azorult | 634f7f210c081e0d54fb348a921db874126736503cf7cfcf2f605c484aa6635a

Analysis

max time kernel
1800s
max time network
1340s
platform
windows10_x64
resource
win10v20210408
submitted
11-05-2021 23:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Lenovo.Easycamera.6.32.2018.05.key.generator.by.aaocg.exe
Size

6.4MB
MD5

cdeeb6da0244476be71ebf88fa76ecdc
SHA1

f26b35c822187292bc1c31c2e61b2a714daa5334
SHA256

634f7f210c081e0d54fb348a921db874126736503cf7cfcf2f605c484aa6635a
SHA512

149487c0ddf5c847c1e5182a921bc9d527b4bfcb525de1a129bd10c25a8119e7de153eadc6fdb157e95999ae20557aabe872c1b6ae8a8fb1a25bfe25478d30e1

Score

10^/10

azorult plugx redline servlyla discovery evasion infostealer persistence spyware stealer trojan upx

Malware Config

Extracted

Family

azorult

http://kvaka.li/1210776429.php

Extracted

Family

redline

Botnet

ServLyla

87.251.71.193:20119

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
PlugX
PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
trojan plugx
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

resource	yara_rule
behavioral1/memory/1184-272-0x0000000000400000-0x000000000041C000-memory.dmp	family_redline
behavioral1/memory/1184-273-0x00000000004163CE-mapping.dmp	family_redline

Executes dropped EXE 17 IoCs

pid	Process
3312	keygen-pr.exe
3700	keygen-step-1.exe
2112	keygen-step-5.exe
2108	keygen-step-3.exe
3884	keygen-step-4.exe
3904	key.exe
3932	Installer.exe
704	FDhpFB.exe
1184	jg6_6asg.exe
3356	zhangxia.exe
2340	Setup.exe
1184	Setup.exe
1468	gcttt.exe
596	jfiag3g_gg.exe
2196	jfiag3g_gg.exe
2712	jfiag3g_gg.exe
3700	jfiag3g_gg.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000500000001ab42-283.dat	upx
behavioral1/files/0x000500000001ab42-284.dat	upx
behavioral1/files/0x000600000001ab42-292.dat	upx
behavioral1/files/0x000600000001ab42-293.dat	upx
behavioral1/files/0x00050000000152e2-323.dat	upx
behavioral1/files/0x00050000000152e2-324.dat	upx
behavioral1/files/0x000b0000000152e2-327.dat	upx
behavioral1/files/0x000b0000000152e2-328.dat	upx

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation	zhangxia.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation	Setup.exe

Loads dropped DLL 2 IoCs

pid	Process
2160	regsvr32.exe
1896	rUNdlL32.eXe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.exe"	gcttt.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	jg6_6asg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
51	ip-api.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	svchost.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
2160	regsvr32.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 356 set thread context of 3372	356	svchost.exe	111
PID 2340 set thread context of 1184	2340	Setup.exe	114

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
220	taskkill.exe
1476	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies data under HKEY_USERS 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	svchost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-08760 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\MrtCache	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 01000000b03640a4b2bafcc5b2fae0ffc5d616b3706e3d7c662321288f905fbf1da517d6795305b55984aa45bc3d6007dc6a2743eb2698d5c33415e62522	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance	zhangxia.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DOMStorage	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$blogger	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\MigrationTime = 1d24df8b702cd701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{CB8EE8F6-976B-4984-A0CD-655694EE7176} = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$MediaWiki	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20EP1MI0-142C-L17D-YD26-2GCP283P3KMT}\1 = "1060"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 923bbb43ca46d701	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage\ProcessingFlag = c0189552ca46d701	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 12a5dc52ca46d701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\UUID = "{A131C09D-432F-4669-B209-5E8734081914}"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$Telligent	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\MigrationTime = 1d24df8b702cd701	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\AllComplete = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListInPrivateBrowsingAllowed = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "268435456"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\FileVersion = "2016061511"	MicrosoftEdge.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Installer.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
744	PING.EXE

