raccoon | 65fa93616cdb8c92a541dd2ad8468d6688e1b1f2606891b56db3e90fbfc9acbd

System Information Discovery

Processes:

SHejuwanushi.exekeygen-step-4.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation	SHejuwanushi.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation	keygen-step-4.exe

Loads dropped DLL 34 IoCs

Processes:

rundll32.exeInstall.tmpinstaller.exeMsiExec.exerundll32.exeMsiExec.exerasup.exetoolspab1.exeMsiExec.exeraeaddbraeaddbraeaddb

pid	process
4092	rundll32.exe
2840	Install.tmp
4596	installer.exe
4596	installer.exe
4596	installer.exe
6504	MsiExec.exe
6504	MsiExec.exe
4604	rundll32.exe
5820	MsiExec.exe
5820	MsiExec.exe
5820	MsiExec.exe
5820	MsiExec.exe
5820	MsiExec.exe
5820	MsiExec.exe
5820	MsiExec.exe
5820	MsiExec.exe
5820	MsiExec.exe
5820	MsiExec.exe
4596	installer.exe
5380	rasup.exe
5820	MsiExec.exe
5820	MsiExec.exe
6856	toolspab1.exe
4260	MsiExec.exe
4260	MsiExec.exe
4260	MsiExec.exe
4260	MsiExec.exe
4260	MsiExec.exe
4260	MsiExec.exe
4260	MsiExec.exe
5820	MsiExec.exe
5976	raeaddb
6120	raeaddb
5100	raeaddb

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

3822093.exeUltra.exegpooe.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Host = "C:\\ProgramData\\Windows Host\\Windows Host.exe"	3822093.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Windows Mail\\Polehirecy.exe\""	Ultra.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.exe"	gpooe.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

jg6_6asg.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA jg6_6asg.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	jg6_6asg.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

installer.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\X:	installer.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	installer.exe
File opened (read-only)	\??\B:	installer.exe
File opened (read-only)	\??\Q:	installer.exe
File opened (read-only)	\??\V:	installer.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\H:	installer.exe
File opened (read-only)	\??\N:	installer.exe
File opened (read-only)	\??\R:	installer.exe
File opened (read-only)	\??\T:	installer.exe
File opened (read-only)	\??\U:	installer.exe
File opened (read-only)	\??\W:	installer.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	installer.exe
File opened (read-only)	\??\O:	installer.exe
File opened (read-only)	\??\S:	installer.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	installer.exe
File opened (read-only)	\??\P:	installer.exe
File opened (read-only)	\??\M:	installer.exe
File opened (read-only)	\??\Y:	installer.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	installer.exe
File opened (read-only)	\??\F:	installer.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\K:	installer.exe
File opened (read-only)	\??\Z:	installer.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\J:	installer.exe
File opened (read-only)	\??\L:	installer.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

32 ip-api.com
83 ip-api.com

flow	ioc
32	ip-api.com
83	ip-api.com

Drops file in System32 directory 12 IoCs

Processes:

svchost.exesvchost.exe

description	ioc	process
File opened for modification	C:\Windows\System32\Tasks\Firefox Default Browser Agent A05089B86B6C33FF	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\RI4LVLZJ.cookie	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\AdvancedWindowsManager #2	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\AdvancedWindowsManager #6	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\AdvancedUpdater	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\AdvancedWindowsManager #3	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\AdvancedWindowsManager #4	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\AdvancedWindowsManager #5	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\PjPVhJpbFf	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\RI4LVLZJ.cookie	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\AdvancedWindowsManager #1	svchost.exe

Suspicious use of SetThreadContext 7 IoCs

Processes:

svchost.exetoolspab1.exeFessura.exe.comraeaddbraeaddbraeaddb

description	pid	process	target process
PID 2208 set thread context of 3852	2208	svchost.exe	svchost.exe
PID 2208 set thread context of 428	2208	svchost.exe	svchost.exe
PID 6660 set thread context of 6856	6660	toolspab1.exe	toolspab1.exe
PID 6184 set thread context of 5540	6184	Fessura.exe.com	RegAsm.exe
PID 5000 set thread context of 5976	5000	raeaddb	raeaddb
PID 7008 set thread context of 6120	7008	raeaddb	raeaddb
PID 4604 set thread context of 5100	4604	raeaddb	raeaddb

