raccoon | 65fa93616cdb8c92a541dd2ad8468d6688e1b1f2606891b56db3e90fbfc9acbd

System Information Discovery

Processes:

Nyshulyzhaewu.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation	Nyshulyzhaewu.exe

Loads dropped DLL 14 IoCs

Processes:

Install.tmprundll32.exetoolspab1.exey1.exe5D94.exe

pid	process
4940	Install.tmp
5216	rundll32.exe
4160	toolspab1.exe
5724	y1.exe
5724	y1.exe
5724	y1.exe
5724	y1.exe
5724	y1.exe
4456	5D94.exe
4456	5D94.exe
4456	5D94.exe
4456	5D94.exe
4456	5D94.exe
4456	5D94.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 10 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

Processes:

6006.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	6006.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0"	6006.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0"	6006.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	6006.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	6006.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions	6006.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\6006.exe = "0"	6006.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection	6006.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	6006.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet	6006.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

Ultra.exegpooe.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Windows Mail\\Qekaelaetaeso.exe\""	Ultra.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.exe"	gpooe.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

Processes:

md1_1eaf.exemd2_2efs.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	md1_1eaf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	md2_2efs.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

51 ip-api.com
163 api.myip.com
164 api.myip.com
Drops file in System32 directory 1 IoCs

Processes:

svchost.exe

description ioc process

File opened for modification C:\Windows\System32\Tasks\Firefox Default Browser Agent 6E7FA43C6D09028C svchost.exe

flow	ioc
51	ip-api.com
163	api.myip.com
164	api.myip.com

description	ioc	process
File opened for modification	C:\Windows\System32\Tasks\Firefox Default Browser Agent 6E7FA43C6D09028C	svchost.exe

Suspicious use of SetThreadContext 6 IoCs

Processes:

svchost.exepowershell.exe283931421.exe6B14.exe1882394667.exe6006.exe

description	pid	process	target process
PID 4572 set thread context of 5308	4572	svchost.exe	svchost.exe
PID 3228 set thread context of 4160	3228	powershell.exe	toolspab1.exe
PID 3196 set thread context of 200	3196	283931421.exe	AddInProcess32.exe
PID 5176 set thread context of 5684	5176	6B14.exe	AddInProcess32.exe
PID 2576 set thread context of 4488	2576	1882394667.exe	AddInProcess32.exe
PID 3640 set thread context of 2692	3640	6006.exe	6006.exe

Drops file in Program Files directory 12 IoCs

Processes:

ultramediaburner.tmpUltra.exegoogle-game.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe	ultramediaburner.tmp
File created	C:\Program Files (x86)\UltraMediaBurner\unins000.dat	ultramediaburner.tmp
File created	C:\Program Files (x86)\UltraMediaBurner\is-K1KPF.tmp	ultramediaburner.tmp
File created	C:\Program Files (x86)\Windows Mail\Qekaelaetaeso.exe.config	Ultra.exe
File created	C:\Program Files\nvsmartmax.dll	google-game.exe
File created	C:\Program Files\install.dll	google-game.exe
File created	C:\Program Files\Internet Explorer\RAVUBNGGUE\ultramediaburner.exe	Ultra.exe
File created	C:\Program Files\Internet Explorer\RAVUBNGGUE\ultramediaburner.exe.config	Ultra.exe
File created	C:\Program Files (x86)\UltraMediaBurner\is-R43KB.tmp	ultramediaburner.tmp
File opened for modification	C:\Program Files (x86)\UltraMediaBurner\unins000.dat	ultramediaburner.tmp
File created	C:\Program Files (x86)\Windows Mail\Qekaelaetaeso.exe	Ultra.exe
File created	C:\Program Files\install.dat	google-game.exe

Drops file in Windows directory 1 IoCs

Processes:

MicrosoftEdge.exe

description ioc process

File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

toolspab1.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspab1.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspab1.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspab1.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

svchost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe

Delays execution with timeout.exe 2 IoCs
evasion

Processes:

timeout.exetimeout.exe

pid process

5052 timeout.exe
4008 timeout.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

