raccoon | 65fa93616cdb8c92a541dd2ad8468d6688e1b1f2606891b56db3e90fbfc9acbd

System Information Discovery

Processes:

Fepetoduki.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation	Fepetoduki.exe

Loads dropped DLL 10 IoCs

Processes:

Install.tmprundll32.exetoolspab1.exey1.exejvjtvctjvjtvct

pid process

3992 Install.tmp
1188 rundll32.exe
4988 toolspab1.exe
5156 y1.exe
5156 y1.exe
5156 y1.exe
5156 y1.exe
5156 y1.exe
804 jvjtvct
5596 jvjtvct
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

gpooe.exeUltra.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.exe"	gpooe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Windows Media Player\\Qelaecejuca.exe\""	Ultra.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

Processes:

md1_1eaf.exemd2_2efs.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	md1_1eaf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	md2_2efs.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

217 api.myip.com
218 api.myip.com
60 ip-api.com
Drops file in System32 directory 1 IoCs

Processes:

svchost.exe

description ioc process

File opened for modification C:\Windows\System32\Tasks\Firefox Default Browser Agent 216949F769B03399 svchost.exe

flow	ioc
217	api.myip.com
218	api.myip.com
60	ip-api.com

description	ioc	process
File opened for modification	C:\Windows\System32\Tasks\Firefox Default Browser Agent 216949F769B03399	svchost.exe

Suspicious use of SetThreadContext 7 IoCs

Processes:

svchost.exetoolspab1.exeBBCbrowser.exe73647503.exe1904464500.exejvjtvctjvjtvct

description	pid	process	target process
PID 3148 set thread context of 4964	3148	svchost.exe	svchost.exe
PID 5940 set thread context of 4988	5940	toolspab1.exe	toolspab1.exe
PID 4552 set thread context of 4292	4552	BBCbrowser.exe	AddInProcess32.exe
PID 5704 set thread context of 4112	5704	73647503.exe	AddInProcess32.exe
PID 5036 set thread context of 4568	5036	1904464500.exe	AddInProcess32.exe
PID 6088 set thread context of 804	6088	jvjtvct	jvjtvct
PID 4276 set thread context of 5596	4276	jvjtvct	jvjtvct

Drops file in Program Files directory 12 IoCs

Processes:

Ultra.exeultramediaburner.tmpgoogle-game.exe

description	ioc	process
File created	C:\Program Files\Windows Photo Viewer\TEAMRHJURY\ultramediaburner.exe.config	Ultra.exe
File created	C:\Program Files (x86)\UltraMediaBurner\unins000.dat	ultramediaburner.tmp
File created	C:\Program Files (x86)\UltraMediaBurner\is-20RLD.tmp	ultramediaburner.tmp
File created	C:\Program Files (x86)\UltraMediaBurner\is-FI6IG.tmp	ultramediaburner.tmp
File created	C:\Program Files\install.dat	google-game.exe
File created	C:\Program Files\install.dll	google-game.exe
File created	C:\Program Files\Windows Photo Viewer\TEAMRHJURY\ultramediaburner.exe	Ultra.exe
File created	C:\Program Files (x86)\Windows Media Player\Qelaecejuca.exe	Ultra.exe
File created	C:\Program Files (x86)\Windows Media Player\Qelaecejuca.exe.config	Ultra.exe
File opened for modification	C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe	ultramediaburner.tmp
File opened for modification	C:\Program Files (x86)\UltraMediaBurner\unins000.dat	ultramediaburner.tmp
File created	C:\Program Files\nvsmartmax.dll	google-game.exe

Drops file in Windows directory 1 IoCs

Processes:

MicrosoftEdge.exe

description ioc process

File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

Checks SCSI registry key(s) 3 TTPs 13 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

toolspab1.exejvjtvctMicrosoftEdgeCP.exejvjtvct

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspab1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	jvjtvct
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	jvjtvct
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000	MicrosoftEdgeCP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\000A	MicrosoftEdgeCP.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	jvjtvct
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	jvjtvct
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspab1.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspab1.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	jvjtvct
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000	MicrosoftEdgeCP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\000A	MicrosoftEdgeCP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	jvjtvct