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1896	rUNdlL32.eXe
1896	rUNdlL32.eXe
356	svchost.exe
356	svchost.exe
2196	jfiag3g_gg.exe
2196	jfiag3g_gg.exe
1184	Setup.exe
2712	jfiag3g_gg.exe
2712	jfiag3g_gg.exe
3700	jfiag3g_gg.exe
3700	jfiag3g_gg.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4164	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeCreateTokenPrivilege	3932	Installer.exe
Token: SeAssignPrimaryTokenPrivilege	3932	Installer.exe
Token: SeLockMemoryPrivilege	3932	Installer.exe
Token: SeIncreaseQuotaPrivilege	3932	Installer.exe
Token: SeMachineAccountPrivilege	3932	Installer.exe
Token: SeTcbPrivilege	3932	Installer.exe
Token: SeSecurityPrivilege	3932	Installer.exe
Token: SeTakeOwnershipPrivilege	3932	Installer.exe
Token: SeLoadDriverPrivilege	3932	Installer.exe
Token: SeSystemProfilePrivilege	3932	Installer.exe
Token: SeSystemtimePrivilege	3932	Installer.exe
Token: SeProfSingleProcessPrivilege	3932	Installer.exe
Token: SeIncBasePriorityPrivilege	3932	Installer.exe
Token: SeCreatePagefilePrivilege	3932	Installer.exe
Token: SeCreatePermanentPrivilege	3932	Installer.exe
Token: SeBackupPrivilege	3932	Installer.exe
Token: SeRestorePrivilege	3932	Installer.exe
Token: SeShutdownPrivilege	3932	Installer.exe
Token: SeDebugPrivilege	3932	Installer.exe
Token: SeAuditPrivilege	3932	Installer.exe
Token: SeSystemEnvironmentPrivilege	3932	Installer.exe
Token: SeChangeNotifyPrivilege	3932	Installer.exe
Token: SeRemoteShutdownPrivilege	3932	Installer.exe
Token: SeUndockPrivilege	3932	Installer.exe
Token: SeSyncAgentPrivilege	3932	Installer.exe
Token: SeEnableDelegationPrivilege	3932	Installer.exe
Token: SeManageVolumePrivilege	3932	Installer.exe
Token: SeImpersonatePrivilege	3932	Installer.exe
Token: SeCreateGlobalPrivilege	3932	Installer.exe
Token: 31	3932	Installer.exe
Token: 32	3932	Installer.exe
Token: 33	3932	Installer.exe
Token: 34	3932	Installer.exe
Token: 35	3932	Installer.exe
Token: SeDebugPrivilege	220	taskkill.exe
Token: SeDebugPrivilege	1476	taskkill.exe
Token: SeManageVolumePrivilege	1184	jg6_6asg.exe
Token: SeManageVolumePrivilege	1184	jg6_6asg.exe
Token: SeManageVolumePrivilege	1184	jg6_6asg.exe
Token: SeManageVolumePrivilege	1184	jg6_6asg.exe
Token: SeManageVolumePrivilege	1184	jg6_6asg.exe
Token: SeDebugPrivilege	1896	rUNdlL32.eXe
Token: SeDebugPrivilege	356	svchost.exe
Token: SeDebugPrivilege	1896	rUNdlL32.eXe
Token: SeDebugPrivilege	1896	rUNdlL32.eXe
Token: SeDebugPrivilege	1896	rUNdlL32.eXe
Token: SeDebugPrivilege	1896	rUNdlL32.eXe
Token: SeDebugPrivilege	1896	rUNdlL32.eXe
Token: SeDebugPrivilege	1896	rUNdlL32.eXe
Token: SeDebugPrivilege	1896	rUNdlL32.eXe
Token: SeDebugPrivilege	1896	rUNdlL32.eXe
Token: SeDebugPrivilege	1896	rUNdlL32.eXe
Token: SeDebugPrivilege	1896	rUNdlL32.eXe
Token: SeDebugPrivilege	1896	rUNdlL32.eXe
Token: SeDebugPrivilege	1896	rUNdlL32.eXe
Token: SeDebugPrivilege	2340	Setup.exe
Token: SeDebugPrivilege	1184	Setup.exe
Token: SeAssignPrimaryTokenPrivilege	2700	svchost.exe
Token: SeIncreaseQuotaPrivilege	2700	svchost.exe
Token: SeSecurityPrivilege	2700	svchost.exe
Token: SeTakeOwnershipPrivilege	2700	svchost.exe
Token: SeLoadDriverPrivilege	2700	svchost.exe
Token: SeSystemtimePrivilege	2700	svchost.exe
Token: SeBackupPrivilege	2700	svchost.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3352	MicrosoftEdge.exe
4164	MicrosoftEdgeCP.exe