5204 taskkill.exe

pid	process
5052	timeout.exe
4008	timeout.exe

pid	process
5204	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

Processes:

MicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7"	svchost.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exesvchost.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exerundll32.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{QJ2559JN-BF7A-LM2A-20M4-JBF9M43Q7G3S}\1 = "5612"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\SettingsVersion = "2"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DontShowMeThisDialogAgain	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionIn = "{671CA1C7-ED49-4678-9ED7-FE98160EACC4}"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows\AllowInPrivate	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. = 01000000846ba5a7366c513c06f6953069b41e268c65f1d22a8ee2d64360c353f905340bcdc018c25d8c768fb4352974a974f25c25c4ff34901fb42d2f9dc34cd633	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\MigrationTime = 301bd569d72dd701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EL1681II-FO1F-AN2G-81K3-DNI5R86H5R6K}\1 = "25"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites\Order = 0c0000000a000000000000000c0000000100000000000000	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PageSetup	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url4 = "https://login.live.com/"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify.	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionIn	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\ManagerHistoryComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\MigrationTime = 301bd569d72dd701	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\MigrationTime = 301bd569d72dd701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = a60c09c6be3cd701	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\AllComplete = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\InternetRegistry	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

Processes:

Z3hAcl8wWz.exeNyshulyzhaewu.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD	Z3hAcl8wWz.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD\Blob = 0300000001000000140000006c0ce2dd0584c47cac18839f14055f19fa270cdd2000000001000000500500003082054c30820434a0030201020206016de34cff62300d06092a864886f70d01010b05003081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a301e170d3030303130313030303030305a170d3438313231353039313533375a3081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a30820122300d06092a864886f70d01010105000382010f003082010a0282010100ae86c5043ed34d99f44fa3052ea34047a7fbbe33188b1dc2ca645ca3249e85e54b4921d4998fda6a22247c32d9087d742af3bf850803ae8c1e25faad53fb8fd823b7353d9a3ac992bf917f693826c790e53a540b120b6553508ec9585e467d310bd3ef9fb61731deb522eb78f43f824b34be36782db7a8cb162cd22247b14e4c5ae633ed66542354a59971bddc59160ecdc521b4477c93ca9e624e0af00298602300f5dc368819c3cb9f02604636888276b3a498570473b5328b0834f327c34285e333da9207e12f0edbb654c8cf11e3cc7cba17a52cd7cd42c10ae095a2e4eb9d3e3f361488243f0584af40e72d6e6e182149bfb8342384f60f12e14734258d0203010001a382017430820170300f0603551d130101ff040530030101ff3082012c06096086480186f842010d0482011d138201195468697320526f6f74206365727469666963617465207761732067656e65726174656420627920436861726c65732050726f787920666f722053534c2050726f7879696e672e20496620746869732063657274696669636174652069732070617274206f66206120636572746966696361746520636861696e2c2074686973206d65616e73207468617420796f752772652062726f7773696e67207468726f75676820436861726c65732050726f787920776974682053534c2050726f7879696e6720656e61626c656420666f72207468697320776562736974652e20506c656173652073656520687474703a2f2f636861726c657370726f78792e636f6d2f73736c20666f72206d6f726520696e666f726d6174696f6e2e300e0603551d0f0101ff040403020204301d0603551d0e04160414f8d0dc54367cf794020f8b92783a5d8a91251f9f300d06092a864886f70d01010b05000382010100662271eb9d5c744c88382de98ba37320e6312104d04273a92007a8670976d6530e6347d00bbded1319bb6754f36237596095922911e3661a70354f6ba0b797a76258be7adebb8c8dbeeed977760b80271d74b2444d92f6c1337a379b73545b251de5f8812b9625abbbfaedc15f8c6c374b9b26dd0fef035185f5899d8819e689dc6db5f0babbfd637c52b1bec80115b889faeed493d4112d744954ad3abe6607c41a4a2d657ba330ed131fa4e8c25bb28ee181dcef8da91c17bfd30a23c8eae81b152ed85ff938afc32b34ffdaffbdb72d9bb04067bfc87f579eba9637b165ea008ea7408bc8265f33c039bf60f506d245a6b53017afc8e161d70ed5b0d76576	Z3hAcl8wWz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Nyshulyzhaewu.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Nyshulyzhaewu.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXE

