Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
ﱞﱞﱞ�...ﱞﱞ
windows10_x64
8ﱞﱞﱞ�...ﱞﱞ
windows10_x64
8ﱞﱞﱞ�...ﱞﱞ
windows10_x64
10ﱞﱞﱞ�...ﱞﱞ
windows10_x64
10ﱞﱞﱞ�...ฺฺ
windows10_x64
10ﱞﱞﱞ�...ฺฺ
windows10_x64
10ﱞﱞﱞ�...ฺฺ
windows10_x64
10ﱞﱞﱞ�...ฺฺ
windows10_x64
8ﱞﱞﱞ�...ﱞﱞ
windows10_x64
10ﱞﱞﱞ�...ﱞﱞ
windows10_x64
8ﱞﱞﱞ�...ﱞﱞ
windows10_x64
10ﱞﱞﱞ�...ﱞﱞ
windows10_x64
8ﱞﱞﱞ�...ﱞﱞ
windows10_x64
10ﱞﱞﱞ�...ﱞﱞ
windows10_x64
8ﱞﱞﱞ�...ﱞﱞ
windows10_x64
8ﱞﱞﱞ�...ﱞﱞ
windows10_x64
8ﱞﱞﱞ�...ﱞﱞ
windows7_x64
10ﱞﱞﱞ�...ﱞﱞ
windows7_x64
10ﱞﱞﱞ�...ﱞﱞ
windows7_x64
10ﱞﱞﱞ�...ﱞﱞ
windows7_x64
10win102
windows10_x64
8win102
windows10_x64
8win102
windows10_x64
8win102
windows10_x64
10win104
windows10_x64
10win104
windows10_x64
10win104
windows10_x64
8win104
windows10_x64
8win105
windows10_x64
8win105
windows10_x64
8win105
windows10_x64
8win105
windows10_x64
10Resubmissions
12/11/2024, 01:29
241112-bwgrxs1gnf 1008/07/2021, 12:18
210708-8z6d5h8z2n 1006/07/2021, 17:53
210706-g6we6sa7sa 1019/06/2021, 18:17
210619-vr8bj2dzfn 1017/06/2021, 21:39
210617-a9cvlnmrbx 1011/06/2021, 17:26
210611-wvab1yw2tj 1008/06/2021, 06:47
210608-qrbpch3y46 1008/06/2021, 06:47
210608-64tndgm1ln 1005/06/2021, 18:40
210605-cd6qpr55sx 1004/06/2021, 11:56
210604-5c416rs3ns 10Analysis
-
max time kernel
600s -
max time network
407s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
16/05/2021, 11:05
Static task
static1
Behavioral task
behavioral1
Sample
Install.exe
Resource
win10v20210408
Behavioral task
behavioral2
Sample
Install2.exe
Resource
win10v20210408
Behavioral task
behavioral3
Sample
keygen-step-4.exe
Resource
win10v20210410
Behavioral task
behavioral4
Sample
keygen-step-4d.exe
Resource
win10v20210410
Behavioral task
behavioral5
Sample
Install.exe
Resource
win10v20210410
Behavioral task
behavioral6
Sample
Install2.exe
Resource
win10v20210410
Behavioral task
behavioral7
Sample
keygen-step-4.exe
Resource
win10v20210410
Behavioral task
behavioral8
Sample
keygen-step-4d.exe
Resource
win10v20210408
Behavioral task
behavioral9
Sample
Install.exe
Resource
win10v20210410
Behavioral task
behavioral10
Sample
Install2.exe
Resource
win10v20210408
Behavioral task
behavioral11
Sample
keygen-step-4.exe
Resource
win10v20210410
Behavioral task
behavioral12
Sample
keygen-step-4d.exe
Resource
win10v20210408
Behavioral task
behavioral13
Sample
Install.exe
Resource
win10v20210410
Behavioral task
behavioral14
Sample
Install2.exe
Resource
win10v20210408
Behavioral task
behavioral15
Sample
keygen-step-4.exe
Resource
win10v20210408
Behavioral task
behavioral16
Sample
keygen-step-4d.exe
Resource
win10v20210408
Behavioral task
behavioral17
Sample
Install.exe
Resource
win7v20210410
Behavioral task
behavioral18
Sample
Install2.exe
Resource
win7v20210410
Behavioral task
behavioral19
Sample
keygen-step-4.exe
Resource
win7v20210410
Behavioral task
behavioral20
Sample
keygen-step-4d.exe
Resource
win7v20210410
Behavioral task
behavioral21
Sample
Install.exe
Resource
win10v20210408
Behavioral task
behavioral22
Sample
Install2.exe
Resource
win10v20210408
Behavioral task
behavioral23
Sample
keygen-step-4.exe
Resource
win10v20210408
Behavioral task
behavioral24
Sample
keygen-step-4d.exe
Resource
win10v20210410
Behavioral task
behavioral25
Sample
Install.exe
Resource
win10v20210410
Behavioral task
behavioral26
Sample
Install2.exe
Resource
win10v20210410
Behavioral task
behavioral27
Sample
keygen-step-4.exe
Resource
win10v20210408
Behavioral task
behavioral28
Sample
keygen-step-4d.exe
Resource
win10v20210408
Behavioral task
behavioral29
Sample
Install.exe
Resource
win10v20210408
Behavioral task
behavioral30
Sample
Install2.exe
Resource
win10v20210408
Behavioral task
behavioral31
Sample
keygen-step-4.exe
Resource
win10v20210408
General
-
Target
Install.exe
-
Size
497KB
-
MD5
41a5f4fd1ea7cac4aa94a87aebccfef0
-
SHA1
0d0abf079413a4c773754bf4fda338dc5b9a8ddc
-
SHA256
97e95e99fd499ec45a7c1d8683d5731ce5e7a8fb8b710622e578cd169a00d8d9
-
SHA512
5ca14bda498f26efff4e1179969b8f2c25244063c7bf25f3ec20b5cd24b5be320bbfb8b3d0b2d66f5c5b415da777a766fece5f251a4247773c6cb991417fb75f
Malware Config
Extracted
smokeloader
2020
http://999080321newfolder1002002131-service1002.space/
http://999080321newfolder1002002231-service1002.space/
http://999080321newfolder3100231-service1002.space/
http://999080321newfolder1002002431-service1002.space/
http://999080321newfolder1002002531-service1002.space/
http://999080321newfolder33417-012425999080321.space/
http://999080321test125831-service10020125999080321.space/
http://999080321test136831-service10020125999080321.space/
http://999080321test147831-service10020125999080321.space/
http://999080321test146831-service10020125999080321.space/
http://999080321test134831-service10020125999080321.space/
http://999080321est213531-service1002012425999080321.ru/
http://999080321yes1t3481-service10020125999080321.ru/
http://999080321test13561-service10020125999080321.su/