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

6064 timeout.exe

pid	process
6064	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

MicrosoftEdgeCP.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	MicrosoftEdgeCP.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	MicrosoftEdgeCP.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	MicrosoftEdgeCP.exe

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

4168 taskkill.exe

pid	process
4168	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

Processes:

MicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7"	svchost.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exerundll32.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exesvchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData\RulesFileNextUpdateDate = "325848876"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\theonlygames.com\ = "89"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "110"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{7924B16B-16AD-41B8-B684-829A2D505897} = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{62FM2EJ3-714D-A09D-WM25-6QFJ226I1FER}	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\theonlygames.com\Total = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "89"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "217"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "1090"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 01000000698053cf8901834113ba9d0c42dc41eef991a848cd1ceba25e786fe1a271ee60d0617d8852fd1cdacbe6081d2bf6b6ba8a6384436047b07ef419d1144f2ee6e94d4c382a1ade675a756435221367e69c985c8f596a80d62e9c3f	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url2 = "https://login.aliexpress.com/"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url4 = "https://login.live.com/"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\enlisted.net\ = "47"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension = "{E220E8F5-90E5-40D1-A32F-3309B1836A87}"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 0000000000000000	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState\EdpCleanupState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Rating Prompt Shown = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\ImageStoreRandomFolder = "11zzrcw"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "74"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\enlisted.net\NumberOfSubdoma = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\Total	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\SmartScreenCompletedVersi = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{62FM2EJ3-714D-A09D-WM25-6QFJ226I1FER}\1 = "25"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\enlisted.net\Total = "47"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\theonlygames.com\ = "28"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "1169"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\theonlygames.com\Total = "89"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\enlisted.net\ = "9"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\theonlygames.com\ = "47"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\enlisted.net	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DontShowMeThisDialogAgain	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\enlisted.net\ = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\enlisted.net\ = "248"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{45AC2TN3-666M-M32E-TO40-1MIP137D5TOZ}\1 = "4252"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\theonlygames.com	MicrosoftEdgeCP.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

Processes:

bIuMEXhIV5.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD	bIuMEXhIV5.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD\Blob = 0300000001000000140000006c0ce2dd0584c47cac18839f14055f19fa270cdd2000000001000000500500003082054c30820434a0030201020206016de34cff62300d06092a864886f70d01010b05003081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a301e170d3030303130313030303030305a170d3438313231353039313533375a3081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a30820122300d06092a864886f70d01010105000382010f003082010a0282010100ae86c5043ed34d99f44fa3052ea34047a7fbbe33188b1dc2ca645ca3249e85e54b4921d4998fda6a22247c32d9087d742af3bf850803ae8c1e25faad53fb8fd823b7353d9a3ac992bf917f693826c790e53a540b120b6553508ec9585e467d310bd3ef9fb61731deb522eb78f43f824b34be36782db7a8cb162cd22247b14e4c5ae633ed66542354a59971bddc59160ecdc521b4477c93ca9e624e0af00298602300f5dc368819c3cb9f02604636888276b3a498570473b5328b0834f327c34285e333da9207e12f0edbb654c8cf11e3cc7cba17a52cd7cd42c10ae095a2e4eb9d3e3f361488243f0584af40e72d6e6e182149bfb8342384f60f12e14734258d0203010001a382017430820170300f0603551d130101ff040530030101ff3082012c06096086480186f842010d0482011d138201195468697320526f6f74206365727469666963617465207761732067656e65726174656420627920436861726c65732050726f787920666f722053534c2050726f7879696e672e20496620746869732063657274696669636174652069732070617274206f66206120636572746966696361746520636861696e2c2074686973206d65616e73207468617420796f752772652062726f7773696e67207468726f75676820436861726c65732050726f787920776974682053534c2050726f7879696e6720656e61626c656420666f72207468697320776562736974652e20506c656173652073656520687474703a2f2f636861726c657370726f78792e636f6d2f73736c20666f72206d6f726520696e666f726d6174696f6e2e300e0603551d0f0101ff040403020204301d0603551d0e04160414f8d0dc54367cf794020f8b92783a5d8a91251f9f300d06092a864886f70d01010b05000382010100662271eb9d5c744c88382de98ba37320e6312104d04273a92007a8670976d6530e6347d00bbded1319bb6754f36237596095922911e3661a70354f6ba0b797a76258be7adebb8c8dbeeed977760b80271d74b2444d92f6c1337a379b73545b251de5f8812b9625abbbfaedc15f8c6c374b9b26dd0fef035185f5899d8819e689dc6db5f0babbfd637c52b1bec80115b889faeed493d4112d744954ad3abe6607c41a4a2d657ba330ed131fa4e8c25bb28ee181dcef8da91c17bfd30a23c8eae81b152ed85ff938afc32b34ffdaffbdb72d9bb04067bfc87f579eba9637b165ea008ea7408bc8265f33c039bf60f506d245a6b53017afc8e161d70ed5b0d76576	bIuMEXhIV5.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXE

pid process

1928 PING.EXE
4880 PING.EXE

pid	process
1928	PING.EXE
4880	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

ultramediaburner.tmpTucydegeli.exe

pid	process
3580	ultramediaburner.tmp
3580	ultramediaburner.tmp
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe
3752	Tucydegeli.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3020

pid	process
3020

Suspicious behavior: MapViewOfSection 64 IoCs

Processes:

MicrosoftEdgeCP.exetoolspab1.exeexplorer.exeexplorer.exeexplorer.exejvjtvct

pid	process
4788	MicrosoftEdgeCP.exe
4788	MicrosoftEdgeCP.exe
4988	toolspab1.exe
3020
3020
3020
3020
3020
3020
3020
3020
5748	explorer.exe
5748	explorer.exe
5748	explorer.exe
5748	explorer.exe
5748	explorer.exe
5748	explorer.exe
5748	explorer.exe
5748	explorer.exe
5748	explorer.exe
5748	explorer.exe
3020
3020
3020
3020
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
5008	explorer.exe
3020
3020
3020
3020
5812	explorer.exe
5812	explorer.exe
5812	explorer.exe
5812	explorer.exe
5812	explorer.exe
5812	explorer.exe
5812	explorer.exe
5812	explorer.exe
5812	explorer.exe
5812	explorer.exe
3020
3020
804	jvjtvct
5812	explorer.exe
5812	explorer.exe
5748	explorer.exe
5748	explorer.exe
5008	explorer.exe
5008	explorer.exe
4788	MicrosoftEdgeCP.exe
4788	MicrosoftEdgeCP.exe
5812	explorer.exe
5812	explorer.exe
5748	explorer.exe
5748	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Ultra.exeFepetoduki.exeTucydegeli.exeMicrosoftEdge.exerundll32.exesvchost.exesvchost.exesvchost.exeHookSetp.exeMicrosoftEdgeCP.exe