pid process

5300 PING.EXE
5892 PING.EXE

pid	process
5300	PING.EXE
5892	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

ultramediaburner.tmpSHecivaexyty.exe

pid	process
4080	ultramediaburner.tmp
4080	ultramediaburner.tmp
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe
4220	SHecivaexyty.exe

Suspicious behavior: MapViewOfSection 21 IoCs

Processes:

MicrosoftEdgeCP.exetoolspab1.exe

pid process

3440 MicrosoftEdgeCP.exe
3440 MicrosoftEdgeCP.exe
4160 toolspab1.exe
2416
2416
2416
2416
2416
2416
2416
2416
2416
2416
2416
2416
2416
2416
2416
2416
2416
2416

pid	process
3440	MicrosoftEdgeCP.exe
3440	MicrosoftEdgeCP.exe
4160	toolspab1.exe
2416
2416
2416
2416
2416
2416
2416
2416
2416
2416
2416
2416
2416
2416
2416
2416
2416
2416

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Ultra.exeNyshulyzhaewu.exeSHecivaexyty.exeMicrosoftEdge.exeMicrosoftEdgeCP.exe283931421.exerundll32.exesvchost.exeHookSetp.exesvchost.exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	3076	Ultra.exe
Token: SeDebugPrivilege	4212	Nyshulyzhaewu.exe
Token: SeDebugPrivilege	4220	SHecivaexyty.exe
Token: SeDebugPrivilege	1828	MicrosoftEdge.exe
Token: SeDebugPrivilege	1828	MicrosoftEdge.exe
Token: SeDebugPrivilege	1828	MicrosoftEdge.exe
Token: SeDebugPrivilege	1828	MicrosoftEdge.exe
Token: SeDebugPrivilege	4344	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4344	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4344	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4344	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3196	283931421.exe
Token: SeDebugPrivilege	5216	rundll32.exe
Token: SeDebugPrivilege	5216	rundll32.exe
Token: SeTcbPrivilege	4572	svchost.exe
Token: SeDebugPrivilege	5216	rundll32.exe
Token: SeDebugPrivilege	5216	rundll32.exe
Token: SeDebugPrivilege	5216	rundll32.exe
Token: SeDebugPrivilege	5216	rundll32.exe
Token: SeDebugPrivilege	5216	rundll32.exe
Token: SeDebugPrivilege	5216	rundll32.exe
Token: SeDebugPrivilege	5216	rundll32.exe
Token: SeDebugPrivilege	5460	HookSetp.exe
Token: SeDebugPrivilege	5216	rundll32.exe
Token: SeAuditPrivilege	2380	svchost.exe
Token: SeDebugPrivilege	5216	rundll32.exe
Token: SeDebugPrivilege	5216	rundll32.exe
Token: SeDebugPrivilege	5216	rundll32.exe
Token: SeAssignPrimaryTokenPrivilege	2708	svchost.exe
Token: SeIncreaseQuotaPrivilege	2708	svchost.exe
Token: SeSecurityPrivilege	2708	svchost.exe
Token: SeTakeOwnershipPrivilege	2708	svchost.exe
Token: SeLoadDriverPrivilege	2708	svchost.exe
Token: SeSystemtimePrivilege	2708	svchost.exe
Token: SeBackupPrivilege	2708	svchost.exe
Token: SeRestorePrivilege	2708	svchost.exe
Token: SeShutdownPrivilege	2708	svchost.exe
Token: SeSystemEnvironmentPrivilege	2708	svchost.exe
Token: SeUndockPrivilege	2708	svchost.exe
Token: SeManageVolumePrivilege	2708	svchost.exe
Token: SeAuditPrivilege	2380	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2708	svchost.exe
Token: SeIncreaseQuotaPrivilege	2708	svchost.exe
Token: SeSecurityPrivilege	2708	svchost.exe
Token: SeTakeOwnershipPrivilege	2708	svchost.exe
Token: SeLoadDriverPrivilege	2708	svchost.exe
Token: SeSystemtimePrivilege	2708	svchost.exe
Token: SeBackupPrivilege	2708	svchost.exe
Token: SeRestorePrivilege	2708	svchost.exe
Token: SeShutdownPrivilege	2708	svchost.exe
Token: SeSystemEnvironmentPrivilege	2708	svchost.exe
Token: SeUndockPrivilege	2708	svchost.exe
Token: SeManageVolumePrivilege	2708	svchost.exe
Token: SeAuditPrivilege	2380	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2708	svchost.exe
Token: SeIncreaseQuotaPrivilege	2708	svchost.exe
Token: SeSecurityPrivilege	2708	svchost.exe
Token: SeTakeOwnershipPrivilege	2708	svchost.exe
Token: SeLoadDriverPrivilege	2708	svchost.exe
Token: SeSystemtimePrivilege	2708	svchost.exe
Token: SeBackupPrivilege	2708	svchost.exe
Token: SeRestorePrivilege	2708	svchost.exe
Token: SeShutdownPrivilege	2708	svchost.exe
Token: SeSystemEnvironmentPrivilege	2708	svchost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