http://999080321test14781-service10020125999080321.info/
http://999080321test13461-service10020125999080321.net/
http://999080321test15671-service10020125999080321.tech/
http://999080321test12671-service10020125999080321.online/
http://999080321utest1341-service10020125999080321.ru/
http://999080321uest71-service100201dom25999080321.ru/
http://999080321test61-service10020125999080321.website/
http://999080321test51-service10020125999080321.xyz/
http://999080321test41-service100201pro25999080321.ru/
http://999080321yest31-service100201rus25999080321.ru/
http://999080321rest21-service10020125999080321.eu/
http://999080321test11-service10020125999080321.press/
http://999080321newfolder4561-service10020125999080321.ru/
http://999080321rustest213-service10020125999080321.ru/
http://999080321test281-service10020125999080321.ru/
http://999080321test261-service10020125999080321.space/
http://999080321yomtest251-service10020125999080321.ru/
http://999080321yirtest231-service10020125999080321.ru/
Extracted
raccoon
afefd33a49c7cbd55d417545269920f24c85aa37
-
url4cnc
https://telete.in/jagressor_kz
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
resource yara_rule behavioral9/memory/5060-353-0x0000000002030000-0x000000000204E000-memory.dmp family_redline behavioral9/memory/5060-356-0x0000000002380000-0x000000000239D000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Blocklisted process makes network request 52 IoCs
flow pid Process 96 3928 MsiExec.exe 97 3928 MsiExec.exe 98 3928 MsiExec.exe 99 3928 MsiExec.exe 100 3928 MsiExec.exe 101 3928 MsiExec.exe 102 3928 MsiExec.exe 103 3928 MsiExec.exe 104 3928 MsiExec.exe 105 3928 MsiExec.exe 107 3928 MsiExec.exe 108 3928 MsiExec.exe 109 3928 MsiExec.exe 112 3928 MsiExec.exe 113 3928 MsiExec.exe 114 3928 MsiExec.exe 115 3928 MsiExec.exe 118 3928 MsiExec.exe 119 3928 MsiExec.exe 120 3928 MsiExec.exe 123 3928 MsiExec.exe 124 3928 MsiExec.exe 125 3928 MsiExec.exe 129 3928 MsiExec.exe 130 3928 MsiExec.exe 131 3928 MsiExec.exe 134 3928 MsiExec.exe 135 3928 MsiExec.exe 137 3928 MsiExec.exe 138 3928 MsiExec.exe 140 3928 MsiExec.exe 141 3928 MsiExec.exe 142 3928 MsiExec.exe 144 3928 MsiExec.exe 146 3928 MsiExec.exe 147 3928 MsiExec.exe 153 3928 MsiExec.exe 154 3928 MsiExec.exe 155 3928 MsiExec.exe 156 3928 MsiExec.exe 161 3928 MsiExec.exe 165 3928 MsiExec.exe 166 3928 MsiExec.exe 172 3928 MsiExec.exe 175 3928 MsiExec.exe 176 3928 MsiExec.exe 177 3928 MsiExec.exe 178 3928 MsiExec.exe 238 3984 MsiExec.exe 240 3984 MsiExec.exe 242 3984 MsiExec.exe 243 3984 MsiExec.exe -
Downloads MZ/PE file
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts Ultra.exe -
Executes dropped EXE 33 IoCs
pid Process 1804 Install.tmp 360 Ultra.exe 2720 ultramediaburner.exe 1120 ultramediaburner.tmp 988 Buzhytisahe.exe 192 UltraMediaBurner.exe 2740 Kocevaroki.exe 4636 001.exe 5052 installer.exe 4336 hbggg.exe 4500 jfiag3g_gg.exe 5140 jfiag3g_gg.exe 5500 google-game.exe 6084 huesaa.exe 6020 jfiag3g_gg.exe 5144 setup.exe 5020 askinstall39.exe 4436 jfiag3g_gg.exe 4308 customer1.exe 4652 jfiag3g_gg.exe 4848 toolspab1.exe 5788 toolspab1.exe 5916 jfiag3g_gg.exe 4808 005.exe 3084 installer.exe 5024 48C2.exe 4060 4CE9.exe 5620 5910.exe 5060 5D95.exe 1436 64F8.exe 1260 48C2.exe 4916 acfituw 5688 acfituw -
resource yara_rule behavioral9/files/0x000100000001abb6-170.dat upx behavioral9/files/0x000100000001abb6-171.dat upx behavioral9/files/0x000100000001ac2e-200.dat upx behavioral9/files/0x000100000001ac2e-201.dat upx -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation Buzhytisahe.exe Key value queried \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation google-game.exe -
Loads dropped DLL 62 IoCs
pid Process 1804 Install.tmp 5052 installer.exe 5052 installer.exe 5052 installer.exe 4252 MsiExec.exe 4252 MsiExec.exe 3928 MsiExec.exe 3928 MsiExec.exe 3928 MsiExec.exe 3928 MsiExec.exe 3928 MsiExec.exe 3928 MsiExec.exe 3928 MsiExec.exe 3928 MsiExec.exe 3928 MsiExec.exe 3928 MsiExec.exe 5052 installer.exe 3928 MsiExec.exe 3928 MsiExec.exe 4420 MsiExec.exe 4420 MsiExec.exe 4420 MsiExec.exe 4420 MsiExec.exe 4420 MsiExec.exe 4420 MsiExec.exe 4420 MsiExec.exe 3928 MsiExec.exe 5456 rUNdlL32.eXe 5788 toolspab1.exe 3084 installer.exe 3084 installer.exe 3084 installer.exe 6072 MsiExec.exe 6072 MsiExec.exe 3984 MsiExec.exe 3984 MsiExec.exe 3984 MsiExec.exe 3984 MsiExec.exe 3984 MsiExec.exe 3984 MsiExec.exe 3984 MsiExec.exe 3984 MsiExec.exe 3984 MsiExec.exe 3984 MsiExec.exe 3084 installer.exe 3984 MsiExec.exe 3984 MsiExec.exe 5508 MsiExec.exe 5508 MsiExec.exe 5508 MsiExec.exe 5508 MsiExec.exe 5508 MsiExec.exe 5508 MsiExec.exe 5508 MsiExec.exe 3984 MsiExec.exe 5620 5910.exe 5620 5910.exe 5620 5910.exe 5620 5910.exe 5620 5910.exe 5620 5910.exe 5688 acfituw -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Internet Explorer\\Gudajetaru.exe\"" Ultra.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.exe" hbggg.