4164	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 604 wrote to memory of 2208	604	Lenovo.Easycamera.6.32.2018.05.key.generator.by.aaocg.exe	78
PID 604 wrote to memory of 2208	604	Lenovo.Easycamera.6.32.2018.05.key.generator.by.aaocg.exe	78
PID 604 wrote to memory of 2208	604	Lenovo.Easycamera.6.32.2018.05.key.generator.by.aaocg.exe	78
PID 2208 wrote to memory of 3312	2208	cmd.exe	81
PID 2208 wrote to memory of 3312	2208	cmd.exe	81
PID 2208 wrote to memory of 3312	2208	cmd.exe	81
PID 2208 wrote to memory of 3700	2208	cmd.exe	82
PID 2208 wrote to memory of 3700	2208	cmd.exe	82
PID 2208 wrote to memory of 3700	2208	cmd.exe	82
PID 2208 wrote to memory of 2112	2208	cmd.exe	83
PID 2208 wrote to memory of 2112	2208	cmd.exe	83
PID 2208 wrote to memory of 2112	2208	cmd.exe	83
PID 2208 wrote to memory of 2108	2208	cmd.exe	84
PID 2208 wrote to memory of 2108	2208	cmd.exe	84
PID 2208 wrote to memory of 2108	2208	cmd.exe	84
PID 2208 wrote to memory of 3884	2208	cmd.exe	85
PID 2208 wrote to memory of 3884	2208	cmd.exe	85
PID 2208 wrote to memory of 3884	2208	cmd.exe	85
PID 3884 wrote to memory of 3932	3884	keygen-step-4.exe	86
PID 3884 wrote to memory of 3932	3884	keygen-step-4.exe	86
PID 3884 wrote to memory of 3932	3884	keygen-step-4.exe	86
PID 3312 wrote to memory of 3904	3312	keygen-pr.exe	87
PID 3312 wrote to memory of 3904	3312	keygen-pr.exe	87
PID 3312 wrote to memory of 3904	3312	keygen-pr.exe	87
PID 2112 wrote to memory of 1872	2112	keygen-step-5.exe	88
PID 2112 wrote to memory of 1872	2112	keygen-step-5.exe	88
PID 2112 wrote to memory of 1872	2112	keygen-step-5.exe	88
PID 2108 wrote to memory of 3292	2108	keygen-step-3.exe	90
PID 2108 wrote to memory of 3292	2108	keygen-step-3.exe	90
PID 2108 wrote to memory of 3292	2108	keygen-step-3.exe	90
PID 3904 wrote to memory of 3208	3904	key.exe	91
PID 3904 wrote to memory of 3208	3904	key.exe	91
PID 3904 wrote to memory of 3208	3904	key.exe	91
PID 3292 wrote to memory of 744	3292	cmd.exe	93
PID 3292 wrote to memory of 744	3292	cmd.exe	93
PID 3292 wrote to memory of 744	3292	cmd.exe	93
PID 1872 wrote to memory of 704	1872	cmd.exe	94
PID 1872 wrote to memory of 704	1872	cmd.exe	94
PID 1872 wrote to memory of 704	1872	cmd.exe	94
PID 1872 wrote to memory of 220	1872	cmd.exe	95
PID 1872 wrote to memory of 220	1872	cmd.exe	95
PID 1872 wrote to memory of 220	1872	cmd.exe	95
PID 704 wrote to memory of 1260	704	FDhpFB.exe	96
PID 704 wrote to memory of 1260	704	FDhpFB.exe	96
PID 704 wrote to memory of 1260	704	FDhpFB.exe	96
PID 704 wrote to memory of 3700	704	FDhpFB.exe	98
PID 704 wrote to memory of 3700	704	FDhpFB.exe	98
PID 704 wrote to memory of 3700	704	FDhpFB.exe	98
PID 3700 wrote to memory of 3200	3700	cmd.exe	100
PID 3700 wrote to memory of 3200	3700	cmd.exe	100
PID 3700 wrote to memory of 3200	3700	cmd.exe	100
PID 3700 wrote to memory of 3632	3700	cmd.exe	101
PID 3700 wrote to memory of 3632	3700	cmd.exe	101
PID 3700 wrote to memory of 3632	3700	cmd.exe	101
PID 3700 wrote to memory of 2160	3700	cmd.exe	102
PID 3700 wrote to memory of 2160	3700	cmd.exe	102
PID 3700 wrote to memory of 2160	3700	cmd.exe	102
PID 3932 wrote to memory of 820	3932	Installer.exe	103
PID 3932 wrote to memory of 820	3932	Installer.exe	103
PID 3932 wrote to memory of 820	3932	Installer.exe	103
PID 820 wrote to memory of 1476	820	cmd.exe	105
PID 820 wrote to memory of 1476	820	cmd.exe	105
PID 820 wrote to memory of 1476	820	cmd.exe	105
PID 3884 wrote to memory of 1184	3884	keygen-step-4.exe	106