ultramediaburner.tmp

pid process

4080 ultramediaburner.tmp
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exegoogle-game.exe

pid process

1828 MicrosoftEdge.exe
3440 MicrosoftEdgeCP.exe
3440 MicrosoftEdgeCP.exe
3936 google-game.exe
3936 google-game.exe

pid	process
1828	MicrosoftEdge.exe
3440	MicrosoftEdgeCP.exe
3440	MicrosoftEdgeCP.exe
3936	google-game.exe
3936	google-game.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Install.exeInstall.tmpUltra.exeultramediaburner.exeultramediaburner.tmpSHecivaexyty.execmd.execmd.execmd.exegpooe.exeskipper.execmd.execmd.exegoogle-game.exerundll32.exesvchost.execmd.exe

description	pid	process	target process
PID 4436 wrote to memory of 4940	4436	Install.exe	Install.tmp
PID 4436 wrote to memory of 4940	4436	Install.exe	Install.tmp
PID 4436 wrote to memory of 4940	4436	Install.exe	Install.tmp
PID 4940 wrote to memory of 3076	4940	Install.tmp	Ultra.exe
PID 4940 wrote to memory of 3076	4940	Install.tmp	Ultra.exe
PID 3076 wrote to memory of 4032	3076	Ultra.exe	ultramediaburner.exe
PID 3076 wrote to memory of 4032	3076	Ultra.exe	ultramediaburner.exe
PID 3076 wrote to memory of 4032	3076	Ultra.exe	ultramediaburner.exe
PID 4032 wrote to memory of 4080	4032	ultramediaburner.exe	ultramediaburner.tmp
PID 4032 wrote to memory of 4080	4032	ultramediaburner.exe	ultramediaburner.tmp
PID 4032 wrote to memory of 4080	4032	ultramediaburner.exe	ultramediaburner.tmp
PID 3076 wrote to memory of 4212	3076	Ultra.exe	Nyshulyzhaewu.exe
PID 3076 wrote to memory of 4212	3076	Ultra.exe	Nyshulyzhaewu.exe
PID 4080 wrote to memory of 4260	4080	ultramediaburner.tmp	UltraMediaBurner.exe
PID 4080 wrote to memory of 4260	4080	ultramediaburner.tmp	UltraMediaBurner.exe
PID 3076 wrote to memory of 4220	3076	Ultra.exe	SHecivaexyty.exe
PID 3076 wrote to memory of 4220	3076	Ultra.exe	SHecivaexyty.exe
PID 4220 wrote to memory of 1160	4220	SHecivaexyty.exe	cmd.exe
PID 4220 wrote to memory of 1160	4220	SHecivaexyty.exe	cmd.exe
PID 1160 wrote to memory of 3676	1160	cmd.exe	skipper.exe
PID 1160 wrote to memory of 3676	1160	cmd.exe	skipper.exe
PID 1160 wrote to memory of 3676	1160	cmd.exe	skipper.exe
PID 4220 wrote to memory of 4444	4220	SHecivaexyty.exe	cmd.exe
PID 4220 wrote to memory of 4444	4220	SHecivaexyty.exe	cmd.exe
PID 4444 wrote to memory of 3232	4444	cmd.exe	001.exe
PID 4444 wrote to memory of 3232	4444	cmd.exe	001.exe