Drops file in Program Files directory 18 IoCs

Processes:

msiexec.exeUltra.exexiuhuali.exeultramediaburner.tmp

description	ioc	process
File opened for modification	C:\Program Files (x86)\AW Manager\Windows Manager\Privacy.url	msiexec.exe
File created	C:\Program Files\Windows Security\KKDOVEMTBY\ultramediaburner.exe	Ultra.exe
File created	C:\Program Files\Windows Security\KKDOVEMTBY\ultramediaburner.exe.config	Ultra.exe
File created	C:\Program Files (x86)\Windows Mail\Polehirecy.exe	Ultra.exe
File opened for modification	C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.ini	msiexec.exe
File created	C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe	msiexec.exe
File created	C:\Program Files\install.dll	xiuhuali.exe
File opened for modification	C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe	ultramediaburner.tmp
File created	C:\Program Files (x86)\Windows Mail\Polehirecy.exe.config	Ultra.exe
File created	C:\Program Files (x86)\UltraMediaBurner\is-BME9L.tmp	ultramediaburner.tmp
File opened for modification	C:\Program Files (x86)\AW Manager\Windows Manager\EULA.url	msiexec.exe
File created	C:\Program Files\libEGL.dll	xiuhuali.exe
File created	C:\Program Files (x86)\UltraMediaBurner\unins000.dat	ultramediaburner.tmp
File created	C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	msiexec.exe
File created	C:\Program Files (x86)\AW Manager\Windows Manager\Uninstall.lnk	msiexec.exe
File created	C:\Program Files\install.dat	xiuhuali.exe
File created	C:\Program Files (x86)\UltraMediaBurner\is-PO3BG.tmp	ultramediaburner.tmp
File opened for modification	C:\Program Files (x86)\UltraMediaBurner\unins000.dat	ultramediaburner.tmp

Drops file in Windows directory 34 IoCs

Processes:

msiexec.exeMicrosoftEdge.exeMicrosoftEdge.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI79DF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8F20.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI94CE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9E08.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI57B8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5855.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C845414C-903C-4218-9DE7-132AB97FDF62}	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI722C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9878.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA0AA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\SystemFoldermsiexec.exe	msiexec.exe
File created	C:\Windows\Installer\f75444d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f75444d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5895.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9C42.tmp	msiexec.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File opened for modification	C:\Windows\Installer\MSI572A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5962.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\f754450.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5903.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6D1A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA06B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA242.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7B96.tmp	msiexec.exe
File created	C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\logo.exe	msiexec.exe
File created	C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\SystemFoldermsiexec.exe	msiexec.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File opened for modification	C:\Windows\Installer\MSI4F1B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6FCA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7644.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\logo.exe	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

toolspab1.exeraeaddbraeaddbraeaddb

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspab1.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspab1.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	raeaddb
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	raeaddb
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	raeaddb
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspab1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	raeaddb
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	raeaddb
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	raeaddb
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	raeaddb
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	raeaddb
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	raeaddb

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

svchost.exesvchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

5096 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

5260 timeout.exe
Kills process with taskkill 2 IoCs
evasion

Processes:

taskkill.exetaskkill.exe

pid process

6404 taskkill.exe
4312 taskkill.exe

pid	process
5096	schtasks.exe

pid	process
5260	timeout.exe

pid	process
6404	taskkill.exe
4312	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

Processes:

MicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exebrowser_broker.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe

Modifies data under HKEY_USERS 16 IoCs

Processes:

svchost.exesvchost.exemsiexec.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\16\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17	msiexec.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exemsiexec.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 61b779feb244d701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\LastClosedHeight = "600"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\DatabaseComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar\WebBrowser	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingDelete\C:\Users\Admin\AppData\Local\Pack = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\ProductName = "Windows Manager"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 0043158db044d701	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 965484f9b044d701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\NextBrowserDataLogTime = 009b134be344d701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{1ABF8FAB-96A9-4492-A978-869CCEDC5F54} = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 2cd29187b044d701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\NextPromptBuild = "15063"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IntelliForms	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Zoom	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\AllComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\TypedUrlsComplete = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdge.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

