup3310.exe" /Verysilent /subid=5778⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\is-6JU42.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-6JU42.tmp\Setup3310.tmp" /SL5="$302B6,138429,56832,C:\Users\Admin\AppData\Local\Temp\wdaaicfvwkr\Setup3310.exe" /Verysilent /subid=5779⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\is-2L8RJ.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-2L8RJ.tmp\Setup.exe" /Verysilent10⤵PID:4404
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\RunWW.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\RunWW.exe"11⤵PID:5536
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\jg7_7wjg.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\jg7_7wjg.exe"11⤵PID:5576
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\LabPicV3.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\LabPicV3.exe"11⤵PID:5664
-
C:\Users\Admin\AppData\Local\Temp\is-QMQT8.tmp\LabPicV3.tmp"C:\Users\Admin\AppData\Local\Temp\is-QMQT8.tmp\LabPicV3.tmp" /SL5="$7005C,239334,155648,C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\LabPicV3.exe"12⤵PID:1984
-
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\lylal220.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\lylal220.exe"11⤵PID:5728
-
C:\Users\Admin\AppData\Local\Temp\is-T14TV.tmp\lylal220.tmp"C:\Users\Admin\AppData\Local\Temp\is-T14TV.tmp\lylal220.tmp" /SL5="$402FE,491750,408064,C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\lylal220.exe"12⤵PID:1132
-
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\hjjgaa.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\hjjgaa.exe"11⤵PID:5532
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\22.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\22.exe"11⤵PID:4264
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\guihuali-game.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\guihuali-game.exe"11⤵PID:4120
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\HookSetp.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\HookSetp.exe"11⤵PID:4916
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\0Jm5LQEyZe9W.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\0Jm5LQEyZe9W.exe"11⤵PID:5952
-
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\Three.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\Three.exe"11⤵PID:4176
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\3nwuvokncjl\vict.exe"C:\Users\Admin\AppData\Local\Temp\3nwuvokncjl\vict.exe" /VERYSILENT /id=5358⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\is-OROIG.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-OROIG.tmp\vict.tmp" /SL5="$20316,870426,780800,C:\Users\Admin\AppData\Local\Temp\3nwuvokncjl\vict.exe" /VERYSILENT /id=5359⤵PID:4124
-
-
-
C:\Users\Admin\AppData\Local\Temp\asxexlbgrok\app.exe"C:\Users\Admin\AppData\Local\Temp\asxexlbgrok\app.exe" /8-238⤵PID:736
-
-
C:\Users\Admin\AppData\Local\Temp\ykf0whi4ue3\vpn.exe"C:\Users\Admin\AppData\Local\Temp\ykf0whi4ue3\vpn.exe" /silent /subid=4828⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\is-P3RBG.tmp\vpn.tmp"C:\Users\Admin\AppData\Local\Temp\is-P3RBG.tmp\vpn.tmp" /SL5="$402BA,15170975,270336,C:\Users\Admin\AppData\Local\Temp\ykf0whi4ue3\vpn.exe" /silent /subid=4829⤵PID:4100
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "10⤵PID:5876
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe remove tap090111⤵PID:4248
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\4eyfk2eobc0\n0hxpegijv2.exe"C:\Users\Admin\AppData\Local\Temp\4eyfk2eobc0\n0hxpegijv2.exe" /ustwo INSTALL8⤵PID:4256
-
-
C:\Users\Admin\AppData\Local\Temp\sqxf2mygd3r\rgffds4wkrj.exe"C:\Users\Admin\AppData\Local\Temp\sqxf2mygd3r\rgffds4wkrj.exe"8⤵PID:4324
-
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\sqxf2mygd3r\rgffds4wkrj.exe"9⤵PID:5240
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 300010⤵
- Runs ping.exe
PID:5704
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\sgpnxaujgad\f2ioubc2osk.exe"C:\Users\Admin\AppData\Local\Temp\sgpnxaujgad\f2ioubc2osk.exe" /quiet SILENT=1 AF=7568⤵PID:4340
-
-
C:\Users\Admin\AppData\Local\Temp\cyfajjziq52\IBInstaller_97039.exe"C:\Users\Admin\AppData\Local\Temp\cyfajjziq52\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq8⤵PID:4540
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\FQ31WV04Y0\setups.exe"C:\Users\Admin\AppData\Local\Temp\FQ31WV04Y0\setups.exe" ll5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:492 -
C:\Users\Admin\AppData\Local\Temp\is-V7ITN.tmp\setups.tmp"C:\Users\Admin\AppData\Local\Temp\is-V7ITN.tmp\setups.tmp" /SL5="$60084,454998,229376,C:\Users\Admin\AppData\Local\Temp\FQ31WV04Y0\setups.exe" ll6⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2928
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe"4⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe5⤵
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3452
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\Full_Version.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\Full_Version.exe"4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files\unins.vbs"5⤵PID:4356
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Program Files\unins0000.dll",install6⤵PID:4660
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"4⤵
- Executes dropped EXE
PID:4376 -
C:\Users\Admin\AppData\Roaming\CFC9.tmp.exe"C:\Users\Admin\AppData\Roaming\CFC9.tmp.exe"5⤵PID:4548
-
C:\Windows\system32\msiexec.exe-o pool.supportxmr.com:8080 -u 47wDrszce6VbnMB4zhhEA1Gr3EzwHx2eS6QzC5sFoq8iGdMjnzX8bnEjBdQHsAuW8C1SNgxyGa4DQTVnQ9jfhRod73np5P8.w29346 --cpu-max-threads-hint 50 -r 99996⤵PID:4460
-
-
C:\Windows\system32\msiexec.exe-P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.w7509@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 999996⤵PID:4876
-
-
-
C:\Users\Admin\AppData\Roaming\D122.tmp.exe"C:\Users\Admin\AppData\Roaming\D122.tmp.exe"5⤵PID:4608
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"5⤵PID:4904
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.16⤵
- Runs ping.exe
PID:4780
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe"4⤵PID:5020
-
-
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2204
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:1460
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:4520
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:4736
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵PID:4824
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\is-OFVNT.tmp\IBInstaller_97039.tmp"C:\Users\Admin\AppData\Local\Temp\is-OFVNT.tmp\IBInstaller_97039.tmp" /SL5="$202D6,14575146,721408,C:\Users\Admin\AppData\Local\Temp\cyfajjziq52\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq1⤵PID:4108
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c expand C:\Users\Admin\AppData\Local\Temp\is-4960O.tmp\{app}\microsoft.cab -F:* %ProgramData%2⤵PID:5464
-
C:\Windows\SysWOW64\expand.exeexpand C:\Users\Admin\AppData\Local\Temp\is-4960O.tmp\{app}\microsoft.cab -F:* C:\ProgramData3⤵PID:5752
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-O4LTU.tmp\win1host.exe"C:\Users\Admin\AppData\Local\Temp\is-O4LTU.tmp\win1host.exe" 5351⤵PID:5380
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵PID:5200
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 51490D6534F20B03CC4DF53198E579CA C2⤵PID:5548
-