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: installer.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\V: installer.exe File opened (read-only) \??\Q: installer.exe File opened (read-only) \??\X: installer.exe File opened (read-only) \??\F: installer.exe File opened (read-only) \??\H: installer.exe File opened (read-only) \??\P: installer.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: installer.exe File opened (read-only) \??\T: installer.exe File opened (read-only) \??\O: installer.exe File opened (read-only) \??\P: installer.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: installer.exe File opened (read-only) \??\T: installer.exe File opened (read-only) \??\Z: installer.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\B: installer.exe File opened (read-only) \??\E: installer.exe File opened (read-only) \??\W: installer.exe File opened (read-only) \??\A: installer.exe File opened (read-only) \??\G: installer.exe File opened (read-only) \??\R: installer.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: installer.exe File opened (read-only) \??\J: installer.exe File opened (read-only) \??\U: installer.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: installer.exe File opened (read-only) \??\B: installer.exe File opened (read-only) \??\S: installer.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\U: installer.exe File opened (read-only) \??\W: installer.exe File opened (read-only) \??\M: installer.exe File opened (read-only) \??\V: installer.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\N: installer.exe File opened (read-only) \??\Y: installer.exe File opened (read-only) \??\L: installer.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: installer.exe File opened (read-only) \??\G: installer.exe File opened (read-only) \??\F: installer.exe File opened (read-only) \??\I: installer.exe File opened (read-only) \??\Y: installer.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\L: installer.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: installer.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\M: installer.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 54 ip-api.com -
Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\System32\Tasks\Firefox Default Browser Agent 30508A918DCBB7A2 svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #2 svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #5 svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #6 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #1 svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedUpdater svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #3 svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #4 svchost.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 3680 set thread context of 5772 3680 svchost.exe 117 PID 4848 set thread context of 5788 4848 toolspab1.exe 143 PID 5024 set thread context of 1260 5024 48C2.exe 174 PID 4916 set thread context of 5688 4916 acfituw 177 -
Drops file in Program Files directory 15 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\UltraMediaBurner\unins000.dat ultramediaburner.tmp File created C:\Program Files (x86)\AW Manager\Windows Manager\Uninstall.lnk msiexec.exe File opened for modification C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.ini msiexec.exe File created C:\Program Files\Windows Security\HIGNFWWYDV\ultramediaburner.exe Ultra.exe File created C:\Program Files\Windows Security\HIGNFWWYDV\ultramediaburner.exe.config Ultra.exe File created C:\Program Files (x86)\UltraMediaBurner\is-3JJU5.tmp ultramediaburner.tmp File created C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe msiexec.exe File opened for modification C:\Program Files (x86)\AW Manager\Windows Manager\Privacy.url msiexec.exe File created C:\Program Files (x86)\UltraMediaBurner\unins000.dat ultramediaburner.tmp File created C:\Program Files (x86)\UltraMediaBurner\is-QFDBO.tmp ultramediaburner.tmp File created C:\Program Files (x86)\Internet Explorer\Gudajetaru.exe.config Ultra.exe File opened for modification C:\Program Files (x86)\AW Manager\Windows Manager\EULA.url msiexec.exe File opened for modification C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe ultramediaburner.tmp File created C:\Program Files (x86)\Internet Explorer\Gudajetaru.exe Ultra.exe File created C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe msiexec.exe -
Drops file in Windows directory 54 IoCs