description	pid	process
Token: SeDebugPrivilege	2944	Ultra.exe
Token: SeDebugPrivilege	2160	Fepetoduki.exe
Token: SeDebugPrivilege	3752	Tucydegeli.exe
Token: SeDebugPrivilege	4340	MicrosoftEdge.exe
Token: SeDebugPrivilege	4340	MicrosoftEdge.exe
Token: SeDebugPrivilege	4340	MicrosoftEdge.exe
Token: SeDebugPrivilege	4340	MicrosoftEdge.exe
Token: SeDebugPrivilege	1188	rundll32.exe
Token: SeDebugPrivilege	1188	rundll32.exe
Token: SeDebugPrivilege	1188	rundll32.exe
Token: SeTcbPrivilege	3148	svchost.exe
Token: SeDebugPrivilege	1188	rundll32.exe
Token: SeDebugPrivilege	1188	rundll32.exe
Token: SeDebugPrivilege	1188	rundll32.exe
Token: SeAuditPrivilege	2396	svchost.exe
Token: SeDebugPrivilege	1188	rundll32.exe
Token: SeDebugPrivilege	1188	rundll32.exe
Token: SeDebugPrivilege	1188	rundll32.exe
Token: SeDebugPrivilege	1188	rundll32.exe
Token: SeDebugPrivilege	1188	rundll32.exe
Token: SeDebugPrivilege	1188	rundll32.exe
Token: SeAssignPrimaryTokenPrivilege	2680	svchost.exe
Token: SeIncreaseQuotaPrivilege	2680	svchost.exe
Token: SeSecurityPrivilege	2680	svchost.exe
Token: SeTakeOwnershipPrivilege	2680	svchost.exe
Token: SeLoadDriverPrivilege	2680	svchost.exe
Token: SeSystemtimePrivilege	2680	svchost.exe
Token: SeBackupPrivilege	2680	svchost.exe
Token: SeRestorePrivilege	2680	svchost.exe
Token: SeShutdownPrivilege	2680	svchost.exe
Token: SeSystemEnvironmentPrivilege	2680	svchost.exe
Token: SeUndockPrivilege	2680	svchost.exe
Token: SeManageVolumePrivilege	2680	svchost.exe
Token: SeAuditPrivilege	2396	svchost.exe
Token: SeDebugPrivilege	1188	rundll32.exe
Token: SeAssignPrimaryTokenPrivilege	2680	svchost.exe
Token: SeIncreaseQuotaPrivilege	2680	svchost.exe
Token: SeSecurityPrivilege	2680	svchost.exe
Token: SeTakeOwnershipPrivilege	2680	svchost.exe
Token: SeLoadDriverPrivilege	2680	svchost.exe
Token: SeSystemtimePrivilege	2680	svchost.exe
Token: SeBackupPrivilege	2680	svchost.exe
Token: SeRestorePrivilege	2680	svchost.exe
Token: SeShutdownPrivilege	2680	svchost.exe
Token: SeSystemEnvironmentPrivilege	2680	svchost.exe
Token: SeUndockPrivilege	2680	svchost.exe
Token: SeManageVolumePrivilege	2680	svchost.exe
Token: SeAuditPrivilege	2396	svchost.exe
Token: SeDebugPrivilege	5100	HookSetp.exe
Token: SeAssignPrimaryTokenPrivilege	2680	svchost.exe
Token: SeIncreaseQuotaPrivilege	2680	svchost.exe
Token: SeSecurityPrivilege	2680	svchost.exe
Token: SeTakeOwnershipPrivilege	2680	svchost.exe
Token: SeLoadDriverPrivilege	2680	svchost.exe
Token: SeSystemtimePrivilege	2680	svchost.exe
Token: SeBackupPrivilege	2680	svchost.exe
Token: SeRestorePrivilege	2680	svchost.exe
Token: SeShutdownPrivilege	2680	svchost.exe
Token: SeSystemEnvironmentPrivilege	2680	svchost.exe
Token: SeUndockPrivilege	2680	svchost.exe
Token: SeManageVolumePrivilege	2680	svchost.exe
Token: SeAuditPrivilege	2396	svchost.exe
Token: SeDebugPrivilege	776	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	776	MicrosoftEdgeCP.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

ultramediaburner.tmp

pid process

3580 ultramediaburner.tmp
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

MicrosoftEdge.exegoogle-game.exeMicrosoftEdgeCP.exe

pid process

4340 MicrosoftEdge.exe
4884 google-game.exe
4884 google-game.exe
4788 MicrosoftEdgeCP.exe
4788 MicrosoftEdgeCP.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

pid process

3020

pid	process
4340	MicrosoftEdge.exe
4884	google-game.exe
4884	google-game.exe
4788	MicrosoftEdgeCP.exe
4788	MicrosoftEdgeCP.exe

pid	process
3020

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Install.exeInstall.tmpUltra.exeultramediaburner.exeultramediaburner.tmpTucydegeli.execmd.execmd.execmd.exegpooe.execmd.exegoogle-game.execmd.exerundll32.exesvchost.exe