Processes:

installer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	installer.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXEPING.EXE

pid process

4256 PING.EXE
6536 PING.EXE
6900 PING.EXE

pid	process
4256	PING.EXE
6536	PING.EXE
6900	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exesvchost.exeultramediaburner.tmpPiloryshily.exe

pid	process
4092	rundll32.exe
4092	rundll32.exe
2208	svchost.exe
2208	svchost.exe
2208	svchost.exe
2208	svchost.exe
3164	ultramediaburner.tmp
3164	ultramediaburner.tmp
3916	Piloryshily.exe
3916	Piloryshily.exe
3916	Piloryshily.exe
3916	Piloryshily.exe
3916	Piloryshily.exe
3916	Piloryshily.exe
3916	Piloryshily.exe
3916	Piloryshily.exe
3916	Piloryshily.exe
3916	Piloryshily.exe
3916	Piloryshily.exe
3916	Piloryshily.exe
3916	Piloryshily.exe
3916	Piloryshily.exe
3916	Piloryshily.exe
3916	Piloryshily.exe
3916	Piloryshily.exe
3916	Piloryshily.exe
3916	Piloryshily.exe
3916	Piloryshily.exe
3916	Piloryshily.exe
3916	Piloryshily.exe
3916	Piloryshily.exe
3916	Piloryshily.exe
3916	Piloryshily.exe
3916	Piloryshily.exe
3916	Piloryshily.exe
3916	Piloryshily.exe
3916	Piloryshily.exe
3916	Piloryshily.exe
3916	Piloryshily.exe
3916	Piloryshily.exe
3916	Piloryshily.exe
3916	Piloryshily.exe
3916	Piloryshily.exe
3916	Piloryshily.exe
3916	Piloryshily.exe
3916	Piloryshily.exe
3916	Piloryshily.exe
3916	Piloryshily.exe
3916	Piloryshily.exe
3916	Piloryshily.exe
3916	Piloryshily.exe
3916	Piloryshily.exe
3916	Piloryshily.exe
3916	Piloryshily.exe
3916	Piloryshily.exe
3916	Piloryshily.exe
3916	Piloryshily.exe
3916	Piloryshily.exe
3916	Piloryshily.exe
3916	Piloryshily.exe
3916	Piloryshily.exe
3916	Piloryshily.exe
3916	Piloryshily.exe
3916	Piloryshily.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3052

pid	process
3052

Suspicious behavior: MapViewOfSection 10 IoCs

Processes:

MicrosoftEdgeCP.exetoolspab1.exeFessura.exe.comMicrosoftEdgeCP.exeraeaddbraeaddbraeaddb

pid	process
5736	MicrosoftEdgeCP.exe
6856	toolspab1.exe
6184	Fessura.exe.com
5200	MicrosoftEdgeCP.exe
5200	MicrosoftEdgeCP.exe
5976	raeaddb
5200	MicrosoftEdgeCP.exe
5200	MicrosoftEdgeCP.exe
6120	raeaddb
5100	raeaddb

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

rundll32.exesvchost.exeJoSetp.exeUltra.exesvchost.exePiloryshily.exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	4092	rundll32.exe
Token: SeDebugPrivilege	4092	rundll32.exe
Token: SeTcbPrivilege	2208	svchost.exe
Token: SeDebugPrivilege	4092	rundll32.exe
Token: SeDebugPrivilege	4092	rundll32.exe
Token: SeDebugPrivilege	4092	rundll32.exe
Token: SeDebugPrivilege	4092	rundll32.exe
Token: SeDebugPrivilege	4092	rundll32.exe
Token: SeDebugPrivilege	4092	rundll32.exe
Token: SeDebugPrivilege	4092	rundll32.exe
Token: SeDebugPrivilege	4092	rundll32.exe
Token: SeDebugPrivilege	4092	rundll32.exe
Token: SeDebugPrivilege	4092	rundll32.exe
Token: SeDebugPrivilege	4092	rundll32.exe
Token: SeDebugPrivilege	2848	JoSetp.exe
Token: SeTcbPrivilege	2208	svchost.exe
Token: SeDebugPrivilege	2272	Ultra.exe
Token: SeAuditPrivilege	2532	svchost.exe
Token: SeDebugPrivilege	3916	Piloryshily.exe
Token: SeAssignPrimaryTokenPrivilege	2688	svchost.exe
Token: SeIncreaseQuotaPrivilege	2688	svchost.exe
Token: SeSecurityPrivilege	2688	svchost.exe
Token: SeTakeOwnershipPrivilege	2688	svchost.exe
Token: SeLoadDriverPrivilege	2688	svchost.exe
Token: SeSystemtimePrivilege	2688	svchost.exe
Token: SeBackupPrivilege	2688	svchost.exe
Token: SeRestorePrivilege	2688	svchost.exe
Token: SeShutdownPrivilege	2688	svchost.exe
Token: SeSystemEnvironmentPrivilege	2688	svchost.exe
Token: SeUndockPrivilege	2688	svchost.exe
Token: SeManageVolumePrivilege	2688	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2688	svchost.exe
Token: SeIncreaseQuotaPrivilege	2688	svchost.exe
Token: SeSecurityPrivilege	2688	svchost.exe
Token: SeTakeOwnershipPrivilege	2688	svchost.exe
Token: SeLoadDriverPrivilege	2688	svchost.exe
Token: SeSystemtimePrivilege	2688	svchost.exe
Token: SeBackupPrivilege	2688	svchost.exe
Token: SeRestorePrivilege	2688	svchost.exe
Token: SeShutdownPrivilege	2688	svchost.exe
Token: SeSystemEnvironmentPrivilege	2688	svchost.exe
Token: SeUndockPrivilege	2688	svchost.exe
Token: SeManageVolumePrivilege	2688	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2688	svchost.exe
Token: SeIncreaseQuotaPrivilege	2688	svchost.exe
Token: SeSecurityPrivilege	2688	svchost.exe
Token: SeTakeOwnershipPrivilege	2688	svchost.exe
Token: SeLoadDriverPrivilege	2688	svchost.exe
Token: SeSystemtimePrivilege	2688	svchost.exe
Token: SeBackupPrivilege	2688	svchost.exe
Token: SeRestorePrivilege	2688	svchost.exe
Token: SeShutdownPrivilege	2688	svchost.exe
Token: SeSystemEnvironmentPrivilege	2688	svchost.exe
Token: SeUndockPrivilege	2688	svchost.exe
Token: SeManageVolumePrivilege	2688	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2688	svchost.exe
Token: SeIncreaseQuotaPrivilege	2688	svchost.exe
Token: SeSecurityPrivilege	2688	svchost.exe
Token: SeTakeOwnershipPrivilege	2688	svchost.exe
Token: SeLoadDriverPrivilege	2688	svchost.exe
Token: SeSystemtimePrivilege	2688	svchost.exe
Token: SeBackupPrivilege	2688	svchost.exe
Token: SeRestorePrivilege	2688	svchost.exe
Token: SeShutdownPrivilege	2688	svchost.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