description ioc Process File created C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\logo.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI67CE.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6BF7.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI743C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI40AC.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI413B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4795.tmp msiexec.exe File created C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\SystemFoldermsiexec.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI418A.tmp msiexec.exe File opened for modification C:\Windows\Installer\f745da6.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI63F1.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI648E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7684.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4335.tmp msiexec.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File opened for modification C:\Windows\Installer\MSI41DA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4628.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4814.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI65A8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6D02.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI72F2.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4412.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4765.tmp msiexec.exe File opened for modification C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\logo.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI6665.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6721.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{C845414C-903C-4218-9DE7-132AB97FDF62} msiexec.exe File opened for modification C:\Windows\Installer\MSI74DB.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI74FB.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI46D5.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4705.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI6DDE.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI73FC.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI745C.tmp msiexec.exe File opened for modification C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\SystemFoldermsiexec.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI4735.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI60A4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6B0C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4305.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4402.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI69C3.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI43A3.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6E4C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI749C.tmp msiexec.exe File created C:\Windows\Installer\f745da9.msi msiexec.exe File created C:\Windows\Installer\f745da6.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI3F92.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI40FB.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI41BA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI46A6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI42E4.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspab1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI acfituw Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI acfituw Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI acfituw Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspab1.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspab1.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe -
Kills process with taskkill 3 IoCs
pid Process 5124 taskkill.exe 4484 taskkill.exe 4400 taskkill.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe -
Modifies data under HKEY_USERS 18 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix svchost.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\16\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\18 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software svchost.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\17 msiexec.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\ManagerHistoryComplete = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DontShowMeThisDialogAgain MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{BD3919E5-E282-46AA-B1A8-E6CA7238DFD3} = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. = "1" MicrosoftEdge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{QJ2559JN-BF7A-LM2A-20M4-JBF9M43Q7G3S}\1 = "6280" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\DetectPhoneNumberCompletedV = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. = 010000006132f59aa1cbcbe7fbbbb9cd1ab78a207161779c658e020596831d4afa2f8783c8864aee6a6e6f9599f363245ad1639028b35de2efaaed87daf8da7ab51f MicrosoftEdge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Zoom MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B72164C = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a MicrosoftEdge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C414548CC3098124D97E31A29BF7FD26 msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\DatastoreSchemaVersion = "8" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3 