description	pid	process	target process
PID 2840 wrote to memory of 3992	2840	Install.exe	Install.tmp
PID 2840 wrote to memory of 3992	2840	Install.exe	Install.tmp
PID 2840 wrote to memory of 3992	2840	Install.exe	Install.tmp
PID 3992 wrote to memory of 2944	3992	Install.tmp	Ultra.exe
PID 3992 wrote to memory of 2944	3992	Install.tmp	Ultra.exe
PID 2944 wrote to memory of 3000	2944	Ultra.exe	ultramediaburner.exe
PID 2944 wrote to memory of 3000	2944	Ultra.exe	ultramediaburner.exe
PID 2944 wrote to memory of 3000	2944	Ultra.exe	ultramediaburner.exe
PID 3000 wrote to memory of 3580	3000	ultramediaburner.exe	ultramediaburner.tmp
PID 3000 wrote to memory of 3580	3000	ultramediaburner.exe	ultramediaburner.tmp
PID 3000 wrote to memory of 3580	3000	ultramediaburner.exe	ultramediaburner.tmp
PID 2944 wrote to memory of 2160	2944	Ultra.exe	Fepetoduki.exe
PID 2944 wrote to memory of 2160	2944	Ultra.exe	Fepetoduki.exe
PID 2944 wrote to memory of 3752	2944	Ultra.exe	Tucydegeli.exe
PID 2944 wrote to memory of 3752	2944	Ultra.exe	Tucydegeli.exe
PID 3580 wrote to memory of 3924	3580	ultramediaburner.tmp	UltraMediaBurner.exe
PID 3580 wrote to memory of 3924	3580	ultramediaburner.tmp	UltraMediaBurner.exe
PID 3752 wrote to memory of 4388	3752	Tucydegeli.exe	cmd.exe
PID 3752 wrote to memory of 4388	3752	Tucydegeli.exe	cmd.exe
PID 4388 wrote to memory of 4560	4388	cmd.exe	skipper.exe
PID 4388 wrote to memory of 4560	4388	cmd.exe	skipper.exe
PID 4388 wrote to memory of 4560	4388	cmd.exe	skipper.exe
PID 3752 wrote to memory of 4636	3752	Tucydegeli.exe	cmd.exe
PID 3752 wrote to memory of 4636	3752	Tucydegeli.exe	cmd.exe
PID 4636 wrote to memory of 4812	4636	cmd.exe	001.exe
PID 4636 wrote to memory of 4812	4636	cmd.exe	001.exe
PID 4636 wrote to memory of 4812	4636	cmd.exe	001.exe
PID 3752 wrote to memory of 3908	3752	Tucydegeli.exe	cmd.exe
PID 3752 wrote to memory of 3908	3752	Tucydegeli.exe	cmd.exe
PID 3908 wrote to memory of 4184	3908	cmd.exe	gpooe.exe
PID 3908 wrote to memory of 4184	3908	cmd.exe	gpooe.exe
PID 3908 wrote to memory of 4184	3908	cmd.exe	gpooe.exe
PID 4184 wrote to memory of 4324	4184	gpooe.exe	jfiag3g_gg.exe
PID 4184 wrote to memory of 4324	4184	gpooe.exe	jfiag3g_gg.exe
PID 4184 wrote to memory of 4324	4184	gpooe.exe	jfiag3g_gg.exe
PID 3752 wrote to memory of 4628	3752	Tucydegeli.exe	cmd.exe
PID 3752 wrote to memory of 4628	3752	Tucydegeli.exe	cmd.exe
PID 4628 wrote to memory of 4884	4628	cmd.exe	google-game.exe
PID 4628 wrote to memory of 4884	4628	cmd.exe	google-game.exe
PID 4628 wrote to memory of 4884	4628	cmd.exe	google-game.exe
PID 3752 wrote to memory of 5112	3752	Tucydegeli.exe	cmd.exe
PID 3752 wrote to memory of 5112	3752	Tucydegeli.exe	cmd.exe
PID 4884 wrote to memory of 1188	4884	google-game.exe	rundll32.exe
PID 4884 wrote to memory of 1188	4884	google-game.exe	rundll32.exe
PID 4884 wrote to memory of 1188	4884	google-game.exe	rundll32.exe
PID 5112 wrote to memory of 4376	5112	cmd.exe	md1_1eaf.exe
PID 5112 wrote to memory of 4376	5112	cmd.exe	md1_1eaf.exe
PID 5112 wrote to memory of 4376	5112	cmd.exe	md1_1eaf.exe
PID 3752 wrote to memory of 4264	3752	Tucydegeli.exe	cmd.exe
PID 3752 wrote to memory of 4264	3752	Tucydegeli.exe	cmd.exe
PID 4184 wrote to memory of 4508	4184	gpooe.exe	jfiag3g_gg.exe
PID 4184 wrote to memory of 4508	4184	gpooe.exe	jfiag3g_gg.exe
PID 4184 wrote to memory of 4508	4184	gpooe.exe	jfiag3g_gg.exe
PID 1188 wrote to memory of 3148	1188	rundll32.exe	svchost.exe
PID 1188 wrote to memory of 2824	1188	rundll32.exe	svchost.exe
PID 1188 wrote to memory of 336	1188	rundll32.exe	svchost.exe
PID 3148 wrote to memory of 4964	3148	svchost.exe	svchost.exe
PID 3148 wrote to memory of 4964	3148	svchost.exe	svchost.exe
PID 3148 wrote to memory of 4964	3148	svchost.exe	svchost.exe
PID 1188 wrote to memory of 2404	1188	rundll32.exe	svchost.exe
PID 1188 wrote to memory of 2396	1188	rundll32.exe	svchost.exe
PID 1188 wrote to memory of 1076	1188	rundll32.exe	svchost.exe
PID 1188 wrote to memory of 404	1188	rundll32.exe	svchost.exe
PID 1188 wrote to memory of 1400	1188	rundll32.exe	svchost.exe