PID 4444 wrote to memory of 3232	4444	cmd.exe	001.exe
PID 4220 wrote to memory of 2460	4220	SHecivaexyty.exe	cmd.exe
PID 4220 wrote to memory of 2460	4220	SHecivaexyty.exe	cmd.exe
PID 2460 wrote to memory of 4960	2460	cmd.exe	gpooe.exe
PID 2460 wrote to memory of 4960	2460	cmd.exe	gpooe.exe
PID 2460 wrote to memory of 4960	2460	cmd.exe	gpooe.exe
PID 4960 wrote to memory of 2668	4960	gpooe.exe	jfiag3g_gg.exe
PID 4960 wrote to memory of 2668	4960	gpooe.exe	jfiag3g_gg.exe
PID 4960 wrote to memory of 2668	4960	gpooe.exe	jfiag3g_gg.exe
PID 3676 wrote to memory of 3196	3676	skipper.exe	283931421.exe
PID 3676 wrote to memory of 3196	3676	skipper.exe	283931421.exe
PID 3676 wrote to memory of 3196	3676	skipper.exe	283931421.exe
PID 4220 wrote to memory of 4000	4220	SHecivaexyty.exe	cmd.exe
PID 4220 wrote to memory of 4000	4220	SHecivaexyty.exe	cmd.exe
PID 4000 wrote to memory of 3936	4000	cmd.exe	google-game.exe
PID 4000 wrote to memory of 3936	4000	cmd.exe	google-game.exe
PID 4000 wrote to memory of 3936	4000	cmd.exe	google-game.exe
PID 4220 wrote to memory of 2672	4220	SHecivaexyty.exe	cmd.exe
PID 4220 wrote to memory of 2672	4220	SHecivaexyty.exe	cmd.exe
PID 2672 wrote to memory of 1872	2672	cmd.exe	md1_1eaf.exe
PID 2672 wrote to memory of 1872	2672	cmd.exe	md1_1eaf.exe
PID 2672 wrote to memory of 1872	2672	cmd.exe	md1_1eaf.exe
PID 4220 wrote to memory of 5152	4220	SHecivaexyty.exe	cmd.exe
PID 4220 wrote to memory of 5152	4220	SHecivaexyty.exe	cmd.exe
PID 3936 wrote to memory of 5216	3936	google-game.exe	rundll32.exe
PID 3936 wrote to memory of 5216	3936	google-game.exe	rundll32.exe
PID 3936 wrote to memory of 5216	3936	google-game.exe	rundll32.exe
PID 5216 wrote to memory of 4572	5216	rundll32.exe	svchost.exe
PID 5216 wrote to memory of 2608	5216	rundll32.exe	svchost.exe
PID 4572 wrote to memory of 5308	4572	svchost.exe	svchost.exe
PID 4572 wrote to memory of 5308	4572	svchost.exe	svchost.exe
PID 4572 wrote to memory of 5308	4572	svchost.exe	svchost.exe
PID 4960 wrote to memory of 5360	4960	gpooe.exe	jfiag3g_gg.exe
PID 4960 wrote to memory of 5360	4960	gpooe.exe	jfiag3g_gg.exe
PID 4960 wrote to memory of 5360	4960	gpooe.exe	jfiag3g_gg.exe
PID 5216 wrote to memory of 356	5216	rundll32.exe	svchost.exe
PID 5216 wrote to memory of 2400	5216	rundll32.exe	svchost.exe
PID 5152 wrote to memory of 5460	5152	cmd.exe	HookSetp.exe