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:60

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2716

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2700

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2604

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
PID:2388

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2368

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1836

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1380

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1296

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1228

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1092

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
PID:1044

C:\Users\Admin\AppData\Local\Temp\Lenovo.Easycamera.6.32.2018.05.key.generator.by.aaocg.exe
"C:\Users\Admin\AppData\Local\Temp\Lenovo.Easycamera.6.32.2018.05.key.generator.by.aaocg.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:604
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2208
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
    keygen-pr.exe -p83fsase3Ge
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3312
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX3\key.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX3\key.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3904
    - - C:\Users\Admin\AppData\Local\Temp\RarSFX3\key.exe
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX3\key.exe -txt -scanlocal -file:potato.dat
        5⤵
        
        PID:3208
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
    keygen-step-1.exe
    3⤵
    - Executes dropped EXE
    PID:3700
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe
    keygen-step-5.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2112
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /Q /C tYpE "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe" > ..\FDhpFB.exe &&STARt..\FDhpFB.exe -PpTHlybeBhi_Z2JPlcy& If"" == "" for %E in ( "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe" ) do taskkill -IM "%~NXE" /f > NuL
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1872
    - - C:\Users\Admin\AppData\Local\Temp\FDhpFB.exe
        
        ..\FDhpFB.exe -PpTHlybeBhi_Z2JPlcy
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:704
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /Q /C tYpE "C:\Users\Admin\AppData\Local\Temp\FDhpFB.exe" > ..\FDhpFB.exe &&STARt..\FDhpFB.exe -PpTHlybeBhi_Z2JPlcy& If"-PpTHlybeBhi_Z2JPlcy" == "" for %E in ( "C:\Users\Admin\AppData\Local\Temp\FDhpFB.exe" ) do taskkill -IM "%~NXE" /f > NuL
        6⤵
        