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:336

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1236

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2824

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2740

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2680

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2404

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2396

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1848

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1400

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1224

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1076

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
- Drops file in System32 directory
PID:404
- C:\Users\Admin\AppData\Roaming\jvjtvct
  C:\Users\Admin\AppData\Roaming\jvjtvct
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:6088
- - C:\Users\Admin\AppData\Roaming\jvjtvct
    C:\Users\Admin\AppData\Roaming\jvjtvct
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks SCSI registry key(s)
    - Suspicious behavior: MapViewOfSection
    PID:804
- C:\Users\Admin\AppData\Roaming\jvjtvct
  C:\Users\Admin\AppData\Roaming\jvjtvct
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:4276
- - C:\Users\Admin\AppData\Roaming\jvjtvct
    C:\Users\Admin\AppData\Roaming\jvjtvct
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks SCSI registry key(s)
    PID:5596

C:\Users\Admin\AppData\Local\Temp\Install.exe
"C:\Users\Admin\AppData\Local\Temp\Install.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Users\Admin\AppData\Local\Temp\is-DOHUR.tmp\Install.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-DOHUR.tmp\Install.tmp" /SL5="$7004E,235791,152064,C:\Users\Admin\AppData\Local\Temp\Install.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3992
- - C:\Users\Admin\AppData\Local\Temp\is-A5H69.tmp\Ultra.exe
    "C:\Users\Admin\AppData\Local\Temp\is-A5H69.tmp\Ultra.exe" /S /UID=burnerch1
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Program Files directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2944
  - - C:\Program Files\Windows Photo Viewer\TEAMRHJURY\ultramediaburner.exe
      "C:\Program Files\Windows Photo Viewer\TEAMRHJURY\ultramediaburner.exe" /VERYSILENT
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3000
    - - C:\Users\Admin\AppData\Local\Temp\is-UP3CD.tmp\ultramediaburner.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-UP3CD.tmp\ultramediaburner.tmp" /SL5="$40058,281924,62464,C:\Program Files\Windows Photo Viewer\TEAMRHJURY\ultramediaburner.exe" /VERYSILENT
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:3580
      - C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
        
        "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
        6⤵
        Executes dropped EXE
        