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2720

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2708

C:\Users\Admin\AppData\Local\Temp\Install.exe
"C:\Users\Admin\AppData\Local\Temp\Install.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4436

C:\Users\Admin\AppData\Local\Temp\is-92H3M.tmp\Install.tmp
"C:\Users\Admin\AppData\Local\Temp\is-92H3M.tmp\Install.tmp" /SL5="$301DA,235791,152064,C:\Users\Admin\AppData\Local\Temp\Install.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4940

C:\Users\Admin\AppData\Local\Temp\is-PL9FU.tmp\Ultra.exe
"C:\Users\Admin\AppData\Local\Temp\is-PL9FU.tmp\Ultra.exe" /S /UID=burnerch1
3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3076

C:\Program Files\Internet Explorer\RAVUBNGGUE\ultramediaburner.exe
"C:\Program Files\Internet Explorer\RAVUBNGGUE\ultramediaburner.exe" /VERYSILENT
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032

C:\Users\Admin\AppData\Local\Temp\is-CC1TP.tmp\ultramediaburner.tmp
"C:\Users\Admin\AppData\Local\Temp\is-CC1TP.tmp\ultramediaburner.tmp" /SL5="$301E0,281924,62464,C:\Program Files\Internet Explorer\RAVUBNGGUE\ultramediaburner.exe" /VERYSILENT
5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4080

C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
6⤵
- Executes dropped EXE
PID:4260

C:\Users\Admin\AppData\Local\Temp\d8-9a28c-350-6efb2-bd493e17f9468\Nyshulyzhaewu.exe
"C:\Users\Admin\AppData\Local\Temp\d8-9a28c-350-6efb2-bd493e17f9468\Nyshulyzhaewu.exe"
4⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:4212

C:\Users\Admin\AppData\Local\Temp\6b-b3d6e-bf1-9e799-a7d772859bdeb\SHecivaexyty.exe
"C:\Users\Admin\AppData\Local\Temp\6b-b3d6e-bf1-9e799-a7d772859bdeb\SHecivaexyty.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4220

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\cmbx25ir.bma\skipper.exe /s & exit
5⤵
- Suspicious use of WriteProcessMemory
PID:1160

C:\Users\Admin\AppData\Local\Temp\cmbx25ir.bma\skipper.exe
C:\Users\Admin\AppData\Local\Temp\cmbx25ir.bma\skipper.exe /s
6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676

C:\Users\Admin\AppData\Local\Temp\283931421.exe
C:\Users\Admin\AppData\Local\Temp\283931421.exe
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3196

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
8⤵
PID:4408

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
8⤵
PID:200

C:\Users\Admin\AppData\Local\Temp\1882394667.exe
C:\Users\Admin\AppData\Local\Temp\1882394667.exe
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2576

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
8⤵
PID:4488

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /k ping 0 & del C:\Users\Admin\AppData\Local\Temp\cmbx25ir.bma\skipper.exe & exit
7⤵
PID:5744

C:\Windows\SysWOW64\PING.EXE
ping 0
8⤵
- Runs ping.exe
PID:5892

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0gzzsrvf.2by\001.exe & exit
5⤵
- Suspicious use of WriteProcessMemory
PID:4444

C:\Users\Admin\AppData\Local\Temp\0gzzsrvf.2by\001.exe
C:\Users\Admin\AppData\Local\Temp\0gzzsrvf.2by\001.exe
6⤵
- Executes dropped EXE
PID:3232

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\hfdjhqj1.01v\gpooe.exe & exit
5⤵
- Suspicious use of WriteProcessMemory
PID:2460

C:\Users\Admin\AppData\Local\Temp\hfdjhqj1.01v\gpooe.exe
C:\Users\Admin\AppData\Local\Temp\hfdjhqj1.01v\gpooe.exe
6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4960

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
7⤵
- Executes dropped EXE
PID:2668