ultramediaburner.tmpinstaller.exe

pid process

3164 ultramediaburner.tmp
4596 installer.exe
3052
3052

pid	process
3164	ultramediaburner.tmp
4596	installer.exe
3052
3052

Suspicious use of SetWindowsHookEx 11 IoCs

Processes:

xiuhuali.exeMicrosoftEdge.exeMicrosoftEdgeCP.exegoogle-game.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeD486.exe

pid	process
2976	xiuhuali.exe
2976	xiuhuali.exe
4692	MicrosoftEdge.exe
5736	MicrosoftEdgeCP.exe
5736	MicrosoftEdgeCP.exe
4300	google-game.exe
4300	google-game.exe
5944	MicrosoftEdge.exe
5200	MicrosoftEdgeCP.exe
5200	MicrosoftEdgeCP.exe
5016	D486.exe

Suspicious use of UnmapMainImage 1 IoCs

Processes:

pid process

3052

pid	process
3052

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

keygen-step-4.exexiuhuali.exerundll32.exesvchost.exeInstall.exeInstall.tmpUltra.exeultramediaburner.exeultramediaburner.tmpfilee.execmd.exePiloryshily.execmd.execmd.exe

description	pid	process	target process
PID 1840 wrote to memory of 2976	1840	keygen-step-4.exe	xiuhuali.exe
PID 1840 wrote to memory of 2976	1840	keygen-step-4.exe	xiuhuali.exe
PID 1840 wrote to memory of 2976	1840	keygen-step-4.exe	xiuhuali.exe
PID 2976 wrote to memory of 4092	2976	xiuhuali.exe	rundll32.exe
PID 2976 wrote to memory of 4092	2976	xiuhuali.exe	rundll32.exe
PID 2976 wrote to memory of 4092	2976	xiuhuali.exe	rundll32.exe
PID 4092 wrote to memory of 2208	4092	rundll32.exe	svchost.exe
PID 4092 wrote to memory of 2936	4092	rundll32.exe	svchost.exe
PID 2208 wrote to memory of 3852	2208	svchost.exe	svchost.exe
PID 2208 wrote to memory of 3852	2208	svchost.exe	svchost.exe
PID 2208 wrote to memory of 3852	2208	svchost.exe	svchost.exe
PID 4092 wrote to memory of 60	4092	rundll32.exe	svchost.exe
PID 4092 wrote to memory of 2484	4092	rundll32.exe	svchost.exe
PID 4092 wrote to memory of 2532	4092	rundll32.exe	svchost.exe
PID 4092 wrote to memory of 1104	4092	rundll32.exe	svchost.exe
PID 4092 wrote to memory of 1028	4092	rundll32.exe	svchost.exe
PID 4092 wrote to memory of 1468	4092	rundll32.exe	svchost.exe
PID 4092 wrote to memory of 1884	4092	rundll32.exe	svchost.exe
PID 4092 wrote to memory of 1224	4092	rundll32.exe	svchost.exe
PID 4092 wrote to memory of 1392	4092	rundll32.exe	svchost.exe
PID 4092 wrote to memory of 2688	4092	rundll32.exe	svchost.exe
PID 4092 wrote to memory of 2696	4092	rundll32.exe	svchost.exe
PID 1840 wrote to memory of 2848	1840	keygen-step-4.exe	JoSetp.exe
PID 1840 wrote to memory of 2848	1840	keygen-step-4.exe	JoSetp.exe
PID 1840 wrote to memory of 3860	1840	keygen-step-4.exe	Install.exe