        PID:3924
  - - C:\Users\Admin\AppData\Local\Temp\44-620ad-081-75d80-e65fbe6f95d13\Fepetoduki.exe
      "C:\Users\Admin\AppData\Local\Temp\44-620ad-081-75d80-e65fbe6f95d13\Fepetoduki.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Suspicious use of AdjustPrivilegeToken
      PID:2160
  - - C:\Users\Admin\AppData\Local\Temp\43-19b2c-345-c5599-7ca12ccdc88d3\Tucydegeli.exe
      "C:\Users\Admin\AppData\Local\Temp\43-19b2c-345-c5599-7ca12ccdc88d3\Tucydegeli.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3752
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\11ufwpoz.3yp\skipper.exe /s & exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4388
      - C:\Users\Admin\AppData\Local\Temp\11ufwpoz.3yp\skipper.exe
        
        C:\Users\Admin\AppData\Local\Temp\11ufwpoz.3yp\skipper.exe /s
        6⤵
        Executes dropped EXE
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\73647503.exe
        
        C:\Users\Admin\AppData\Local\Temp\73647503.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5704
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        8⤵
        
        PID:996
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        8⤵
        
        PID:4112
        
        C:\Users\Admin\AppData\Local\Temp\1904464500.exe
        
        C:\Users\Admin\AppData\Local\Temp\1904464500.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5036
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        8⤵
        
        PID:4568
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /k ping 0 & del C:\Users\Admin\AppData\Local\Temp\11ufwpoz.3yp\skipper.exe & exit
        7⤵
        
        PID:3500
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 0
        8⤵
        Runs ping.exe
        
        PID:4880
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\1210gqmh.hr4\001.exe & exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4636
      - C:\Users\Admin\AppData\Local\Temp\1210gqmh.hr4\001.exe
        
        C:\Users\Admin\AppData\Local\Temp\1210gqmh.hr4\001.exe
        6⤵
        Executes dropped EXE
        
        PID:4812
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\z32kirgo.n4a\gpooe.exe & exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3908
      - C:\Users\Admin\AppData\Local\Temp\z32kirgo.n4a\gpooe.exe
        
        C:\Users\Admin\AppData\Local\Temp\z32kirgo.n4a\gpooe.exe
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:4184
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        7⤵
        Executes dropped EXE
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        7⤵
        Executes dropped EXE
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        7⤵
        Executes dropped EXE
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        7⤵
        Executes dropped EXE
        
        PID:6020
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\zrmvgbnv.aa1\google-game.exe & exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4628
      - C:\Users\Admin\AppData\Local\Temp\zrmvgbnv.aa1\google-game.exe
        
        C:\Users\Admin\AppData\Local\Temp\zrmvgbnv.aa1\google-game.exe
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4884
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" "C:\Program Files\install.dll",install
        7⤵
        Loads dropped DLL
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1188
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ulqooyjd.0ws\md1_1eaf.exe & exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5112
      - C:\Users\Admin\AppData\Local\Temp\ulqooyjd.0ws\md1_1eaf.exe
        
        C:\Users\Admin\AppData\Local\Temp\ulqooyjd.0ws\md1_1eaf.exe
        6⤵
        Executes dropped EXE
        Checks whether UAC is enabled
        
        PID:4376
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\w1zf3lvz.dyy\HookSetp.exe /silent & exit
        5⤵
        
        PID:4264
      - C:\Users\Admin\AppData\Local\Temp\w1zf3lvz.dyy\HookSetp.exe
        
        C:\Users\Admin\AppData\Local\Temp\w1zf3lvz.dyy\HookSetp.exe /silent
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5100
        
        C:\Users\Admin\AppData\Roaming\6818719.exe
        
        "C:\Users\Admin\AppData\Roaming\6818719.exe"
        7⤵
        Executes dropped EXE
        
        PID:5524
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\l1dz15bj.0uq\BBCbrowser.exe /VERYSILENT & exit
        5⤵
        
        PID:1608
      - C:\Users\Admin\AppData\Local\Temp\l1dz15bj.0uq\BBCbrowser.exe
        
        C:\Users\Admin\AppData\Local\Temp\l1dz15bj.0uq\BBCbrowser.exe /VERYSILENT
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4552
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        7⤵
        