        PID:1260
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c eCHO |SET /p = "MZ"> 30EY.gg& COpY /b /y 30EY.gg +Q_FM.YU +H_WJ2.E3 + PJ76k1.o + SZaA.2a0+ 8Td1LZ.82Q+ DMgIJ5IH.JC+ 4_xVhVZw.W + hWLEB3.E + BHn249Hz.35 +TRYY00W9.RM+ QBCT.xsG + 2SOkTK.Jx + Y1ws.9T8+ 9Q5AeJ.L + 7VrCZVK.U ..\IZ1SIMY.QE > nUl & sTART regsvr32 ..\iZ1SIMY.qE -u -S & DEl/Q * > Nul
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3700
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" eCHO "
        7⤵
        
        PID:3200
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" SET /p = "MZ" 1>30EY.gg"
        7⤵
        
        PID:3632
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32 ..\iZ1SIMY.qE -u -S
        7⤵
        Loads dropped DLL
        Suspicious use of NtCreateThreadExHideFromDebugger
        
        PID:2160
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -IM "keygen-step-5.exe" /f
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:220
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
    keygen-step-3.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2108
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3292
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 1.1.1.1 -n 1 -w 3000
        5⤵
        Runs ping.exe
        
        PID:744
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
    keygen-step-4.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3884
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX2\Installer.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Installer.exe"
      4⤵
      Executes dropped EXE
      Modifies system certificate store
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3932
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:820
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1476
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX2\jg6_6asg.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX2\jg6_6asg.exe"
      4⤵
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious use of AdjustPrivilegeToken
      PID:1184
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX2\zhangxia.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX2\zhangxia.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Modifies registry class
      PID:3356
    - - C:\Windows\SysWOW64\rUNdlL32.eXe
        
        "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",install
        5⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1896
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      PID:2340
    - - C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe
        5⤵
        Executes dropped EXE
        Checks computer location settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1184
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX2\gcttt.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX2\gcttt.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      PID:1468
    - - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        5⤵
        Executes dropped EXE
        
        PID:596
    - - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:2196
    - - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:2712
    - - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:3700

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s BITS
1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:356
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k SystemNetworkService
  2⤵
  - Drops file in System32 directory
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:3372

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3352

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:1264

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:4164

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:4232

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4480

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4640

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4728

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/60-215-0x00000289519A0000-0x00000289519EB000-memory.dmp

Filesize
300KB

Download
memory/60-300-0x00000289520B0000-0x0000028952120000-memory.dmp

Filesize
448KB

Download
memory/60-218-0x0000028951A60000-0x0000028951AD0000-memory.dmp

Filesize
448KB

Download
memory/356-224-0x0000028B83AD0000-0x0000028B83B40000-memory.dmp

Filesize
448KB

Download
memory/1044-251-0x0000012700510000-0x0000012700580000-memory.dmp

Filesize
448KB

Download
memory/1044-308-0x0000012700600000-0x0000012700670000-memory.dmp

Filesize
448KB

Download
memory/1092-233-0x00000265F7700000-0x00000265F7770000-memory.dmp

Filesize
448KB

Download
memory/1092-306-0x00000265F7770000-0x00000265F77E0000-memory.dmp

Filesize
448KB

Download
memory/1184-285-0x0000000003070000-0x0000000003071000-memory.dmp

Filesize
4KB

Download
memory/1184-290-0x0000000005A50000-0x0000000005A51000-memory.dmp

Filesize
4KB

Download
memory/1184-288-0x0000000003110000-0x0000000003111000-memory.dmp

Filesize
4KB

Download
memory/1184-272-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1184-176-0x0000000003710000-0x0000000003720000-memory.dmp