PID 1840 wrote to memory of 3860	1840	keygen-step-4.exe	Install.exe
PID 1840 wrote to memory of 3860	1840	keygen-step-4.exe	Install.exe
PID 3860 wrote to memory of 2840	3860	Install.exe	Install.tmp
PID 3860 wrote to memory of 2840	3860	Install.exe	Install.tmp
PID 3860 wrote to memory of 2840	3860	Install.exe	Install.tmp
PID 2208 wrote to memory of 428	2208	svchost.exe	svchost.exe
PID 2208 wrote to memory of 428	2208	svchost.exe	svchost.exe
PID 2208 wrote to memory of 428	2208	svchost.exe	svchost.exe
PID 2840 wrote to memory of 2272	2840	Install.tmp	Ultra.exe
PID 2840 wrote to memory of 2272	2840	Install.tmp	Ultra.exe
PID 2272 wrote to memory of 2852	2272	Ultra.exe	ultramediaburner.exe
PID 2272 wrote to memory of 2852	2272	Ultra.exe	ultramediaburner.exe
PID 2272 wrote to memory of 2852	2272	Ultra.exe	ultramediaburner.exe
PID 2852 wrote to memory of 3164	2852	ultramediaburner.exe	ultramediaburner.tmp
PID 2852 wrote to memory of 3164	2852	ultramediaburner.exe	ultramediaburner.tmp
PID 2852 wrote to memory of 3164	2852	ultramediaburner.exe	ultramediaburner.tmp
PID 2272 wrote to memory of 4044	2272	Ultra.exe	SHejuwanushi.exe
PID 2272 wrote to memory of 4044	2272	Ultra.exe	SHejuwanushi.exe
PID 2272 wrote to memory of 3916	2272	Ultra.exe	Piloryshily.exe
PID 2272 wrote to memory of 3916	2272	Ultra.exe	Piloryshily.exe
PID 1840 wrote to memory of 3608	1840	keygen-step-4.exe	filee.exe
PID 1840 wrote to memory of 3608	1840	keygen-step-4.exe	filee.exe
PID 1840 wrote to memory of 3608	1840	keygen-step-4.exe	filee.exe
PID 3164 wrote to memory of 932	3164	ultramediaburner.tmp	UltraMediaBurner.exe
PID 3164 wrote to memory of 932	3164	ultramediaburner.tmp	UltraMediaBurner.exe
PID 3608 wrote to memory of 4204	3608	filee.exe	cmd.exe
PID 3608 wrote to memory of 4204	3608	filee.exe	cmd.exe
PID 3608 wrote to memory of 4204	3608	filee.exe	cmd.exe
PID 4204 wrote to memory of 4256	4204	cmd.exe	PING.EXE
PID 4204 wrote to memory of 4256	4204	cmd.exe	PING.EXE
PID 4204 wrote to memory of 4256	4204	cmd.exe	PING.EXE
PID 3916 wrote to memory of 5952	3916	Piloryshily.exe	cmd.exe
PID 3916 wrote to memory of 5952	3916	Piloryshily.exe	cmd.exe
PID 3916 wrote to memory of 6976	3916	Piloryshily.exe	cmd.exe
PID 3916 wrote to memory of 6976	3916	Piloryshily.exe	cmd.exe
PID 5952 wrote to memory of 7064	5952	cmd.exe	KiffMainE1.exe
PID 5952 wrote to memory of 7064	5952	cmd.exe	KiffMainE1.exe
PID 6976 wrote to memory of 7056	6976	cmd.exe	001.exe
PID 6976 wrote to memory of 7056	6976	cmd.exe	001.exe