        PID:4292
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\cit4ajqk.bzi\md2_2efs.exe & exit
        5⤵
        
        PID:5328
      - C:\Users\Admin\AppData\Local\Temp\cit4ajqk.bzi\md2_2efs.exe
        
        C:\Users\Admin\AppData\Local\Temp\cit4ajqk.bzi\md2_2efs.exe
        6⤵
        Executes dropped EXE
        Checks whether UAC is enabled
        
        PID:5552
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\akcwrvtm.pib\askinstall39.exe & exit
        5⤵
        
        PID:5724
      - C:\Users\Admin\AppData\Local\Temp\akcwrvtm.pib\askinstall39.exe
        
        C:\Users\Admin\AppData\Local\Temp\akcwrvtm.pib\askinstall39.exe
        6⤵
        Executes dropped EXE
        
        PID:6032
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        7⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        8⤵
        Kills process with taskkill
        
        PID:4168
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ciepevde.vkd\y1.exe & exit
        5⤵
        
        PID:5852
      - C:\Users\Admin\AppData\Local\Temp\ciepevde.vkd\y1.exe
        
        C:\Users\Admin\AppData\Local\Temp\ciepevde.vkd\y1.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\bIuMEXhIV5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bIuMEXhIV5.exe"
        7⤵
        Executes dropped EXE
        Modifies system certificate store
        
        PID:2772
        
        C:\Users\Admin\AppData\Roaming\1619686801305.exe
        
        "C:\Users\Admin\AppData\Roaming\1619686801305.exe" /sjson "C:\Users\Admin\AppData\Roaming\1619686801305.txt"
        8⤵
        Executes dropped EXE
        
        PID:5728
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\bIuMEXhIV5.exe"
        8⤵
        
        PID:1824
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 3
        9⤵
        Runs ping.exe
        
        PID:1928
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\ciepevde.vkd\y1.exe"
        7⤵
        
        PID:2244
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /T 10 /NOBREAK
        8⤵
        Delays execution with timeout.exe
        
        PID:6064
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\w0ugri01.vxr\jvppp.exe & exit
        5⤵
        
        PID:5384
      - C:\Users\Admin\AppData\Local\Temp\w0ugri01.vxr\jvppp.exe
        
        C:\Users\Admin\AppData\Local\Temp\w0ugri01.vxr\jvppp.exe
        6⤵
        Executes dropped EXE
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        7⤵
        Executes dropped EXE
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        7⤵
        Executes dropped EXE
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        7⤵
        Executes dropped EXE
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        7⤵
        Executes dropped EXE
        
        PID:5436
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\lwsjqpu1.uyq\GcleanerWW.exe /mixone & exit
        5⤵
        
        PID:4292
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\bx0tqe1o.0fb\toolspab1.exe & exit
        5⤵
        
        PID:5580
      - C:\Users\Admin\AppData\Local\Temp\bx0tqe1o.0fb\toolspab1.exe
        
        C:\Users\Admin\AppData\Local\Temp\bx0tqe1o.0fb\toolspab1.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\bx0tqe1o.0fb\toolspab1.exe
        
        C:\Users\Admin\AppData\Local\Temp\bx0tqe1o.0fb\toolspab1.exe
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks SCSI registry key(s)
        Suspicious behavior: MapViewOfSection
        
        PID:4988
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\d4utr01y.lko\005.exe & exit
        5⤵
        
        PID:6044
      - C:\Users\Admin\AppData\Local\Temp\d4utr01y.lko\005.exe
        
        C:\Users\Admin\AppData\Local\Temp\d4utr01y.lko\005.exe
        6⤵
        Executes dropped EXE
        
        PID:5376

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s BITS
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3148
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k SystemNetworkService
  2⤵
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  PID:4964

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4340

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4668

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:4788

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:776

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5128

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:3776

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5528

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2348

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2448

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4960

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:5748

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:996

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:5008

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4372

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:5812

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4920

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies registry class
PID:1892

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5196

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

Software Discovery

T1518

System Information Discovery