MicrosoftEdge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5785CBDF4ABB5AD409841A692AF14EA9 msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CacheLimit = "1" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CacheLimit = "256000" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory MicrosoftEdgeCP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Roaming\\AW Manager\\Windows Manager 1.0.0\\install\\97FDF62\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{QJ2559JN-BF7A-LM2A-20M4-JBF9M43Q7G3S} svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\AllComplete = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DOMStorage MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\UUID = "{4960C3AC-D11A-4242-8819-C421BDF1AF52}" MicrosoftEdge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\PackageCode = "6BBF4B2F4524B25478C17BFBEE2559F7" msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = a221290c434ad701 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 5e8ef80c434ad701 MicrosoftEdge.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\Language = "1033" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{IY7880QH-GQ0R-SG6F-75Z5-PGQ2S76C3D6F} svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\TypedUrlsComplete = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionIn MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. = 01000000256173aa554f09ca430119096e78658b7d6d3dbb5a7aed67ba8fe54bdc9bd4c5769481faaa56bff7dc0a1264b3f9ec12d208c18b644856295446bd33b7175437c23f2b2782f29bff5656027238b8f40a64edcc82d93a5fe33a8e7482e0e002d19f0435d26944c0757e82910806d4b43eb1ba6150b0729e44b306cce4aa169462c5825b07746a1bc1672f82a98e6cb30919119849780f04233250b660d5d90644ac59fb92f2850d18f4fd87e020a23636b29020c30531e261300b47a7fe49e955a22979e729b637ce808cb2b4f89407aea8d8ca024ef8c82386d63677f386e5e24c92f5930e1b04ef9d7ca47b636418fd108acdbbd083c15053534d10cab0644365344a4b94d5e22d076e07c1da30539fc944da1da2f4b96bd42055b4a5e7045763afb67ab5044e1c48008b3b551abe214ca86474136a2ab4c2dfeb3ab94bc1ce0aa3af6f19c9f8bd24d31124df408214ea54aa547c058a9d392f5db391fc7b413bb0a50e2342c85e32877da53dc4adca94e91d5c95e4db9281afad17981a581776768b19c19093c3c4bc6851b3c40ee95b08ab7fb6296808dc476467988bdb059be59623cfb7 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0" MicrosoftEdge.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 installer.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4288 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1120 ultramediaburner.tmp 1120 ultramediaburner.tmp 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe 2740 Kocevaroki.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3048 Process not Found -
Suspicious behavior: MapViewOfSection 22 IoCs
pid Process 4940 MicrosoftEdgeCP.exe 4940 MicrosoftEdgeCP.exe 5788 toolspab1.exe 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 5688 acfituw -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 360 Ultra.exe Token: SeDebugPrivilege 2740 Kocevaroki.exe Token: SeDebugPrivilege 988 Buzhytisahe.exe Token: SeDebugPrivilege 4176 MicrosoftEdge.exe Token: SeDebugPrivilege 4176 MicrosoftEdge.exe Token: SeDebugPrivilege 4176 MicrosoftEdge.exe Token: SeDebugPrivilege 4176 MicrosoftEdge.exe Token: SeSecurityPrivilege 4844 msiexec.exe Token: SeCreateTokenPrivilege 5052 installer.exe Token: SeAssignPrimaryTokenPrivilege 5052 installer.exe Token: SeLockMemoryPrivilege 5052 installer.exe Token: SeIncreaseQuotaPrivilege 5052 installer.exe Token: SeMachineAccountPrivilege 5052 installer.exe Token: SeTcbPrivilege 5052 installer.exe Token: SeSecurityPrivilege 5052 installer.exe Token: SeTakeOwnershipPrivilege 5052 installer.exe Token: SeLoadDriverPrivilege 5052 installer.exe Token: SeSystemProfilePrivilege 5052 installer.exe Token: SeSystemtimePrivilege 5052 installer.exe Token: SeProfSingleProcessPrivilege 5052 installer.exe Token: SeIncBasePriorityPrivilege 5052 installer.exe Token: SeCreatePagefilePrivilege 5052 installer.exe Token: SeCreatePermanentPrivilege 5052 installer.exe Token: SeBackupPrivilege 5052 installer.exe Token: SeRestorePrivilege 5052 installer.exe Token: SeShutdownPrivilege 5052 installer.exe Token: SeDebugPrivilege 5052 installer.exe Token: SeAuditPrivilege 5052 installer.exe Token: SeSystemEnvironmentPrivilege 5052 installer.exe Token: SeChangeNotifyPrivilege 5052 installer.exe Token: SeRemoteShutdownPrivilege 5052 installer.exe Token: SeUndockPrivilege 5052 installer.exe Token: SeSyncAgentPrivilege 5052 installer.exe Token: SeEnableDelegationPrivilege 5052 installer.exe Token: SeManageVolumePrivilege 5052 installer.exe Token: SeImpersonatePrivilege 5052 installer.exe Token: SeCreateGlobalPrivilege 5052 installer.exe Token: SeCreateTokenPrivilege 5052 installer.exe Token: SeAssignPrimaryTokenPrivilege 5052 installer.exe Token: SeLockMemoryPrivilege 5052 installer.exe Token: SeIncreaseQuotaPrivilege 5052 installer.exe