Filesize
64KB

Download
memory/1184-287-0x00000000057B0000-0x0000000005DB6000-memory.dmp

Filesize
6.0MB

Download
memory/1184-278-0x0000000005DC0000-0x0000000005DC1000-memory.dmp

Filesize
4KB

Download
memory/1184-182-0x00000000038B0000-0x00000000038C0000-memory.dmp

Filesize
64KB

Download
memory/1184-188-0x0000000004AC0000-0x0000000004AC8000-memory.dmp

Filesize
32KB

Download
memory/1184-286-0x00000000030D0000-0x00000000030D1000-memory.dmp

Filesize
4KB

Download
memory/1228-262-0x0000020D98540000-0x0000020D985B0000-memory.dmp

Filesize
448KB

Download
memory/1228-314-0x0000020D985B0000-0x0000020D98620000-memory.dmp

Filesize
448KB

Download
memory/1296-264-0x000001929F660000-0x000001929F6D0000-memory.dmp

Filesize
448KB

Download
memory/1296-316-0x000001929F740000-0x000001929F7B0000-memory.dmp

Filesize
448KB

Download
memory/1380-258-0x000001C362470000-0x000001C3624E0000-memory.dmp

Filesize
448KB

Download
memory/1380-310-0x000001C362A40000-0x000001C362AB0000-memory.dmp

Filesize
448KB

Download
memory/1836-260-0x000002B6DE8B0000-0x000002B6DE920000-memory.dmp

Filesize
448KB

Download
memory/1836-312-0x000002B6DE920000-0x000002B6DE990000-memory.dmp

Filesize
448KB

Download
memory/1896-209-0x00000000031B1000-0x00000000032B2000-memory.dmp

Filesize
1.0MB

Download
memory/1896-217-0x0000000004CD0000-0x0000000004D2C000-memory.dmp

Filesize
368KB

Download
memory/2160-321-0x0000000010000000-0x000000001018A000-memory.dmp

Filesize
1.5MB

Download
memory/2160-296-0x0000000004220000-0x00000000043AA000-memory.dmp

Filesize
1.5MB

Download
memory/2340-267-0x00000000079B0000-0x0000000007EAE000-memory.dmp

Filesize
5.0MB

Download
memory/2340-266-0x0000000007A90000-0x0000000007A91000-memory.dmp

Filesize
4KB

Download
memory/2340-237-0x0000000000CF0000-0x0000000000CF1000-memory.dmp

Filesize
4KB

Download
memory/2340-271-0x00000000054F0000-0x000000000550C000-memory.dmp

Filesize
112KB

Download
memory/2340-249-0x0000000007EB0000-0x0000000007EB1000-memory.dmp

Filesize
4KB

Download
memory/2340-268-0x0000000007A70000-0x0000000007A71000-memory.dmp

Filesize
4KB

Download
memory/2368-223-0x000001B8B0BA0000-0x000001B8B0C10000-memory.dmp

Filesize
448KB

Download
memory/2368-302-0x000001B8B0C10000-0x000001B8B0C80000-memory.dmp

Filesize
448KB

Download
memory/2388-304-0x0000015BBB1B0000-0x0000015BBB220000-memory.dmp

Filesize
448KB

Download
memory/2388-229-0x0000015BBB140000-0x0000015BBB1B0000-memory.dmp

Filesize
448KB

Download
memory/2604-212-0x0000029CE8300000-0x0000029CE8370000-memory.dmp

Filesize
448KB

Download
memory/2604-298-0x0000029CE8720000-0x0000029CE8790000-memory.dmp

Filesize
448KB

Download
memory/2700-252-0x0000028873E30000-0x0000028873EA0000-memory.dmp

Filesize
448KB

Download
memory/2700-318-0x0000028873EA0000-0x0000028873F10000-memory.dmp

Filesize
448KB

Download
memory/2716-320-0x000001E9E12B0000-0x000001E9E1320000-memory.dmp

Filesize
448KB

Download
memory/2716-257-0x000001E9E0F00000-0x000001E9E0F70000-memory.dmp

Filesize
448KB

Download
memory/3372-270-0x000002258C400000-0x000002258C505000-memory.dmp

Filesize
1.0MB

Download
memory/3372-213-0x0000022589DD0000-0x0000022589E40000-memory.dmp

Filesize
448KB

Download
memory/3904-141-0x00000000026D0000-0x000000000286C000-memory.dmp

Filesize
1.6MB

Download