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:60

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1224

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1104

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1468

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1392

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
- Drops file in System32 directory
PID:1028

C:\Users\Admin\AppData\Roaming\raeaddb
C:\Users\Admin\AppData\Roaming\raeaddb
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5000

C:\Users\Admin\AppData\Roaming\raeaddb
C:\Users\Admin\AppData\Roaming\raeaddb
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:5976

C:\Users\Admin\AppData\Roaming\raeaddb
C:\Users\Admin\AppData\Roaming\raeaddb
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:7008

C:\Users\Admin\AppData\Roaming\raeaddb
C:\Users\Admin\AppData\Roaming\raeaddb
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:6120

C:\Users\Admin\AppData\Roaming\raeaddb
C:\Users\Admin\AppData\Roaming\raeaddb
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4604

C:\Users\Admin\AppData\Roaming\raeaddb
C:\Users\Admin\AppData\Roaming\raeaddb
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:5100

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1884

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2688

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2936

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2696

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2532

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2484

C:\Users\Admin\AppData\Local\Temp\keygen-step-4.exe
"C:\Users\Admin\AppData\Local\Temp\keygen-step-4.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1840

C:\Users\Admin\AppData\Local\Temp\RarSFX0\xiuhuali.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\xiuhuali.exe"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2976

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Program Files\install.dll",install
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4092

C:\Users\Admin\AppData\Local\Temp\RarSFX0\JoSetp.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\JoSetp.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2848

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Install.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Install.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860

C:\Users\Admin\AppData\Local\Temp\is-0SS60.tmp\Install.tmp
"C:\Users\Admin\AppData\Local\Temp\is-0SS60.tmp\Install.tmp" /SL5="$A0080,235791,152064,C:\Users\Admin\AppData\Local\Temp\RarSFX0\Install.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2840

C:\Users\Admin\AppData\Local\Temp\is-9CKO7.tmp\Ultra.exe
"C:\Users\Admin\AppData\Local\Temp\is-9CKO7.tmp\Ultra.exe" /S /UID=burnerch1
4⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2272

C:\Program Files\Windows Security\KKDOVEMTBY\ultramediaburner.exe
"C:\Program Files\Windows Security\KKDOVEMTBY\ultramediaburner.exe" /VERYSILENT
5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852

C:\Users\Admin\AppData\Local\Temp\is-02I0O.tmp\ultramediaburner.tmp
"C:\Users\Admin\AppData\Local\Temp\is-02I0O.tmp\ultramediaburner.tmp" /SL5="$501DA,281924,62464,C:\Program Files\Windows Security\KKDOVEMTBY\ultramediaburner.exe" /VERYSILENT
6⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3164

C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
7⤵
- Executes dropped EXE
PID:932

C:\Users\Admin\AppData\Local\Temp\69-f9e3e-265-89da3-4487d9b0493b9\SHejuwanushi.exe
"C:\Users\Admin\AppData\Local\Temp\69-f9e3e-265-89da3-4487d9b0493b9\SHejuwanushi.exe"
5⤵
- Executes dropped EXE
- Checks computer location settings
PID:4044

C:\Users\Admin\AppData\Local\Temp\0f-39e19-297-3bbb5-8af7b365519da\Piloryshily.exe
"C:\Users\Admin\AppData\Local\Temp\0f-39e19-297-3bbb5-8af7b365519da\Piloryshily.exe"
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3916

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ymza0er4.3bz\KiffMainE1.exe & exit
6⤵
- Suspicious use of WriteProcessMemory
PID:5952

C:\Users\Admin\AppData\Local\Temp\ymza0er4.3bz\KiffMainE1.exe
C:\Users\Admin\AppData\Local\Temp\ymza0er4.3bz\KiffMainE1.exe
7⤵
- Executes dropped EXE
PID:7064

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\btfm1y34.w5e\001.exe & exit
6⤵
- Suspicious use of WriteProcessMemory
PID:6976

C:\Users\Admin\AppData\Local\Temp\btfm1y34.w5e\001.exe
C:\Users\Admin\AppData\Local\Temp\btfm1y34.w5e\001.exe
7⤵
- Executes dropped EXE
PID:7056

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\5q202zkg.yy1\installer.exe /qn CAMPAIGN="654" & exit
6⤵
PID:4332

C:\Users\Admin\AppData\Local\Temp\5q202zkg.yy1\installer.exe
C:\Users\Admin\AppData\Local\Temp\5q202zkg.yy1\installer.exe /qn CAMPAIGN="654"
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
PID:4596