Token: SeMachineAccountPrivilege 5052 installer.exe Token: SeTcbPrivilege 5052 installer.exe Token: SeSecurityPrivilege 5052 installer.exe Token: SeTakeOwnershipPrivilege 5052 installer.exe Token: SeLoadDriverPrivilege 5052 installer.exe Token: SeSystemProfilePrivilege 5052 installer.exe Token: SeSystemtimePrivilege 5052 installer.exe Token: SeProfSingleProcessPrivilege 5052 installer.exe Token: SeIncBasePriorityPrivilege 5052 installer.exe Token: SeCreatePagefilePrivilege 5052 installer.exe Token: SeCreatePermanentPrivilege 5052 installer.exe Token: SeBackupPrivilege 5052 installer.exe Token: SeRestorePrivilege 5052 installer.exe Token: SeShutdownPrivilege 5052 installer.exe Token: SeDebugPrivilege 5052 installer.exe Token: SeAuditPrivilege 5052 installer.exe Token: SeSystemEnvironmentPrivilege 5052 installer.exe Token: SeChangeNotifyPrivilege 5052 installer.exe Token: SeRemoteShutdownPrivilege 5052 installer.exe Token: SeUndockPrivilege 5052 installer.exe Token: SeSyncAgentPrivilege 5052 installer.exe Token: SeEnableDelegationPrivilege 5052 installer.exe Token: SeManageVolumePrivilege 5052 installer.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 1120 ultramediaburner.tmp 5052 installer.exe 3084 installer.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4176 MicrosoftEdge.exe 4940 MicrosoftEdgeCP.exe 4940 MicrosoftEdgeCP.exe 4060 4CE9.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3516 wrote to memory of 1804 3516 Install.exe 74 PID 3516 wrote to memory of 1804 3516 Install.exe 74 PID 3516 wrote to memory of 1804 3516 Install.exe 74 PID 1804 wrote to memory of 360 1804 Install.tmp 77 PID 1804 wrote to memory of 360 1804 Install.tmp 77 PID 360 wrote to memory of 2720 360 Ultra.exe 81 PID 360 wrote to memory of 2720 360 Ultra.exe 81 PID 360 wrote to memory of 2720 360 Ultra.exe 81 PID 2720 wrote to memory of 1120 2720 ultramediaburner.exe 82 PID 2720 wrote to memory of 1120 2720 ultramediaburner.exe 82 PID 2720 wrote to memory of 1120 2720 ultramediaburner.exe 82 PID 360 wrote to memory of 988 360 Ultra.exe 83 PID 360 wrote to memory of 988 360 Ultra.exe 83 PID 1120 wrote to memory of 192 1120 ultramediaburner.tmp 84 PID 1120 wrote to memory of 192 1120 ultramediaburner.tmp 84 PID 360 wrote to memory of 2740 360 Ultra.exe 85 PID 360 wrote to memory of 2740 360 Ultra.exe 85 PID 2740 wrote to memory of 4416 2740 Kocevaroki.exe 90 PID 2740 wrote to memory of 4416 2740 Kocevaroki.exe 90 PID 4416 wrote to memory of 4636 4416 cmd.exe 92 PID 4416 wrote to memory of 4636 4416 cmd.exe 92 PID 4416 wrote to memory of 4636 4416 cmd.exe 92 PID 2740 wrote to memory of 4928 2740 Kocevaroki.exe 93 PID 2740 wrote to memory of 4928 2740 Kocevaroki.exe 93 PID 4928 wrote to memory of 5052 4928 cmd.exe 95 PID 4928 wrote to memory of 5052 4928 cmd.exe 95 PID 4928 wrote to memory of 5052 4928 cmd.exe 95 PID 2740 wrote to memory of 4208 2740 Kocevaroki.exe 96 PID 2740 wrote to memory of 4208 2740 Kocevaroki.exe 96 PID 4208 wrote to memory of 4336 4208 cmd.exe 98 PID 4208 wrote to memory of 4336 4208 cmd.exe 98 PID 4208 wrote to memory of 4336 4208 cmd.exe 98 PID 4336 wrote to memory of 4500 4336 hbggg.exe 99 PID 4336 wrote to memory of 4500 4336 hbggg.exe 99 PID 4336 wrote to memory of 4500 4336 hbggg.exe 99 PID 4844 wrote to memory of 4252 4844 msiexec.exe 103 PID 4844 wrote to memory of 4252 4844 msiexec.exe 103 PID 4844 wrote to memory of 4252 4844 msiexec.exe 103 PID 5052 wrote to memory of 5064 5052 installer.exe 105 PID 5052 wrote to memory of 5064 5052 installer.exe 105 PID 5052 wrote to memory of 5064 5052 installer.exe 105 PID 4844 wrote to memory of 3928 4844 msiexec.exe 106 PID 4844 wrote to memory of 3928 4844 msiexec.exe 106 PID 4844 wrote to memory of 3928 4844 msiexec.exe 106 PID 3928 wrote to memory of 5124 3928 MsiExec.exe 108 PID 3928 wrote to memory of 5124 3928 MsiExec.exe 108 PID 3928 wrote to memory of 5124 3928 MsiExec.exe 108 PID 4336 wrote to memory of 5140 4336 hbggg.exe 107 PID 4336 wrote to memory of 5140 4336 hbggg.exe 107 PID 4336 wrote to memory of 5140 4336 hbggg.exe 107 PID 4844 wrote to memory of 4420 4844 msiexec.exe 110 PID 4844 wrote to memory of 4420 4844 msiexec.exe 110 PID 4844 wrote to memory of 4420 4844 msiexec.exe 110 PID 2740 wrote to memory of 5152 2740 Kocevaroki.exe 142 PID 2740 wrote to memory of 5152 2740 Kocevaroki.exe 142 PID 5152 wrote to memory of 5500 5152 DllHost.exe 115 PID 5152 wrote to memory of 5500 5152 DllHost.exe 115 PID 5152 wrote to memory of 5500 5152 DllHost.exe 115 PID 5500 wrote to memory of 5456 5500 google-game.exe 116 PID 5500 wrote to memory of 5456 5500 google-game.exe 116 PID 5500 wrote to memory of 5456 5500 google-game.exe 116 PID 5456 wrote to memory of 3680 5456 rUNdlL32.eXe 71 PID 5456 wrote to memory of 2604 5456 rUNdlL32.eXe 31 PID 3680 wrote to memory of 5772 3680 svchost.exe 117
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵