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
7⤵
- Executes dropped EXE
PID:5360

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vq0rs31f.20m\google-game.exe & exit
5⤵
PID:4000

C:\Users\Admin\AppData\Local\Temp\vq0rs31f.20m\google-game.exe
C:\Users\Admin\AppData\Local\Temp\vq0rs31f.20m\google-game.exe
6⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3936

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Program Files\install.dll",install
7⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5216

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\5qs5pj2k.ae3\md1_1eaf.exe & exit
5⤵
- Suspicious use of WriteProcessMemory
PID:2672

C:\Users\Admin\AppData\Local\Temp\5qs5pj2k.ae3\md1_1eaf.exe
C:\Users\Admin\AppData\Local\Temp\5qs5pj2k.ae3\md1_1eaf.exe
6⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:1872

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jnj4jrld.ghw\HookSetp.exe /silent & exit
5⤵
PID:5152

C:\Users\Admin\AppData\Local\Temp\jnj4jrld.ghw\HookSetp.exe
C:\Users\Admin\AppData\Local\Temp\jnj4jrld.ghw\HookSetp.exe /silent
6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5460

C:\Users\Admin\AppData\Roaming\3622706.exe
"C:\Users\Admin\AppData\Roaming\3622706.exe"
7⤵
PID:5240

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\hjuhur2p.2ia\BBCbrowser.exe /VERYSILENT & exit
5⤵
PID:5924

C:\Users\Admin\AppData\Local\Temp\hjuhur2p.2ia\BBCbrowser.exe
C:\Users\Admin\AppData\Local\Temp\hjuhur2p.2ia\BBCbrowser.exe /VERYSILENT
6⤵
PID:5176

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
7⤵
PID:5684

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\t3sp2ky5.c3i\md2_2efs.exe & exit
5⤵
PID:5612

C:\Users\Admin\AppData\Local\Temp\t3sp2ky5.c3i\md2_2efs.exe
C:\Users\Admin\AppData\Local\Temp\t3sp2ky5.c3i\md2_2efs.exe
6⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:4412

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\oxyrbjde.j2g\askinstall39.exe & exit
5⤵
PID:5604

C:\Users\Admin\AppData\Local\Temp\oxyrbjde.j2g\askinstall39.exe
C:\Users\Admin\AppData\Local\Temp\oxyrbjde.j2g\askinstall39.exe
6⤵
- Executes dropped EXE
PID:6012

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
7⤵
PID:184

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
8⤵
- Kills process with taskkill
PID:5204

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2wzmfxb4.fho\y1.exe & exit
5⤵
PID:5412

C:\Users\Admin\AppData\Local\Temp\2wzmfxb4.fho\y1.exe
C:\Users\Admin\AppData\Local\Temp\2wzmfxb4.fho\y1.exe
6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5724

C:\Users\Admin\AppData\Local\Temp\Z3hAcl8wWz.exe
"C:\Users\Admin\AppData\Local\Temp\Z3hAcl8wWz.exe"
7⤵
- Executes dropped EXE
- Modifies system certificate store
PID:5784

C:\Users\Admin\AppData\Roaming\1619676845795.exe
"C:\Users\Admin\AppData\Roaming\1619676845795.exe" /sjson "C:\Users\Admin\AppData\Roaming\1619676845795.txt"
8⤵
- Executes dropped EXE
PID:4140

C:\Windows\SysWOW64\cmd.exe
cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\Z3hAcl8wWz.exe"
8⤵
PID:500

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 3
9⤵
- Runs ping.exe
PID:5300

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\2wzmfxb4.fho\y1.exe"
7⤵
PID:1700

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
8⤵
- Delays execution with timeout.exe
PID:4008

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2mi0bnpd.2bz\jvppp.exe & exit
5⤵
PID:3940

C:\Users\Admin\AppData\Local\Temp\2mi0bnpd.2bz\jvppp.exe
C:\Users\Admin\AppData\Local\Temp\2mi0bnpd.2bz\jvppp.exe
6⤵
- Executes dropped EXE
PID:5812