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\5q202zkg.yy1\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\5q202zkg.yy1\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1620290961 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
8⤵
PID:4584

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\fe1mnahc.1hx\gpooe.exe & exit
6⤵
PID:5436

C:\Users\Admin\AppData\Local\Temp\fe1mnahc.1hx\gpooe.exe
C:\Users\Admin\AppData\Local\Temp\fe1mnahc.1hx\gpooe.exe
7⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5560

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
8⤵
- Executes dropped EXE
PID:5716

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
8⤵
- Executes dropped EXE
PID:5224

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
8⤵
- Executes dropped EXE
PID:4768

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
8⤵
- Executes dropped EXE
PID:1248

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\p4ysrou3.kk0\google-game.exe & exit
6⤵
PID:6964

C:\Users\Admin\AppData\Local\Temp\p4ysrou3.kk0\google-game.exe
C:\Users\Admin\AppData\Local\Temp\p4ysrou3.kk0\google-game.exe
7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4300

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\install.dll",install
8⤵
- Loads dropped DLL
PID:4604

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\t1hsmhw5.vwz\huesaa.exe & exit
6⤵
PID:5072

C:\Users\Admin\AppData\Local\Temp\t1hsmhw5.vwz\huesaa.exe
C:\Users\Admin\AppData\Local\Temp\t1hsmhw5.vwz\huesaa.exe
7⤵
- Executes dropped EXE
PID:5316

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
8⤵
- Executes dropped EXE
PID:5980

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
8⤵
- Executes dropped EXE
PID:5060

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
8⤵
- Executes dropped EXE
PID:5108

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
8⤵
- Executes dropped EXE
PID:5032

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\gsqm0ogg.nty\rasup.exe & exit
6⤵
PID:5172

C:\Users\Admin\AppData\Local\Temp\gsqm0ogg.nty\rasup.exe
C:\Users\Admin\AppData\Local\Temp\gsqm0ogg.nty\rasup.exe
7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5380

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\gsqm0ogg.nty\rasup.exe"
8⤵
PID:6120

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
9⤵
- Delays execution with timeout.exe
PID:5260

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\g5cfh2lg.0sk\askinstall39.exe & exit
6⤵
PID:5780

C:\Users\Admin\AppData\Local\Temp\g5cfh2lg.0sk\askinstall39.exe
C:\Users\Admin\AppData\Local\Temp\g5cfh2lg.0sk\askinstall39.exe
7⤵
- Executes dropped EXE
PID:5484

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
8⤵
PID:6880

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
9⤵
- Kills process with taskkill
PID:4312

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\sp15gvcz.bub\PbTSetp.exe & exit
6⤵
PID:7000

C:\Users\Admin\AppData\Local\Temp\sp15gvcz.bub\PbTSetp.exe
C:\Users\Admin\AppData\Local\Temp\sp15gvcz.bub\PbTSetp.exe
7⤵
- Executes dropped EXE
PID:7164

C:\Users\Admin\AppData\Roaming\7529328.exe
"C:\Users\Admin\AppData\Roaming\7529328.exe"
8⤵
- Executes dropped EXE
PID:4952

C:\Users\Admin\AppData\Roaming\3822093.exe
"C:\Users\Admin\AppData\Roaming\3822093.exe"
8⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5664

C:\ProgramData\Windows Host\Windows Host.exe
"C:\ProgramData\Windows Host\Windows Host.exe"
9⤵
- Executes dropped EXE
PID:2672

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\zbqomf5l.ein\keygen.exe & exit
6⤵
PID:4316

C:\Users\Admin\AppData\Local\Temp\zbqomf5l.ein\keygen.exe
C:\Users\Admin\AppData\Local\Temp\zbqomf5l.ein\keygen.exe
7⤵
- Executes dropped EXE
PID:1200

C:\Windows\SysWOW64\at.exe
"C:\Windows\System32\at.exe"
8⤵
PID:5256

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c cfJhtziJSwbWaavQqftKBOzknThtiEQiDkdMlfkCNBTYvSLeKmkYzx & C:\Windows\System32\cmd.exe < Sta.vstm
8⤵
PID:6008

C:\Windows\SysWOW64\cmd.exe
C:\Windows\System32\cmd.exe
9⤵
PID:6740

C:\Windows\SysWOW64\findstr.exe
findstr /V /R "^auPnRNysIHbguzrrqNSScEBqzRPPbdMbFoQYCAfsPGuHOxFbthGdjTOOFOtZYdTsVqJXDtAAbBePnTjYkaLlJckLzezNcd$" Poi.vstm
10⤵
PID:7028