- Drops file in System32 directory
PID:344 -
C:\Users\Admin\AppData\Roaming\acfituwC:\Users\Admin\AppData\Roaming\acfituw2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4916 -
C:\Users\Admin\AppData\Roaming\acfituwC:\Users\Admin\AppData\Roaming\acfituw3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:5688
-
-
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵PID:2380
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s WpnService1⤵PID:2724
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Winmgmt1⤵PID:2712
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵PID:2604
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵PID:2368
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection1⤵PID:1924
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s SENS1⤵PID:1380
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s UserManager1⤵
- Modifies registry class
PID:1368
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Themes1⤵PID:1164
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵PID:1112
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\is-DQD9E.tmp\Install.tmp"C:\Users\Admin\AppData\Local\Temp\is-DQD9E.tmp\Install.tmp" /SL5="$40078,235791,152064,C:\Users\Admin\AppData\Local\Temp\Install.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\is-1QB6I.tmp\Ultra.exe"C:\Users\Admin\AppData\Local\Temp\is-1QB6I.tmp\Ultra.exe" /S /UID=burnerch13⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:360 -
C:\Program Files\Windows Security\HIGNFWWYDV\ultramediaburner.exe"C:\Program Files\Windows Security\HIGNFWWYDV\ultramediaburner.exe" /VERYSILENT4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\is-LI1CG.tmp\ultramediaburner.tmp"C:\Users\Admin\AppData\Local\Temp\is-LI1CG.tmp\ultramediaburner.tmp" /SL5="$8003A,281924,62464,C:\Program Files\Windows Security\HIGNFWWYDV\ultramediaburner.exe" /VERYSILENT5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu6⤵
- Executes dropped EXE
PID:192
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\93-b27cb-696-15c86-7e39ac6dab035\Buzhytisahe.exe"C:\Users\Admin\AppData\Local\Temp\93-b27cb-696-15c86-7e39ac6dab035\Buzhytisahe.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
PID:988
-
-
C:\Users\Admin\AppData\Local\Temp\3d-0b5da-f53-bf9ad-d1149a5d83745\Kocevaroki.exe"C:\Users\Admin\AppData\Local\Temp\3d-0b5da-f53-bf9ad-d1149a5d83745\Kocevaroki.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\kzhxpi1k.adb\001.exe & exit5⤵
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\kzhxpi1k.adb\001.exeC:\Users\Admin\AppData\Local\Temp\kzhxpi1k.adb\001.exe6⤵
- Executes dropped EXE
PID:4636
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\yqrqbfr2.f44\installer.exe /qn CAMPAIGN="654" & exit5⤵
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\yqrqbfr2.f44\installer.exeC:\Users\Admin\AppData\Local\Temp\yqrqbfr2.f44\installer.exe /qn CAMPAIGN="654"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\yqrqbfr2.f44\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\yqrqbfr2.f44\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1620903704 /qn CAMPAIGN=""654"" " CAMPAIGN="654"7⤵PID:5064
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\zp2k0cpx.xhx\hbggg.exe & exit5⤵
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\zp2k0cpx.xhx\hbggg.exeC:\Users\Admin\AppData\Local\Temp\zp2k0cpx.xhx\hbggg.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Executes dropped EXE
PID:4500
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Executes dropped EXE
PID:5140
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\hweu2tek.oc2\google-game.exe & exit5⤵PID:5152
-
C:\Users\Admin\AppData\Local\Temp\hweu2tek.oc2\google-game.exeC:\Users\Admin\AppData\Local\Temp\hweu2tek.oc2\google-game.exe6⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5500 -
C:\Windows\SysWOW64\rUNdlL32.eXe"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",install7⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:5456
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\fjch5caq.hml\huesaa.exe & exit5⤵PID:5652
-
C:\Users\Admin\AppData\Local\Temp\fjch5caq.hml\huesaa.exeC:\Users\Admin\AppData\Local\Temp\fjch5caq.hml\huesaa.exe6⤵
- Executes dropped EXE
PID:6084 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Executes dropped EXE
PID:6020
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Executes dropped EXE
PID:4436
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\hh3e0eb5.tog\setup.exe & exit5⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\hh3e0eb5.tog\setup.exeC:\Users\Admin\AppData\Local\Temp\hh3e0eb5.tog\setup.exe6⤵
- Executes dropped EXE
PID:5144 -
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\hh3e0eb5.tog\setup.exe"7⤵PID:4504
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30008⤵
- Runs ping.exe
PID:4288