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
7⤵
- Executes dropped EXE
PID:3556

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
7⤵
- Executes dropped EXE
PID:4112

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jsbcgqlp.eow\GcleanerWW.exe /mixone & exit
5⤵
- Suspicious use of WriteProcessMemory
PID:4000

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\v5umchb5.are\toolspab1.exe & exit
5⤵
- Suspicious use of WriteProcessMemory
PID:5152

C:\Users\Admin\AppData\Local\Temp\v5umchb5.are\toolspab1.exe
C:\Users\Admin\AppData\Local\Temp\v5umchb5.are\toolspab1.exe
6⤵
PID:3228

C:\Users\Admin\AppData\Local\Temp\v5umchb5.are\toolspab1.exe
C:\Users\Admin\AppData\Local\Temp\v5umchb5.are\toolspab1.exe
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4160

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\iblvmsva.5rh\005.exe & exit
5⤵
PID:5236

C:\Users\Admin\AppData\Local\Temp\iblvmsva.5rh\005.exe
C:\Users\Admin\AppData\Local\Temp\iblvmsva.5rh\005.exe
6⤵
- Executes dropped EXE
PID:5452

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2608

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2400

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2380

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1924

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s BITS
1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
2⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:5308

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1448

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1340

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1180

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1128

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
- Drops file in System32 directory
PID:512

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:356

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1828

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:5072

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:3440

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4344

C:\Users\Admin\AppData\Local\Temp\52B5.exe
C:\Users\Admin\AppData\Local\Temp\52B5.exe
1⤵
- Executes dropped EXE
PID:5908

C:\Users\Admin\AppData\Local\Temp\5630.exe
C:\Users\Admin\AppData\Local\Temp\5630.exe
1⤵
- Executes dropped EXE
PID:4812

C:\Users\Admin\AppData\Local\Temp\5D94.exe
C:\Users\Admin\AppData\Local\Temp\5D94.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4456

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\5D94.exe"
2⤵
PID:3268

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
3⤵
- Delays execution with timeout.exe
PID:5052

C:\Users\Admin\AppData\Local\Temp\6006.exe
C:\Users\Admin\AppData\Local\Temp\6006.exe
1⤵
- Executes dropped EXE
- Windows security modification
- Suspicious use of SetThreadContext
PID:3640

C:\Users\Admin\AppData\Local\Temp\c5e1e68b-f31a-4ab0-ba81-24b0d19bacfa\AdvancedRun.exe
"C:\Users\Admin\AppData\Local\Temp\c5e1e68b-f31a-4ab0-ba81-24b0d19bacfa\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\c5e1e68b-f31a-4ab0-ba81-24b0d19bacfa\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
2⤵
- Executes dropped EXE
PID:1152

C:\Users\Admin\AppData\Local\Temp\c5e1e68b-f31a-4ab0-ba81-24b0d19bacfa\AdvancedRun.exe
"C:\Users\Admin\AppData\Local\Temp\c5e1e68b-f31a-4ab0-ba81-24b0d19bacfa\AdvancedRun.exe" /SpecialRun 4101d8 1152
3⤵
- Executes dropped EXE
PID:2108

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\6006.exe" -Force
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3228

C:\Users\Admin\AppData\Local\Temp\6006.exe
"C:\Users\Admin\AppData\Local\Temp\6006.exe"
2⤵
- Executes dropped EXE
PID:2692

C:\Users\Admin\AppData\Local\Temp\668F.exe
C:\Users\Admin\AppData\Local\Temp\668F.exe
1⤵
- Executes dropped EXE
PID:4280

C:\Users\Admin\AppData\Local\Temp\668F.exe
"{path}"
2⤵
PID:4600

C:\Users\Admin\AppData\Local\Temp\6B14.exe
C:\Users\Admin\AppData\Local\Temp\6B14.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5176

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4956

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3956

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:5740

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4972

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:5904

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4772

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:5820

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1528

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
- Executes dropped EXE
PID:5240

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Software Discovery

T1518

Query Registry

System Information Discovery