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Fessura.exe.com
Fessura.exe.com Z
10⤵
- Executes dropped EXE
PID:6296

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Fessura.exe.com
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Fessura.exe.com Z
11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:6184

C:\Windows\SysWOW64\schtasks.exe
schtasks.exe /create /tn "PjPVhJpbFf" /tr "C:\\Users\\Admin\\AppData\\Roaming\\cpyTzEXhxT\\PjPVhJpbFf.exe.com C:\\Users\\Admin\\AppData\\Roaming\\cpyTzEXhxT\\A" /sc onstart /F /RU SYSTEM
12⤵
- Creates scheduled task(s)
PID:5096

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\RegAsm.exe
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\RegAsm.exe
12⤵
- Executes dropped EXE
PID:5540

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 30
10⤵
- Runs ping.exe
PID:6900

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
8⤵
PID:3856

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\51fggu0b.bfh\setup.exe & exit
6⤵
PID:3924

C:\Users\Admin\AppData\Local\Temp\51fggu0b.bfh\setup.exe
C:\Users\Admin\AppData\Local\Temp\51fggu0b.bfh\setup.exe
7⤵
- Executes dropped EXE
PID:6612

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\51fggu0b.bfh\setup.exe"
8⤵
PID:6200

C:\Windows\SysWOW64\PING.EXE
ping 1.1.1.1 -n 1 -w 3000
9⤵
- Runs ping.exe
PID:6536

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\c0oibvw0.2pd\y1.exe & exit
6⤵
PID:7096

C:\Users\Admin\AppData\Local\Temp\c0oibvw0.2pd\y1.exe
C:\Users\Admin\AppData\Local\Temp\c0oibvw0.2pd\y1.exe
7⤵
- Executes dropped EXE
PID:5136

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\wreywpjp.v5a\toolspab1.exe & exit
6⤵
PID:5796

C:\Users\Admin\AppData\Local\Temp\wreywpjp.v5a\toolspab1.exe
C:\Users\Admin\AppData\Local\Temp\wreywpjp.v5a\toolspab1.exe
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:6660

C:\Users\Admin\AppData\Local\Temp\wreywpjp.v5a\toolspab1.exe
C:\Users\Admin\AppData\Local\Temp\wreywpjp.v5a\toolspab1.exe
8⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:6856

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3aie2fjp.abf\005.exe & exit
6⤵
PID:6264

C:\Users\Admin\AppData\Local\Temp\3aie2fjp.abf\005.exe
C:\Users\Admin\AppData\Local\Temp\3aie2fjp.abf\005.exe
7⤵
- Executes dropped EXE
PID:6004

C:\Users\Admin\AppData\Local\Temp\RarSFX0\filee.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\filee.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX0\filee.exe" >> NUL
3⤵
- Suspicious use of WriteProcessMemory
PID:4204

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
4⤵
- Runs ping.exe
PID:4256

C:\Users\Admin\AppData\Local\Temp\RarSFX0\jg6_6asg.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\jg6_6asg.exe"
2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:5300

C:\Users\Admin\AppData\Local\Temp\RarSFX0\gaoou.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\gaoou.exe"
2⤵
- Executes dropped EXE
PID:7000

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
3⤵
- Executes dropped EXE
PID:2288

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
3⤵
- Executes dropped EXE
PID:4504

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
3⤵
- Executes dropped EXE
PID:4600

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
3⤵
- Executes dropped EXE
PID:3108

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s BITS
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
2⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:3852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:428

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4692

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4808

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
PID:4108

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 5D7560D4FE8A1A4A0BD9587CA07DA7E5 C
2⤵
- Loads dropped DLL
PID:6504

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 6CAA95C3B81990BE5F36FE52B1740905
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:5820

C:\Windows\SysWOW64\taskkill.exe
"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
3⤵
- Kills process with taskkill
PID:6404

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 7904C156D31BE53EC3F8489C6E2D4C85 E Global\MSI0000
2⤵
- Loads dropped DLL
PID:4260

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:5736

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:6476

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5000

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5944

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:6576

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:5200

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:2068

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:820

C:\Users\Admin\AppData\Local\Temp\D486.exe
C:\Users\Admin\AppData\Local\Temp\D486.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5016

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:1320

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5952

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Install Root Certificate

T1130

Modify Registry

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

Software Discovery

T1518

System Information Discovery