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ozrknd10.0yz\askinstall39.exe & exit5⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\ozrknd10.0yz\askinstall39.exeC:\Users\Admin\AppData\Local\Temp\ozrknd10.0yz\askinstall39.exe6⤵
- Executes dropped EXE
PID:5020 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe7⤵PID:1256
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe8⤵
- Kills process with taskkill
PID:4484
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\wzljn1sa.cfh\customer1.exe & exit5⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\wzljn1sa.cfh\customer1.exeC:\Users\Admin\AppData\Local\Temp\wzljn1sa.cfh\customer1.exe6⤵
- Executes dropped EXE
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Executes dropped EXE
PID:4652
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Executes dropped EXE
PID:5916
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\anj1fgut.mu0\toolspab1.exe & exit5⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\anj1fgut.mu0\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\anj1fgut.mu0\toolspab1.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\anj1fgut.mu0\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\anj1fgut.mu0\toolspab1.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:5788
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\l5lvura2.nzx\GcleanerWW.exe /mixone & exit5⤵PID:5060
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\lfb5f3k3.zev\005.exe & exit5⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\lfb5f3k3.zev\005.exeC:\Users\Admin\AppData\Local\Temp\lfb5f3k3.zev\005.exe6⤵
- Executes dropped EXE
PID:4808
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ic1e2got.n21\installer.exe /qn CAMPAIGN="654" & exit5⤵PID:5812
-
C:\Users\Admin\AppData\Local\Temp\ic1e2got.n21\installer.exeC:\Users\Admin\AppData\Local\Temp\ic1e2got.n21\installer.exe /qn CAMPAIGN="654"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
PID:3084 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\ic1e2got.n21\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ic1e2got.n21\ EXE_CMD_LINE="/forcecleanup /wintime 1620903704 /qn CAMPAIGN=""654"" " CAMPAIGN="654"7⤵PID:4240
-
-
-
-
-
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
PID:5772
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4176
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:4260
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding AAA84598F799DFC7B00F98BCA3B51E0B C2⤵
- Loads dropped DLL
PID:4252
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 92960067808B0D956038243D7870D4FA2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f3⤵
- Kills process with taskkill
PID:5124
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 110EE28BD77F890874CAA6FC301F3418 E Global\MSI00002⤵
- Loads dropped DLL
PID:4420
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B39C712514E4668A46F6C153C12E7B1B C2⤵
- Loads dropped DLL
PID:6072
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding CDD50A26C80E2590272B429F6CAB7BE72⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:3984 -
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f3⤵
- Kills process with taskkill
PID:4400
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding DBEBAEE00C46583A8D1F2676E63602E5 E Global\MSI00002⤵
- Loads dropped DLL
PID:5508
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:4940
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:4308
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
- Suspicious use of WriteProcessMemory
PID:5152
-
C:\Users\Admin\AppData\Local\Temp\48C2.exeC:\Users\Admin\AppData\Local\Temp\48C2.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5024 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\48C2.exe"2⤵PID:3312
-
-
C:\Users\Admin\AppData\Local\Temp\48C2.exe"C:\Users\Admin\AppData\Local\Temp\48C2.exe"2⤵
- Executes dropped EXE
PID:1260
-
-
C:\Users\Admin\AppData\Local\Temp\4CE9.exeC:\Users\Admin\AppData\Local\Temp\4CE9.exe1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4060
-
C:\Users\Admin\AppData\Local\Temp\5910.exeC:\Users\Admin\AppData\Local\Temp\5910.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5620
-
C:\Users\Admin\AppData\Local\Temp\5D95.exeC:\Users\Admin\AppData\Local\Temp\5D95.exe1⤵
- Executes dropped EXE
PID:5060
-
C:\Users\Admin\AppData\Local\Temp\64F8.exeC:\Users\Admin\AppData\Local\Temp\64F8.exe1⤵
- Executes dropped EXE
PID:1436
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:5828
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:5160
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4376
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:4956
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4236
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:4652
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4528
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:4508
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:5520